redline | hxxps://download[.]tt2dd[.]com/

Resubmissions

22-05-2024 04:29

240522-e39m3aca78 10

11-05-2024 11:09

11-05-2024 10:59

09-05-2024 13:02

04-05-2024 06:42

02-05-2024 14:21

Analysis

max time kernel
239s
max time network
225s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download.tt2dd.com/

Score

10^/10

redline rajab discovery infostealer motw persistence phishing spyware stealer

Malware Config

Extracted

Family

redline

Botnet

rajab

45.89.53.206:4663

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/4976-465-0x0000000000990000-0x00000000009E2000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Infected.pif

description pid process target process

PID 3760 created 3312 3760 Infected.pif Explorer.EXE

description	pid	process	target process
PID 3760 created 3312	3760	Infected.pif	Explorer.EXE

Executes dropped EXE 13 IoCs

Processes:

Setup.exeInfected.pifMusicPlayerApp.exeRegAsm.exepython_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.exeITSMAgent.exeITSMAgent.exe

pid	process
3076	Setup.exe
3760	Infected.pif
3840	MusicPlayerApp.exe
4976	RegAsm.exe
3100	python_x86_Lib.exe
5568	ITSMService.exe
3064	ITSMAgent.exe
2268	ITSMAgent.exe
2520	ITSMAgent.exe
5468	RmmService.exe
5796	RmmService.exe
1232	ITSMAgent.exe
4836	ITSMAgent.exe

Loads dropped DLL 64 IoCs

Processes:

MusicPlayerApp.exeMsiExec.exeMsiExec.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
3840	MusicPlayerApp.exe
3840	MusicPlayerApp.exe
3840	MusicPlayerApp.exe
3840	MusicPlayerApp.exe
5084	MsiExec.exe
5084	MsiExec.exe
5084	MsiExec.exe
5084	MsiExec.exe
3336	MsiExec.exe
3336	MsiExec.exe
3336	MsiExec.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
2268	ITSMAgent.exe
2268	ITSMAgent.exe
2268	ITSMAgent.exe
2268	ITSMAgent.exe
2268	ITSMAgent.exe
2268	ITSMAgent.exe
2268	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
2520	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\ITarian\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

13 3080 msiexec.exe
14 3080 msiexec.exe
15 3080 msiexec.exe

flow	pid	process
13	3080	msiexec.exe
14	3080	msiexec.exe
15	3080	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

Processes:

ITSMService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeMusicPlayerApp.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	MusicPlayerApp.exe
File opened (read-only)	\??\Z:	MusicPlayerApp.exe
File opened (read-only)	\??\K:	MusicPlayerApp.exe
File opened (read-only)	\??\M:	MusicPlayerApp.exe
File opened (read-only)	\??\R:	MusicPlayerApp.exe
File opened (read-only)	\??\S:	MusicPlayerApp.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	MusicPlayerApp.exe
File opened (read-only)	\??\J:	MusicPlayerApp.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	MusicPlayerApp.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	MusicPlayerApp.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	MusicPlayerApp.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	MusicPlayerApp.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	MusicPlayerApp.exe
File opened (read-only)	\??\W:	MusicPlayerApp.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	MusicPlayerApp.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	MusicPlayerApp.exe
File opened (read-only)	\??\P:	MusicPlayerApp.exe
File opened (read-only)	\??\I:	MusicPlayerApp.exe
File opened (read-only)	\??\V:	MusicPlayerApp.exe
File opened (read-only)	\??\Y:	MusicPlayerApp.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	MusicPlayerApp.exe
File opened (read-only)	\??\U:	MusicPlayerApp.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

7 https://ertytvm.xyz/?FCmkiNRLh0Y2BHeutdTwaKGo54Mfs6-xIzrmYvfqdQhHKX4B1CPNVREiawejpUG3Lo7WMuF9A8c-Mf62jtxdLuv8WekyJqrXRI

flow	ioc
7	https://ertytvm.xyz/?FCmkiNRLh0Y2BHeutdTwaKGo54Mfs6-xIzrmYvfqdQhHKX4B1CPNVREiawejpUG3Lo7WMuF9A8c-Mf62jtxdLuv8WekyJqrXRI

Drops file in System32 directory 8 IoCs

Processes:

ITSMService.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ITSMService.exe

Drops file in Program Files directory 64 IoCs

Processes:

python_x86_Lib.exeRmmService.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\copy.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\sl.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\RmmServiceInstaller.log	RmmService.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\mhlib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\eclipse.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+12	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\combobox.xbm	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\license.terms	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\sw.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Resolute	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Jamaica	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\DLLs\_tkinter.pyd	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\cookielib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib-tk\Dialog.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip-7.1.2.dist-info\entry_points.txt	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\commands\install.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Tahiti	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\compiler\syntax.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\RemoteObjectBrowser.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\ttk\clamTheme.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\McMurdo	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\pref\WmDefault.txt	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\xmllib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\d3dcompiler_47.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\ensurepip\_bundled\setuptools-18.2-py2.py3-none-any.whl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\pep425tags.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\cp936.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Curacao	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\samples\STList2.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\tclIndex	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\cp437.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_buffer.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\commands\search.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\response.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\North	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\inputstream.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\iso8859-5.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Brazil\DeNoronha	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\harddisk.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Mexico	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Kentucky\Monticello	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\St_Thomas	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\bitmaps\minusarm.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\linecache.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\hebrewprober.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Curacao	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\Syowa	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\_MozillaCookieJar.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\concrt140.dll	msiexec.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\SimpleHTTPServer.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\response.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Creston	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Indian\Christmas	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\sre_compile.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Belfast	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\TList.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\GrepDialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\tk.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\bz2_codec.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\multiprocessing\managers.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\bitmaps\tick.xbm	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\config-extensions.def	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\images	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8\8.5\msgcat-1.5.2.tm	python_x86_Lib.exe

Drops file in Windows directory 23 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIEEF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C27550CBACB76D8.TMP	msiexec.exe
File created	C:\Windows\Installer\e58e9d0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF58C.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF07DC23815E37794A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4E0.tmp	msiexec.exe
File created	C:\Windows\Installer\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e58e9ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF42.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{CA6B5E30-616B-4A5E-BC20-52629865CC0A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{CA6B5E30-616B-4A5E-BC20-52629865CC0A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3BF5E65D7C236242.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA74AB31DEBDFB007.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e9ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECAE.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007968374e010db61f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007968374e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007968374e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7968374e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007968374e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2104 tasklist.exe
3884 tasklist.exe

pid	process
2104	tasklist.exe
3884	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 62 IoCs

Processes:

ITSMService.exepython_x86_Lib.exemsiexec.exechrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	ITSMService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000446a9dea00acda01	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000014cc9fea00acda01	ITSMService.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608257628131549"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe

Modifies registry class 27 IoCs

Processes:

msiexec.exeITSMService.exechrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03E5B6ACB616E5A4CB0225268956CCA0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Version = "134527975"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductIcon = "C:\\Windows\\Installer\\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\03E5B6ACB616E5A4CB0225268956CCA0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\PackageName = "em_13XP0ghe_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03E5B6ACB616E5A4CB0225268956CCA0\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductName = "Facebook Facebook"	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\PackageCode = "DFFE6588FCABA52429605389FCB2DC8B"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exeITSMService.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	ITSMService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ITSMService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ITSMService.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982.rar:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2040 PING.EXE
Suspicious behavior: AddClipboardFormatListener 5 IoCs

Processes:

ITSMAgent.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid process

3064 ITSMAgent.exe
2268 ITSMAgent.exe
2520 ITSMAgent.exe
1232 ITSMAgent.exe
4836 ITSMAgent.exe

pid	process
2040	PING.EXE

pid	process
3064	ITSMAgent.exe
2268	ITSMAgent.exe
2520	ITSMAgent.exe
1232	ITSMAgent.exe
4836	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

chrome.exeInfected.pifmsiexec.exeRegAsm.exeITSMService.exechrome.exe

pid	process
3880	chrome.exe
3880	chrome.exe
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
2104	msiexec.exe
2104	msiexec.exe
4976	RegAsm.exe
4976	RegAsm.exe
5568	ITSMService.exe
5568	ITSMService.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
4976	RegAsm.exe
5568	ITSMService.exe
5568	ITSMService.exe
5672	chrome.exe
5672	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exechrome.exe

pid process

3880 chrome.exe
3880 chrome.exe
3880 chrome.exe
3880 chrome.exe
5672 chrome.exe
5672 chrome.exe
5672 chrome.exe
5672 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe
Token: SeShutdownPrivilege	3880	chrome.exe
Token: SeCreatePagefilePrivilege	3880	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exeInfected.pifmsiexec.exeITSMAgent.exe

pid	process
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
2696	7zG.exe
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3080	msiexec.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3080	msiexec.exe
3064	ITSMAgent.exe

Suspicious use of SendNotifyMessage 62 IoCs

Processes:

chrome.exeInfected.pifITSMAgent.exeITSMAgent.exechrome.exe

pid	process
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3880	chrome.exe
3760	Infected.pif
3760	Infected.pif
3760	Infected.pif
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
3064	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
4836	ITSMAgent.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe
5672	chrome.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

ITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
3064	ITSMAgent.exe
2268	ITSMAgent.exe
2520	ITSMAgent.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
5568	ITSMService.exe
1232	ITSMAgent.exe
4836	ITSMAgent.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3880 wrote to memory of 4012	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 4012	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3304	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3276	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3276	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe
PID 3880 wrote to memory of 3576	3880	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download.tt2dd.com/
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa11abab58,0x7ffa11abab68,0x7ffa11abab78
3⤵
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:2
3⤵
PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
PID:3276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:1
3⤵
PID:464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:1
3⤵
PID:764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4316 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
PID:1656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4652 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:1
3⤵
PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4456 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:1
3⤵
PID:3444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
PID:804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
- NTFS ADS
PID:3716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 --field-trial-handle=1808,i,15041923982854558463,12845051399265599010,131072 /prefetch:8
3⤵
PID:1700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\" -spe -an -ai#7zMap26787:188:7zEvent29618
2⤵
- Suspicious use of FindShellTrayWindow
PID:2696

C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\Setup.exe
"C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\Setup.exe"
2⤵
- Executes dropped EXE
PID:3076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k copy Inch Inch.cmd & Inch.cmd & exit
3⤵
PID:4688

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
PID:2104

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:3336

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
PID:3884

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:3136

C:\Windows\SysWOW64\cmd.exe
cmd /c md 4161514
4⤵
PID:4460

C:\Windows\SysWOW64\findstr.exe
findstr /V "TemplatesJunkFinancialBlocking" Innovation
4⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Locks + Marble + Irs + Ray 4161514\X
4⤵
PID:3100

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\4161514\Infected.pif
4161514\Infected.pif 4161514\X
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3760

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:2040

C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\bin\Debug\MusicPlayerApp.exe
"C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\bin\Debug\MusicPlayerApp.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:3840

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\4161514\RegAsm.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\4161514\RegAsm.exe
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4976

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\em_13XP0ghe_installer_Win7-Win11_x86_x64.msi"
2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0096ab58,0x7ffa0096ab68,0x7ffa0096ab78
3⤵
PID:5472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:2
3⤵
PID:5828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:5864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:5692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:1
3⤵
PID:5732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:1
3⤵
PID:5992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:1
3⤵
PID:5576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:3228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:1216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:8
3⤵
PID:72

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4964 --field-trial-handle=1764,i,3052357495460550165,6709374565095285919,131072 /prefetch:1
3⤵
PID:2428

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2104

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:1064

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding EC2AA232EA58AD9E587ADC69F6AD2EC4
2⤵
- Loads dropped DLL
PID:5084

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding EE00E4B7F1980E7F072D973160BF4556 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "
3⤵
PID:4800

C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:3100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
5⤵
PID:4308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2720

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5568

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2268

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2520

C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe" --start
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5468

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1232

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5960

C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
PID:5796

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58e9cf.rbs

Filesize
710KB

MD5
0ec08fe14935a8088168bddee10e2f53

SHA1
0b52ed3b64fcc1b2c35fa115054ea0a47c5d04e5

SHA256
f219ef58e3d6bbb6dd9fb020096d29267ecd611c6ab4be76ae9ae438b9139c18

SHA512
1106b25d9773fb7159a5cfa02ce4f6d20db581964890da13045efad021e92e8c1f601770b70e7d5494925407d220a63c6b6b1a04b27f1349788d620813d5e067

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe

Filesize
2.9MB

MD5
a223cbdc0a058b5158a7b46cd2c5d06c

SHA1
3376c1f6a9d28791c259623846604979ddfc70dd

SHA256
8382bea9ebf7638cd1c5170444330cf27e89eb5e96f76d7a89b47b3ae21425e3

SHA512
ea26b077355dd4000dfb698c1a6d68eea93bc96afd4b1d9e98c3ce6fc597afa7ec436b903b419f872dc2c0d082dee0f75b42b2a776321f26bb6f27883086d5f3

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
5dd213b6a86ace1f5ebbbef3497eb3df

SHA1
98befcfeb090612b38659edb31c1a7198f51a9a1

SHA256
d6a6ef869c1f4c2b3a7f6bb259a4dfeb27e2cf0833e64f9b6491714e5263f609

SHA512
c557ac75c50cd9f01beb175a348bbd8c000f0d90d02eece86461b6f26bbc596b94031051e6ed6ae1b689a22efd30fcb403b748ba7361a6bc7d9eea89d75c9bf1

