hxxps://github[.]com/x64dbg/x64dbg

Analysis

max time kernel
2699s
max time network
2668s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/x64dbg/x64dbg

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Downloads MZ/PE file

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\iVCam.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\iVCamAud.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation	iVCam.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation	iVCam.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 27 IoCs

pid	Process
2948	iVCam_x64_v7.3.3.exe
4524	iVCam_x64_v7.3.3.tmp
2924	mDNSResponder.exe
2728	Process not Found
3024	devcon.exe
3084	devcon.exe
4196	iVCam.exe
788	adb.exe
3280	iVCam.exe
4100	iVCam.exe
1232	adb.exe
4124	iVCam.exe
4524	iVCam.exe
4652	iVCam.exe
1652	iVCam.exe
2268	iVCam.exe
5052	iVCam.exe
4724	iVCam.exe
4036	iVCam.exe
3268	iVCam.exe
3620	adb.exe
4580	iVCam.exe
1444	adb.exe
1968	Termoimpianti_Pro_Demo_Setup.tmp
3100	Termoimpianti.exe
752	Termoimpianti.exe
4528	Termoimpianti.exe

Loads dropped DLL 64 IoCs

pid	Process
680	MsiExec.exe
680	MsiExec.exe
680	MsiExec.exe
2796	MsiExec.exe
2796	MsiExec.exe
1624	MsiExec.exe
4112	MsiExec.exe
2128	MsiExec.exe
4500	Process not Found
3856	x64dbg.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
788	adb.exe
788	adb.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
3856	x64dbg.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
1232	adb.exe
1232	adb.exe
4100	iVCam.exe
4100	iVCam.exe
4124	iVCam.exe
4124	iVCam.exe
4124	iVCam.exe
4124	iVCam.exe
4124	iVCam.exe
4124	iVCam.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iVCam = "C:\\Program Files\\e2eSoft\\iVCam\\iVCam.exe /silent"	iVCam_x64_v7.3.3.tmp

Blocklisted process makes network request 1 IoCs

flow	pid	Process
161	2044	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
19	camo.githubusercontent.com
22	camo.githubusercontent.com
24	camo.githubusercontent.com
619	raw.githubusercontent.com
16	camo.githubusercontent.com
17	camo.githubusercontent.com
20	camo.githubusercontent.com
21	camo.githubusercontent.com
27	raw.githubusercontent.com
616	camo.githubusercontent.com

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64\iVCamAud.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\amd64\iVCamAud.sys	DrvInst.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64\SETCB81.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\ivcamaud.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64\SETDD34.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\amd64\iVCam.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD23.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\iVCamAudx64.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB61.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64\SETCB81.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64\iVCam.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\amd64\iVCam.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.PNF	devcon.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD33.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64\SETDD34.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB60.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB60.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB61.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\iVCamx64.cat	DrvInst.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD33.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\iVCamAudx64.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\ivcam.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\amd64\iVCamAud.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\ivcamaud.PNF	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\iVCamx64.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.PNF	DrvInst.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD23.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\ivcamaud.inf	DrvInst.exe

Suspicious use of SetThreadContext 26 IoCs

description	pid	Process	procid_target
PID 3856 set thread context of 4196	3856	x64dbg.exe	150
PID 3856 set thread context of 4196	3856	x64dbg.exe	150
PID 3856 set thread context of 4196	3856	x64dbg.exe	150
PID 3856 set thread context of 3280	3856	x64dbg.exe	153
PID 2324 set thread context of 4524	2324	x64dbg.exe	162
PID 2324 set thread context of 4652	2324	x64dbg.exe	163
PID 2324 set thread context of 1652	2324	x64dbg.exe	164
PID 2324 set thread context of 2268	2324	x64dbg.exe	165
PID 2324 set thread context of 5052	2324	x64dbg.exe	166
PID 2472 set thread context of 4724	2472	x64dbg.exe	168
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2472 set thread context of 4036	2472	x64dbg.exe	169
PID 2396 set thread context of 4528	2396	x32dbg.exe	226

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-V01UD.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-44191.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-EILO2.tmp	iVCam_x64_v7.3.3.tmp
File opened for modification	C:\Program Files\e2eSoft\iVCam\libiomp5md.dll	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\is-BQR3E.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-1VTER.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-8H6KH.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\fr.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\e2eSoft\iVCam\driver\amd64\is-3PACM.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-C51UH.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-8A1D9.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-NSNP3.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-TVDNS.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_CN.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar	msiexec.exe
File created	C:\Program Files\e2eSoft\iVCam\is-SN598.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-HINJH.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-VR1D3.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-MNRJP.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-9K1T8.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-U9B2V.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_TW.lproj\About Bonjour.rtf	msiexec.exe
File opened for modification	C:\Program Files\e2eSoft\iVCam\avcodec.dll	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\unins000.dat	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\driver_mic\is-7CSTR.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\is-F1GK6.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\es.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\e2eSoft\iVCam\driver\is-A95O2.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-0R6TU.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-ICOJD.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-KL1A8.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ko.lproj\About Bonjour.rtf	msiexec.exe
File opened for modification	C:\Program Files\e2eSoft\iVCam\adb\AdbWinUsbApi.dll	iVCam_x64_v7.3.3.tmp
File opened for modification	C:\Program Files\e2eSoft\iVCam\onnxruntime.dll	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-TMH06.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-D6UF4.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\en_GB.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\nl.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt_PT.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\e2eSoft\iVCam\is-6AGU9.tmp	iVCam_x64_v7.3.3.tmp
File opened for modification	C:\Program Files\e2eSoft\iVCam\avformat.dll	iVCam_x64_v7.3.3.tmp
File opened for modification	C:\Program Files\e2eSoft\iVCam\avutil.dll	iVCam_x64_v7.3.3.tmp
File opened for modification	C:\Program Files\e2eSoft\iVCam\vcomp140.dll	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\driver_mic\is-AQ68J.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-DQMQ5.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-0MK1O.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\is-2FNI9.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\is-B261A.tmp	iVCam_x64_v7.3.3.tmp
File opened for modification	C:\Program Files\e2eSoft\iVCam\vcruntime140_1.dll	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\is-B8GTQ.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-CMMS6.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-HOIG3.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-T06HC.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-DU2VT.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\luts\is-R8ONQ.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\mDNSResponder.exe	msiexec.exe
File opened for modification	C:\Program Files\e2eSoft\iVCam\vcruntime140.dll	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\driver\is-12A1P.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-HHTBJ.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-JT8IJ.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\resource\filters\is-3S5H6.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files\e2eSoft\iVCam\is-504HK.tmp	iVCam_x64_v7.3.3.tmp
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\it.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\e2eSoft\iVCam\driver\is-F6OE5.tmp	iVCam_x64_v7.3.3.tmp

