fatalrat | 29845854e66ed3cb86e35fddd39a1cc3036dc0066e721bc2a40ffd2723c2a128

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

爱思助手 v22.36.31.msi
Size

238.4MB
MD5

8d2448eb58f29d873ce13ac227b7401d
SHA1

6aef9a1b0b8c04edf5fd854150c6479dc62ec441
SHA256

29845854e66ed3cb86e35fddd39a1cc3036dc0066e721bc2a40ffd2723c2a128
SHA512

4f481566997ff7f957524383124a25c4fa9714f940c83950c171828b65b2d3eaf49d76cb51760ecf72fa435f3c019a66421195e8bf83428ece087c67c20795f1
SSDEEP

6291456:mA6tXSfIyusQa58Z6S/DI7UUUTmTchnDb:mZXSfIb2Q67HiP

Score

10^/10

fatalrat discovery infostealer rat spyware stealer

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/2956-263-0x0000000000CA0000-0x0000000000CCA000-memory.dmp	fatalrat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Blocklisted process makes network request 1 IoCs

Processes:

MsiExec.exe

flow pid process

5 3048 MsiExec.exe

flow	pid	process
5	3048	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

i4Tools.exei4Tools_x64.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\setting.cfg.VOjxyw	i4Tools.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qtmultimedia_uk.qm	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\CrashReport.exe	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\api-ms-win-core-processthreads-l1-1-1.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\itunesFlashDll\api-ms-win-core-util-l1-1-0.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\plugins\mediaservice\dsengine.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\plugins\printsupport\windowsprintersupport.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\plugins\imageformats	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qtwebengine_locales\uk.pak	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\files\tutorial\ios9trustapp\jquery-1.11.1.min.js	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\files\OpenStreetMap\qwebchannel.js	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\themes\Default.skin	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-sysinfo-l1-1-0.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\postproc-55.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\swscale-5.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\files\OpenStreetMap\images\search-icon-mobile.png	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\files\Openhiddenncm\Openhiddenncm.exe	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\itunesFlashDll\api-ms-win-core-file-l2-1-0.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\itunesFlashDll\api-ms-win-crt-multibyte-l1-1-0.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\Qt5Concurrent.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\files\OpenStreetMap\images\loader.gif	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qtbase_he.qm	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\files\Openhiddenncm\ncmdriver_win10\iOSNcmDriver.sys	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-sysinfo-l1-1-0.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\libphoto.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\files\bonjour\Bonjour.msi	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\QtWebEngineProcess.exe	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\api-ms-win-crt-math-l1-1-0.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\api-ms-win-crt-math-l1-1-0.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\libcurl.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\libzip2.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qt_fi.qm	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\api-ms-win-core-timezone-l1-1-0.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\iCloudDll\Foundation.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qtwebengine_locales\cs.pak	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\iCloudDll\CoreText.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\plugins\mediaservice\qtmedia_audioengine.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\plugins\platforms	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\files\WeChat\images\zz.png	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\files\WeChat\plugin\qqEmoji\qqEmoji.js	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\Qt5PrintSupport.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\Qt5WebChannel.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\files	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\translations\qt_he.qm	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\idm_sync.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\plugins\audio\qtaudio_wasapi.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\itunesFlashDll\zlib1.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\translations\qtwebengine_locales\fr.pak	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qtwebengine_uk.qm	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\idm_jb.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\zlib.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\plugins\bearer\qgenericbearer.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\cache\loadflash.log	i4Tools.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\plugins\iconengines	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\translations\qtwebengine_ca.qm	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\translations\qt_sk.qm	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-string-l1-1-0.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\iCloudDll\concrt140.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\libcjpeg.dll	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\files\inf	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\translations\qtbase_ru.qm	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\translations\qt_ja.qm	i4Tools_x64.exe
File opened for modification	C:\Program Files (x86)\i4Tools8\x64\itunesFlashDll\api-ms-win-core-interlocked-l1-1-0.dll	i4Tools_x64.exe
File created	C:\Program Files (x86)\i4Tools8\x64\itunesFlashDll\MobileDevice.dll	i4Tools_x64.exe

Drops file in Windows directory 24 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSICE37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0AC.tmp	msiexec.exe
File created	C:\Windows\Installer\f76cd50.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID312.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76cd50.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID643.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76cd4d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID352.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID642.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID654.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSICF03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID206.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID293.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76cd4d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID06D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID311.tmp	msiexec.exe

Executes dropped EXE 8 IoCs

Processes:

MSID643.tmpMSID642.tmpthelper.exei4Tools_x64.exethelper.exei4Tools.exei4Viewer.exei4Viewer.exe

pid process

1944 MSID643.tmp
2528 MSID642.tmp
2956 thelper.exe
2672 i4Tools_x64.exe
288 thelper.exe
1620 i4Tools.exe
1656 i4Viewer.exe
1644 i4Viewer.exe

pid	process
1944	MSID643.tmp
2528	MSID642.tmp
2956	thelper.exe
2672	i4Tools_x64.exe
288	thelper.exe
1620	i4Tools.exe
1656	i4Viewer.exe
1644	i4Viewer.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exethelper.exethelper.exei4Tools_x64.exei4Tools.exe

pid	process
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
1808	MsiExec.exe
1808	MsiExec.exe
3048	MsiExec.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
2956	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
288	thelper.exe
2672	i4Tools_x64.exe
2672	i4Tools_x64.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeMsiExec.exeMSID643.tmpMSID642.tmpthelper.exei4Tools_x64.exethelper.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSID643.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSID642.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i4Tools_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thelper.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe

Modifies registry class 53 IoCs

Processes:

i4Tools.exei4Viewer.exei4Viewer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\shell\i4Tools\command\ = "\"C:\\Program Files (x86)\\i4Tools8\\x64\\i4Tools.exe\" /open \"%1\""	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\DefaultIcon\ = "C:\\Program Files (x86)\\i4Tools8\\x64\\i4Viewer.exe,-103"	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\shell\ = "open"	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.svg\ = "i4Viewer.svg"	i4Viewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\DefaultIcon\ = "C:\\Program Files (x86)\\i4Tools8\\x64\\i4Tools.exe, 1"	i4Tools.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\shell\open\command	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\shell\i4Tools	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.plist	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\DefaultIcon	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.heic	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\shell\open\command	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.ipa	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\shell\i4Tools\command	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\shell\open\command	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\shell\open\ = "打开(&O)"	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\DefaultIcon	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\shell\i4Tools	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\shell\i4Tools\ = "使用爱思助手打开"	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.heic\ = "i4Viewer.heic"	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\DefaultIcon	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\shell\ = "i4Tools"	i4Tools.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\DefaultIcon	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\DefaultIcon	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\shell\ = "i4Tools"	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\shell\i4Tools\ = "使用爱思助手安装"	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\shell\open\command\ = "\"C:\\Program Files (x86)\\i4Tools8\\x64\\i4Viewer.exe\" /open \"%1\""	i4Viewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\URL Protocol	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\DefaultIcon\ = "C:\\Program Files (x86)\\i4Tools8\\x64\\i4Viewer.exe,-104"	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\shell	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\DefaultIcon\ = "C:\\Program Files (x86)\\i4Tools8\\x64\\i4Tools.exe,-103"	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\shell\open\ = "打开(&O)"	i4Viewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\shell\open\command\ = "\"C:\\Program Files (x86)\\i4Tools8\\x64\\i4Tools.exe\" /open \"%1\""	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\shell\open	i4Viewer.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\iTunes.ipa\shell	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.svg	i4Viewer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\ = "URL:PCi4Tools"	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\shell	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\shell\ = "open"	i4Viewer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.ipa\ = "iTunes.ipa"	i4Tools.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\shell	i4Tools.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PCi4Tools\shell\open	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\shell\i4Tools\command\ = "\"C:\\Program Files (x86)\\i4Tools8\\x64\\i4Tools.exe\" /open \"%1\""	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.heic\shell\open	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\i4Viewer.svg\shell\open\command\ = "\"C:\\Program Files (x86)\\i4Tools8\\x64\\i4Viewer.exe\" /open \"%1\""	i4Viewer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.plist\ = "PlistEditor.plist"	i4Tools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\DefaultIcon\ = "C:\\Program Files (x86)\\i4Tools8\\x64\\i4Tools.exe,-102"	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\shell	i4Tools.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\PlistEditor.plist\shell\i4Tools\command	i4Tools.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

