Malware Analysis Report

2024-07-28 11:07

Sample ID 240517-typjnagd64
Target 01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e
SHA256 01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e
Tags
oss_ak
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e

Threat Level: Likely malicious

The file 01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e was found to be: Likely malicious.

Malicious Activity Summary

oss_ak

detect oss ak

Loads dropped DLL

Executes dropped EXE

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Modifies registry class

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-17 16:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 16:28

Reported

2024-05-17 16:30

Platform

win7-20240220-en

Max time kernel

132s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe"

Signatures

detect oss ak

oss_ak
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSIFA0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe N/A
N/A N/A C:\Windows\Installer\MSI106D.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSICDD.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f760c34.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFA0.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI106D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f760c31.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC6F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSID3C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIDBA.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF50.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f760c34.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f760c31.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2792 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3068 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 2772 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 1428 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSIFA0.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp
PID 2204 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI106D.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe

"C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 85E15EAD54FC7122C93CA7D79685B6B2 C

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1715703898 " AI_EUIMSI=""

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding DCAAAF31A429174E468176E953D071C1

C:\Windows\Installer\MSIFA0.tmp

"C:\Windows\Installer\MSIFA0.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe"

C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe

"C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe"

C:\Windows\Installer\MSI106D.tmp

"C:\Windows\Installer\MSI106D.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 107-136a.oss-cn-beijing.aliyuncs.com udp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp

Files

memory/3068-0-0x0000000000310000-0x0000000000311000-memory.dmp

C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup.msi

MD5 ed011ae5bd9b187f623680a99a82a8c3
SHA1 b26c7b62c90a5e20627fec65df61eb605dd1c30b
SHA256 d22ddab47c5ba6fdc5f2b4c4d41644597d832a56bc91a2074092a55923bf3843
SHA512 ff8cf2ebd6fdabdc16f31150ce48cab43202769d83a2d86c8c42265c99b337c4d036fdd49393e1bc651df33fbf3dd527bc2b14e9598123d4e4e86cf72222f925

C:\Users\Admin\AppData\Local\Temp\MSIAE9.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Windows\Installer\MSIDBA.tmp

MD5 89136bfd28a2e1ec6b6d841214e1e670
SHA1 4c6aab98925cb556f7bf2dbbc9f7ed0da92ef2ab
SHA256 1a3c0e60aad0a3bb92a6e0b786df93920aed7b0c7ec56ab49f2692102ac5adec
SHA512 22237702745fe11a6f23a943f16a12f23b42fe04d87af6383afeccd854320f3a6961590a76ab6a04f020f9830fb3d9f8b34315ad007a5464dbdba2d543851812

C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup1.cab

MD5 45d1b6fe6265012304efded3b68b514b
SHA1 81f730fa79f79c3a414dbc440212082d941904be
SHA256 f00693121cb98dd585afcc1718256b2f29179812a8ca91168a48c247d8f4d384
SHA512 b0f204639ddf896d0abf147cac679457b280af9ffe0815ccc4b6c55415355b02b32c52e5774f1974522e6fb5b991a37c04c1f5d92826f0778a7d8333b07032ac

C:\Config.Msi\f760c35.rbs

MD5 0b81cbb6f0928a056dbc22fae9c8e59d
SHA1 fc59717b6b33b6f78dea16622ea4c511e812b346
SHA256 716c80a24cc36a77d6c4dcda0c2f0f8f952f9663bf1947826dc1dfa55330778f
SHA512 1e3fa09ff379728df843ded4ae15f3988fde8d43654bffe8e7e4bd91d9464e39c1b0096772ed72b2b997d945cdcffee364ab8bafa677a80bf4b78cccb63c7e1f

C:\Windows\Installer\MSIFA0.tmp

MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

memory/1428-50-0x0000000000120000-0x0000000000122000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe

MD5 90d0a198ebd84ab18ed372dab02b5862
SHA1 d4f39b9a647ae6ad7c981c7acb4a6ff06025094d
SHA256 0037c9895723fb712b57b144cbb429f319ab5a3c1e4c44a3ffefa351486bcdaf
SHA512 056c0300b2f9beb88a83711d94082fd3c8a86d7d9f73de37dd1f63795a1c1cb780fa4e984a2a2416d0ea489750622633402586e98e72799031f6c933379df84a

memory/2708-58-0x0000000000260000-0x0000000000262000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe

MD5 c3dca8a1bd0bc7e3016ae4a2d8cff1af
SHA1 df6047d4caa7ebde25735edea25d2b1d0fd03737
SHA256 ba42b868a8618ca9ef05a27031c483d9306b944927cde7e9dd54c833447e9e91
SHA512 81516d6cdce85316671b12c3e7e3cf73220f17a5a5df90070af56f83895a6f618f819d35b6b8a02eb18763e232e9904f527229ec3500ec62a9780b79c8341f49

memory/472-63-0x0000000000FE0000-0x0000000001418000-memory.dmp

memory/472-70-0x0000000000310000-0x000000000032A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 16:28

Reported

2024-05-17 16:30

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe"