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a8f9f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI980B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3B8.tmp	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\ks.PNF	DrvInst.exe
File created	C:\Windows\Installer\e5a8f9f.msi	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD8D.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	DrvInst.exe
File created	C:\Windows\INF\c_media.PNF	devcon.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\Installer\e5a8fa4.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	DrvInst.exe
File created	C:\Windows\INF\KSCAPTUR.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File created	C:\Windows\Installer\SourceHash{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EE5.tmp	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A00.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133647746108258943"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\ProgID\ = "Bonjour.DNSSDEventManager.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\ = "Analog Crossbar Property Page"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService\ = "DNSSDService Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\ = "TXTRecord Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\ProductIcon = "C:\\Windows\\Installer\\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\\Bonjour.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ = "_IDNSSDEvents"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A802-A46D-11d0-A18C-00A02401DCD4}\CLSID = "{A799A802-A46D-11d0-A18C-00A02401DCD4}"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager.1\ = "DNSSDEventManager Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ = "DNSSDRecord Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\CLSID\ = "{5E93C5A9-7516-4259-A67B-41A656F6E01C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B}\FriendlyName = "WDM Streaming Encoder Devices"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager\CurVer\ = "Bonjour.DNSSDEventManager.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord\CLSID\ = "{AFEE063C-05BA-4248-A26E-168477F49734}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.TXTRecord.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\ = "WDM TV Tuner"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\ = "DNSSDRecord Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\Bonjour.DLL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDEventManager.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8BFDDD6597F70844985D521E5FA22BF8\mDNSResponder = "Bonjour"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable	msiexec.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3848	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 6 IoCs

pid	Process
3856	x64dbg.exe
2324	x64dbg.exe
2472	x64dbg.exe
1888	x64dbg.exe
2396	x32dbg.exe
4028	die.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
2508	chrome.exe
2508	chrome.exe
4524	iVCam_x64_v7.3.3.tmp
4524	iVCam_x64_v7.3.3.tmp
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe
3856	x64dbg.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
3856	x64dbg.exe
2324	x64dbg.exe
2472	x64dbg.exe
4100	iVCam.exe
1888	x64dbg.exe
2396	x32dbg.exe
4028	die.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe
Token: SeShutdownPrivilege	3600	chrome.exe
Token: SeCreatePagefilePrivilege	3600	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
3600	chrome.exe
4196	iVCam.exe
4196	iVCam.exe
4196	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
3280	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
4100	iVCam.exe
3268	iVCam.exe
3268	iVCam.exe
3268	iVCam.exe
4100	iVCam.exe
3268	iVCam.exe
4580	iVCam.exe
4580	iVCam.exe
4580	iVCam.exe
3268	iVCam.exe
4580	iVCam.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3856	x64dbg.exe
3856	x64dbg.exe
2324	x64dbg.exe
2324	x64dbg.exe
2472	x64dbg.exe
2472	x64dbg.exe
1888	x64dbg.exe
1888	x64dbg.exe
2396	x32dbg.exe
2396	x32dbg.exe
4028	die.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2424	3600	chrome.exe	82
PID 3600 wrote to memory of 2424	3600	chrome.exe	82
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 4092	3600	chrome.exe	85
PID 3600 wrote to memory of 2864	3600	chrome.exe	86
PID 3600 wrote to memory of 2864	3600	chrome.exe	86
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87
PID 3600 wrote to memory of 4924	3600	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/x64dbg/x64dbg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85ef1ab58,0x7ff85ef1ab68,0x7ff85ef1ab78
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1584 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4396 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5244 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4548 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5024 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5564 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4232 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3000 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3064 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5860 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5088 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4360 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1756 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:4888
- C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe
  "C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe"
  2⤵
  - Executes dropped EXE
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\is-MDPII.tmp\iVCam_x64_v7.3.3.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-MDPII.tmp\iVCam_x64_v7.3.3.tmp" /SL5="$50168,46076563,321024,C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4524
  - - C:\Windows\system32\msiexec.exe
      "msiexec.exe" /i "C:\Program Files\e2eSoft\iVCam\Bonjour.msi" /qn /quiet
      4⤵
      PID:2988
  - - C:\Program Files\e2eSoft\iVCam\devcon.exe
      "C:\Program Files\e2eSoft\iVCam\devcon.exe" install driver\iVCam.inf iVCamDevice
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:3024
  - - C:\Program Files\e2eSoft\iVCam\devcon.exe
      "C:\Program Files\e2eSoft\iVCam\devcon.exe" install driver_mic\iVCamAud.inf {SW}\{87CBEC3E-E0E3-44E1-A852-FFCD02450D2B}
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:8
  2⤵
  PID:4516

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1756

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2044
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 270DC7039DB33C9CE51C8F77100BC1F6
  2⤵
  - Loads dropped DLL
  PID:680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 67421B72A06121A960C0BBF47B84B13A
  2⤵
  - Loads dropped DLL
  PID:2796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 093E25D522D8056ED27DE77CCEBD7B99 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1624
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:4112
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:2128

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1412
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{590d49f2-4634-f74c-b299-d09a0649d32c}\ivcam.inf" "9" "44ef8cb23" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\program files\e2esoft\ivcam\driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1568
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\IMAGE\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce884ba3b39ed:iVCam.NTamd64:3.1.0.185:ivcamdevice," "44ef8cb23" "000000000000014C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4644
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4be9ab0c-bc95-9b48-bddc-5e3de230dcd0}\ivcamaud.inf" "9" "45df85a97" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files\e2esoft\ivcam\driver_mic"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3584
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca112759a6d3:E2ESOFT_VAUDIODRV.NTAMD64:1.2.0.158:{sw}\{87cbec3e-e0e3-44e1-a852-ffcd02450d2b}," "45df85a97" "0000000000000174"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1108

C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe
"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" C:\Users\Public\Desktop\iVCam.lnk
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3856
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SendNotifyMessage
  PID:4196
- - C:\Program Files\e2eSoft\iVCam\adb\adb.exe
    "C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:788
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SendNotifyMessage
  PID:3280

C:\Program Files\e2eSoft\iVCam\iVCam.exe
"C:\Program Files\e2eSoft\iVCam\iVCam.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:4100
- C:\Program Files\e2eSoft\iVCam\adb\adb.exe
  "C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1232
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe" /restart
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:3268
- - C:\Program Files\e2eSoft\iVCam\adb\adb.exe
    "C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server
    3⤵
    - Executes dropped EXE
    PID:3620
- - C:\Program Files\e2eSoft\iVCam\iVCam.exe
    "C:\Program Files\e2eSoft\iVCam\iVCam.exe" /restart
    3⤵
    - Executes dropped EXE
    - Suspicious use of SendNotifyMessage
    PID:4580
  - - C:\Program Files\e2eSoft\iVCam\adb\adb.exe
      "C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server
      4⤵
      Executes dropped EXE
      PID:1444

C:\Program Files\e2eSoft\iVCam\iVCam.exe
"C:\Program Files\e2eSoft\iVCam\iVCam.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4124

C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe
"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" C:\Users\Admin\Desktop\iVCam.lnk
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2324
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:5052

C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe
"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" C:\Users\Admin\Desktop\iVCam.lnk
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2472
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Program Files\e2eSoft\iVCam\iVCam.exe
  "C:\Program Files\e2eSoft\iVCam\iVCam.exe"
  2⤵
  - Executes dropped EXE
  PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff85ef1ab58,0x7ff85ef1ab68,0x7ff85ef1ab78
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4400 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4792 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3236 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2736 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4768 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3992 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4964 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=244 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1268 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4272 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5588 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5560 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5492 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:8
  2⤵
  PID:2756

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4492

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_termoimpianti_pro.zip\termoimpianti_pro\Informazioni.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3848

C:\Users\Admin\Desktop\Termoimpianti_Pro_Demo_Setup.exe
"C:\Users\Admin\Desktop\Termoimpianti_Pro_Demo_Setup.exe"
1⤵
PID:2448
- C:\Users\Admin\AppData\Local\Temp\is-C99EC.tmp\Termoimpianti_Pro_Demo_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-C99EC.tmp\Termoimpianti_Pro_Demo_Setup.tmp" /SL5="$5026C,9162121,53248,C:\Users\Admin\Desktop\Termoimpianti_Pro_Demo_Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe
    "C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"
    3⤵
    - Executes dropped EXE
    PID:3100

C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe
"C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"
1⤵
- Executes dropped EXE
PID:752

C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe
"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" "C:\Users\Public\Desktop\Termoimpianti Pro 4.0 Demo.lnk"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1888

C:\Users\Admin\Desktop\New folder\release\x32\x32dbg.exe
"C:\Users\Admin\Desktop\New folder\release\x32\x32dbg.exe" "C:\Users\Public\Desktop\Termoimpianti Pro 4.0 Demo.lnk"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2396
- C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe
  "C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"
  2⤵
  - Executes dropped EXE
  PID:4528