i4Tools.exe

pid process

1620 i4Tools.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

MsiExec.exemsiexec.exei4Tools_x64.exei4Tools.exe

pid	process
3048	MsiExec.exe
2248	msiexec.exe
2248	msiexec.exe
2672	i4Tools_x64.exe
2672	i4Tools_x64.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

i4Tools.exe

pid process

1620 i4Tools.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	3000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3000	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeSecurityPrivilege	2248	msiexec.exe
Token: SeCreateTokenPrivilege	3000	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3000	msiexec.exe
Token: SeLockMemoryPrivilege	3000	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3000	msiexec.exe
Token: SeMachineAccountPrivilege	3000	msiexec.exe
Token: SeTcbPrivilege	3000	msiexec.exe
Token: SeSecurityPrivilege	3000	msiexec.exe
Token: SeTakeOwnershipPrivilege	3000	msiexec.exe
Token: SeLoadDriverPrivilege	3000	msiexec.exe
Token: SeSystemProfilePrivilege	3000	msiexec.exe
Token: SeSystemtimePrivilege	3000	msiexec.exe
Token: SeProfSingleProcessPrivilege	3000	msiexec.exe
Token: SeIncBasePriorityPrivilege	3000	msiexec.exe
Token: SeCreatePagefilePrivilege	3000	msiexec.exe
Token: SeCreatePermanentPrivilege	3000	msiexec.exe
Token: SeBackupPrivilege	3000	msiexec.exe
Token: SeRestorePrivilege	3000	msiexec.exe
Token: SeShutdownPrivilege	3000	msiexec.exe
Token: SeDebugPrivilege	3000	msiexec.exe
Token: SeAuditPrivilege	3000	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3000	msiexec.exe
Token: SeChangeNotifyPrivilege	3000	msiexec.exe
Token: SeRemoteShutdownPrivilege	3000	msiexec.exe
Token: SeUndockPrivilege	3000	msiexec.exe
Token: SeSyncAgentPrivilege	3000	msiexec.exe
Token: SeEnableDelegationPrivilege	3000	msiexec.exe
Token: SeManageVolumePrivilege	3000	msiexec.exe
Token: SeImpersonatePrivilege	3000	msiexec.exe
Token: SeCreateGlobalPrivilege	3000	msiexec.exe
Token: SeBackupPrivilege	2384	vssvc.exe
Token: SeRestorePrivilege	2384	vssvc.exe
Token: SeAuditPrivilege	2384	vssvc.exe
Token: SeBackupPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2824	DrvInst.exe
Token: SeLoadDriverPrivilege	2824	DrvInst.exe
Token: SeLoadDriverPrivilege	2824	DrvInst.exe
Token: SeLoadDriverPrivilege	2824	DrvInst.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msiexec.exei4Tools.exe

pid process

3000 msiexec.exe
3000 msiexec.exe
1620 i4Tools.exe
1620 i4Tools.exe
1620 i4Tools.exe
1620 i4Tools.exe
1620 i4Tools.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

i4Tools.exe

pid process

1620 i4Tools.exe
1620 i4Tools.exe
1620 i4Tools.exe
1620 i4Tools.exe
1620 i4Tools.exe

pid	process
3000	msiexec.exe
3000	msiexec.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

i4Tools.exe

pid	process
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe
1620	i4Tools.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

msiexec.exethelper.exei4Tools_x64.exei4Tools.exe

description	pid	process	target process
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 3048	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1808	2248	msiexec.exe	MsiExec.exe
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 1944	2248	msiexec.exe	MSID643.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2248 wrote to memory of 2528	2248	msiexec.exe	MSID642.tmp
PID 2956 wrote to memory of 288	2956	thelper.exe	thelper.exe
PID 2956 wrote to memory of 288	2956	thelper.exe	thelper.exe
PID 2956 wrote to memory of 288	2956	thelper.exe	thelper.exe
PID 2956 wrote to memory of 288	2956	thelper.exe	thelper.exe
PID 2672 wrote to memory of 1620	2672	i4Tools_x64.exe	i4Tools.exe
PID 2672 wrote to memory of 1620	2672	i4Tools_x64.exe	i4Tools.exe
PID 2672 wrote to memory of 1620	2672	i4Tools_x64.exe	i4Tools.exe
PID 2672 wrote to memory of 1620	2672	i4Tools_x64.exe	i4Tools.exe
PID 1620 wrote to memory of 1656	1620	i4Tools.exe	i4Viewer.exe
PID 1620 wrote to memory of 1656	1620	i4Tools.exe	i4Viewer.exe
PID 1620 wrote to memory of 1656	1620	i4Tools.exe	i4Viewer.exe
PID 1620 wrote to memory of 1644	1620	i4Tools.exe	i4Viewer.exe
PID 1620 wrote to memory of 1644	1620	i4Tools.exe	i4Viewer.exe
PID 1620 wrote to memory of 1644	1620	i4Tools.exe	i4Viewer.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\爱思助手 v22.36.31.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71C000891CA82946860EF59152241549
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24DFE13C53A433DB24C4AACEE7632096 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1808
- C:\Windows\Installer\MSID643.tmp
  "C:\Windows\Installer\MSID643.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\i4Tools_x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1944
- C:\Windows\Installer\MSID642.tmp
  "C:\Windows\Installer\MSID642.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004B8" "00000000000005D4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\ProgramData\Microsoft\MF\thelper.exe
"C:\ProgramData\Microsoft\MF\thelper.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\thelper.exe
  "C:\Users\Admin\AppData\Local\thelper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:288

C:\Users\Admin\AppData\Roaming\i4Tools_x64.exe
"C:\Users\Admin\AppData\Roaming\i4Tools_x64.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\i4Tools8\x64\i4Tools.exe
  "C:\Program Files (x86)\i4Tools8\x64\i4Tools.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Program Files (x86)\i4Tools8\x64\i4Viewer.exe
    i4Viewer.exe /reg 1
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1656
- - C:\Program Files (x86)\i4Tools8\x64\i4Viewer.exe
    i4Viewer.exe /reg 2
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76cd51.rbs