Signatures

detect oss ak

oss_ak
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI4F8E.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe N/A
N/A N/A C:\Windows\Installer\MSI507A.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\e574ad4.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4BE0.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4CBC.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4CCD.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e574ad4.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4F8E.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{A5BBA976-4B07-4766-95EA-8521D8C0711D} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4E55.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI507A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4B32.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4C00.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4BCF.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3980 wrote to memory of 5108 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3980 wrote to memory of 5108 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3980 wrote to memory of 5108 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 5032 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 5032 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 5032 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe C:\Windows\SysWOW64\msiexec.exe
PID 3980 wrote to memory of 4708 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3980 wrote to memory of 4708 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3980 wrote to memory of 4708 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3980 wrote to memory of 3760 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI4F8E.tmp
PID 3980 wrote to memory of 3760 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI4F8E.tmp
PID 3980 wrote to memory of 3760 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI4F8E.tmp
PID 3980 wrote to memory of 4748 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI507A.tmp
PID 3980 wrote to memory of 4748 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI507A.tmp
PID 3980 wrote to memory of 4748 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI507A.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe

"C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 20C0D83214A997B60C2D1EF6C5ECE460 C

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\01bf8b7817a9965e2497b953a0d5a4c4431bded1e98172cd7afff9520640663e.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1715722692 " AI_EUIMSI=""

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 4F0FB3F94B1E9AE4681089E5C6C76CB1

C:\Windows\Installer\MSI4F8E.tmp

"C:\Windows\Installer\MSI4F8E.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe"

C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe

"C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe"

C:\Windows\Installer\MSI507A.tmp

"C:\Windows\Installer\MSI507A.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 107-136a.oss-cn-beijing.aliyuncs.com udp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
NL 23.62.61.104:443 www.bing.com tcp
US 8.8.8.8:53 104.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 99.56.20.217.in-addr.arpa udp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
CN 59.110.185.237:80 107-136a.oss-cn-beijing.aliyuncs.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 168.253.116.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup.msi

MD5 ed011ae5bd9b187f623680a99a82a8c3
SHA1 b26c7b62c90a5e20627fec65df61eb605dd1c30b
SHA256 d22ddab47c5ba6fdc5f2b4c4d41644597d832a56bc91a2074092a55923bf3843
SHA512 ff8cf2ebd6fdabdc16f31150ce48cab43202769d83a2d86c8c42265c99b337c4d036fdd49393e1bc651df33fbf3dd527bc2b14e9598123d4e4e86cf72222f925

C:\Users\Admin\AppData\Local\Temp\MSI48A3.tmp

MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

C:\Windows\Installer\MSI4CCD.tmp

MD5 89136bfd28a2e1ec6b6d841214e1e670
SHA1 4c6aab98925cb556f7bf2dbbc9f7ed0da92ef2ab
SHA256 1a3c0e60aad0a3bb92a6e0b786df93920aed7b0c7ec56ab49f2692102ac5adec
SHA512 22237702745fe11a6f23a943f16a12f23b42fe04d87af6383afeccd854320f3a6961590a76ab6a04f020f9830fb3d9f8b34315ad007a5464dbdba2d543851812

C:\Users\Admin\AppData\Roaming\DeepLSetup\DeepLSetup 1.0.0.0\install\DeepL_Setup1.cab

MD5 45d1b6fe6265012304efded3b68b514b
SHA1 81f730fa79f79c3a414dbc440212082d941904be
SHA256 f00693121cb98dd585afcc1718256b2f29179812a8ca91168a48c247d8f4d384
SHA512 b0f204639ddf896d0abf147cac679457b280af9ffe0815ccc4b6c55415355b02b32c52e5774f1974522e6fb5b991a37c04c1f5d92826f0778a7d8333b07032ac

C:\Config.Msi\e574ad7.rbs

MD5 c44967ab9db56db475eb9bcf10c9d3c0
SHA1 b9f77b4c749d834070410646964b1221e0906e04
SHA256 433cd21e93bf51dc26776f96f322938d0eb2bbfadf80180aadb80ef3423032d0
SHA512 81a7fa3477b7d2d9683a5a2455d7a04b24127cccd0b7513a35cbe784a3d93477f63205072631ae60bc86e14f5aca89fdbeb6bd05576fea762a044e0df712116d

C:\Windows\Installer\MSI4F8E.tmp

MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b

C:\Users\Admin\AppData\Local\Temp\DeepL_x64.exe

MD5 90d0a198ebd84ab18ed372dab02b5862
SHA1 d4f39b9a647ae6ad7c981c7acb4a6ff06025094d
SHA256 0037c9895723fb712b57b144cbb429f319ab5a3c1e4c44a3ffefa351486bcdaf
SHA512 056c0300b2f9beb88a83711d94082fd3c8a86d7d9f73de37dd1f63795a1c1cb780fa4e984a2a2416d0ea489750622633402586e98e72799031f6c933379df84a

memory/1376-69-0x0000000000F20000-0x0000000001358000-memory.dmp

memory/1376-77-0x0000000001C70000-0x0000000001C8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsProgramInstaller.exe

MD5 c3dca8a1bd0bc7e3016ae4a2d8cff1af
SHA1 df6047d4caa7ebde25735edea25d2b1d0fd03737
SHA256 ba42b868a8618ca9ef05a27031c483d9306b944927cde7e9dd54c833447e9e91
SHA512 81516d6cdce85316671b12c3e7e3cf73220f17a5a5df90070af56f83895a6f618f819d35b6b8a02eb18763e232e9904f527229ec3500ec62a9780b79c8341f49