Malware Analysis Report

2025-08-05 19:17

Sample ID 240513-msdfwaag7z
Target setup.msi
SHA256 90516b6e70cf233597cf2b54b5908f374797f6391a3d1a9e429f8b414a139301
Tags
evasion trojan
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

90516b6e70cf233597cf2b54b5908f374797f6391a3d1a9e429f8b414a139301

Threat Level: Shows suspicious behavior

The file setup.msi was found to be: Shows suspicious behavior.

Malicious Activity Summary

evasion trojan

Enumerates connected drives

Blocklisted process makes network request

Checks whether UAC is enabled

Checks computer location settings

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-13 10:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-13 10:43

Reported

2024-05-13 10:44

Platform

win7-20240221-en

Max time kernel

37s

Max time network

39s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Installer\MSI33A7.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI2F7B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3027.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI31A1.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3347.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2D27.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f762971.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2CD8.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2EDE.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI30A5.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f762974.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI34F0.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f762971.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3132.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f762974.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f762976.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI33A7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2B80.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2DC4.tmp C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI33A7.tmp N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c54c6d22a5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A27AD8C1-1115-11EF-9891-EEF45767FDFF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f2691862625017445e9b781e613c62e0840095b12bff42ed35816e462adee9a8000000000e80000000020000200000002ddf45b06eec188b34cc9997237d05ccfe06d2f72cf925bc7f0c1532c8aeb62020000000799d6f7a0018302fcb53f9d7a0387ebb7119431d4928789666d7b1cb99ccd8e5400000008da54a9c34b6fec80da8bf41c03c5b8b34b47bebf5accf353897448c6f90e30a29fb6c433640d1bb91edcc804209afe2536f9b07776a6357fadafc0de985b4d6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\yahoo.com\Total = "22" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\yahoo.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\yahoo.com\Total = "14" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\uk.yahoo.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\yahoo.com\Total = "8" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ff353137359b5b224e7ef668ab6838d99ca654c7b8b2798b1e9d6c60ab213ca6000000000e8000000002000020000000b8ba2583ebaa3c95168ea7f2b7bf99fdfbacca13ba94eeb2cb0b9aace5691e0b9000000038a01a1283c68f51b472c3ef78f4673033e6eeb6d40c8726c75d71ddc742fd61eca80aa4356eff9b7f3874b9a68fe5f6c4490d407444dcb7af524f155b410c9dead0afd5c9cb0abab41ed4f99704e681abea6acbe3072325d9eec3e2676fcc60b20c94902befe93915b16ff03764c789b32495b342a7a0c87deda543f9164469c75b2e7edc5b465d7d6037f96649912b400000006e2ec1d96fca67f67ffda494e71690d38ca75ffe50a98123af36834cf2d95217955d5742e72762a17d34b4d917c28cdaebc97aeec2bc06a435db30b6a62434b6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\uk.yahoo.com\ = "8" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\uk.yahoo.com\ = "22" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\uk.yahoo.com\ = "14" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\uk.yahoo.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\yahoo.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\yahoo.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0AD881C19F612E04DAD74EFBEB5A28A0\55435E464F2BDA24DA73E2F419529F73 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\PackageName = "setup.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55435E464F2BDA24DA73E2F419529F73 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55435E464F2BDA24DA73E2F419529F73\MainFeature C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\ProductName = "Apps" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\PackageCode = "FE5E588C7A5F4984ABC63A7C48A961C9" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Version = "16777216" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0AD881C19F612E04DAD74EFBEB5A28A0 C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 1336 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2892 wrote to memory of 2712 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI33A7.tmp
PID 2740 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2740 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2740 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2740 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 860EA756A5D053DCFC464971ADDCAD9C