C:\Users\Admin\Desktop\New folder (2)\die.exe
"C:\Users\Admin\Desktop\New folder (2)\die.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5a8fa2.rbs

Filesize
126KB

MD5
9e73d259bfbf16ac47aba0c6d41337dc

SHA1
2417a0401b0e8a2d4dd12e9f7589bfc8578691ec

SHA256
cfa993d2f4b6c3b8598cf48c58d4b3700d1e467c15612d769051210acd89b9f1

SHA512
74d3b8b960480f8f3e138e9ca5b32548516dba4b878281f26b1d4ecbd075d2d9872f0cc4cabfecc75b202b106f809c26c69c7140445906e56bf746f886c97485

Download Submit
C:\Program Files (x86)\Bonjour\mDNSResponder.exe

Filesize
381KB

MD5
5ea9c80f18cbc393ea7d9a2991ded4b5

SHA1
b8917c5ae45d1ba5ca534058f1386fac92f5da63

SHA256
7e5eb1ce44febe93686174058d51581fa00bdff0ebb84bd74bc08f6386019253

SHA512
7fd949b792a40630ca385dd2bc88db9673f9106975b9f55481e2382f67986dd75b03cdf0fbf59846b513a8def0c506ac6561f6ba658775286f11d761b575513a

Download Submit
C:\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
119KB

MD5
f6d02735de16705c1ebe6429592cd355

SHA1
c6ee693de2c01cad34012471b70d87869969a0cb

SHA256
356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

SHA512
1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

Download Submit
C:\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
b5c2f92ee1106dfe7bb1cce4d35b6037

SHA1
31070ef84c5355b082873ffc19ff60659637995f

SHA256
e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50

SHA512
7f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7

Download Submit
C:\Program Files\Bonjour\mdnsNSP.dll

Filesize
130KB

MD5
eaaa2b83c4764fdcfbee4a4d6546de92

SHA1
961a7e7735ee8f07ca54fa7cbfb23399748f8174

SHA256
043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

SHA512
bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

Download Submit
C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar

Filesize
17KB

MD5
ce9a2f5a7fcfff341d6d901ad919a2ab

SHA1
341f9d9a0b3fd8cfbefe0169b148dcc55688ee93

SHA256
cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7

SHA512
1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f

Download Submit
C:\Program Files\e2eSoft\iVCam\Bonjour.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Program Files\e2eSoft\iVCam\devcon.exe

Filesize
80KB

MD5
f40af690c8c4ef25e7774889c574743d

SHA1
a559f9be11692178897e29bb5b077a7fa21dc74b

SHA256
e830b1266010bb56807c5330e4b720ed82a7a78f557a69eaa4594439b7912fdd

SHA512
5ef5e1c0528c4558c932857088c60b3fe512d856edfb39d7a935065c8b4d0c57728fbf804adc3c1e4438ee6646f428a06f578d8cebf422341fb9b1397c90a0d8

Download Submit
C:\Program Files\e2eSoft\iVCam\driver\iVCam.inf

Filesize
7KB

MD5
047290efd60f712d012883bde88e2721

SHA1
681d7dd7ff45904c98ffd856bcd9c5093c3b8d50

SHA256
23b3dd1cc59cee29c7f6eb89cf1824956113f247c3c90987fa19264d673e335e

SHA512
cf5c39ce2bac0185213087ea9b75bef21ee4646d477a74ec9134157c30d37ddb47d219304176e541f93455949559169c3adafb98fbc3f2db29d02818d0e2113f

Download Submit
C:\Program Files\e2eSoft\iVCam\iVCam.exe

Filesize
3.2MB

MD5
dde13355f57399a93a04ceb01f488450

SHA1
de5577a9a969d55db1372cba278e22e22bd37315

SHA256
d968dbe3bdeb0e8cdea39c5bd2deaab31add32ef9060b6b1f85b6e33a44e37dd

SHA512
fee68a6c9c0cf61596142c8669708a84306af2a51ac37413087e2b21467e6dcb8d33f9dfc86eea1dcba4c10b94f14c570a8665ba92603e8debcbdedbc7a96b8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
2e622239aaff6d778c494fea97908109

SHA1
aec335887bd43376554850d99955f5f5ae82a8e6

SHA256
e3ba21a0ca61fcca7a8d22d7002f79a4d7a5435f017349601826e99a144ccdd5

SHA512
4aa5c77f40a0f507f61163f63af8d1ed5d21c220c5666488a4cf4d2ca9d5cf965dddc2687eba4c61a732e07b269aebf4c5477c262b2bccdce1b15954d5a5ec80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
19KB

MD5
f6c5f91182d258e81425b5814913051b

SHA1
b82c9fa9215cc431995b0d5a6a74f44945a8c008

SHA256
6978a3d3b264438b44353c188da1097721f8ae6bd6c42756f130de64b1034731

SHA512
2cca8e44477ab360a5bd7ca0af4e12e54714577e9edab90f7e0fbf079e81e15229f7e08419dc7f839a2cb00129211cc837df2c5da97a346e7c8db9fa174f8da7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000053

Filesize
33KB

MD5
bd2a7d3944f0756e7bf4f71d45e91137

SHA1
a09cef4cd8fd1fac5ac5a20c29f744436f25e227

SHA256
a753d3d4d9acc09e00ea4c120515e5894b29ef0c6e36404b4bfa3a53bc41033f

SHA512
e4901b565ccfdb6a3d60bfa5c3de7f9e456f36e3f707cf594a185ecc65f9bb54ee0ae74d77a21504741af71b8614b08a15d23e0b0d683c67512e96d9293c32f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054

Filesize
59KB

MD5
6605246a239ba92340fd9bffcbbbe56c

SHA1
4f800e926a3e78cc405f8ce2e2ea2541f61c5d19

SHA256
f4126432a558c17d96906cf98fb9dcd53a783cdc120ba33c3f346878794f3566

SHA512
c7a9f0671d87025f8be35594f021de1b739d9bbdb3b1ec3f9aab330bdad78c1c9bf77c14fe63b45835f396005abe2be200fc89cb50a4e36763a0805cceb1ee2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055

Filesize
27KB

MD5
9c74c1c6a1a51ff845f9abab8abe7e0d

SHA1
657dcb20b01ffe4425503006d42610b3863a8507

SHA256
6cc7741d4c19ff5bb130eb7af69ce8bf0b797d82f0832c770c23f43a55faa97d

SHA512
4c6ff59b681bc6a707ef87b2af14116983c0c4156560e9127af7eda7a43cc7042c351955499e245cbbf37eac78bc08943ce8ee81ac600fae2b91c0f265620682

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b

Filesize
64KB

MD5
717e44bb4a259b9ee4a600bd4f2f2372

SHA1
f08b1dd3e44d5057d6cb942febd1382969f9d605

SHA256
45714612acf08d73a7b594609387b1547add832ed6289a56dd355d3d41199525

SHA512
4a9a93d7d66dc91868ac0d330a645a6a08d35995642888e553ea3390aeb4b783ee9d81eb2b7a61943ad1f44eeabf1920ad33a407a8f4b37e29e6fac9ae03de8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c

Filesize
121KB

MD5
4d160f5c1032115a43b6687dece5bf12

SHA1
4f1b00870968aec41d24ddea501f4125dbfbc37f

SHA256
8c238cde58cc54693edd7d4dabb4a4cb5b761b44fb84de1187095698d26aec28

SHA512
4da361a77e73c68629cf1f3fc097c7ece1166b588eeaac2953e18ae17aa04b0de6901dc9b32966015cf2f27eba36dbb487d51e7d676eb474fb338818ffc63af0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
191KB

MD5
fddf30eed0ee94f6d6e24949c6328ec0

SHA1
8642f26785eab0e7923e7ac57723b45aaeeb2556

SHA256
86a1c62fe399115e7fba10f7bbe80a501ec16046ae526717a2ac80da36ae1003

SHA512
69b9d5e92229257cb97ad42761b4adb65c40440524408cf16c330537ceb956be0bb787e85007de6ba69bd22d0f5c68c39c275166233d85526f54eab843f6cdbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
8d36a3238cb508d5475f2ec0c16c1ee1