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
92b15a27b622a312e32cf89ac85ce1d8

SHA1
d047ffa2f23bd68d32f70033fa47ecd57036dc98

SHA256
6f8a8bd9c681513a1ecacb85df0d6e9ac6e517094a9a0eea7819d920c111262a

SHA512
f56bc3b10f8b50d383b11d4d1d93248eb4211bb7cb0ec3763b0f42042958d505e3630d0fb043d2affd522dfadcb453114a3e7fa60f80472236a116099af0edc4

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
be90e2afc41f21748f28705cd3955b67

SHA1
dc88448b901b1bf07c8f95a4e2a3f483ebc345c6

SHA256
2185572d1513ff96bace1a173bcf5a9bfcb75584263ff3f6d41940b6b8b9a79a

SHA512
10427c278aee662e785e55ac5f636154071fe8cafdef0404f3d4d5d0846a2f84809a574284be36a9a6e7e26309f827b109f54f08b5ad1cc9608e6bb0af1937cf

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d2787df0f7822a70d3e47e0fa4aec7f5

SHA1
7432142e59fd0d98a1ddcc44b6a6ad7f37175e3b

SHA256
bd24b5245c4b7680203e5f0e3cb61ede8f1619e1eaf6df55d7b953e845765b05

SHA512
19d34cfc351b0a3fc685d40ccfd2070e6e80cee99c8a4a8fa7884d29601f355f76c245a34659b72481ebe51515e1efd62323ea9e5f301a6bed55f7bc4a77c06b

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
28f2a4059b7cbef083b39827c849ea02

SHA1
235a1026c9d30caad634327213a0dde32eda7279

SHA256
f37ec016c1222f29b0c4b625ec8a0b7ac9831919d83b9a2bade108b707010c8a

SHA512
e7c54c6d321c9a3b62421a5af362e68c0665341594ace3218c47392ab6c6c0b59a53fccd31347c9347ab9a6e911b7473dddf34ce33b29e7cc5bd09b734382bd1

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
71f885b461881fc4f613d72e82f0c8ec

SHA1
5ee4b522f3049cc417f7d97ca91f8e017b1b066d

SHA256
7722cf85d6dd21c4676434d5fa0ea0fe55930694e3fb2244b18ab7447257551b

SHA512
59b0c6002131a5545aa150efdcbbdb2e7e28658cdbeec6c5dc6bed65e0114f4fc0b6f1be3a35b6c5056dd1d630f48a745ecc8117df9e8a07d3aa339a4953c8ff

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
49f4d35a5452614895f4c27e854b95b7

SHA1
b9b649f8141ccc629c40ad83a4a6c6d69fe6a39f

SHA256
c15be0bc4974f728d55c43c203e54a99ad6faf804484ed88f5328bd2364d00b2

SHA512
2e8be7fb0713c00d5960abde60e010b6a92b4e35044f0e5449fa18c3cff4f37170f17c7f446a6041b2ca439228fcb7f650cba746e00b4af6db38f197aa50e31f

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
26071147cb271c2233dc15edaf85b01e

SHA1
d317f4d49b9dab45f82d4f318f38ce88ad1320a8

SHA256
4416779c192def9076240f61565ed532ac1ad659cb50087d17bd4403d37c4f08

SHA512
6577474f50ba37d9c09aa70250d4234a233e28cdcc4666f232fbffb3f7fc76436827fb122814ecfe7d63ee1959957f9e35e555b3ef5398cd3f394052c4f1876e

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
f8f5ca3bc25c2f2f1c967bc91ff55fcc

SHA1
e6741f3ada75c6ba4885599461fbb2b46007a9dd

SHA256
a86d1a6e9f4c24cac9e0b008141cb8d2b3971d63c3370207b4a684d4eb8addc1

SHA512
2b12b7aed99659fd42d714a4a4336e56ed23fa803f860d2d0903e2812ab3c6228292c0942d85c50510a2918e77a973d9ffc02df4af2b9d866fbdfc851ae3c6d6

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
7c75d5f56d6c284316f6063b182c89b0

SHA1
cdb450ba9e9aa1029a7b3135dd6e65780f8d706c

SHA256
17971d6defff7adb95d8ba061c8594e5ef77383f231f68efc37ffb3516896278

SHA512
998a4d1b137c58abcfa5a72eb9f54cce530a9bb6e3a3b8d94d8158daa93eda849f984e61c38442905fa1bf1109a174201acddaa0b9180e9bbea6ac0c778b1d22

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
8c3295c5baf759fd5a2bd40d039f63f2

SHA1
463aa327248a17808c89a86cb44e49d97b714b18

SHA256
ab102ec9dd34e2ad8b13410b2333c5b004dd133db3b5c785b969684137cd2d49

SHA512
d4231e990f1a339861a2b829c7ec3702dd0fc1948de525c67676022d7a21381c42381828f40d0be021378820b0a04d6fe487c7a934861a09de87f76d64b61c7e

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
6ddb4f83045810e41b23162009b50c4f

SHA1
90945f39f93e6882b2aeee9b5c08bae80de53c71

SHA256
da1fcf4988df9e0b55d9fce0b8cddedfeb4cff16add1f7f550b9e159eec9b196

SHA512
492b44f1b9fa9ae50dcda42a89e04303a60bab916f94d661d4ba9043f6486cfcd7937b72c3b171aacd9bbd051e5978e6db53a0bba186798af7bd89e5e8a429a7

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
32KB

MD5
90d6a9e6a25fe31c9b1cf51211997e7e

SHA1
5aeb7bb7a08447367321e141e241aa03a05e7a3b

SHA256
ded1e40cd9bab7df37913892d618e460b1e74510320eb71f2ab0cfcf644b56ae

SHA512
9a079ca885eb59f6c8d48c7a0beef95f68c4291c58651c7901bfc0ac4f450bd40db379e3d877c38ae2658661136bf5e1fd73c13b7de681ee9fb8cec814c7fbcb

Download Submit
C:\ProgramData\ITarian\Endpoint Manager\oem.rcc

Filesize
32KB

MD5
c533733cd62bddcaf9dcbe6f6ab8ff88

SHA1
d43784d3baad1d4dddc0f83fbe9b7128b7a6df59

SHA256
7985a1b0b9eb329930d142ca57026ca6a95853ec76e1b527a1beda66a91518e0

SHA512
8a7b4203d31d3456aaa27e1d37b9343afc3b8e6cb2825736c6b691b6c039b065c0a4857674130e8b3f36844997a73eeab0d66169ccc4b5d82a0c4a1e34b8e829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
2f7c28efb9ccfd1f11abed93d0237233