C:\Windows\Installer\MSI33A7.tmp

"C:\Windows\Installer\MSI33A7.tmp" https://telixsearch.com/tyy

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 repository.certum.pl udp
NL 23.62.61.145:80 repository.certum.pl tcp
US 8.8.8.8:53 telixsearch.com udp
US 8.8.8.8:53 collect.installeranalytics.com udp
US 104.21.79.52:443 telixsearch.com tcp
US 104.21.79.52:443 telixsearch.com tcp
US 54.211.30.217:80 collect.installeranalytics.com tcp
US 8.8.8.8:53 yahoo.com udp
US 74.6.143.26:443 yahoo.com tcp
US 74.6.143.26:443 yahoo.com tcp
US 8.8.8.8:53 www.yahoo.com udp
GB 87.248.114.11:443 www.yahoo.com tcp
GB 87.248.114.11:443 www.yahoo.com tcp
US 8.8.8.8:53 guce.yahoo.com udp
IE 18.200.69.228:443 guce.yahoo.com tcp
IE 18.200.69.228:443 guce.yahoo.com tcp
US 8.8.8.8:53 consent.yahoo.com udp
IE 18.200.69.228:443 consent.yahoo.com tcp
IE 18.200.69.228:443 consent.yahoo.com tcp
US 8.8.8.8:53 s.yimg.com udp
GB 87.248.114.11:443 s.yimg.com tcp
GB 87.248.114.11:443 s.yimg.com tcp
GB 87.248.114.11:443 s.yimg.com tcp
GB 87.248.114.11:443 s.yimg.com tcp
US 8.8.8.8:53 uk.yahoo.com udp
GB 87.248.114.12:443 uk.yahoo.com tcp
GB 87.248.114.12:443 uk.yahoo.com tcp
GB 87.248.114.11:443 uk.yahoo.com tcp
US 8.8.8.8:53 consent.cmp.oath.com udp
GB 87.248.114.11:443 uk.yahoo.com tcp
GB 87.248.114.12:443 uk.yahoo.com tcp
US 8.8.8.8:53 edge-mcdn.secure.yahoo.com udp
US 152.195.53.200:443 consent.cmp.oath.com tcp
US 152.195.53.200:443 consent.cmp.oath.com tcp
GB 87.248.114.11:443 edge-mcdn.secure.yahoo.com tcp
GB 87.248.114.11:443 edge-mcdn.secure.yahoo.com tcp
US 8.8.8.8:53 ganon.yahoo.com udp
IE 188.125.72.139:443 ganon.yahoo.com tcp
IE 188.125.72.139:443 ganon.yahoo.com tcp
GB 87.248.114.12:443 edge-mcdn.secure.yahoo.com tcp
GB 87.248.114.12:443 edge-mcdn.secure.yahoo.com tcp
GB 87.248.114.12:443 edge-mcdn.secure.yahoo.com tcp
GB 87.248.114.12:443 edge-mcdn.secure.yahoo.com tcp
US 152.195.53.200:443 consent.cmp.oath.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar2754.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar2894.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cf533088cde4d317026d5bcf7e0f6a8
SHA1 ef47b4bc90a887c85183e73f7634db92e72042c6
SHA256 e649886dd7efc27985476942fd84c871874491d20a4f2820f7f2f5353a11814a
SHA512 216bd64be03d03c643453e08be16b7be988cc3561266064f702e84134fe0652dd4a6dede8431050f1d4925c4ff00676b4c2ab59b6a64897fe3756f8e21940418

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\538F535B7FBDE384E456CC9F5DA5FBAB

MD5 6d469ed9256d08235b5e747d1e27dbf2
SHA1 d3dd483e2bbf4c05e8af10f5fa7626cfd3dc3092
SHA256 b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804
SHA512 04cbf2a5f740d030208136b0ee1db38299943c74efa55045f564268246a929018fcaf26aa02768bb20321aa3f70c4609c163c75a3929ef8da016de000566a74c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\538F535B7FBDE384E456CC9F5DA5FBAB

MD5 2062504e75cd4a3254ec102966265309
SHA1 5a1be615db30cc19782bb9bad29d8a2bcc1a7092
SHA256 76ac51b0bf754bdc729a179b978f7dcbdb9ea2ed1d0a98ee06d35eb8e264fd66
SHA512 7e90cd16d59c89b34ec60190f13e8eda56ade5f5b30c01cf70f6f460b9638efd4549e34050d8d4b7d52f4b9b7206b632dcf93e64e4e4cf665a403873b6598b5d

C:\Windows\Installer\MSI2B80.tmp

MD5 c6b7f525bebdce408cae137e6c82fa4c
SHA1 6b13d7b7e66c2c32815b98e33c95937f559e2cac
SHA256 e0ea63e00f640c74ddd0b51a46d4d0601acdebdc8b97957fed727f332a96dc90
SHA512 f1e330aad8bc2de79fbe7e7452148714d3f823450c5de039ccbc3690f523c55b240dca4e8d9a9ac83e7afcea6462950b4bc2cbcf52b4c959b9047660a6872a4f

C:\Windows\Installer\MSI2CD8.tmp

MD5 8d84543f774c6b280b32b24265e272e8
SHA1 cd3a0dbc06b9b4945f3a5d3b40972a0b5f66044b
SHA256 32b60176177d943df28f931828717f4b52b1434b8c0cd3ca8cc8a424b016b092
SHA512 247c5c3c4765e61b4d4b7514886e9eccb45746593b21a8dc8f718a224a1a0bc813fe227030738c3035cb9a9017ba53d7feff07cccb11407e9b22678af0c42056

C:\Windows\Installer\MSI2DC4.tmp

MD5 9ac5da40be505273f6f1b48ce6d159be
SHA1 47d3fbb35dd5df773bb9cb523eaf063c40f52241
SHA256 6547bac5e0f08595325b769a6605a6c27b1eb2620a31dc9ecc4185b64882e837
SHA512 8826dc286b48b4008eff8e38f3ffe4519601f702bd9a6b71731e2ce929789f9ec92f4997fcd28930b91132df5053ffa4f276b5dcb2f8589b93befb805b4bad3b

C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\{49E282C4-D56A-4731-8628-876CB5409200}.session