SHA1
2b25d8c202b457aeded8bba3c88558483c17b018

SHA256
446c66b8226827ae2be2a479cc970771ede7951060c01634f5ee25fd068dc707

SHA512
e62318d44ff7ab7c91e1a69aa191ccf311addde669c8bcd6cb62ae0d97ce8ff5af033e9ce113c2269e6a881cb5eecd14802a2a07f9fdfe663934e3fa8ea119b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b17322593b8a5507c335aacb8d350859

SHA1
03e6e1d05242735c142e27ada54e1c3e78142a72

SHA256
3180b8ba53204b9bef728b9962a205995afacf12e12ebbe588367e0a97aa244f

SHA512
0292faf8f270a5321426287f60b81f26f5db360fecb345df3a75d1cdf7d853c23e5b9be7073dc634bc58c22aec264ebc28b8ffabd2f5cd890aa7910ca24154c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
31020b381d6f6c86af46ec8dbf84df11

SHA1
8748211ba4becd2f955a14d7ec142e79f10264d5

SHA256
f4dfa450be12bb620ddd7c03ceb45f34e18132ccaac814dcc2ea7395bc53d3dd

SHA512
13eb97243f05323009ae4bb75459e9eb3ffede27e2da9d394ee007d143579ae8cc6e80cc69f9c2919f20b6081d9cd2717f8005140df646fa74f1da0f9c0aabe4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
e05f6172c3b9a7b184e90a4971e5bf3d

SHA1
01bf7e7876c2bc32df7601fcb0e5ddda0af9544a

SHA256
efe15a608be644b71e66f51962c9e2e4f691414d9fc80e0d0a1b14305a4e5db9

SHA512
c9aac191df2f658cfb280609334b1e388b7d95d0f609b7800315f0a7e12da3090baf342981e7c6aa7114ebce9e5710b2c8254598a6bb33ca3966a36a92988ee9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
b3c8d14c3b947531815ef195531f8ef9

SHA1
93c0101406c8fdba61cdf85d1723a12d17b29506

SHA256
c8157454e1ffa742a6ccee12c8a4df338e9cfdf51b38e45eefdf5989b53bf618

SHA512
9b44ab41ea1fb0217125fb2a5c0c39221a8f7e2302ef84ce0ec24d5c85df8c2b5e7f8fe4741f28c5a5e2e92ac57bd27cb156a6d92ce7320c6f85a41976064480

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
706896abf9bff42691957b07e054c706

SHA1
81359d3a7bb8e3009266dc579fac5bd99c2a9ab6

SHA256
e1122724329205d1d10c6d42466652a26c031a9af419fb6a57e1c4d97f210b4c

SHA512
2457cc6b5634e0712e262ea3f704ffa1322e0a2fdae4c48e0f673b1e91b79ac2bca27d7911af586f0a445bf1d9f6ae48daf26587da63a2507bdf1a0e99e1f55d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
69087e3a8d7d94ce6df483c3864c1ce8

SHA1
fad09a2a56336753c3c89e7b3fa9e8431a3b6d4c

SHA256
70f35033f66ff7573c5359acb1601c8169988fc022e03de6bce49304f05b2582

SHA512
b074de71e8f62aabc0feabd06229ab7178d5ef4ef80b2fff6284121ec6b283e7763be25f601e2b9ad532defbd491044bc1bca356690034dfb0abbabe382dc443

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
611bed384b41f6f675cb01fd356c9895

SHA1
4843f10aa163114f070d06793299784e373ec208

SHA256
2f978d13abde15df19cfc76d780bfd7092cf21c7b28c114132cb91f12066fabd

SHA512
b6b97aef02a1ee789a8976aa57b7dc3151665f00b0b14c157150a485d21bb2af3963e53d762cdc73221851cc40d0e66db93248f9f31691bf68b057fbbe0098a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
115df14070943aea9865083354ee355f

SHA1
b0d7df43bb5aff4377275e94f95bba1f19920191

SHA256
14a5eecc87b93f4b513e16c128d4d5dc53959448d0c3223942ac577f5a957bc5

SHA512
2e7b492209ba99a33bef6912a5c69d87a327b20540db526f554c197976d294dcc06160e3f9d5c4e02bce47d9934fa9a30845fcf67a0a2afa181e52db4af8ff2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3435689f67c43b011e09c89ee2b81da0

SHA1
1a3e9fe2b898f5279b18b29c7fe1ea0e795e394c

SHA256
86588da8b9abba45ece681eaa54c5762d8fbd7fb2204f3aa7a7790e7ae634ddb

SHA512
89cd578a863c329668d57def883f49590c24ab94bf0a909c57a4836c4938a8c10938e9ba2a53daa93599861a8b50259f97fbf0004c24e47faaddc2533b38dced

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
9c2bf9ab029bf447dc992d7ae7ac66cd

SHA1
f5afcc7d75744bd8b0d6e0e0b74b3fb4da569d97

SHA256
b3bcd8f91d8c2de8fbee0e480895060b6f89c7494246fd80c112be4d6ac3880c

SHA512
088650ae7e322e0b7acaf6c5e5eb50c6a91f5e8129dbae81994dc157079aff221fb6b9c10e5a2d619a825c0e1e2e3738c0ec3418e297d5b25811f09a1dcc7013

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
870a204c9cd54b3d8066325120970258

SHA1
e409943e08768e2c728db257066d7e8af5e38c9d

SHA256
bc24c1c42bb0c184615af084574a7ecaa4fad6f1d6e670528f1c28150565e714

SHA512
21beae8abb78539c99d6ffe420878eeb60c0c98a3eb18ed0edc2663449cf00053f4b22c71cf1c182057a4acbb9981cc5c673f39fcdfd61810f7e82acc5d9f492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
808a1ae0e541bbc59c5ec64888313591

SHA1
87f3cf8d1014f212c324c0141948783227349567

SHA256
de6670ab1326d6001490918ad0c4d68c59994a9a7c60561e33634fbd9131933c

SHA512
32800e392abeb68c4e1b00899ad9c631b9050745acffd9906903a0bc2865ee108c7440ba85b7566d7b7677cd800c649f573aeef75b23cd353a63122d4a95d042

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f5ea32935a9540efdbc1d8b7739ea29c

SHA1
21526ea720c7b0205fe0cf20ea98a918780e4a70

SHA256
ff289de496a0a1302de25ed960869c2deeb14042d0200669189467294a1a669a

SHA512
e48ff1d4974a775a586c53d68a2bb614b6cbf71cad26599483ebe5bb15fa81a1b14eba07103c113b3b676718d582ff2402ff2531f851e816204ca9b5f9a44b82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6e7a99324fa33aa39e467946f3803a85

SHA1
52ce0c1385dcb7a117b5e9be1873c3da070b1d94

SHA256
0f2e6e19bd7d0e579ca34552e54cfcf3e4d1fdcac6c6be53d501bd2448fb8789

SHA512
4600b2410a23a355aacb18eb1bbde2c0c481adf86afa1d92e23c1de90a7f8d17d7ace09a18e9bcff9fd7196346949fa90e79a2b07f7494e9bd99bcc2b5cd38a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
094afc7c8eca522ae630f6d4e38195c9

SHA1
37cd0e0c45955469125484774f97309d403fce08

SHA256
d76dfec9fda655a55bc99e04b1a6392799444f2fc7ee36cd4c72b7020a517329

SHA512
87583bcbd1b0c0af433143ffe4ccf9688a40d239612fc8c41e3ad4fb9c510c1c40d087ebdf8d8c79dbabab179f6a878672873beae9fc5aea3eff265dc79d4ee0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3d5d5b4366dbf7f8ce0b4ecc5f987d1e