Filesize
377KB

MD5
44e728d5be9387dc5950b51d564c2418

SHA1
4907f3ad3891207162dc26bbdc09810c17fe69d3

SHA256
c73d481fa97d7918183c92a9a3aea5e7bf7e8621260e271f53d82eda5f88bb7a

SHA512
6f2ba55ef9c9f86aead048a630b8f4fc132da0679f10f37419637a7578f3446a1b210fa2e4fa2d44584b09af729950574f17038fad43e2083188be999236e609

Download Submit
C:\Program Files (x86)\i4Tools8\x64\Uninstall.exe

Filesize
1.2MB

MD5
606b7c845413ce8179ae0de69f83aaf0

SHA1
d9be1629d92dafa6e605034402e37dc2c4f8853a

SHA256
93957aafa64bf64df1d8c51605d49fd16a81a357c946f1a77a52578b5764284f

SHA512
cf18802aa312a2d3e4ec5b3c3b56db9fd9e95abd9fc0dae99d7670abcc7deb72712893200a945c9e95741b30323d934026b111132fa103925a6059ced591e638

Download Submit
C:\Program Files (x86)\i4Tools8\x64\files\OpenStreetMap\search.png

Filesize
1KB

MD5
a73bcc83dc2729d19d9d0e1eb36bbd96

SHA1
9d15df65438cab48d07ebe7e9359258ff1011423

SHA256
29739779fd76b21175d4ea24d7ded3e057233127062d05c164b9ab4df9e11a3f

SHA512
c37de466294c22c9b3ed6587c639a7d53ae6f5cc8d352931035885191a2fd329dae3ff28d1bdeb363c2c12243505584354acc5f88bb8e21da9c2942d03cacf03

Download Submit
C:\Program Files (x86)\i4Tools8\x64\files\Openhiddenncm\InfInstallerx64.exe

Filesize
195KB

MD5
30511278df0a734661a69fb14422e2b1

SHA1
c2a7a6172576fab3deff5bb89c83ac16aabf66a9

SHA256
760f9b88e96e73196de563b5bc43c306022c1dff1424b101fa70ecfb71b8d581

SHA512
fa85f2eb4cbdd664eec1a94d0f880f10cb896d0fad874cb041081a90249b8c522554edef49b48fb1952d857b40184e9ce776ede28760504f1f7704d99fd09e21

Download Submit
C:\Program Files (x86)\i4Tools8\x64\files\bonjour\Bonjour64.msi

Filesize
2.6MB

MD5
86e2b390629665fbc20e06dfbf01a48f

SHA1
d9f4697a6f4eceea24735822cb1df501268ca0b0

SHA256
46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

SHA512
05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

Download Submit
C:\Program Files (x86)\i4Tools8\x64\files\tutorial\ios9trustapp\jquery-1.11.1.min.js

Filesize
93KB

MD5
8101d596b2b8fa35fe3a634ea342d7c3

SHA1
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd

SHA256
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

SHA512
9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb

Download Submit
C:\Program Files (x86)\i4Tools8\x64\i4Tools.exe

Filesize
13.4MB

MD5
5736f450d9591a7d45fa1d6c5059b910

SHA1
8a628053b70fa250a87a43bc6d3933f586ac9530

SHA256
27fdd8b1bc9fa685d243129234e5e161e3bb45737e68dd6cef90258aa8617c59

SHA512
975353c84606f191f8f1267e2ffac62baa81f88a54a98c011d05bb1b9b226023a4c71cf5a60f22f7b111b8ff592c59d6ce9aac462ad4404448c62eac7576aab9

Download Submit
C:\Program Files (x86)\i4Tools8\x64\i4Viewer.exe

Filesize
962KB

MD5
f718ee05ae711555800935c09ef27770

SHA1
56d248634268c38f11bc246984bb1b53caf69cbb

SHA256
83eb8f70922c4e84d30ad8bf6ea5b983865f24f20978efd19ea03a25338aa985

SHA512
79b7df695b6300236a92543719bb9d05b8e915b4935a7fa7c87d379d204f92fb3d57c3b58f84f5ce62b9ac269c62536329b0cd755be1d8826c07108467ef86ff

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\ASL.dll

Filesize
62KB

MD5
62328e297a0a20b3ad631f63adfe7242

SHA1
b6f2b79c4fa3c27a79711369b0164033fb071687

SHA256
064efe6c2c64c8c2a48246c2ae902c78f25cc2d5823984fceee87489983d5b41

SHA512
008a03a094db8c9a79e05a884e449429c8d34067dc3b697f58c6e9153462583278ff85a3c1b948c2b5f1805b16710c0ffc99f2d6603d7ff0edb738f7b57a4d6d

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\CFNetwork.dll

Filesize
1.5MB

MD5
dfd35230e121bec9d11dce1ef2bc9914

SHA1
f2b42d25a28af394fbfd3388b8c178a7c4561dce

SHA256
63736f2781d10f55eeaa148932886c0c355f7e1a7ad113a0bc00427409c72bdc

SHA512
7e6da46168315cf424fe5bfe79d5682c45047a8385327562a6b655b7c5de6842bbae56fa851f5e94619927bd2d4607f69d516f6fcb2ab153c32c0982d12b133f

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\SQLite3.dll

Filesize
778KB

MD5
ca426ad13949eb03954cf6af14ed9ccb

SHA1
f5f46048711a3b10fdd243d450f38c70b2bda65d

SHA256
383f6a8aac6ecde29d4cbde8e31be84a528892cc7295985f1c877fdfbe9e2a2f

SHA512
42494f56d3cd9048b7f912e907bbedf1db140d45834e1f5f79957d6453ea0468f97fe7de6e0e5f4d494cb5eff9a7c5b9005e9a506f82a1d7dcd18f5c3790dee1

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
11e55839fcb3a53bdfed2a27fb7d5e80

SHA1
e585a1ed88696cd310c12f91ffa27f17f354b4f4

SHA256
f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d

SHA512
bec9419e35de03cc145b3c974833f73f1a5082d886de4739351b93bb4cc6c0234efd0e35ad845faba83fa600c4a7d5343eaae949a837d00d5528e6db79438ee4

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-datetime-l1-1-0.dll

Filesize
18KB

MD5
9f3cf9f22836c32d988d7c7e0a977e1b

SHA1
1e7bbd6175bdb04826e60de07aa496493c9b3a3b

SHA256
7d588a5a958e32875d7bd346d1371e6ebfd9d5d2ede47755942badfc9c74e207

SHA512
16c98e6aec67ffe4558c6d3f881301490be5d8a714c1adc6735005613251adb8e1c2cb9b1c0d2504a9a99c61a06b0e30c944ca603fc00fbb18cd20ba1c9bd697

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-debug-l1-1-0.dll

Filesize
18KB

MD5
64978e199a7239d2c911876447a7f05b

SHA1
0048ce6724db08c64441ce6e573676bc8ae94bf9

SHA256
92b947f1d6236f86ed7e105cff19e23c13d1968861426511b775905e1d26b47a

SHA512
9c64211895473ffc7162b56b0b8e732dec54cf03ea9b9b36fe3cc3339c35fc71fc7173d4e146989db399cb1bcb063079378bb6f778f7d2591cd545550038397c

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
9d74d89f2679c0c5ddb35a1ef30bd182

SHA1
22eaed07a6e477a4001f9467b5462cf4cc15cc16

SHA256
e207ffc6fef144e5d393e79de75f8f20d223f1ac33a011eeb822d30fa2031046

SHA512
725626e961d32398ea5aa120ac0339deeb493fc02ee7ef4d8e586173fdbf768b5cbb1f16f093ae4ecfee87e661170f8f832777640a353df5d651af4a62a2d819