SHA1
a5162fef0e4cc12a3d6115c9d5e54aa8c0ce1e20

SHA256
d7dcf5c2ca82542b87efab53f4c49320fc01b04ae90ceeffc913006545f56648

SHA512
c6e5f630da0f16b2d2aa1e6fe7194fcafb65bb356642558d757f0da27ba66684ef4e3319fef0ad00c99098289d5dbdc6867cc68e70e59b3fb28cb53eb8d29e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
484B

MD5
ea4f9750ebb0aaf8d8de8561edac88d3

SHA1
45931df3107af6d317bd723be9f902189db3e516

SHA256
1f5c8e2dfa5fc6f571fa7ba938bba9a98c6544359b008bd16c9fce6216c3666b

SHA512
eab90ab6186376e41da4108a928b8de4f2944b50d9fb66ee33e82814c9ba12d4f425c287aff26288fb3753c39fa38f0ae4214919708a6f1346b9bbb86e9112a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
9c02c2bce6311fd19b31ad9be8ecbc8c

SHA1
6d2f50c49f298d8d51f75687ddf3d078f4289fe9

SHA256
09a2d707a06b4089cb247bd09fe97357b59596ca2f1a3b00a379eff57d8e26bc

SHA512
f08f361190ad15e1e790dd2ba31226252723ed3dc860a0c6a96bf25b3fd4f75a382627c23eec57d35062003f6096fd1b12cd62b917f13448f83d3ab747f830e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
fe0564e60bca98f07f3cbaf8ac77999e

SHA1
bd3c7c933500606e6777f58304fff8e771da4c96

SHA256
755a85b01ce80f82a2613f69f59eaf79b3d8529beef6cd7d56bce885ae424554

SHA512
c200c9e3725af83aef01b361a3cf2f9b6fa477fdd8602504a9f42069bbc4af0d146ce85a6c61599aff8a10eeccbfcb42c0dc39d7e038a758afb0bec5b91d62b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\530cf4e3-e23c-4d6c-bbdb-15290e7f8d2f.tmp

Filesize
7KB

MD5
b402bc47b124592b22fac0814c96e03f

SHA1
a949915d76aeecfcc3866f3c0829a8bd36475444

SHA256
0ce2d10872625a65caa6d78c3e6ff606a115ce17acfcea4b0a1bf96694878278

SHA512
0717b6c0f47d6ef4a31f8c304395f61db4d151461a9e571b3af5646ca8a8954dbab08f63e4aae915dacc1e1bfc84f88c2368c8e73815bdbc6fc3f14c8b359d0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
14b2ecbdd18898c382043d85da54d2b8

SHA1
22105ab55af7f77fb5901280323441a43517ebf1

SHA256
757166eef347e50eac20d496ce8e5caf628ad148456532bccd6aafa739dec748

SHA512
e8cf0132e3210f8dd8dc46b3fb448deffcf10c5a61acdc64510d4ccdcc4a124536d8bda00e1111d44ab1bc2d6bddfb2decc124b9e6d30a75899f9242bb84fd4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b892d32f6946ea42e84aba626a9f3154

SHA1
c7ef7a9f72b2ab2538136a49c8da9e4b747de028

SHA256
882a025321e18432669e84308d24a35b8e45bee0479852e2bbdf7a5dc8d63f25

SHA512
15a8772217dcb70732bb83daf443231840ef2c97c1145acc8401a910a03728bb09aa649a32a5ec04a61bbc003c253939070799ac417c6774c1db0122a8c917cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ea23c59e159adba8b501b25e6db30b2f

SHA1
eba54f2bafdbe41b74681c77930d21a4d2aedf73

SHA256
fb1e0f1ade833f2f9ac58019ee6a24ea77af080b8bd2d68195b8db372155aaf4

SHA512
09df49d31b42bcdb1b926ee092efc1ac1eba267ccb8cab28a184d5ad35a080c8b157ec0a8f027ee7e21865132f9e94c0cff321084606a610f84696fcfbbe7112

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e326ade81adaf4938f10648ed7463dd3

SHA1
8a3c02ac6c57dec1e05cab96f1fd5ba8865d54ce

SHA256
b6540178815f878a91f9d42c63e01628a83fdef5b2426bb4ba28404bfad3180a

SHA512
e36364359c92bae4c01488b80fecb0a7c3201eb17c2f27604c623f1cb3b0360abf6032105fa2e0b10086f6c3aeb64d7ded3c2f32ab8a5b2f867e0a8ab68ac9d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
aaf3b3d9fe31d6caa9b0c69750831c82

SHA1
680a3a5c5433e79c6b878df22f48b0937aab7f96

SHA256
5ff798592679c8ce60f02b74a3e732efa6e93d9f0189bb0fa8cdac08d516597a

SHA512
1659f90985a078577934f32f8e6b765db2f6f6375c7e29061dd870095bdf23aad6441a37aa9e91c7d740f068f4b0ed156fd08e1fd24292278a5d8c61e266f02c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
e1d9d1d812ab5d5497140955072db8b4

SHA1
d071191ac440e8463fce06059c22f4d8eb2a0467

SHA256
8d33c9d2a8cebb8ca8f13064e3dffa556519967f5807d3708515caf9f4710a2d

SHA512
ff0fda52540e950856fbde4f72bbeef36d6cc7d16cac6facd36c4f51a9ce559dc92b67064fd21b0e2d59be0beb772f8b9e0f04cd9bde8df77f1769d203215bb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
bac0af1a0325f1996cffe45f1a248e39

SHA1
b2462df76ab8b1472be8d9396899b35587b86b6b

SHA256
6575fb1116e3b8abc2f25db92a472cc7d07e62b4dd9fdc71dbd9567c54570b20

SHA512
c85490cf40bb2298fd86c2efa34bce530cf584117b6411504a1180a61d1337e3ba6b61ec34921f5cf69d9a94d92bc224aad9b5d263046d792649c98c269e1f20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
a38ddf4b106bc6de82c5a169b780e75a

SHA1
76480c80b2216cbc99ef4e26838cdc13b99d03c0

SHA256
08355089a403b7d663e136b33ebb09913f83d1888c800272e516d1892050b587

SHA512
4ea665db7dedffb90436e89ae84d4debe56e27184db7eee96a9f997f71f48d1d0504f41c673db61264f1ebbbd736bb031180fc26d12d3f245ad7379b75f01f26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f87972d5da7f4376af7b78a91346ad32

SHA1
185fb43cb6ff0f35b332dd11eac9da9c38fe6346

SHA256
35d370210d4bafae7540a8a831e84effa79374be83d603ec43a3a8c89012be99

SHA512
c402e0673aad808215d53e3018008cb9a1e4a5cae7d8456bf1eb606b01847e0b74998bb1b8d12c22e8256b5d3580f51448fe62b71a022106e255b8b9d0c021a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a8322e1307327fd0bb0b1466100bb1c4