MD5 934abc3d254feff0d771a989f5b4e3e6
SHA1 3fb63ba22ecc91dc06b15e7dda68583dd8c23728
SHA256 a8418bebc6d645819b18e708752c21954141cc4023ff9ed7245a9b7aa155aed1
SHA512 8ad4717e0b749b94f7bc0886788ec8964e2543c1e557ca76a02fe0f07d1f57be8bef90678867f667cb03b7b8a19326e1287b7f5c9bcb495c327b8b2fbbe05561

C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\tracking.ini

MD5 7d666733bca8984893884fd19df0758c
SHA1 91a5757ca59905629b574e66c57db6268431468b
SHA256 1dedcfe17ac57c554ce2da676ded5cb27df0cd02640e08c0ccadbc8f42393504
SHA512 f003787efccc32dbef0c5dfe420f782798353eb8c5287c453971006e94d16544f6713a33d194557c98b59e0bae063f5127122965fce7d7d6d0630806dd614e54

C:\Config.Msi\f762975.rbs

MD5 ed6b4809c8b6315579098ca0b6632312
SHA1 238b5ac82338ad3b9c9c90d82910f3b8d2fc9f2c
SHA256 0bf2946283d949cbb4f0e30b4e3dea4a31966eae50613322e43415643c6782c2
SHA512 e9a3d0665b1959dcbaa1e4833a9371e286ef40b73cd2a2b50a05d19eb18d0a719cc95c1449a7e8d4121f3f57c55a4238092322296b9362ec7ece1e9be47bb6d7

C:\Windows\Installer\MSI33A7.tmp

MD5 e014e0a640cefb49b2a301ff7d00e6c0
SHA1 986ebc61f6fc8a5b967208d950cc6ac9e4d5c3f0
SHA256 edb6a8e18a441e20127545d0663905f051ad4891566049e60d8263d6052e2be3
SHA512 39fd9de58525cdb7f5874841d1a66d6d53cb61378fd4dfd7b13e6a99b2e7b01a3be76f62bc7768b498c9d71fd75c214d9ded52ee458374a2374af3bd09e6d4a9

C:\Users\Admin\AppData\Local\Temp\URL339E.url

MD5 f55413e1ba8c031cc52db905951a37d2
SHA1 62f6ef8f268fd5a7951980e2b20445b6a23b000c
SHA256 a2342cbf200f262c6b3a36da301d8ea540edd9f2627492032501679e54d01c55
SHA512 a18f615f8d2dab277ece0a85826168d8405e18f5f1aed725be77c847fbab9c40faed1cad9fdec8af6288d1fda15e51cb6bc9dd33648714cd51d1023d389757da

memory/2712-345-0x0000000000CE0000-0x0000000000CE2000-memory.dmp

C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\tracking.ini

MD5 4ba237b2154d11df1003f62b4a9758f1
SHA1 ff82c8955a0cc3653a517b154a97e8a93256e4af
SHA256 4f3f7b2e4987ef09d798e6aadb7c1df598bc12ebb260c460cab1b03ac4462a52
SHA512 0d1d5cbea01464fef92c4709c23edc780e82197fa12703a7c63b13d90acf031f0bb9b2dbdda61d5a1a24b1b0ec59ed6b8153a7d784cced10f9554d285f0f3873

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dca8a8a0b59004be0c5df50eab97c30a
SHA1 7d983cec790e40fc6ea08c6f2e449357e41f5141
SHA256 4afbc736b1d563586ba6b13b00809d1312f0e03641382b088b0a1f57f458aef6
SHA512 8b5d19a8eb09647d722cdb5417528e407a63ffc67a129bb1835eb24d7e8e3e2cb3dde591f8867351074b953762b4d2cb6541d2df427fb822a27f4724c1c31155

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfa8b9fc4bbbae0fb14b0ed8941b4336
SHA1 d8d0e0314cf6bc097cfc48ab23ad0e1ac3e949e9
SHA256 0a7d937a7608aa8576033aa6be42ea677959527de72ecf0dc3da6b17b73f1e05
SHA512 14c4453ae610b9a4fa959f203f5a4c2626ac6c50145320e3accd061311d91fb1cee1b099acdd0e89bc5b8a05236fc922e395af783beff866df314c7070a2ea71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8385f3524f7741c9bcd87b8ad6a4854
SHA1 637027e664f6bb12007804c29a9d7096b399390b
SHA256 e90b43cc90ff42f2b894276dcf0eeb87aa97ef68719c60bc8eb19881eeea01ab
SHA512 42941af5644646e3af1344782067164dc4a6b24b68b1db846b1cba08140c88d4a3484beceb81ff00eb3831e6c85d9b1dc20f85b517f1a39a922e73a66741eeea

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\yahoo[1].png

MD5 b6814ae5582d7953821acbd76e977bb4
SHA1 75a33fc706c2c6ba233e76c17337e466949f403c
SHA256 4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3
SHA512 958268f22e72875b97c42d8927e6a1d6168c94fe2184de906029688a9d63038301df2e3de57e571a3d0ecc7ad41178401823e5c54576936d37c84c7a3ed8ef6b