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
d826d27c73d9f2420fb39fbe0745c7f0

SHA1
6e68e239f1a58185c7dad0fcfaac9ecfd2e5726c

SHA256
c0e5d482bd93bf71a73c01d0c1ec0722ea3260eba1f4c87e797bae334b5e9870

SHA512
c49843eb10e4e54c66e0e194dbd29ceab9094bdfe745b6a858cb03e34d73a6326f54804e5e5505deacc87146cbdfba17a0f02e62e76c685bce0cd1ff41962ff4

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
ec4f2cb68dcf7e96516eb284003be8bb

SHA1
fb9237719b5e21b9db176e41bdf125e6e7c01b11

SHA256
3816bbb7dd76d8fc6a7b83a0ed2f61b23dd5fc0843d3308ee077cb725d5c9088

SHA512
6cbda80c476a9fcf46458cac45229c96dc9df251230531e25088e834cd954db9ff4561e744f76495f9c57a4068b7635c72c6f9ff838436c54142297ee310b236

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
b9287eb7bcbfdcec2e8d4198fd266509

SHA1
1375b6ff6121ec140668881f4a0b02f0c517f6c7

SHA256
096409422ecd1894e4d6289fd2d1c7490bd83daff0c1e3d16c36c78bd477b895

SHA512
b86348d3f42d0ff465066a14c281088c73ec5e03efacdaabe27a410b054a8a81b438d7e5d030b0d95f53b07783911b8b8200581d4e0b6f1b3cc79f4aae1d67df

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
6a35a52d536e34ba060a19d06b1dac80

SHA1
0494a9cbf898e5babb6e697fc2de04a128d2fc35

SHA256
a369ef130749bf8cd9f67055179e6f537f200c060af47493d49473912a95021e

SHA512
a8aeb58bcf4b314212c2ab5a8fd3c2edeb97e680f774171d4a79390aa23bb62a414aef0ecd5286ffb68b7ed8f6e713ff1892d6d4cc2cbb67de916c6062e762d9

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
ee5c2fb7bc23bfd06ff32556cc7c3b4d

SHA1
5d60ebf016219bbec340d353a4fa541fff596d3f

SHA256
efc9f0e32bce971900ddf66a1a9e68daa3bfb2099a1ba9f24c6ee82da2cbd6e8

SHA512
5d1b8a130c27d8eb63ca0c836bdf63e76afb311de26ed4f25b073bda843ebfa25e136849e3882822257e3783058f30af818a96764d60821a40329cff4e1badac

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
48a5e206d92f3102256ec65e8d570ee0

SHA1
76024fad398dfa4734afce0cc2e5ac117f090ba6

SHA256
a272ae4fc60e511f48950b08f106fcdd3bc86831df908ee78d630f1ae921880c

SHA512
65407da566b571e050c25448be6042e84b0c1c7248422cba00b543af9de425a723b0c7c54c4eb6f534e42b1679a058562d500875ddc4f2b52e6b8e6107b1b575

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
e33f52e89dfc376eaf7aa655f260ca76

SHA1
b66e1f934f491544190714966031b6dfd2e349ec

SHA256
0bd03e89a539aaa3100e2f7d9a058964730320e55aee1f85be8fd243eea7017a

SHA512
95cb889599801ba7fa225b633d0fe25fdcc8b495dee5eba05b15a6e53a8a3643b5defe1a881236c40f4fa4365d6775ece067dbb526afdf2015f4d1355c9dfc57

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
dbb81fcc74c59490008ee59bffff5a6d

SHA1
edbb465ab3bea3a4df3f05e5a4e816edbe195c3b

SHA256
f33e6ac5d3e1c4f1d89564fb6aeeac170486c073b67694380755049dbc48eec1

SHA512
2847a73e952bd5f2448264e0bfc8dc1dcd37f8b02d6d6f525ef0cb69c8e634fdcc4637876361b22c53244659039ed305c015435834b61eea15015fed45e9c374

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
0ee9e0c830a7534dcfc9be72146796f9

SHA1
cecc860b494135482ae693f8e252301073a98578

SHA256
8f3f0fd765a37f48162f0bd00c3047e79b4eda355223bfcbed4d35b51349cfcc

SHA512
47161e02f4478464ab45c1e3bf9d244d34613e0e68ebe48511a9a0c4e7f8ddb0c1dfd59707c6968c5d76d5027cd19ef748d1235bf74b976410ea6672a6a4bcaf

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
1557093add722d1c5a97c359bfcd0d77

SHA1
a8ce995f00a12a81a13d3ef47ce0834178ed69a4

SHA256
3a20635a223e68418c22858413e8c603aac25723de1cb0f54dd675349ec3213d

SHA512
b7acd6882b4d36b52f1e49e4b61ddd025de8503f765b72c94ec5a0d85b6ced513c348f7c4898675728c851a2632ad71c78937cdec9dff994b7b27ed2d85cdddd

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
2a61e4e21bf255107884b6520af5bbcc

SHA1
884eb1a835bcde4e7fd98134f0be797229f4239a

SHA256
64742ee0729cbe72555247b0165fae03bea7a6b0147869253dae3bb0072173e8

SHA512
d0ca104904352586bbd3da654125b3df9355fe250938a465e8e900d135cec397f1118fdf54829b076df82b8e45fcd7656c2c7aa33ad3c0af5189f7a55e43f498

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
d5c4b8f7260563f72150a84fe884ee31

SHA1
dae1185359ed25a4974504cd1ceaacde28d4318e

SHA256
02839f3b2bdf6adfc89d2f800cc8acda59a40c3e7ce14ef3026f4c72e202297d

SHA512
09ca23413eecf1df94aa36e53fc6fff0f402f21eda2ef79be6aa087818a5bb82ed98db790a2b5cf4ef91a8f70d8e27f56313bc2054a26872d2cad611c472f0b7

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
f61b9ecb79cd20fc2e8fce87286cfe43

SHA1
7a48accbe43e156f886f1f2836f74e1043feec59

SHA256
bfa24f94ba095174b82d3657f8ecc689eab8ff380c69b1c9a7e311eb70d66386

SHA512
42ab62087bbc9fc9c9003ae96ebb9e9bbfa3db4eb74bd6746da035d53d1002015d8482ecb92620ec65c42b8b2b41d9b0a7793e105b0cf8cb6f713a2bc03241db

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
a472bd416bdc12668523670360650910

SHA1
831d930ef9917e0dccacd8e7f7fd6f3d90082441

SHA256
48dceeea29558966c391cda34e5755386c2e7e252ea0a03d8d1f21e3cb370c5b

SHA512
166134e6c3403f4437e10afb514a55677481d3b03f7cfdf17917a0bb6fa1f387feae58d7dd5dfbc375eae66d24f10c3163ba5958c22beb6978c0b778c2883b6f

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
17KB

MD5
525a156e0ff61306fd44bf7937cacfae

SHA1
6a9a88317a55c939c0cb9f77256f5c3f961d0562

SHA256
41c69b545d931045a280f83b2f5fbe0ea18c35ac42dfca54b661b42fe8e4f982

SHA512
c99147eba45e9561b7a2802b0c15a2df2ac886ce95a95f2980f8bf4d1dff92a69b94f11cd17383b577303f24295b1b7e52b8c80ad26c0bb08862c726b9cd8841