SHA1
1133e29f955bbba42d4ff1c4e4fccac1e2159154

SHA256
1ef2e632ca21b17a8b09ea3a030754a16d2dc7301868e3ba30af324822019136

SHA512
8bf73b950884603a2511a04ab311b6ae64da398d1c23104fb8cabd1d2d2189226001d24110787f0ada14ae93c64328a5a3b325b8ac7f8635820e7d4ae47c22d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
957eb22f64c04ab232dcef9b3a35e10b

SHA1
020f166ae86041c7413972a9fe37f5b7dfa347ca

SHA256
ac53e53ec8815eac2dbd5da9ad637d8af8ebe83fbc427c64cb7d6281f65c8ae2

SHA512
7c4ce5990389dd1ef1dbab66b1ae3d59e2da450e0391c0b9dd4555b003e8c796fdcfdcfc50dfbe73e3f7a505f2a654cc0d25f5f5529e53e528334f0c470edc73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
6bbeb1149eb5e72fde78c0492cdc7402

SHA1
79abbd72c55e7ac6bb77286a060d6fbd421517ce

SHA256
41d32265786439c7b4739881dc96ed871167e14edf4cb90f8d754e827e2a0cd6

SHA512
31002ce4624e3fe6cfea94d76db27d9ea1c5bcedd46becc00a5ad600a70c0fda9db1ea30968df5eb84c13ff0852c2035980a28591b913b36de9e5863d9a4cc88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
6a6912aa4ae27f5367a726816683539e

SHA1
4cfd09bab2ba68056d6a638bcb774e48467fce52

SHA256
02091f42e2fe3dd80dcbeedea605add6d0da8745a6c9437a9ae7bcde605c85cb

SHA512
0b1602945078764ab9b87efcc7da3929f01f147a342c995231cf96a021e84060bc4336c11939991492be2423dab0d7aadb8afafc1c35d5cd92e38a4e20a18629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
306a99255737849bf127564165690287

SHA1
cdda7cb4f1710224d8d33fec8e00b3ab76af0af7

SHA256
e088c6b44d2d9e3a300f555223a132761a489028f797f677e6b393e6ae531b0f

SHA512
0025515d01f0c99b5614758c6a84bbc10b23b08b5e0374145703bb5f775965a05a3ead96a3639d57cd6d57a2f01678acb992e6ea8ce6481abf73037e5cc2ab41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
b1856b34d5fc8e1dc6e7e94f3bb9e33e

SHA1
34840893285ab6616a85fc34cec2b599e5bea48c

SHA256
7b2994d1d13c94fab463254b84ba54cd726fe94c60a89b1be0ab2f8adb01a3f4

SHA512
1f43d55a15e2d4b6ee67f6414b3fc0d458e9a1fd9cc61a75d915dafef64f05f791afa9c5d27b4302fd311fd95c44029cac07bf25aee18e1137df2e30874e6ffb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
4df2a650cbe246276b6d1969549cce80

SHA1
76d968142be30f83f3822cf55e87f75828e57f92

SHA256
a4d787013c39b3682992861947e82f3ccdbf0dfccc8929a77a8b81db2e7e30d3

SHA512
341704cfa48988ced5d3c0c94145c6cfa4b3e14ef3582c0b250343c2b3ba1089d9be3d1b7eb461e076fb2be3bc01c0f403b78b90f9ae2176c8646bd99d0a25dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
4c77486dd6b4954e2e3f02b587612ae8

SHA1
ded07c3c2046e9f770e73c8ccbb994d2c2591322

SHA256
014ed01cee2089bf20776218f18fe949b8bf21a962e9d5bece9f407bdb94f54f

SHA512
9c6b407746a7563f1ef48ad5c44826b7cfe4b96de15c713b870fc6f51a4317abeb7a673beb13811cdc5ce66a4b089ceaf199706cddf85445fdea5cee4a025be0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
87KB

MD5
0717eb701d6016f379db38b766d6c8fa

SHA1
6e741679524ff5903f1995eff2441995cffed937

SHA256
a75d1bd0d8c31ac9811fa01df42564ba8aed588ab1e1b593d3b16f57562a697d

SHA512
96667e8c0b5bda99f2cb67c7504d820f0652482a13dbb92c26432b4256097aa2fd1c07440bf0408190b1221ec595500a41c274acdcc8c486b2214d8ffecfb563

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57ae8f.TMP

Filesize
82KB

MD5
569f66a17237238b0fa28c00c6602951

SHA1
14382e16d4b46a471998e1d0709d0317450fe541

SHA256
917cc5c365b7a0136700c90e970c32e693050157bd043f6b42a9f5b25800382c

SHA512
ac930373eabe08b3cc1659a4c29728500491af15230d2e25bf9aa1b053eb8adeae897e3eb012628d7b13b8e491764c2c899080e95cf01fbae7ccdba509820a76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\4161514\Infected.pif

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\4161514\RegAsm.exe

Filesize
63KB

MD5
42ab6e035df99a43dbb879c86b620b91

SHA1
c6e116569d17d8142dbb217b1f8bfa95bc148c38

SHA256
53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b

SHA512
2e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\4161514\X

Filesize
384KB

MD5
564fcef4278786869d9e7f8606d17f47

SHA1
d36470b9a08322aa27014fc9ae97a69829ae4d54

SHA256
7ecd3748e97c574c643cad0722725983ac377a780f8e5442c383ce7a3b2205bc

SHA512
983ebba8851235fbfe515aa9b4156eca079914bb9c126d5f31c592bcb0025d26c54e2fd50b9f153b9eb687b0cae4361aedee61634004296680d5d454ad0022e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Beef

Filesize
31KB

MD5
654f7945c1c6e8cf978cccce420e373b

SHA1
5e53a3e35f09ca36692a566a0735a398e1e541c8

SHA256
b56604fbe129b7f4c4ed303747f006541a46c0194871c92edac85bef7a192189

SHA512
ae05c90eaa2580db92c102f0de514a0226504d3679eb7ec3be6b01a5f7e8f704a5411370c588b8fc92aa930e699abad3ff6b3c9869c88a9370b72096e8703ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Breakfast

Filesize
13KB

MD5
099088c7bdbeb6b0c025727492dd71cc

SHA1
3b186caff335362dacaf494a37f5c0bd8a42d5a8

SHA256
20883cfb559483c21725fbbc28934ddfe1a2bd9d3889fc0b2a925d41638c818d

SHA512
8897621fbcf8aec2409704dfa419edaff7a4321e2d5b0e7ecb47a1025fc3f8bcf1ea0a0e2ffa8bcdff13197fc427de395601607e8fa400e07d8c4f759173e46d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ce