SHA1
30e6a46979cc9690a1a7f26867b8c14d493fc519

SHA256
a9006816d4a1f3904f486f46637e20c2588434509e936aa931062b36ce3dd317

SHA512
310cfc7b5cd1f73757e4510e9c4bc44ff3727b6daf595d7e21b4d266a4be5000afa8620807a8dc47812fb23b40e4a2dad4105d9d230a421c8544f5382a0b0b4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
562eb1d005d980fdde0709c22a524eaa

SHA1
d706647df1d97135a2869c813095adfeadb6ee68

SHA256
80a0f8e85c297430f474963336ce038b279fcda1f5641715e0fde6b4560223f5

SHA512
bd087687842899060879a0c3e3563370bd4adc8b4e5b68d1a9fb43dfa7149d67293d06d5bdaef74761131fe70f27773c474c0212b3dc93b77a5f3abe181eb39b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
398d0722bac4a9cf888cf6cbe7c41036

SHA1
e5f9a213ff16aacb004a081850a2e7f9eea945bd

SHA256
ad8a7b77c78e2e8b91ac8c69b0982508ce3b6ea63931e7be2f4cc60108ea0047

SHA512
80a18f80912449aa57c5cb7f93cafad9f10fd0aab514b1901c19e1ef24a755e2511404d520721fa65e5bf80bb9916337a088fa91bf335011cf9ad218399526c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5521fbc0c3e1049428de97ab80c4d4c8

SHA1
cf23d1a69a5f5b0f69c95ec110d923a48979fbc7

SHA256
e5fac08bd5f49887166f5d2616cd00925591217105469cd14caaa2087d1e0576

SHA512
82db747924e1638c9d08b79f0c2fb0d845bc852fa68f94fa942a1cec71272b19b54af6643d2c92c301b3bb574c0aad6dc954aa401f4b14a18e737006bdeec0b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5061109050d28c5edc79a5ac508f8a5c

SHA1
1f97c02909167f064232a50bd637e334b31acae7

SHA256
34393c58cd2736a219628b6d87c9bb722b8c199111912044e5e76bd4adf6881c

SHA512
58674f1264bcd54cd09ffbd1d19561feb6ff350a2095da1eb4ea35708042434297e290db05b217dc524793c2aabff1b2cc61cf33f0ade4651a250f49be8bb891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
74be4e4d2b48ab0edebb66f366450d97

SHA1
3bf7c344b5d3760ddb792dbe1853ad40a95c8917

SHA256
09513e2421654bc71f2591964776f104f714ad14c9b6074a7148a14aaf7a8f15

SHA512
00cca64bfc0a7bb28956b7e2abc279b38d6681f37d84e274d108f3929d378965ca8f853e840b3755b8551f219d49c4253363ff25ff131acde35ab07dbb05e143

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
b16f45be659c3d9048df412568c76a33

SHA1
2518754a88932336993e67253d6c88c0e754d089

SHA256
42197863faf5869345f262f32006873dde131824fffdbc4c798dfb7ed6d6e414

SHA512
96b1f0765e39294ddda100c36d115a42cdabda0e7ceed4d2973f20c2175fa9d262a5b6ce1db4db801da1e13a939d7f5aed92887eac99243ee825c746c21ca4d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
8a76ad3949a8dea0dc0e1e7c9eabf05e

SHA1
789620b7f85feb5a9167d29652ab950e423956cb

SHA256
d4869355843a4002c6b603f10f1344534ca07dcf62a366614d6123cb963a158e

SHA512
85da07243f44a896d3ee00dfb862ebf3e07a1e8288bb074a46cfbd4f5c0dc82125dff190d12a05994deaf528bab0221f0b57ec228b2c175c264d77e5bd51b6c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fd308390aca661007dbc42e5893dbea8

SHA1
34a271efe703b2536f6c14501e09a14f5d2a7193

SHA256
682d09d5b46205d9165451339cb9528d321e1403761e1237b5da4e5d2f789b65

SHA512
aad6dbb257260c68586a6344ba8f5d24b1a5dbed7ceaf54cc1772cdadc4f2da0e979de14ae81e1554f8da471a14cee2c6d683f21f27b5d39f4983cc26e43b64c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
a65f991cabb8f9ac27f2953fd32b282f

SHA1
f3f5ef892310c83254b0bfa01c165e141da08774

SHA256
6273c8ef876ed28fdb8d076d1d76cdaa66b39a694872b43434c67cca683ca53d

SHA512
5567d9a222bb063d42d971870ec653fbfcded80c2e8e43b9600eb1f56d8b161f79fc4800cecfb598bee7b54fa3fa81d6bf3552c9d3c763ee1d8bc8839773ef54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
982aa37f7afb1ec1ca50aeff15b786b6

SHA1
89722967c5377b8dd91d68d50fa97674966a64f8

SHA256
8e566c70e123a226d0dae7416bff4f6514e427d30dc56cb169a34fd89e650c6e

SHA512
8a37c6b9fecbd0d8a9966540555946b7f9029137696c27d1f428295ded3e17c4b4fdabc7459dfefea00eb9564fc131d973e6ff49c6562e5a330ad29d8ace7e91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a0a9eb3bd3d354785c3429b027b59e06

SHA1
faa93f4a208c295d9981550d2f23e233c4f524e6

SHA256
46b86fac6c29389e894ec2befb0dd29279b42c36d0d142591313f2da8fd0fe5f

SHA512
f49bcc920b6dbffee1447b049909325cc8b010477728071d8de07c370cf2e8fbd25ac9e4db6e97b9cfd270ed75aa8293bd7c448947b0ecdd188bffbc731385a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
dc01928e9671e704f94f2a9740e9f9c1

SHA1
4ff3d6b96c5abd9912745d793ae75708f22dd777

SHA256
d1b6fbd3d6b7979810d0c1027d8e991fb1ba88f3913d6bf857e7397626f3155d

SHA512
663c0e3eab76d662d0d90b5b0969e7850422491a8e1c227a035d0edf80c21188293889fece6790871d15117e01dd17a098a118e80ffc3461ef16900536b62dc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c94acf9ca1da2f939062407275eab3ff

SHA1
d42f27594bf8862fce833f492078c05049c1dc22

SHA256
316f396222963552523140c81d9cafe47baba4d7ff37a80b8bc87fa87de50f5e

SHA512
7712ae14e533b9124bca731a719b4846e6829f9f89f2edebb968de3ef715e6454fcf1e03f7747f2519eef8f56e4353796ea6c5060ecb12c13ad83f67d858e9b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
ef00e817c4024fac7b60a8c3b2f9e080

SHA1
eec9417f651f003bef63cfc6718c7128a765cfef

SHA256
927fbe948c6cf44730313e58127b22ec2ce923988251fd3050aec08a76c61165

SHA512
6da1a80a81b9e5ea2d649bd444ed6c65aa2e9d931e0dbe6404fe718822744014088468e7bf170014179971a2a71ff03f3d7b278122aaf8597d5cea12cda925eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5f56f0399aeda78bc8410afd924d3fb8

SHA1
0366283840fb9d02af91baa65068955bd61b0d4a

SHA256
5c8dbca662dba409d332aee1566dbda477201c7a56c377692ae2078328fcdc98

SHA512
11aeb376b7dd05e6ba01eacae2eeb87fbe8066cdec50a5ced52938cb88fbe9314eef58786e4eb5e8efa6a1f84d0eafb3ae9775b0da4e53bd1db052ebca8ac74f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5361dfd87e1b981841f707ae321501a4

SHA1
7b0076d06e72d17535aee602ba29a610db9d8697

SHA256
f72546f710029f5b865efcf1dd6c806cba1e8c3c77b25e86f62ffb16263b63c7

SHA512
764b07f0d8fa9a21eef91474d194aad893482353fc4243117c6fd3417bfd14cbf6a4df443f63e49e68ce6f7636f035c795bca644c394a78f7d2ec017084b958c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5f10626432a7f90386ec96afe06f75c0