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
e57ec98e69961e45cc7a4e0666d26b7d

SHA1
70462a1d68bf49908fcb7186743a47a1affc5d7d

SHA256
52c9b061c4c74eeb70019edde2b690c7e9d9744979a3b718d6687b3a83f00def

SHA512
4a450bcbce0eb3f98f78af07673227a55cdf8e7840fa892196cbb8d0f90551b32731f70f171644f8097fda97d57caa4b7430023671b19881764613231a20cdc9

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
99572ae21d1c8afe3d02f1124979e911

SHA1
5b17addc80b1406a3eaa615f5e37d92e953a0bb7

SHA256
e7d39dcb79d739ec030e9a4e2165b264a24c400566056e1fda267fdd1a8b36bd

SHA512
27ca8149d1f0c625de90a3f4cd4a4930ab0c1362ee10a7131ebfd2a88065c2a34c8ad7fb6d95ce33072146b9309488cbfe122984606d631b99d925e3fc42fcff

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
e4110aa5c8a32b63de2c85e0bc297c54

SHA1
6039680f47750cf56d0c9a1768de815a44b83de7

SHA256
01bb32d692b86ebb39a76893125e0f3aaf957c6e4bd682fb46eac32f6fb65be7

SHA512
0631ea8224403ca113dff9b17852e92c1fcb2820e4f335b668b12689d2a8f058ba33905692f2fd0f4897f8f766db816747ec95478d854b75a0803d2c899e6d98

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
a13048905fc64cd2103094c871c6d826

SHA1
cebb1a74bd5196a3fe174a20543335074a1b7397

SHA256
fb23439a5982e723e8e4ae1a5a35f9bbbfba1e76feb4596668f57093b231da6b

SHA512
e23effc6c17177d07f43955cc8ffa17ed05cc2c0a6430078b37de8536170dc3cb4f8970eba1049b10a789ab5acb423745f9d842dac4d63d5714751186a3f071d

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
00b548bf3eab7a6debce296ee5e877de

SHA1
ae18022eb78c192ac3baee32664b9eb011194772

SHA256
d592b91a087c001f9ea38dc5912a90c78fad3a368879d04fd7e5650ed374c8dc

SHA512
3ba15d9a0f1680c2b182cf04fbbfcb0d4f1b607519c161c590928930ad1b3eba8bd417575a51305b9552f0abf0064c74267336ec09cea709aed9228e4eac799e

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
96d9965ea02eefeadf1f122dfa724449

SHA1
c6f9eb1babe64b30fb1ff6b74e93db8ac41d1294

SHA256
4f31b2888ca82bd1ff40d71e2d11500456b99940dd469bfb097fcd304676fa38

SHA512
4018eae1e00899a5bd392c9b4f25561cf03292011f52387edd77058f49bd1b7456570f0108338088e5711bf5d6ba33aeb2c7bcd5d24d2744b173ff75bba0347b

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
032a139ea3cc41f2bb801cd580759a75

SHA1
4d88e10bcc4e75edc83bca578510d53fc827aa1a

SHA256
905f86530c56c9b453dd8bd9770440de0f6f35aa84b171de747a04d112e35aad

SHA512
4f574dfe92e90c7d6f162c0b69dd56c96031790abe15e52121c7e44980bbab86914ee06fc153fa5f3a77c4f1c6e4c24d7044507880a80b587872477708506a50

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
94e386a317faa200aa1dc270ce54e5fd

SHA1
e352ced285c04378bc3f6af4b30fa69df70b8974

SHA256
e4ccd13d5861e3e28984fc7263d79b580a0bc7bbe0d234ed8f1a69706ef908f3

SHA512
f622d303adecdce6ff88acc779d108556c2fdbe1f4140092d2d637c2fc1aaf651c1798291239e1334aabea702d7d380150922abd4e0122cbfc9c079a64dc0e76

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
e8ccecac4f06679b9d5e77333d216ee0

SHA1
377363813d0fc18083bdb0456a66efb6598a763a

SHA256
2cf24c6aac48261ab04eb616e85dd707417697764f860fc29dd3955dd2c49226

SHA512
e37db74e11138639e3bb02270589f977bfd803d450ff098d474ca461fd1fabc8e646a177a2082fd0a901fbe15225c4d352567a561c453f56ad8e0097838b945e

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
42153324a982f848d7a49bb7406125c2

SHA1
f0878690d23ad0c905f0a6ec37e9ea1edb813195

SHA256
fcd8b213e2e9962b84d1eec4296bbefdf4465398a235e118be12c878fdc08c05

SHA512
1710b3fd90210dd6603f2104de249704cad9d83acdc0c6b96ac24e20c4913679b1e4ee41bb7812d919ba76cadb36f7bd8210ee127325fd9db6b542cf2d0b7f69

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
aad41d33906cfdb31681ce8276648481

SHA1
6367d1990873c5af2f5d05d31ea083fb8b127883

SHA256
242cb185643df586a5f55735e8810b8d2b6b095c78be206e42cdaae7665bb2cf

SHA512
43b2cf09fcb13211f5bcab6942050e03dfb9ce36b727727f7c764df3754f332f04dc81f411e55caeecfa676c43dd1e977f29b0042c485babaaad609c239a84a9

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
bc75b80a80802146e79c383c94542f06

SHA1
7da2020a855ea6c003d905551a28af456e7519c2

SHA256
81a7a98e11ae94236f34a82a0d450a1100a9b8e752205248de0037a764b91a07

SHA512
0b6a8f6809f1a39c90bfe58ef0d05d997be307cb18771ff8fed6539bf7e19ee8cc3bedc44e1c22f34441db9b82a6470d3814fc7465d1ea82fa30d37278a0fe65

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
1028042a84aefe816280f22a4517dc68

SHA1
b3437beb0e5a6a062678a0b32cea98f3c5e33580

SHA256
4a88f73cae12080b9a637f76f8ab1b8ac29829817ff03ddd611a25b6981ee573

SHA512
1da4a2d152943447950ae5de80360741c8a827647d1568c18b026376645f15cc9b5d1915dbdb43278adeac1423b20d6e1c97f6ad67ce724a0d91ec84c4e5250c

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
b7e1023ebbf0e5018c58b5488c03a643

SHA1
b10d3a570d4a44b87480d015aac4d04ef3f0a355

SHA256
e7238f5e38d3991e9d6219255e8cd951d6dd431402c4b4b295a68bd43efa3d48

SHA512
c5536416aeba4b37931e2961a29ea4c8679f6d942289325c9067d46b36797e404c0d8dfd01ce997e89bd42a7f084029d2f2d3cd7485b8cec5e66db50ac1df565

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
538057da2c6ec8b927904346bb808792

SHA1
1156a3d1a653678b9f85aa64ff65bd3c10510b5e

SHA256
f8720e9250c5d5aace6918e1f67f6105f2cd08c0cf55633d2b6b28032d904e9a

SHA512
228531381ae55e7c1a24cfe36101325cd0b95899f2a125c72e82043f13248236171ad89a497e5b1d6c19a5febb8d2bd38cb43e81fbd753f3088aaee1c1791b7d

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
4aa747ecc612240d522c23b51a8be7c1