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

MD5 2fcc5264ece316f836127f64d8571c19
SHA1 0b532c17aa6e226a01f2bad081b3c1fe447a9222
SHA256 09a296b3de01c2e17ff769d523fdfee479c2dedc8465619b7f1c7551a895be77
SHA512 a48b1ec917584d29b49e9f1c71363f22a97c5f5c87d4e19eb4b5977e6f24c6368343fbbcb9fbdfe65d33851dfaa8e58270ae576fa4760dda23e8c8f2c81da267

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2eef32e3d2d12de7d4ed8a64f723567
SHA1 a9c4aa0b38562222d98d3235b0e288c601d3fcbf
SHA256 944a8c5d3a892f91b7f1cce8fbbff7e80f27faa400c5a188cd2d9e5cfa12f458
SHA512 3f0b8e570d62ce46606fabcb812b089d614c2ce2a7268eb3cd7c1ec698b59223cf197d358c21d6a3663d38ca8c04dc1228230d4a3ec12772fde45439fcc44d6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 572e28773aee94b98dea9ebfed473881
SHA1 c42e52a2cc3e077552cda9625e450f778a0c32a7
SHA256 712bccd06dc3431433653df8b0796f74f2861e3d41372fa52d2cd23c7f2b8a9a
SHA512 31fe243e2a28402d998c75a348fc8f068ee7fdb00ace3d0db3cdbfd2e326b892701c43b2d5807075e0b4d67afae1fc5f406f94da827ccdb1e2c7ef580fb7f96b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d84cbb18569cdfec50d29215971eab0
SHA1 a7774c61b67c09b198a098cc3183bacdd90fc24b
SHA256 db04c304df2c6cf72c9f69eae14c5e10432f36d0c0c4fb8feede86a3a26c88ac
SHA512 58ba1771faee11f03b4bc3eebb9fd44e87b59845888b2aa5253404d583c4433f809f224b95ca185482a517dedbf541f15906de60a4e74d4d504f26d08e60b4c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97d73cd84bb5a08b6519caecf63cba19
SHA1 3cf689d6ae63fbaa62a1485931c00c97180a2b9a
SHA256 ab6b9981614d0bf8e7b5af66698ef97efcfe1dbf0e2e8f8a7d62b3217282a837
SHA512 166c7398c9a75522255012dc6bbd1e82420361dd9008c276895405f672de2c8cfff625cc8c8477b97870675c00322a7a26d60fba98e7eeafa0f8d1f6a27c48fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c24884b4767aaab75515e67cd2bd5cc0
SHA1 a5cc576277cfe4e5d8218141b97c34ef7b014196
SHA256 e5e1c3c355d41be385cb7d4d3429ee4da5145a4fecb097a8014eefcbdebe9ead
SHA512 c8ec506ca6c8dc04bb5afd37e6477f95ae5c17a7377b7265c56397486fcd031961b9ab83fd6cfa5adf4c724fe68b675eba4d36dfb4246c7a41b90be857db1365

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45cf0390869672a3ed5edbb55b29b333
SHA1 5b336ecd9619ae0b2ad45784a71d33521345ca67
SHA256 33a9e48207e2736ec1f34e9b955444ee1ca2c71ab179ffaa7431c49c8053efe4
SHA512 fa240eab43d08d9e5af116b1c12206dbad9ba3d833fe82af1ea3c2f028ba56ab2bea4db24b465b9dd3adfbcb64c406cddbff2314d25f236612a8b933e59cf502

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08cfed5dda00fd6ae4c5e8aedd74ac46
SHA1 f543379e24b787e4028fe451ea3ad8127b191515
SHA256 79b43e32bc7867824803a4dc6e330402889938895d76a9095659f6bb73b98085
SHA512 7cd932c45ac3de1952156f5ab9f86ee805a98ceadcbc99dc4b13beffc86ffbf05d8a3b79f03e86eeb04b12336299a27bd5439f78af405bc4c0c354223a105373

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7fef91495265511bcd21743b36dafdce
SHA1 a5a5b11fe1a739ca3e1315ca0b2b7ff2df760d4c
SHA256 6dbc0eaad1230b9fb8f083f655bbfc250cb052bffdeed20c2c0c266062d6c560
SHA512 55c1975a6274c5249ceec9827117c8e11f4eecc5defc0642496b0cbba28e9904e6d8a9e4a6c17720d78ab3aa7bcbe2037cc22946572ad6d3fed09770737b7040