SHA1
3d6b5e78c3c16644c2fe68cbfb3c235c65b0391e

SHA256
801f46255b7fafe87387b6cf5211cdaa597923acc8b4072d0b468b568c463776

SHA512
63ff2bfcad0b42ebb90bdae3f74c77680ad99220ce9726a1b543e60dccb485adfd98dc4d80cf831f2f5b9e5736d5b4c18422042772187cf0b58a655e45b09829

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
34f3f9fcc38396608c0f1796ff1f44d9

SHA1
10bed2aeab49ef985f66fabe98a1d07be928b402

SHA256
0d6b818b7dbedc47167e3349ed7e17049e697caac2f02a75f4ef99fdd776d641

SHA512
46a3e6b5375785e9357b6775508c1ccdadcb74a984fa0fee4742b436983a6ae7c3a0fe9bcc494a56aa1f19218609200f356e1bd95332a201a2fcc006a66b3969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5d15ebbaddaf1fdd3ce3b24419158a85

SHA1
b1eb35047b74303fe1c561443a88e514b65ebe88

SHA256
7adf11a709699b6d77b67ed0590a6e9a044473a7fb735ea6ca2765886f825e15

SHA512
d03ad81e61459ccd3e8991969fccc21df82000ba8fb13ceac581c51878c84d2499dad3c347b6113c5e44f3eb486e01cadd343e854bbf02ae4e5ccad0314d91cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5ed864d288f7fce6a01dcb3437dc88da

SHA1
bad51d1d278d4883fc02239b46b93616567166c9

SHA256
6f116f87b39ba8288cf61e1f638acae5fa21bd195582f5dea26bc7336c819674

SHA512
4decad190c1e2520fae1d5f874120534415256a55f53aafee2455af9ceeffe18a969b46fe55e0d56d7cb9c47648ca49292f491edd7d4768a71024845b59f2fcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c7b5bda5918954b9e17c8c609640efa1

SHA1
cb587cc27d5a1644b9f9002c3085ed14314a49b3

SHA256
90a7f7b66027972f7a6d4ee01e045286608898ae0144c0b64eb51fbc81bf0373

SHA512
c91201fff871358e314d46f1551ae64ffdfd315192c52f32171e61a1801720f1d8c7c760c5696f27bc7c6fec78b1c68751a5c088870d3e4cf5ccfc22f81a71df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
53cd14189b3083123ddfb30294d8783f

SHA1
7ce953983c96a22b256e3a8dcc3847049def0eb6

SHA256
8cf137c934711fc9ff38aef5f0b49140c7e7ba90682c63b83e822d37b64c3b93

SHA512
02164ae977297dd440e919d63e6a0d6f66bdad7803b9182ef01a7799f272363c5e7c17734547dad24aa1bdb9c06607a9e0548dbe70f8c034f749e0a2d27f48a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
20b9ff1939595a6a50b037b764d80b01

SHA1
93b853edd0086eaffa26735c6e33091f4c650e4d

SHA256
5f3aaaa417a026d45cad971131795c241b4ede50556821d47300f033b1653e42

SHA512
53e7637111ffcad8e63bd2b84791efdcd184c6208ffb222a3d0f6e08631a0f5e8d6abb451ef280a73903db94cf634cfe6bd5a6a3ad427e5a8ef1be24d8b7d167

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9de1103a90eb47ae076c4632240bbec8

SHA1
e86ac47b4420fb198302f30459d1a31d1f4e3723

SHA256
296c8aceb32043f3e6ff225a3a6538f4422066efb803ef91642cc3eb89f97ac5

SHA512
afd2b4d5863b541be55ec28e55d8bb7a7e6288ad665b78254953a1469a67687c5b50e00dddc9930507e87851daf1c8da920c4ae2f5843bcb15222aa6d8b67c81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
08077c5488fe1d109324be103bc11283

SHA1
1f909452ba0bf9b218afa49e7090ebe6edd6c365

SHA256
a011afcea695307eeecfb838e4129bb996fb7cf046ad2a609626fc821056c3c7

SHA512
d1d40b3875d9aab72b55b81a0dc33642f0ea4756cb3da8f9bdba05a254b4405985744ed86f16b43a544b9e073cf9d72ba2fb9dc814a8b92d7117400247a9cb85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
ac2779f102cb2756014701a2c9312616

SHA1
67c20178ae256150dde02d64906756947b70357a

SHA256
26ef40d86c30dec5b9bbad7628bef6a6d947e43484ccc86fb7d39a0bf405fc65

SHA512
9af0e930d25f2196b2c5f7e9acea23bcf9670091f07680960d49e1946b9ffc8b94ba1e4f8179535600c00366c4e13615c95eb8c0012741d280acb7e3ea941f0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
cefee2fe40d3762259b77723ba9dad3d

SHA1
c82cfe6399bbedf87cb06bc67af225923873cf0e

SHA256
7400821241d38cb201262b07172ed2633c44f99b026ea21336493cd4de4beab9

SHA512
e6b5e9c4941637ed38ab1fc63bd023a7b457a83dd5d263d8ea8b13acd433f8d68c440f07cd39fb074527c204babca1afb273a621d52ac42adc4b09658e6154fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
12660ebc6eb8f3ee7a2ad149e42b15e7

SHA1
615fcf7a87e66fbcbf9cb0e98bf644e3ad4da346

SHA256
5f9fe902baecf7f801e62e5c92186db8c5c77b7f1bcc09fa1f1d528a0a25a651

SHA512
6dd656c1d18f466d8b580827b43a7a28eb40546a888936e9a7304a30d82c446f502707d1ee94e23b5aead09d7800ec1b99350d5267e8a4ebd3f7fedb5f2e94eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
6ac73205e2a945289173043ccd9d70a3

SHA1
c70b49bc095b02b99ccf2d6362a5feeaa81960fb

SHA256
d9b0470d2d7346245eb1ba29712bf71bab23a51cb5aac6ac09345d01428b27e8

SHA512
acc5ef767e664891bb896830697f6f54b630fe850b55239afdf32b081bf192ba369b0d8df946362cdd3de53d691e79cfc63fce264953033eb0424f48d7404b5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
306KB

MD5
a211daab04a5339d7e7c7f00850e9b89

SHA1
ab58fba187e19195f15f6f66982dceeb27b533e6

SHA256
44cbe1b260578c279222c7d846db0a433e4e25c3bf75962d224827594cf3d111

SHA512
13809838d82509b79efba7297320d20c1a290f1f252c9947fe040a71a907156ad78e48dc68f118f9576cad118008c1e2570ec6108f511beb1cd2395d45e32cb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
287KB

MD5
54c4b5187895c8a9afac5024714ec74c

SHA1
719ddb8962aa648e114191b78a4af741f4fecfcc

SHA256
267d19bb9b149b9265259292e5a880a5b59448293517faf5ba68d60ac14a4b6b

SHA512
6d34afe80b1ab68cc9a811a44bf4890ecbf02307e5b0a871b9d92254a6a13fe3b31a9dd2a976c912ef8e4886fee00fadf65f91f5338c07c08ec3b75ae611d1bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
287KB

MD5
e321c1a93c17dbda7c87f95f53ad7a95

SHA1
a68bf54d8bfa2850b6145b02c9c016a9ebb2f367

SHA256
1f966c861a114dddc20e0d6885235b7a4d018c6c1561195cfb5d28b69e407e5c

SHA512
156605e0f2bd5ae5d204ad2a73d3c7f8ce5a1c8696fed28b500e99f3c967e130b3175ad8143fdd6dbe31e4cdc7b7ae32f36fd2de5bf2b9084fbc798d8b477f4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
167KB