Filesize
67KB

MD5
49fb14a076bcafc86abdbc27ebafe16a

SHA1
65ee937829f08d102962d6e3922eeaea2c84c069

SHA256
9d5aed42fcd6d3d8951bb96670834267e810f84b34860e3bf351afca28e3afb1

SHA512
5dbdccd64410a36dcaabb0bdb793e6123dc61bb32ac316644df394ba4c8ab147a027c38e8f819593b689189852c1436520866afa90d1f9b6b18398060610427c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Changed

Filesize
35KB

MD5
d9f09a4c8c1043afcfc246936564ee01

SHA1
169d6920213f5b8f3cd1cb576170e9ff6344fad0

SHA256
e672668d0fa0efc8952e4ff1f9437a5281827f0c16fe6e02a6792ba0e40b5b3e

SHA512
ef054d017fb61b32bb3fba7293173694c449cbf29d87830419fa1af27f6ec2da3dba6e72e8c7d88bb784bd8297606a05bfc039ca490a47978ec99731ee98c71a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Chronicles

Filesize
14KB

MD5
cccfe820790a18ad637c8c48190a07ab

SHA1
2860eeb3aad76c4de98251c643b097452f2adbe4

SHA256
e76044935d27539fe765cf0f38d62699736b8bfc9e1f9abb4dc9db3a325308a7

SHA512
e518668dea9e6d40bf51781792a85322b0119f67eb905f1064b8b08569413460598e1cf6a31e95eddf7500e315f082b37f55e91455dd91257a08daa5c6de3200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Communications

Filesize
59KB

MD5
a78d9f9007458dad6a6288b823c02308

SHA1
6301c74ed457ea40b1f51cbd936213413db64c73

SHA256
d2410da2189f66692da2d44eb27900089b99f6433d5dbad7487a2dcaeeae5b2a

SHA512
886dd057ee869a6cdd75f7a57e3ac97ea9366d5aeae03ca7407d035d02b8eac8795122ee5a4827f8a566bdca29ad37e84e48fa1b4e14e16d8bb465cba0c9c6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Debug

Filesize
57KB

MD5
3878f94befdeddeed4508cc91d30b775

SHA1
25dd781cba90168310653663767f51b82eae189a

SHA256
139c7c899303807f4c674d4ed2acab9043e470f3aec1598bc62f77348a3bafe5

SHA512
f12390ee74eb18557b2dfb4ea92f0875df945bd454c7b8304c5523df92ef53bb39fbb127044db29d5015e3ff5d2dedb4a2a69fe05a34be2b7200c969869d9904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Diet

Filesize
68KB

MD5
8f80a990e34a018bf985ae5ee6880892

SHA1
9ea1c5555d63159d73331044cd2466002bb4b0ae

SHA256
9c4e2822f78488e9ce0e471944802feb840ae2aac1dd70dd0b38e69d06bb9462

SHA512
2e85af9e4e3b499a8577fa51c302a2a3df10bcf03650c68e6be82f6108ed0e9f5523abcd86f9ce8fcf6fc5ef7e5e9df5588e5b2f4ac1472dc006f22176a2e32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Disclose

Filesize
10KB

MD5
11a09faaee7bc02ace390631b890021c

SHA1
fdd4a531a3be3eba5555ea9cfe9007dda09487a0

SHA256
ab4df3d0689cf6deb9baf90f7265d3465071a6e5b2d243a637d5ee49e997faa1

SHA512
4a72289d0147e065baa8f1d325c242bb8d7996c080a71e9053d3f1a7a7e2bcc9d5d2e04603f32d85ae34f8d903de762bab421917d78f87888cbec2b04185d773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ebay

Filesize
18KB

MD5
ca0e475fb526f9bd88952e61eea23458

SHA1
aba4f6086c5f9f956059229428ab5809da1c8251

SHA256
042b18a9ccd495da456a3bbda195a91fadb37488fa3f24abe3f2a3bcc8fc500f

SHA512
a375461c6c5326a584476cf1228e0d7ec28d5e45d1af8e12a208336c4cec33885f2b668a2351d53be134aab6089c4f90b067920cb2638cd21ff7e54e073b690d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Et

Filesize
54KB

MD5
af2e88cb701298b419c76ac6e2d29138

SHA1
bf164d6fc81cbdf1350dc4cd12326a207ce26987

SHA256
02bea5cbe6052966fab2a8777c7be1927f70c57c57e64c46163288345e31ca80

SHA512
06c9d449eaebadd21a30f6960b6f3fe989f4316dc6119acbb5366624575d9cc7cac16d6825a08b286fedeb4cdf134e469f91e23e895833bb254c7bca60d7724e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Hammer

Filesize
64KB

MD5
a594248941cb800e60aa32730e5afb2f

SHA1
b0f9230e670211942c750d3c68b148e2164947d1

SHA256
0df59af13668eca5be679c3e3a3da05185a59b2fd9778f2aecf3a3f353b9616d

SHA512
44923dcfbe8769895fa1be73bececefda9f78bfd40c18f0a44427225297f3edf28718becce133b0c883bd5f878bba82ccc0f658982eb187dd810ab2f43a53b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Inch.cmd

Filesize
5KB

MD5
c5ee4dcc9184a60b60f76481af4529b7

SHA1
7bbac90ca2bec5b295fed1c845dbec6ffddb727f

SHA256
7863ead1f7df1a80fc847a1751d02d99700714b9a4848401028bc7d36c4ba0d0

SHA512
c8cc6005194b041381a20ab0f02f7b35148fbf04c9b1b32d36dc4fa3aabfa5cc0f2db12163cb727ce48bb4db72fdf31a0e676045306cd72b9f6c625c1fad24d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Innovation

Filesize
204B

MD5
a159d27c920ba255b699838eaffccddd

SHA1
07e71d8b5084395931df7acd1771b2e9609e4ebd

SHA256
105b7b26ab1b62e5d3f32bfb07fbb8f91ad3e434a41ebc55c9d4d3befa82528d

SHA512
7bb0119fa06d4b6cc214015b2f87e05e9c1f1d139d7c85089c28a3ed36254d41dfb4ab8b19e471424f6d487159e497f5488bd8607d005402ed0820fbbdc0225d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Irs

Filesize
56KB

MD5
cdbf87ed2611759361edcf2d1c36cb8d

SHA1
fde07776b66674be84f7e112b080c4b20a6972cb

SHA256
4a2afbcbf160bf24e04c3b9aa72267ffe589a7126aedad36e8fd22126fb79ffd

SHA512
e1b1faec18c602f5d89c64488c148ba943dbfb014e4e2f030a00830d032c58ba95f79d135c39a4cf7346dd815f1996a8f863642f96f37ec9745dd46f42b6e32e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Issue