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0bf9509e8c6c321c222f9b9a9619f78b
SHA1 2f3a844d5f545d6616908958c8043d935c2be32b
SHA256 038ed3d9b657b239a085c44490d09d09d5020cfa2784f388f60c11d13e2c27f5
SHA512 3476b596df82ca90f90da14db61649dc2a9528d11d324d29e3126a0ec6040088f5cc0167bb11eeb6b0c49628ffccf0f0da64dc1e8d947f479d0e5eac636520b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 09b240f6b55a5708b5fb99c324a4d5bf
SHA1 13ce6a5ae1357d3a55d3f5e433f51ef05fdb87a6
SHA256 abd44f1ca5d6924e292cb12df5dd8670452dae2ea13d2e3b5f375dba2e75f962
SHA512 b31d3e3f1579b231fa7fd5d58b4c5d36b5317f0a0272d5c763f6c80f3238bc2f6bb1b88bddee6a455528cdb5bbe546ea6a067677d2ccfc5c9a83b1a5c87fbfc3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d0e87ad7132ba9cb0fbb1f8126cd7e4
SHA1 00f64d6ffed9b0e12051b3c3c6daa69eb46aa698
SHA256 b9ab3542fe5d14ade6ed40d3d22475cdb75196a984d292c0af3c43eabaec430d
SHA512 5aedbd3a9eb3a4eea9244aac21acf3a4410c43af56a47ba6b902677e2a8131ff7ff14837a94811601148dbc4cda8273cc156a441da4630cb1a6d0fc149382780

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3533eb0a5fd9792bee00a7fb1f880fd0
SHA1 e38ea54bfcd1d84ed248ec8170d8fa12bbc6c648
SHA256 4f7228b78e73adfe91c8b82ceffe537088addf74a7376af7654d62aa84812aef
SHA512 3141d436ed50b61bee14280951c7ff7c309fa735af0b6eaff77a0755223db9d7290e6cc81e8a96ffee1bb3955de25e5e680e23bf5116e053138175511b5ba0dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91b0f850995d1d3216c06bba164cb96f
SHA1 584bfee2f532a07445161eefe56f773b5867182c
SHA256 76f7e703171ef30a1e9cafbc0cfacac7025c0738733b467a9d9bc263bf842e02
SHA512 8a43552e6d4feb513a4c1906fb478493c93adebf85136cba731594bd4d04846d40a2b7149bca268d850da886c7689af6ee528952d8f8e0968905a9ba5c1c7eb6

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HGGVH0YJ\uk.yahoo[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ec06e71b2ba52590192753d79a83ba4
SHA1 63796630d3006e2d39ce571a594f43972fb3dc00
SHA256 777538816703171bf20a4c1eab80fa41ca315522335eab28d7ae776f7c8788ae
SHA512 4cf0ea2b5e9c63f69c150a7c0f93096b7f8e8b8b3fe5b4cca4c5373287c3bf30c090abfb91dde5035a5f248b3a22f9bd2c2a82ba217df6590be405989e6b96f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0cf5aa2a2af0e56da36963436435752
SHA1 8fe5e2df4bc5d0eb881bb2c3d35f50c39c3d83ea
SHA256 6851039a744c69f4f6d9464e1a63a1d1de12c23c79e55bd6233b527fbf792aed
SHA512 7133aec99825a92ada99765a425390f51c4f1f1c1e3641b56a1229ad4457a3d3dff7088b9c3e4e2c2c5d1a705c5ffcbdd1ba4ce28b627e19c9e8458e28475cec

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HGGVH0YJ\uk.yahoo[1].xml

MD5 eaf575ac1b4df3076ba54eaaee4bacb3
SHA1 8673a7bb466a02efb221fedd83d5a8fc0dce6244
SHA256 fd4608984c6297a2dd2d8a7460e36695f6c344a3f4e7ebec9a6471a05bbbea72
SHA512 409dee196badc9d034b289ffcc70ed161d7c78935bf946d8c6171b1252162e4386bd2e8f0bafea452e7440437d83d2c0c55e670a7ba2e4379e282e42f57e9819

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b87d1a9967f0a1f2e0fdb316c4c43bf4
SHA1 ff713a12185ecd0382db1544ac20d9177c81476e
SHA256 672ffa5231b51ea5272a06102b860ac711a346cb217992ccb88ffc1a2250eec9
SHA512 db3f1022cb72e00852acb793999f2f724f679368ce2d021462fd07713c733c949995b39f17ae6912afd52c86299e1f1ec510f2463f9b853c58309b9f3cbe27c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd987344b7ee215378cc3e377240c0ca
SHA1 89ccc17910b0f79f2128f3050b1e5dfbe98dda76
SHA256 8acbbc77dedef13de93265c650ebcaa671781d82769fdd5ec911bfcc31772b6d
SHA512 9b9f3ef0ffab08f4ace1cfe03ed89a260ff4d097044ac3c9627d423ee137a77b49c30e11e188a35015e567932846804402a311c75d4e825b427bed646196e47a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 718a996580b99106f8e7f68410c60cd9
SHA1 2aa43671d1f0a563240a71e3b12845984665b179
SHA256 ab1fdf2b26643039b7ab83008899e0be4e97050b5bd3d5c862368d03d5c75eef
SHA512 cc92fc57b3c062f55b30014100e54bde89d1f3128ad591e9c6c8f8bc05121c1b1a0b2f04013365764cb82df7dd15510b59c0a9e7593f2b39ac329c2f1682d0b3

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\2cf1ace.caas-news_web.min[1].js