MD5
59f4cb5bdbc5eab6f5491422b034945f

SHA1
afb4f87c4a5a852348a7c2d8e498e3619f519ca3

SHA256
be56828987314ff90654f504ab1aa2b039a93d4a8d5db373c6d9be4056e35387

SHA512
accb4653f6fdc5fb3cb039eed55cbaca050e3a24a8b8af6ba75220a6a1845d8629289d49ffb7d13ab92dfa8409cf4028e5fe57f49534ffcfb4f0c55f91c0cd9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
7425943a71110f67e8e942a677232b51

SHA1
33c761461532c40aff6646ae8b6ffd7f1b67ef37

SHA256
76765bb8e1eabdee7c4fc3d23e7ad2e0fe4c3a6bb25a94575417a396bb1556b4

SHA512
52c1b504004197d7f8b6597a9bd5684322780f997c77eb43d7861f8a7634b4a61a9d7a73c180efc0004843a3110670b122f26916352a23c923251dcef0501383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
166KB

MD5
604c18e9229d46e62d9b34f783a7a108

SHA1
253cea5919c3d7d292f3a0422404f20bd4c67a06

SHA256
8bcb4f5b462107a86b0845e472ec45fa6efdd84953972dcf47f9cd33caab6f32

SHA512
5fa0aa162ec97288f90e47dabf93c53102dbe0b55c1e342522ea66cb6e900e2bc05b5f788dfb0feb6af06e3fd313627595814c1e4848f4efc46e31713e0eb8c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
e71b1dc7cf11d18f660a9d7bd2f557ef

SHA1
fbd37df1202cba62f18b75f9b1c9a6c5c08d3d1f

SHA256
9fc1179f2a846cd8ca647e58e680b333e68a8e0d4e4aac466ca87fa2a540c36a

SHA512
d1a96f03ad9232c1fa1fdc98a0de289e1d280993b16f643759bcb86f2819cc63cae2e0b18d85df6b064f75dc4580497ec0d257def0a3faf0045aeceed903432d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
85009b3dedcd87884054ad31a6c4b71e

SHA1
20c2a6cf4a748ee2b233a277190c444715b2f2f8

SHA256
f2fa4d8580c2765b51a2e36d150c6a26fd8808d6e3b4decbe8a624b9d0df8328

SHA512
a5483d2f37855bf1eb4e9222f01b0e672c2a754a79dcb5b391715916a88e1a3d573b3e0b2798c518ba05226a3b2621a6ea5495215f7343803e33cd772ea9a9e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
1437afee9652a660679dc89803b50be6

SHA1
9d1320f71062150485c695c84888b9dcd0de4830

SHA256
5ed8a307d0ca4c2b7373298cd30f8745c8d401978013fce765254e3416bef95c

SHA512
0bbc1f2544423d93a5044f323d3aa4f278ef24ade34a46c8a6f5bac6e4ec9915ba325f872007d155ed1f2ce7a245e3ab2f6a895e612e3072d6159f5b2e78fb69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
41386dd58af310f9bb3a464888d8a7ef

SHA1
59ca350dcd853ea8d570df28a300d91c98a0be74

SHA256
9a9b5d6e75e851f45a7f4beb752c25f39137f379b77eb9155d5c21e5db41f692

SHA512
edfd87c546f8e8bf9c61efc67ff5c02f73797732e542a4fd8902aa3f4f8904331d9aeaeb2845628145695a9136daeb0ed9ceea98db23159e3a2ecef826c7fa73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5867be.TMP

Filesize
88KB

MD5
b2f25da77929e3dbcb46fee53763b803

SHA1
a21b8554200bf015ef843dc54a92d684cda7c0df

SHA256
dc75d10d514895296928cdd7f734cfac0f200bd7ab634fa8ae630bd0d5fc00c1

SHA512
519c83db1b7882156fe95c960c618e95a940dde042208e0d257b6832aa1889ecba06886f1d92d6585cbd8f452bee6fef98b5ecbde89dea4332ffcb1331f4b2c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MDPII.tmp\iVCam_x64_v7.3.3.tmp

Filesize
1.3MB

MD5
2c9052cd97995e6e7b53c794bdc22334

SHA1
3decb65bdf356effc6ab5d72d0374ba640668ada

SHA256
9cce716d82b72a99db601b466d1376ea797ec3a8f98b77b8b96c9a7abd2c291b

SHA512
f80934fcda6171207e9a00498c07255aa15938593d3522fc5150c0c58715f5a36122371e6d704c70ffc126faf9818a18e27fa5b427eaffe756f384ff4e66a29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4be9ab0c-bc95-9b48-bddc-5e3de230dcd0}\amd64\iVCamAud.sys

Filesize
255KB

MD5
b646cae82d2c1bb809862fd0f531798a

SHA1
430ebe252e41eb337867827740f08ed0dddec692

SHA256
dec0780dffe9c664b0d3c3514833b92d19194b146661ae8583e0569d245331fe

SHA512
16ee59640d954643f7e8e7b7c2ec71565d6205d7474381d7b571ef9780a5e3d056998a71624ddadd52fe2efa0d597462456abdfd35f40ed85de12f4bddea62b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4be9ab0c-bc95-9b48-bddc-5e3de230dcd0}\iVCamAudx64.cat

Filesize
12KB

MD5
13cb2b1b5266ab32cc1a380f4cb82fb0

SHA1
6f5c44d8780ac595c4880ccecc09ffaea7c9d321

SHA256
a9b83ae60479c64fef634d0a7fdb6eafb4079c702ac9d311b02caeba3dee642d

SHA512
8113e55fc6bcde93938698162d1338f77b1dc7c868dadbbd373bc842e93e32b5cc19e1677a0b6fc9f96298e15679fe6b9eeaee2b2bcd6b9fff23fe4d7db2eaf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4be9ab0c-bc95-9b48-bddc-5e3de230dcd0}\ivcamaud.inf

Filesize
4KB

MD5
7ad00e486875ffb20fa6645c09f67b93

SHA1
913935f317f2b3ddf1d74971403ba65fb183ccf5

SHA256
3490c6325ca17a5e91747f2bbfab9b46d00029d04fdb893fb3941a48fc55e14a

SHA512
1fb837266f183e87701a286b124398434fc1840810ef1b3c1e85a79ae1969ad7202ffda8b1c25698e783b6d0edcdaac318f269668fa21e913c78b24244a440c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{590d49f2-4634-f74c-b299-d09a0649d32c}\amd64\iVCam.sys

Filesize
1.1MB

MD5
d3601de9507278bb52bf7a37aca30ac7

SHA1
109c69bd78fbac1dba058b7c40236d900a79cc05

SHA256
827aa5b010d142c5cfd9c7cda27d878be6c9a775c82f57d8f96b322827b09e32

SHA512
a32276ac87cb95d92ea91e198fcad0898411c72c91d7293627cbdb3d0ce348628c4752fc70fab98b74d43404b4c4b7ef3258e7c56e0f1de798f070c1d13b0785

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.ini

Filesize
48KB

MD5
e76494b892e44011b2249c6555a4fc44

SHA1
5ac9cead1b25d76445d7c47578ccc72a3ecdde12

SHA256
12db173e29f6f768a8bb2d5bee9f6c5f0833948add6e36d744517f48ffff27dc

SHA512
9c2d4bd292f5df366056a7b9ea9a44d880142225ba41a42ff37922da67eb90ea7b4adde2d64225506ac531e20c8e2fd938865ddbe0fda40de0aed5ac61ac9e6b

Download Submit
C:\Users\Admin\Downloads\die_win32_portable_3.10_x86.zip.crdownload

Filesize
18.0MB

MD5
fb12cec5d2bff4ad7d1aff32ccfc4d7d

SHA1
f508ba41e5de2baf32ffe6ad3b9036a1d720aa7d

SHA256
902d615004982e42e90f73413d340110c0a3ac5eb83b56b5691dff020e4493ba

SHA512
2b9e7473f8cb2b9579c03702d64d0e4df7938c5b6d8c5a28229cc7196c006e900b519217a8323feaf04d7b78a9a06c5948185e0591b063e75a9220e98ce4acdc