SHA1
b037be0bc321e9329c7cf0dbf609fdb9b2d82fb4

SHA256
ecc116471ccfa09c599d389d71a574ebed01260b9760021a40665c4d8a22257d

SHA512
fb8c0d4f661fe6c8ce6cd04a3c0661a2f0b6058223edbfea811891aedd343d006c22a8524bf8508c2cc396853252477d5cf3c520889650a24d661f4964bce5c9

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
2f10f2255271b09d58af75f58476899c

SHA1
ca37f8e4c99fb178e718e99eed286d1ef32b00fc

SHA256
24bc147f7c8a2dfcbe9296d83ce75a1f2c02076d8f6e6c81f6032c927ed5888a

SHA512
74d85f5a40bd22eb9c85973bda5e596c3688096dc78fb6984f84ded4757ae82d77894c4cae0f24de77d211bbd869f9a4120a104d7c2ed161b4bb7b8568cf5103

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
65fe48962755451a1a5bab26e6fd978d

SHA1
d1322c477fe4ff61eedf9433b8deddee27f5adb9

SHA256
5a3d9a0a2c1f9b14cb52d9cce92b761ec1fe0460ea7d994179c96648455ead84

SHA512
940269af2c3a8b5b43ca936df1bb5338ae5166f04c34a163b5938895d19bdd7eadc156add1b96b5508e06088419a7d8f466f40bf01e64b4c547fbc1b20328ed7

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
a3eccd7f2f2c45d1553055593278645a

SHA1
23cd6aed1b198ca515d7adb213efae780fbf0537

SHA256
d51dfd972e6df5e8185dce0b4eb26dccb0527c5f1c63bc081677335f69b92b67

SHA512
1dbf60f5df95e72b98b72faccb52f83585bc0bc5b1f65c259e8568d812461b738bb37c96e72e2f272370788cc7dcd7a8e5a698d9fb2c773ce0e17978c19ef858

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
c8f1a3b19e5103751202010805bce5c9

SHA1
179cf585ce939d05f9610d4b684e4dda6f452f76

SHA256
d5e2fb8495bbbfb66b2612cd5179c1a5f4746dcdd043ecd474363ffe4a8deb4f

SHA512
879fbe66e5440cbe01bd1814a36345fce6454196c8457969d2ee9e93b749df91d0d95b1da1d368063b7ef2a3ed538449b456eb2c7507a27de60105a0d37dcb71

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
e0aeba2d9d9ae584d6c1aa0f5929526b

SHA1
3f97b977d8877398d350b373fd441867167bd2ba

SHA256
4eca5b9e5be5750b0bc03fd74b6d5e351cb6d70fd63d5f740a1a122f906390e0

SHA512
cfa02a7afa052c5149a741500063f110462d272af417c33bedeac6ad3af424b181144c8045adc04a44a54dffca4639ae3c135f23d64bcfb66f7d3aa980143799

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\concrt140.dll

Filesize
238KB

MD5
bb7293add679a5688fcdd03f44de4b90

SHA1
4ffb7d8acd1bfec663d99694172c0c8c28a92900

SHA256
f3093cb216bf8ecc8d869e46d8cda3aaca28a326cb865ccbef329e1b13abc834

SHA512
ea094064c1454cceec03b4f54ad122be169c8bbfa6eece9b4f58eb6d59cbefa16af3a9b6f04461e438e4c208b6224a69a15c10cca6cf4cd5527cf0fe90052711

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\libdispatch.dll

Filesize
89KB

MD5
f630de53dab8e00c44948fab59e7c87d

SHA1
4f5e85012120cf6ad3c655a2c4bcc74578494961

SHA256
3bb2bf3f61a5f14ccc4a61c1619ff2fa3afd9a6c7ae3a4368dc64fa00f20ef8b

SHA512
ee0a3c8ef0939fe0fe5b35ecf04983e9ee69cd8e48ee6adb00100d533c716624768d9d1f07b0dca5981d04c4ee4e227a09907bd8dc9cace1350010b588a35ab8

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\libxml2.dll

Filesize
1017KB

MD5
b22578e8a20584fd50d2df00fbfed2d6

SHA1
b2665e707c255b1fb022c8c001912f0fe065f09f

SHA256
c7788669c4232ec3b89f90044eeeb1e4e4ba504172641196be953a8eca035a23

SHA512
64de8a3bec74da6ac5affe80891e392e382aa6c2972ab1672e045a880d3c30d1eeacde3fbf1e64307038943ca679a1960cacf42b4daf1d00b0be4fbf855fdc99

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\msvcp140.dll

Filesize
429KB

MD5
d25c3ff7a4cbbffc7c9fff4f659051ce

SHA1
02fe8d84d7f74c2721ff47d72a6916028c8f2e8a

SHA256
9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5

SHA512
945fe55b43326c95f1eee643d46a53b69a463a88bd149f90e9e193d71b84f4875455d37fd4f06c1307bb2cdbe99c1f6e18cb33c0b8679cd11fea820d7e728065

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\objc.dll

Filesize
181KB

MD5
889942db3c895f286339e84a33bc3768

SHA1
7e10c47e8b67e54245764060fc38dee403f09554

SHA256
19689d52145d9ba930ead5c14159c4adbb2daaae6247ec4b2f41c045abaa1bab

SHA512
f82666c9ad6001c2cb7cdcdf4d8ffa69345df74f44234e6965feba430d0c844b5a3e1c75ee64ee579589e7ff12e597ab15fe8b098ccc991ca3604d60f0245acb

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\ucrtbase.dll

Filesize
899KB

MD5
015b30309491a911e75748ad69c9e680

SHA1
2f2243b6ea99689cd54e45b67d9b7d98847f904c

SHA256
dd32570b8183a8b117233333153da29cc8d2ac5b1c868440dd852d9c3f77baf5

SHA512
51159e407021ce78ad64ea91a5e53f59ee15d6d74b9c2891cd6dd532cae3f1d388198e0cd78648ce067e82fa7f01050b4773d95c5c827439f094b289f0ee0ac8

Download Submit
C:\Program Files (x86)\i4Tools8\x64\iCloudDll\vcruntime140.dll

Filesize
81KB

MD5
a2523ea6950e248cbdf18c9ea1a844f6

SHA1
549c8c2a96605f90d79a872be73efb5d40965444

SHA256
6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4

SHA512
2141c041b6bdbee9ec10088b9d47df02bf72143eb3619e8652296d617efd77697f4dc8727d11998695768843b4e94a47b1aed2c6fb9f097ffc8a42ca7aaaf66a

Download Submit
C:\Program Files (x86)\i4Tools8\x64\setting.cfg

Filesize
92B

MD5
c4cb85ecfbcb9438a57c3cf8f9ebbfee

SHA1
a37259c1dc1e99e1deddc57ba4d380eacc6c4345

SHA256
a0cb579399ea7d48e52f21f7a1d7815ad325e9c18956d3ab5ddc2ec540dbad73

SHA512
1530995292a95da1ae1e00a1474230688de163826f5fe111be91d328a1a8a1e5a303a4755807762c1d8230a492bcc05cd226d808d9b497c9c90b6a5951725bd8