MD5 d5290f60668839218f60a19748013806
SHA1 2cf1ace5cbe6061e1d48b9b1b54e572a51766260
SHA256 1022a4b9724ad79c50265b7a46f7847618ebd475af2bfee1f7d14b9487828931
SHA512 21e15f698ffd1c21e08d9b4f87a95007bf3c48a3168e03897108000e690334a106704148a8e590cd678f7971743d0072f84eab937ca4a2de3ee734c3cb5aab35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b06cf194ec3450e6b4dc7cc3c028ee03
SHA1 71328e23b0d7fa8824bca8f2eb966e69dd235f95
SHA256 70a72ed146461017c593af9178389d7e9561706d09c38f40ba1b1a5680456a2d
SHA512 fab8d7c07d6382fdd6506724586906cf6eb9d3743b9e8f7a4cb9c48a56cb2dd01b9c799fd1c74bd635a14513c44c616a78a24621d0104cb09fe5a483ca49621c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f0228d714c8658ff64925851059ba62
SHA1 f366bbfb9ddc79b27bc338982684b93020f46658
SHA256 c02d0ece9a8080fb0f09a8dec8243b40b9d401ca9c52e6e39626dc9d8015e2e6
SHA512 95a13f450ee576e3ab22db315850f13a1cc388de8fe1f32fb873e9c5fa010ac8b989505f1cb7204715bb561e24eb49a6129cf98adba0601b6e409a1e64e5b0f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0c02f1eb764c258857806c0ff95c3b5d
SHA1 306ff69ea058a9858dea8d22cb01d462f607c365
SHA256 7fec8a8ace02fcf48b2063d57f55ddd2cc4dc6cdfdc09da659600bb46cb6f9e5
SHA512 f45cd3bc6e41f08182f9aa345fd034c28cf7fbffb974708f5b1bcafea837e6549fb43822c952bbba690c892fd70fa51a89087ad77ac0a806323bc7e3099998b7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\favicon[1].ico

MD5 3a07174943f82046370997254100d870
SHA1 ecb1e2e89af0ec6f45f875c22df0fbd45821ba80
SHA256 c6f7ee2cadae2e121342a8c4245141175bfe887776206deb17149d46cf3aa827
SHA512 0a589e20251f62f02c4b96b916fbd9359677a26379d46eeef4e455464643de0c9aeef921ad563d970e7436805dd18ae974de6942dfdf0c65089512d8a3b2fd35

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

MD5 099f3807d4d005d9c958ee953d6b5601
SHA1 1240e744f470df5ea416b7c4413ab7351c7b1bfc
SHA256 fa71a32171d5ccb6d2b6dcb0be20451d1fb8996977ace79db59e75477e2a418c
SHA512 1b6b21eccf786cc5e33db22645a649eb0f42cbc4e3f7562854dc0791c42cd3e7324b55afc153266109d4eaabdb32ab2761bab58da4c24385837fde83d97aae2a

C:\Users\Admin\AppData\Local\Temp\~DFAB52FC66C5909C36.TMP

MD5 8b048d1c9cdbd628cf5a0d9bcc99ad66
SHA1 8a9ca39212b3a6e11fae76c010808aa7da1fd64b
SHA256 c4f792a8707a0f3c7c53723f4f591fee497422098217d4ac9cb52dea6da29da7
SHA512 116df710a146577e2a49b5bdf2e7374d53329a05a56837873854f7f7020385848fec79c273ec4bea2b06909e1f1c580a34897820d46c2add81003e08cadc55ed

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-13 10:43

Reported

2024-05-13 10:45

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

141s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Windows\Installer\MSI5BAA.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI5D03.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e575728.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI58A2.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5A5D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI58B3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5912.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5A8D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5AFD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e575728.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI57B5.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5892.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5AAE.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57572c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5BAA.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5871.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5A1C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5A2D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5A9D.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{64E53455-B2F4-42AD-AD37-2E4F9125F937} C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI5BAA.tmp N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55435E464F2BDA24DA73E2F419529F73 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0AD881C19F612E04DAD74EFBEB5A28A0\55435E464F2BDA24DA73E2F419529F73 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55435E464F2BDA24DA73E2F419529F73\MainFeature C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\PackageName = "setup.msi" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\ProductName = "Apps" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\PackageCode = "FE5E588C7A5F4984ABC63A7C48A961C9" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\Version = "16777216" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0AD881C19F612E04DAD74EFBEB5A28A0 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55435E464F2BDA24DA73E2F419529F73\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4616 wrote to memory of 1444 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4616 wrote to memory of 1444 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4616 wrote to memory of 1444 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4616 wrote to memory of 772 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI5BAA.tmp
PID 4616 wrote to memory of 772 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI5BAA.tmp
PID 4616 wrote to memory of 772 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI5BAA.tmp
PID 772 wrote to memory of 3064 N/A C:\Windows\Installer\MSI5BAA.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 772 wrote to memory of 3064 N/A C:\Windows\Installer\MSI5BAA.tmp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 3360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 3360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4244 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 2204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 2204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3064 wrote to memory of 4964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F907A93CE5D46F08D8F93A2960B0432D