Download Submit
C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe

Filesize
44.5MB

MD5
814d6bace85d71576caa529a0b6f6bcf

SHA1
1343cfa820077c0f2ca27a9f557270a15f6f104e

SHA256
d84e614127227f2c39b5eb3ff03a92520ca551fe12a09ccf5062d81d972230df

SHA512
7b965c5341a56b73c931409027a4fbf4ec603245ad26f60dbd8150a4af6c412dc7100afc888e5c192b4f1bb5501b3d331952817cbdb3fc659108a46fef2532cc

Download Submit
C:\Users\Admin\Downloads\termoimpianti_pro.zip.crdownload

Filesize
9.0MB

MD5
e38c141587202a146c1ea6130607994f

SHA1
6bb5578ace31ab65af157bc3d1d489d1f1131a18

SHA256
0f83e1d52ad1ddc01464f790e3f7c6ac6cfc6c6b94c3630d5a7ea9bf939853ad

SHA512
43b89d99006e3a3cd606eb605e130cbb5c7aee8a92786a0bb7159e8cd54bf90746b83ebf5379902aa87962b2f085da7580a3f11b83889828fa122380362c3999

Download Submit
C:\Users\Public\Termoimpianti Pro 4.0 Demo\2024.sca

Filesize
6KB

MD5
6b0360dda362050bac2e118574b18e1c

SHA1
747825b9fedd249b0151d1d79f20b453b80886eb

SHA256
acc1935c3f1d817d42f62c1fafb8d0b0b913ef643938f3a4322b05bad120d76c

SHA512
68c61329ec26b3d88d4e63846fe88e658a421e5fd93214944287429755196a899592a9ee559ea1ea9aeff1b3a216abded100cd2271b2e8ef33e8180a1fa5b9c3

Download Submit
C:\Users\Public\Termoimpianti Pro 4.0 Demo\Numerazione.ini

Filesize
181B

MD5
34f15d7f2c98274bd540479f1863d3cb

SHA1
5b141ee7b18a06293245ce0e43b5f72265e9decc

SHA256
2f3d90671a3876ad7fad8111576d298cce076938bd0370b7d0eac38d05f8f529

SHA512
f7d6c539e250af69b8cbac67036b0aa6b0164d2ffb2c3982fccfc107be2e914e6821b4d509c9a9f986c2b641468bffecf81d561b506f07d475db8ff2beec31c3

Download Submit
C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe

Filesize
18.2MB

MD5
62011dd1e62fb4850900aa949e0a68b0

SHA1
c08a952fd665899a0295f5ab6b2026290a64a8c4

SHA256
660d9e1a18b48ec299b98dc320d617a86b50ccd45f71dc00f8ca99975a2699aa

SHA512
05ef56b9ca0e4eaac6840c575fa7cb092875e74ed510568c792d4edfbeba30b42c63a633a05b67cce59de04dbab6e7d1254d479689fef20378c99d8ea9b5b932

Download Submit
C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.ini

Filesize
105B

MD5
d121cabd1009d3f47757cd294ec74bac

SHA1
a46f54df12796a60c3b4a06894130a293f04ab50

SHA256
413b43a8af73eb2f5a8a1be28d0c2295963ba9d063fb32a8ecc80bbdbba5f29d

SHA512
4a7a41cdf847dc17634af81db4e07fcbceb84b17fc0dd0c2865423dad23f78c4b1b0b837452e5a586d3485e2eb1c3711aaf436b86bcd339652789bc4062eadc2

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
864B

MD5
8f43f8d8edc0e3aa54d876e1f70288fd

SHA1
dc85d41c21afbf16af7d76f996d867d2cc5b8a4c

SHA256
462c8c1421f0a523e199d3c3933db13352ab15138b4f472516cdf9160d497e8b

SHA512
9f859ae8c81df106605eb9539bfc6491a7a0acbaf932b667f80c0dddadbe85e568b471be102d1379de626ac0921183bd4599257835625d291bc1c799bda36be4

Download Submit
C:\Windows\INF\ks.PNF

Filesize
126KB

MD5
ec10ca8954ca09f9d1e00ba48596196e

SHA1
09a3ab802cd0d47e969de65a13bb3065f70764bc

SHA256
189b48efc7b00f6d5cad6fed9d3dccd25f662ed08b1c22eb47d9f3a0b8d1912d

SHA512
7b2a568f0e379f8673914206618cd6489faecf9722cc6cff36f9bc3a0803b74bff7a59b55729c19eb9f181be745e66071ea06633730fb84feebd2e14a0b18946

Download Submit
C:\Windows\Installer\MSI980B.tmp

Filesize
76KB

MD5
950087e828e1b7426f703678e446c799

SHA1
c9f28be9b9f810132ec8d78c161e5a232491e60e

SHA256
8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

SHA512
9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

Download Submit
C:\Windows\Installer\MSI9EE5.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.PNF

Filesize
10KB

MD5
6b7df9842e89e05d9235e1afe108d48c

SHA1
389ea23ba6b8f0fd0a132e0e92aecf742dfaa56e

SHA256
f2759d38f53274c04d1b44a022a5dd51dd4f2dd934364301b30c6a5c931e9262

SHA512
464c4e368ac3d3115795812bfd141324c276e2c558f9109b8445da4bbb0255b8910fb06cbad40aaef0ae5ea0522eea6a17b99ed96c7790f2928fa49bd0e30a1c

Download Submit
\??\c:\program files\e2esoft\ivcam\driver\iVCamx64.cat

Filesize
11KB

MD5
88be14abb9e82a9b08fabce5f01d8e26

SHA1
bcf29d97641b3d2c915a66f4f28e44d24423a913

SHA256
7797d3f53cf13e2429fbef8feb6326b8a5877e2b4785c1cbf95d9ac50eb16228

SHA512
e3fa7eb15edfe7e5d12549fad7730dfe7b67af67d3781168808cf1bc8fa03fada2d956c49254017260a987aa0d727bfc483499d836fc94c8d53f4a6d010b877c

Download Submit
memory/2324-1437-0x0000000071CC0000-0x000000007220A000-memory.dmp

Filesize
5.3MB

Download
memory/2324-1442-0x0000000072770000-0x0000000072785000-memory.dmp

Filesize
84KB

Download
memory/2948-1405-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2948-743-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2948-768-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2948-740-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3856-1431-0x0000000072790000-0x00000000727A5000-memory.dmp

Filesize
84KB

Download
memory/3856-1406-0x0000000071CE0000-0x000000007222A000-memory.dmp

Filesize
5.3MB

Download
memory/3856-1407-0x0000000071CE0000-0x000000007222A000-memory.dmp

Filesize
5.3MB

Download
memory/3856-1410-0x0000000072790000-0x00000000727A5000-memory.dmp

Filesize
84KB

Download
memory/4100-1435-0x000001C2FC810000-0x000001C2FC811000-memory.dmp

Filesize
4KB

Download
memory/4100-1434-0x000001C2FC810000-0x000001C2FC811000-memory.dmp

Filesize
4KB

Download
memory/4100-1433-0x000001C2FC810000-0x000001C2FC811000-memory.dmp

Filesize
4KB

Download
memory/4196-1409-0x0000017ACB6A0000-0x0000017ACB6A1000-memory.dmp

Filesize
4KB

Download
memory/4196-1421-0x0000017AD0080000-0x0000017AD0081000-memory.dmp

Filesize
4KB

Download
memory/4196-1422-0x0000017AD0080000-0x0000017AD0081000-memory.dmp

Filesize
4KB

Download
memory/4196-1420-0x0000017AD0080000-0x0000017AD0081000-memory.dmp

Filesize
4KB

Download
memory/4524-1404-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4524-769-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4524-772-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4524-747-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4524-1126-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4524-1164-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download