Download Submit
C:\Program Files (x86)\i4Tools8\x64\setting.cfg

Filesize
129B

MD5
eaf1d3d1b1f8a63ec882b1ad7366a97e

SHA1
e10465e5eae1aa3546164d226d18a2f056875644

SHA256
088030d668e628a6bf4c102ac404b58079c259d6572637c44a914cc39fcc4142

SHA512
b5b17a6510c4e34f4b8122a1caff9186a8fec3aee02a2c08fcd0842b796ded9c266d6fb3419f296af3c7d769c7b4927d11ced6e87610c8564d220b1ca6112043

Download Submit
C:\Program Files (x86)\i4Tools8\x64\setting.cfg

Filesize
59B

MD5
7e3caa76fb5d425d09052c1d2f3ba9c4

SHA1
33cf3fe3d62f1f4b28b237f66602cd7f37b2f93f

SHA256
22102cbc90b8577bd9b36902299519391919c7cdcced000dde253290ee0e66c1

SHA512
304832ae14c0f6e1568f55dff7b892ba04c4d3a55ef0fcd570b35ffbb255d8810be6b006b9d6119ed81d162a1b92ab737b420106b38f6811459a6a8cfe906631

Download Submit
C:\Program Files (x86)\i4Tools8\x64\setting.cfg.lock

Filesize
60B

MD5
941008b56fc98876227a6b9ebaaefc35

SHA1
51d927ac3b550fe7bd29bb551ee7f2aa8957f01b

SHA256
11654d19c7b9d38ac20bf9f44e86dc511e3513df813fe01c973a46a5422c24c4

SHA512
6a93e77820a3fd005ad10132ccf44805ad9a3bdec6f16a3d95c1030438277a58d6a85dc9ff6d7a96ebac29b0e22fa0099785b1e607ddfbffe1b255f9fefca9fb

Download Submit
C:\Program Files (x86)\i4Tools8\x64\translations\qt_gd.qm

Filesize
185KB

MD5
d512456777500dc13ef834ed528d3704

SHA1
90a32284052c3fe12c18afec9f7ff56735e2e34b

SHA256
c515dd2a2e00765b5f651aae124a55d617b24777138019abc5a7001da7417561

SHA512
babef929ac600c117967b42389623f352d219a466c484ae68ef3c9da9ff61555875ffb0dafc3e5eada6fb43d37f7afe74a6b6c73458a93ffb42819e1068c9a3b

Download Submit
C:\Program Files (x86)\i4Tools8\x64\translations\qt_he.qm

Filesize
135KB

MD5
26b777c6c94c5aa6e61f949aa889bf74

SHA1
f78da73388c86d4d5e90d19bb3bd5f895c027f27

SHA256
4281c421984772665a9d72ab32276cfe1e2a3b0ebe21d4b63c5a4c3ba1f49365

SHA512
8e02ce06f6de77729aefa24410cbd4bfba2d935ef10dcf071da47bb70d9c5e0969f528bdb3db5cab00e3142d7c573fcf66ea5eb4a2bc557229ad082c0eb1dbcc

Download Submit
C:\Program Files (x86)\i4Tools8\x64\translations\qtmultimedia_en.qm

Filesize
16B

MD5
bcebcf42735c6849bdecbb77451021dd

SHA1
4884fd9af6890647b7af1aefa57f38cca49ad899

SHA256
9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

SHA512
f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

Download Submit
C:\ProgramData\Microsoft\MF\Mi.jpg

Filesize
214KB

MD5
5d2ea1b6fd1cc5d08e455e7ad51e0f4c

SHA1
1b0bd077db590bcdcd5226208b02cb5a63f8c646

SHA256
9fb667f6f3fa36e5c06795e09996f3c4e2a531bf722a02e999b0862d512893a9

SHA512
f37b46ffa4fd75bd74a71221440fa373657fec6f943812e7f56304de5f57ad4ddf9465de9b39f338af2978c7105ca6af973556b772ffa86ca49c418861c5f3ae

Download Submit
C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll

Filesize
249KB

MD5
5362cb2efe55c6d6e9b51849ec0706b2

SHA1
d91acbe95dedc3bcac7ec0051c04ddddd5652778

SHA256
1d7519acca9c8a013c31af2064fbc599a0b14cfd1dfb793a345fab14045fed40

SHA512
dbd591c3d0b9847d9cef59277c03ec89e246db0e54b58fbbe9d492b75cdcb32d75444012cdfb1c77376d15db7fde1f74e694d2487c481ce29a2133342b91e1f5

Download Submit
C:\ProgramData\Microsoft\MF\thelper.exe

Filesize
225KB

MD5
8a8f890b8858b103c8b212f23530e57a

SHA1
bda99503cb1d61774f6bac690d0cd2f55987c3f1

SHA256
cace00054b96a7d71f42f4d838e4288b0e2872de541669114df5d79d72f67d40

SHA512
6b50e5c792693d85796f9338f4a35c14ea9df2fe24b20662a664a146867708000afc39ac1cf47dbb66b4ba325bbf03fae6d4e03d9c28613402469d189e7b871d

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\66dc32b0054debd3687bd1b2\22.36.31\tracking.ini

Filesize
84B

MD5
6216785264c297d4ef7cd6bf22a6f3df

SHA1
2a4967ab72084e61d4d6f767f13f9e74f4fdaaec

SHA256
41b25516531e9b2eccdcb39172b3182b4b87324ee9ac9e0ff1b418970c83d712

SHA512
dc034febc0097af631e5d2af9e31dc333b78a2fe7acf800b3b1aa6f517febe12305055729c7a5c760ee51178e6e7981c7eb21ae5fe1738302fa0f9486d8b862f

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\66dc32b0054debd3687bd1b2\22.36.31\{9914D94D-457D-49A4-B64B-25F2355E549B}.session

Filesize
18KB

MD5
d9f97b35aa4b0b4e2550141428fa6235

SHA1
591274994b4aa94b612775cf4aef154213e73639

SHA256
00b9310e1693652ed5d46a6f4d210a0d851f182b52984f10eb77e419d4a46252

SHA512
c606301cfde0f4426b06dc7488e3915e696726b37a41e83ea5e808f22a3644ca8bdf5e9f7bfaf88687b5ca7c5306327f622bdf333175308a54c94ed1212ee73f

Download Submit
C:\Windows\Installer\MSICE37.tmp

Filesize
770KB

MD5
356fc2c181cc37e3f8ae4d6b855ebfcb

SHA1
2ead1e69f14099ae33a3216a9312c88007b73cd1

SHA256
c92b2d9623f19f8acfeac5fd894346515631ebb590e68f22c40a35fbacbef03c

SHA512
74ea73d3206ba1c6f1963caa4866589fe86636f68815c74733644ad6c4913de3f1399770f6095a48c9d94a7d934072d8d8b409a393de644265f6e456455dcebd

Download Submit
C:\Windows\Installer\MSICF03.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSID312.tmp

Filesize
187KB

MD5
f11e8ec00dfd2d1344d8a222e65fea09

SHA1
235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

SHA256
775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

SHA512
6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

Download Submit
C:\Windows\Installer\MSID642.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\ProgramData\Microsoft\MF\XLFSIO.dll

Filesize
900KB

MD5
0f1dec57c5b19ce955213acdb4b8a806

SHA1
10fc8761f5a4b0eb03b7c71f65cddf4cad43bd18

SHA256
034f10e6615ad547e54a66d2096831934ff30e72293553c4f432fb8f2f06160f

SHA512
92aeadd53e682bfe35b849e751fb8eed98af643040e4da3e1bf24817ad1c540834607470a29e750e0e73525fb154f155c76a04c8435b79dcdbc1ea7464eddd5f