Filesize
68KB

MD5
c2a3acd5ffb5894a56f6d3546d5f9e57

SHA1
76c605744596cd2ece89fb6b7a6ab02379379eff

SHA256
f2bfdcb7a8fe95b531c796bd581258b9b61d1fbe815311f6dc2a633b0f80d8e9

SHA512
681ce12931591165b40bd46235bcb9d2fd2913aa9f3841d3d0b51c1276d951b85b30b50c0d92437191fc79522aba017c56849fa35826e71387401a716c6c01da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Locks

Filesize
144KB

MD5
1659a7eb3dba9d9143f98def92dbbb88

SHA1
3338d23d47256b6c4bd475bd953dcb7b6de13f87

SHA256
8271297087605f98d4351eff05198533a63924f7b666754b85894392aa9327dc

SHA512
c473fc5b74a1877e29f2e904955bd1bb270932cb40148c25c49d5dd7f6d1932a1e70692083176c00eea82adc73e3bac860847bce7bab5d1ce1ed259415fd795f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Marble

Filesize
176KB

MD5
955750a52c9c524e3b1df558e4e598e1

SHA1
6362a9a195fc6446cedb85ecc8df0ba82a9a40b9

SHA256
f233ec33624377ac70388bd8738bab20538b7f8cae46dd1e8bfaf3c87014580f

SHA512
1d7e2fa136a618deffa215fec63b24ca1918c0d2f467c28572a6907e1cedc2c9356536ee111f9d9e0f917d5e38f3322cfcbb0d590c94a526fd9a98e3057b188a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ml

Filesize
8KB

MD5
edbf126b0d7e08948d224a05c9f95c99

SHA1
3669fba40d2ae16eaad5b6f35c92316d478e6d62

SHA256
8ded4af5019a2a1bc87ac8b309ba3de6595ea545cc654430804bb67ae1c38ea3

SHA512
fa75adb54353b5ae83ca072a941fb40d6efc19444e28e425e71692e7801eb9070be8967634c22148f0691743edd878605eee08867797142df1ac9c8c7f8a16ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Prev

Filesize
50KB

MD5
b38311b401517c75f606fa819430d170

SHA1
d9ed5c00db2c4c81a86602e9e66066788d87ce9a

SHA256
f4668ab86a62ae276fb3e9f0940e4a0b0456ff308b552f6e162795dd0e36b704

SHA512
5152bf7bc3eee603784dce61ee9ddd5ef9903fc6219e3052b96f7f0652133e50473ee25da4c85672a67ec3d47ab9bfb4e295a9a4c2a6f60019dfc01c65c9f3c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Probe

Filesize
21KB

MD5
227f0c2bb7513cb9549bf64d7a9b78ea

SHA1
0a9b1a053fc2a69b263a47f4b91943f60ba33ab4

SHA256
09b0812cf3a6232db410a32a7f288d2a2af53116475bd84c00cee02413798ada

SHA512
4a9180ee4eea8519cec3d082183da51aec4a0a0f1b71c1c19266056c400682a9c6bbe24b03ccc897690dc41007bdd9ab7ff3366f049ac1ab647acba9c39a12eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ray

Filesize
8KB

MD5
15b3c47ee4220a1317285551dc46df3b

SHA1
ecccbd8d0bc7616f30548bcee6179da004f64553

SHA256
9be2db11436373cbd4dabb4664297a0814ffa18be3a9637de1b583adb863ba79

SHA512
9859bda25d9eed059d9ac27d091dffcb63a1ea7a37c2dc3b7a7c8006d65e64414367021c97b4c27f1de2dd021f125d7e6451dcd07a497a05c0e0150c6f56d4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reservations

Filesize
55KB

MD5
03bbac1012dc934a35d46a76a50e08ca

SHA1
a5e30a19cf6158349cae5731c35c35074dab14e9

SHA256
48eae157cbce36131cd2bdb12783c54830cfd41adf64b79bf667f71bab318b72

SHA512
c8b80dfd1a0f56634c9dad9cb09672eabcfe448f7270a783724623ae08c87f2948409865e3a53c8a464ea88f51777cb037421d9112b5c3954b242bf28aa25f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Roommate

Filesize
9KB

MD5
ad4997c14c040ff7fac72a295d80e7c2

SHA1
d4ac36b2f27ff097e90a2ebe8178ffdb238e022e

SHA256
3713b88f240265d95a532172bd41471c624126826a6176363e5256e1303bc234

SHA512
ef71df08a3b04942390976d721a175bc77365c6f725e82df102ef0d2b9a9a6f1ded8ed66f31e159f97dffe1a468413ba371883ff3e32def1f102bcd0112f71d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Smoke

Filesize
50KB

MD5
a6f632d877e85b03e384d505ea5eb42a

SHA1
2482da9e439923377d00bf481bafcb14a2fcac3b

SHA256
1b462e05740e262a67885186c277495de523d66ccfa216c2995f9209ad250b2d

SHA512
b29a73018c6029ce9cedd366d3307e351d03462d4f2dcaf9316b34e20d9d833b262f3a0cdb0741468f97599c171b25c016819be39ddbade4d3ef28ff340bcbf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Specify

Filesize
37KB

MD5
e8a0490f31dbef2d3167b57713023d79

SHA1
7856a4a2f9493d0d519700d30935f834c1c0f81a

SHA256
367162d6b910ab48099fcaeb0b15d5b2acdefe995607ffd0bdd3d2f5d5b0f2ad

SHA512
0f89df4ba61ed14b6ef1774cf8a96974b2220cc7c782451818d2395e111d6da7283c9fd2e95589a4d4f644c87ac8efa77ae9f41a17be547a8cf94bcf04e16c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Up

Filesize
60KB

MD5
44c2a2e9389c9670587e7738cc481612

SHA1
dacec904f8f08948270f85b6496d2d0d9a291766

SHA256
4e6c972ee2bed1fb9953db12ff17d4e2b9bb3dee64362d9d182aa492e566f08e

SHA512
dfd35d87a4fb63971f6b07e3f60f387809563486a5373dd7af20a8e5245f9ea0d429837ff2ce3e9015c00036a992c1dbf0447971f192bf6e60bb51dbf14a0d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Woods

Filesize
67KB

MD5
44814f258e71a515115ee6b5b8288d50

SHA1
a8457825e68aed5813384a763163dafdec3502d0

SHA256
29c65d8353f89236340327b3b406712f7bc167c3004c8c68ccd20cde1bc1bc35

SHA512
21afd05cdc279e459ade9343aa5e6b78bfd097bd6bc34963421c457d131fae4efb33117258d78c1fb2043df627cee9f4db60de4427c9599c8b2ced42470acebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpD82B.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\Setup.exe