C:\Windows\Installer\MSI5BAA.tmp

"C:\Windows\Installer\MSI5BAA.tmp" https://telixsearch.com/tyy

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://telixsearch.com/tyy

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc6f446f8,0x7fffc6f44708,0x7fffc6f44718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,12035437910317040963,18397864508698346390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 repository.certum.pl udp
NL 23.62.61.57:80 repository.certum.pl tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 cevcsca2021.ocsp-certum.com udp
NL 23.62.61.137:80 cevcsca2021.ocsp-certum.com tcp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 57.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 137.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 collect.installeranalytics.com udp
US 54.211.30.217:80 collect.installeranalytics.com tcp
US 8.8.8.8:53 217.30.211.54.in-addr.arpa udp
US 8.8.8.8:53 telixsearch.com udp
US 172.67.142.97:443 telixsearch.com tcp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 97.142.67.172.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 8.8.8.8:53 campaigns8.cfd udp
US 8.8.8.8:53 campaigns4.cfd udp
US 172.67.164.89:443 campaigns4.cfd tcp
US 172.67.150.37:443 campaigns8.cfd tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 37.150.67.172.in-addr.arpa udp
US 8.8.8.8:53 89.164.67.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B03113490075047F519A3F760F0FF379_95980E5E8BBE730A69D3C1EABF291983

MD5 beb64c647ba62e122d0160e858cd75da
SHA1 c7e6647d993cda8675ae413f14ec180e89cf2e3f
SHA256 a049638a056e864e35622bc606153277ca3aba90f30e3a462112485c5e103646
SHA512 566319109481b876cdb36d4a86977c6381619460337298587d1cf2b2d33740b49f4883e3cb5cc18d375aebf7d099b8e4faa95854ac7244d4e1edef44b3f7252c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B03113490075047F519A3F760F0FF379_95980E5E8BBE730A69D3C1EABF291983

MD5 789241abb383a9f91658584f49e6dfc8
SHA1 18dd6865fecd2ea2783d48ac936c024d4b1023a3
SHA256 eb5770e213f188c0775231868cafa8badfdf8c2e5ae6f37faf6a69e9f94be12a
SHA512 7441105729d42019bf7d58b37e74beeb6246cb43d85a5a7a95d982c84f33c68528b63d35959781885779d78b52675ca3b0412c070fa1b123163a0b0b8c5c394e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

MD5 a4f39284533c46a364a36dd9237e098e
SHA1 bc4ccf4f86591cc3d251494a08c24c17b6044311
SHA256 b128bb4da80daf1eb6ea1c5e8d56ba4db0943bd60ae46dbc1b0a7b80744dff8a
SHA512 ec16585e55ec508cc47a2d4d81ba6bdf9961e46fc830b4ebf282cdf107527e38d6a3dc26cb675a468143940685a486c61d683df7c52f6d1b328587c7555b943f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

MD5 7c743119d2b568232cffa98482a5cf9e
SHA1 f9a5f04c04e72ff6e27b90e834ecf0a0d90c6acd
SHA256 9e246184034f544f4e01f435e1a11a0a6b7976f7d2cfa1c9f50186e96e0eb6ea
SHA512 d892a274564c454397b11c3bf621e5232c7582384842743c4cd5e4d040ef162f2141e33149ec5c1084907b039ab9ffc60750dd03b5033b576291c9490609ab83

C:\Windows\Installer\MSI57B5.tmp

MD5 c6b7f525bebdce408cae137e6c82fa4c
SHA1 6b13d7b7e66c2c32815b98e33c95937f559e2cac
SHA256 e0ea63e00f640c74ddd0b51a46d4d0601acdebdc8b97957fed727f332a96dc90
SHA512 f1e330aad8bc2de79fbe7e7452148714d3f823450c5de039ccbc3690f523c55b240dca4e8d9a9ac83e7afcea6462950b4bc2cbcf52b4c959b9047660a6872a4f

C:\Windows\Installer\MSI5871.tmp

MD5 8d84543f774c6b280b32b24265e272e8
SHA1 cd3a0dbc06b9b4945f3a5d3b40972a0b5f66044b
SHA256 32b60176177d943df28f931828717f4b52b1434b8c0cd3ca8cc8a424b016b092
SHA512 247c5c3c4765e61b4d4b7514886e9eccb45746593b21a8dc8f718a224a1a0bc813fe227030738c3035cb9a9017ba53d7feff07cccb11407e9b22678af0c42056

C:\Windows\Installer\MSI5912.tmp

MD5 9ac5da40be505273f6f1b48ce6d159be
SHA1 47d3fbb35dd5df773bb9cb523eaf063c40f52241
SHA256 6547bac5e0f08595325b769a6605a6c27b1eb2620a31dc9ecc4185b64882e837
SHA512 8826dc286b48b4008eff8e38f3ffe4519601f702bd9a6b71731e2ce929789f9ec92f4997fcd28930b91132df5053ffa4f276b5dcb2f8589b93befb805b4bad3b