Download Submit
\ProgramData\Microsoft\MF\XLFSIO2.dll

Filesize
209KB

MD5
1bc7af7a8512cf79d4f0efc5cb138ce3

SHA1
68fd202d9380cacd2f8e0ce06d8df1c03c791c5b

SHA256
ef474b18f89310c067a859d55abd4e4f42fdac732e49eafe4246545e36872a62

SHA512
84de4d193d22a305be2ba28fc67bd1cccf83616cead721e57347f1b2e0736d351fef1abf168f7914caa1bcc7a72db43769991016673cd4646def544802ee8960

Download Submit
\ProgramData\Microsoft\MF\XLGraphic.dll

Filesize
730KB

MD5
74c75ae5b97ad708dbe6f69d3a602430

SHA1
a02764d99b44ce4b1d199ef0f8ce73431d094a6a

SHA256
89fbb6b1ca9168a452e803dbdc6343db7c661ad70860a245d76b3b08830156e2

SHA512
52c5f7e00dffb1c0719d18184da2cc8ec2ad178b222775f167b87320f0683a3c2846e30190bc506f12d14c07fa45896935b3d4ac396baa14d7564996e35c2ada

Download Submit
\ProgramData\Microsoft\MF\XLUE.dll

Filesize
2.4MB

MD5
0abbe96e1f7a254e23a80f06a1018c69

SHA1
0b83322fd5e18c9da8c013a0ed952cffa34381ae

SHA256
10f099f68741c179d5ad60b226d15233bb02d73f84ce51a5bbbbc4eb6a08e9d4

SHA512
2924e1e11e11bd655f27eb0243f87002a50a2d4b80e0b0e3ad6fd4c3d75c44222fab426fcaa695881b0093babf544e8aeee50a065ea92274145b0f88b1db0c58

Download Submit
\ProgramData\Microsoft\MF\ic.dll

Filesize
1.6MB

MD5
6a718dd2abeb2eed131f1cc806ac5779

SHA1
c33f8b477b44030efd9687e4da3fa6865a2d9ec9

SHA256
43d45a8a3a80192738b62071dcb5f8d4a8bccbe5291fff4885ef0905ca6184c6

SHA512
c0967fb8e40f737eb282c1ffef05f30e61b7ff7c889d43da85fb2ddd123d3f69daeabe5ea5609d5f87b1c84b27bcb3b3e11290bae5643c2dfe8c296d2e18fa6c

Download Submit
\ProgramData\Microsoft\MF\libexpat.dll

Filesize
668KB

MD5
5ff790879aab8078884eaac71affeb4a

SHA1
59352663fdcf24bb01c1f219410e49c15b51d5c5

SHA256
cceca70f34bbcec861a02c3700de79ea17d80c0a7b9f33d7edd1357a714e0f2f

SHA512
34fbaffc48912e3d3fa2d224e001121e8b36f5be7284a33eb31d306b9a5c00de6e23a9fdc1a17a61fb1371768f0b0e30b9c6e899a08c735fc70482d5aa8ea824

Download Submit
\ProgramData\Microsoft\MF\libpng13.dll

Filesize
157KB

MD5
bb1922dfbdd99e0b89bec66c30c31b73

SHA1
f7a561619c101ba9b335c0b3d318f965b8fc1dfb

SHA256
76457f38cbbdd3dce078a40d42d9ac0dc26ae1c4bb68ab9c880eb7ffb400fd99

SHA512
3054574dd645feb1468cee53db2fd456e4f923eaf5fd686557a01c72c0572b19d70f3885d47fe42e97cdf7ccc2c674a6e966ff19668907cf7828e0a943cf474a

Download Submit
\ProgramData\Microsoft\MF\mt.dll

Filesize
239KB

MD5
2e3ea2f95bfec380e7e79be332fd2012

SHA1
ff5d3be9b93e29342a27db14a69708ab6ad7807e

SHA256
b38def2980035b94f706a53b27ae7f9d31c41831b46fb70712b10a73b5068095

SHA512
91d79bf7c163769bd24ecc6c3b24c642a8a72d90b059297958ac01e7a8baa270954f501c25458a3df5f27fee24510d903a9a1f4b5f664f5f4152385b7f8a0906

Download Submit
\ProgramData\Microsoft\MF\zlib1.dll

Filesize
62KB

MD5
37163aacc5534fbab012fb505be8d647

SHA1
73de6343e52180a24c74f4629e38a62ed8ad5f81

SHA256
0a6357a8852daaafe7aed300e2f7e69d993cac4156e882baa8a3a56b583255ba

SHA512
c3bed1c9bc58652ed16b162ed16a93cf7479a0492db7e6ea577001dbe859affc0b20387d93d23e06e73f49f395e4c9a5a07680f000ebb82d32269742c16a5242

Download Submit
\Windows\Installer\MSICFB1.tmp

Filesize
897KB

MD5
6189cdcb92ab9ddbffd95facd0b631fa

SHA1
b74c72cefcb5808e2c9ae4ba976fa916ba57190d

SHA256
519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

SHA512
ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

Download Submit
memory/288-293-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/288-278-0x0000000000240000-0x0000000000348000-memory.dmp

Filesize
1.0MB

Download
memory/288-285-0x0000000000120000-0x0000000000155000-memory.dmp

Filesize
212KB

Download
memory/288-288-0x00000000004D0000-0x000000000050F000-memory.dmp

Filesize
252KB

Download
memory/288-294-0x0000000072450000-0x0000000072686000-memory.dmp

Filesize
2.2MB

Download
memory/1620-1884-0x0000000002130000-0x000000000213A000-memory.dmp

Filesize
40KB

Download
memory/1620-1886-0x0000000002130000-0x000000000213A000-memory.dmp

Filesize
40KB

Download
memory/1620-1885-0x0000000002130000-0x000000000213A000-memory.dmp

Filesize
40KB

Download
memory/1620-1864-0x0000000002020000-0x000000000202A000-memory.dmp

Filesize
40KB

Download
memory/1620-1861-0x000007FEF53D0000-0x000007FEF590D000-memory.dmp

Filesize
5.2MB

Download
memory/1620-1862-0x000007FEF2410000-0x000007FEF2800000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1863-0x000000013FFD0000-0x0000000140D39000-memory.dmp

Filesize
13.4MB

Download
memory/1944-226-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/2956-256-0x0000000072450000-0x0000000072686000-memory.dmp

Filesize
2.2MB

Download
memory/2956-263-0x0000000000CA0000-0x0000000000CCA000-memory.dmp

Filesize
168KB

Download
memory/2956-258-0x0000000000D10000-0x0000000000D41000-memory.dmp

Filesize
196KB

Download
memory/2956-247-0x0000000000350000-0x000000000038F000-memory.dmp

Filesize
252KB

Download
memory/2956-255-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/2956-243-0x0000000000310000-0x0000000000345000-memory.dmp

Filesize
212KB

Download
memory/2956-282-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/2956-233-0x00000000004D0000-0x00000000005D8000-memory.dmp

Filesize
1.0MB

Download
memory/2956-295-0x0000000072450000-0x0000000072686000-memory.dmp

Filesize
2.2MB

Download