Filesize
910KB

MD5
94e7e5e1cee055f9ac963b7650d5d8bd

SHA1
f18a89aa7fa97135b1214e31f2c79877d2a04284

SHA256
94fa692514c48c66ade5a1a90d07b4114272faf810801efa472b803c49231ad3

SHA512
13f1eeb4788bf868e126e840645f7096c613d748318958116eb3cbfc44dd5876b024b85f8dfa0283921181e1ca3424c721780607480fb7a621ac4650ff6b9e99

Download Submit
C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\bin\Debug\AxInterop.WMPLib.dll

Filesize
52KB

MD5
8314c1c68e3b3a1299dea6dd6d72481d

SHA1
5e76211c54647ad063966f0e9e48c6dbfbaaf97f

SHA256
78fa2eb63e55f1627d4f74e0f1c58d11a90611b7d756bdf3194f38776b2c3b78

SHA512
be8c454093b5047b7e0e7caf78dcd03e4d240b186d5f19eab69e00a9f6e7f9f638e45788880d87b50aa66028bf00f3334dc15b4a95ae860e39e7b8ac37f28f29

Download Submit
C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\bin\Debug\Interop.WMPLib.dll

Filesize
323KB

MD5
080765723df758e60fe61498ae0f2cba

SHA1
ff6bd0f8defe6ee844ddcde416176dc900b07293

SHA256
b06b558ace77acc8737ef0a9573c965b9c841f3569a694bfb468872b589d94d9

SHA512
51bde71b374e76e57b4406c3eb5a03e839673586bfb508f15383995b979d26cbc58923aa93be004ac1d57183e6a686870127cda1a939ae570c22ff74f045e3c6

Download Submit
C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\bin\Debug\MusicPlayerApp.exe

Filesize
12KB

MD5
07902ccf8de472410921d9c227b17f4c

SHA1
a2c1bc9031eec1930bb5864f81be8c67b609e660

SHA256
562a9b6db51783eb0c71b243c39c359d218b72ee6a6bb1508cc64465f8d4893a

SHA512
4631d0e1a79ea59f2a53bfac28e61d730618dd5ca00558cf41cb2793c8b3dbe325cf14b060ef106f78813dac6a21d6482cd234919eb87f60f10e77bd27e4a813

Download Submit
C:\Users\Admin\Downloads\Manual_installer_Win7-Win11_x86_x64-05182024-278753659075324982\bin\Debug\MusicPlayerApp.vshost.exe.config

Filesize
184B

MD5
28960c034283c54b6f70673f77fd07fa

SHA1
914b9e3f9557072ea35ec5725d046b825ef8b918

SHA256
8d65429e0b2a82c11d3edc4ea04ed200aedfea1d7ef8b984e88a8e97cff54770

SHA512
d30dd93457a306d737aac32c0944880517ed4c3e8f2d1650ffca6c1d98e892082b41b40fb89ccf75d5f03d2464b0b4f943cd4b082071f0abfe978d149bd61479

Download Submit
C:\Windows\Installer\MSIF4E0.tmp

Filesize
284KB

MD5
8d992a2126c1d93fe274057e6d4fb1d0

SHA1
bab132d4923c48b88b746f48114564cfae8184a5

SHA256
6c435a95b9ded21a2c27bfdfb096de2367a9e4f8e002a3dbb6aa6f52b6409276

SHA512
136babf8a8f2053e0c4d1d10c345b4b47dde10f15e230a4e914f3c72eb1144ccded421b2d47ad428a02c4273ac124a86e3e32222b0f1b24f69e22a221001869d

Download Submit
C:\Windows\Installer\MSIF58C.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
09fe91fd4bf22e48cf55db9d2027613a

SHA1
9da3500dcf8199782f1d6c9a7438332b5690b837

SHA256
c33b1156520933cff5917b63e460a44c6a2c4ad59bd8e2f712967eae74977bbd

SHA512
46df4a5cb6d2042e78e43b72c11b3395b9f91d0671e425de0c393bc3c85e740b0cf14d6165d14671946232633241a4b2609c9f081f58da6a198e146cb44adf6f

Download Submit
\??\Volume{4e376879-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7728b583-00ae-438d-9530-186db77a37c3}_OnDiskSnapshotProp

Filesize
6KB

MD5
3cc98ea3175cabe7913451538162f261

SHA1
dd74873654427a81286dd48e41a2b1138c63afb0

SHA256
1ad531e7e6ba1ac3e55eb83be6a4d14c923cd24f18fadbdecbb17373ea038b10

SHA512
8342e96fce84f9353670889026a05c83e474e53e964c475f7a0888e112b06051f28c285dd6f3b3b6c67c02321a75775ed66b9e8b38d73383567c249c31370895

Download Submit
\??\pipe\crashpad_3880_PSBAJHOMHVLENXNP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3840-419-0x0000000005F40000-0x00000000064E6000-memory.dmp

Filesize
5.6MB

Download
memory/3840-429-0x0000000005EE0000-0x0000000005F38000-memory.dmp

Filesize
352KB

Download
memory/3840-420-0x0000000005990000-0x0000000005A22000-memory.dmp

Filesize
584KB

Download
memory/3840-425-0x0000000005B70000-0x0000000005B84000-memory.dmp

Filesize
80KB

Download
memory/3840-418-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

Filesize
40KB

Download
memory/3840-421-0x0000000005B40000-0x0000000005B4A000-memory.dmp

Filesize
40KB

Download
memory/4976-488-0x0000000006660000-0x0000000006672000-memory.dmp

Filesize
72KB

Download
memory/4976-465-0x0000000000990000-0x00000000009E2000-memory.dmp

Filesize
328KB

Download
memory/4976-482-0x00000000057E0000-0x0000000005856000-memory.dmp

Filesize
472KB

Download
memory/4976-483-0x0000000006490000-0x00000000064AE000-memory.dmp

Filesize
120KB

Download
memory/4976-486-0x0000000006BD0000-0x00000000071E8000-memory.dmp

Filesize
6.1MB

Download
memory/4976-487-0x0000000006720000-0x000000000682A000-memory.dmp

Filesize
1.0MB

Download
memory/4976-5476-0x0000000008760000-0x0000000008C8C000-memory.dmp

Filesize
5.2MB

Download
memory/4976-5475-0x0000000007910000-0x0000000007AD2000-memory.dmp

Filesize
1.8MB

Download
memory/4976-489-0x00000000066C0000-0x00000000066FC000-memory.dmp

Filesize
240KB

Download
memory/4976-490-0x0000000006830000-0x000000000687C000-memory.dmp

Filesize
304KB

Download
memory/4976-550-0x00000000072F0000-0x0000000007340000-memory.dmp

Filesize
320KB

Download
memory/4976-547-0x0000000006970000-0x00000000069D6000-memory.dmp

Filesize
408KB

Download