C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\{484B9251-CFBA-4DF2-A8D8-489850D2AB16}.session

MD5 94589de8cb4f4653149f86b816ab4df5
SHA1 1085b0d8ee685fea268a397e63391429292624d6
SHA256 a764aded548c12e5100bc1691d6f35e78525ec31885187c22d7ee3e43e2beecd
SHA512 a0b988f0af5e02992d4597acf4d0db35246a5c44e50c9001d33c76bf23b9485dd4a70e82a7123f56b0e0f9768664256e75cfe5cc1feddda4656c7915513517ed

C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\tracking.ini

MD5 2dc610de5887959335b536b2ac3810a5
SHA1 fb464f512723f464aa44d114634a287a5c27f538
SHA256 2e7b74480ce973498b6c6a0c142c3e1342d013cd367428ff546e42664ca1779e
SHA512 32ad3ab9aaf4963b7b5005f550f9a896c425cdaca5e6fc78661aef8382f36a74f08dba544708c5807d50f1e1d6f9bf1f1bd0f6721407023dba0c591b20e3554d

C:\Windows\Installer\MSI5BAA.tmp

MD5 e014e0a640cefb49b2a301ff7d00e6c0
SHA1 986ebc61f6fc8a5b967208d950cc6ac9e4d5c3f0
SHA256 edb6a8e18a441e20127545d0663905f051ad4891566049e60d8263d6052e2be3
SHA512 39fd9de58525cdb7f5874841d1a66d6d53cb61378fd4dfd7b13e6a99b2e7b01a3be76f62bc7768b498c9d71fd75c214d9ded52ee458374a2374af3bd09e6d4a9

C:\Config.Msi\e57572b.rbs

MD5 19eb4e52327750689a35ca27d424d3bc
SHA1 fdeb1d3e3ea57799118e0b50378acc67bfa88d0f
SHA256 80f43b4b4f38e5a0e37eeeab8941c44c8d573b447f72a96eabd06f5d0d973ff1
SHA512 df5fc6e779b714b5e085f6086c3ebcda065dc099999d8d03fe6328301ddca52307b9af18ab57d190dd1606bfeb0a6f9a80740e9937f33e9531c7671f657a59ad

C:\Users\Admin\AppData\Local\AdvinstAnalytics\65b2e2115bc9fc7472607c90\1.0.0\tracking.ini

MD5 f9d1a00b254c7b3c65b145cacf98f699
SHA1 1febf82d0b474b6c9263dba731fceddeada28827
SHA256 b68a4da32ea48c3b4a6b9e753ae0e69dbd34636b80bb08391dc61413a826094b
SHA512 213378302725085caf78e3c6c1a3254f37d94b529d51d4c2a9de24f9118395a175accf48e2d8ba04a930b22034f5d819d3b07d876fed06d3d810298d82063f80

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

\??\pipe\LOCAL\crashpad_3064_EDALMYUGKOXYINPH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ae820ff6acaa447d3d961e6986fd4d76
SHA1 2a6a11654d038e31e8bac0da579b3144d16e00f2
SHA256 aaeb71fbfbca6f998e07740a4aa5141f4d67cff7a98b37e7b6a15ea003c07509
SHA512 3877b899d2fcd5df7cc24209fc0e2ca3d9943eedd063428a90aed9f98164b1f4b6e64ca1b93253b3a4dad17dd3c2e793c905723bc02cc2aa51e248d36bd15642

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5020de2cd655e4b16bf44e66a39d9b53
SHA1 91e96cfb376d59e0d2d7546de8b56915612fad4c
SHA256 e0b0f9453edfc62db8c7f953b9fdc45869266b8b82109b919a961ee4ea8cac4d
SHA512 6d433ce57af5580baa35a884bb8fcd50ae37840e1bbbc2b020f3393d766db377316bbbcd59d3e62e3d3acd01458371ec9f37a3ed7659152b4d30f29ebd4d35c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1f979dbadffa9824ddb847a012f71b6b
SHA1 e6e0d4ad88be7acf82ecffcb939117e407c6aa99
SHA256 e802acee5a2a1bd510040051df50a3e27d0107189a49f3d92c0c0a4c9e34d94a
SHA512 072a575c8c9f22d7e38a202285bb554a0260a68017f839e971c37850ef819a8331244e6ed6ecedcaad24041e84d865f4da2e446a07ad529cbbfcd90c91997677

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20f91a83-c687-4631-8b21-8e8a379fb8ed.tmp

MD5 9246ce6f589f5748eca97e5b6b397f9c
SHA1 7e60809f8ad7748d7ad859c8d8a1b48a6616b1dc
SHA256 3a18b486570a7213581cc22af2bfb68e2300dafe42bed6a38733cef4c27161f1
SHA512 8f9680f9760ec0dafc1528f01172632b4d3a8fae7772757b33c9dc7a0debe4c2de7d8412f3634ec98ef3a3a010dbfde5f486f902bba71922192afd831b62357e