a847b574c6b43c4e5b517bc1487fca6bf83e0f4b3d7517ee32506289a099ee42

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b58b6.msi
Size 6.4MB
Sample240921-yttp2a1apb
SHA256 a847b574c6b43c4e5b517bc1487fca6bf83e0f4b3d7517ee32506289a099ee42
MD5 ed38e3d4ba9a727b436994c2de44b49a
SHA1 e1b528f4437613cde1cf9dddd5414de76a28f8fa
SHA512 260efdd8de9b845a2d5689257d2f4ffe182e7493b643b0525813dd001dbc36c05238d02b00a556f6c29c8547a54eeecea1dad606dd9ee6991678f00c55d645a7
SSDEEP 196608:FBstEAABrjAQq8v8R9hZugbD2RDUrn0P:FKVA9vSPRiUz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2636	ICACLS.EXE
2240	ICACLS.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PixWindowsUI = "\"C:\\Program Files\\printix.net\\Printix Client\\PrintixClient.exe\" -console"	PrintixService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PixWindowsUI = "\"C:\\Program Files\\printix.net\\Printix Client\\PrintixClient.exe\" -console"	PrintixService.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2052	msiexec.exe
5	2052	msiexec.exe
6	1600	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Modifies Windows Firewall 2 TTPs 21 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
840	netsh.exe
920	netsh.exe
968	netsh.exe
1644	netsh.exe
1544	netsh.exe
1556	netsh.exe
2404	netsh.exe
620	netsh.exe
2284	netsh.exe
2436	netsh.exe
580	netsh.exe
1632	netsh.exe
1704	netsh.exe
1448	netsh.exe
2940	netsh.exe
1652	netsh.exe
2168	netsh.exe
332	netsh.exe
2960	netsh.exe
2652	netsh.exe
2912	netsh.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	PrintixService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\printix.net\Printix Client\uninsports.exe	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-BLIT6.tmp	PrintixClientWindows.tmp
File opened for modification	C:\Program Files\printix.net\Printix Client\unins000.dat	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-ITI52.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-47HRK.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\unins000.msg	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\PrintixService.InstallState	PrintixService.exe
File opened for modification	C:\Program Files\printix.net\Printix Client\PrintixClient.exe	PrintixClientWindows.tmp
File opened for modification	C:\Program Files\printix.net\Printix Client\PrintixService.exe	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-FNQRI.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\unins000.dat	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-0HM33.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-2D2KN.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\PrintixPackage.txt	cmd.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Installer\f76eacc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF12E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFA5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFA6.tmp	msiexec.exe
File created	C:\Windows\Installer\{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\f76eacd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDA3.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76eacd.ipi	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\MSIBD53.tmp	msiexec.exe
File created	C:\Windows\Installer\f76eacf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76eacc.msi	msiexec.exe

Executes dropped EXE 10 IoCs

pid	Process
2556	PrintixClientWindows.exe
2768	PrintixClientWindows.tmp
1452	_setup64.tmp
1592	dismhost.exe
2312	dismhost.exe
1612	PrintixService.exe
2876	PrintixService.exe
1652	PrintixClient.exe
1264	PrintixClient.exe
2320	PrintixService.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2856	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
604	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2556	PrintixClientWindows.exe
2768	PrintixClientWindows.tmp
2768	PrintixClientWindows.tmp
2768	PrintixClientWindows.tmp
2768	PrintixClientWindows.tmp
2768	PrintixClientWindows.tmp
2564	dism.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1592	dismhost.exe
1980	dism.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe
2312	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2052	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 63 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrintixClientWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrintixClientWindows.tmp

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\PrintixClient.exe = "10000"	PrintixService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\PrintixClient.exe = "10000"	PrintixService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\PrintixClient.exe = "10000"	PrintixService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	PrintixService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	PrintixClientWindows.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	PrintixService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	PrintixService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	PrintixService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	PrintixService.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\ProductIcon = "C:\\Windows\\Installer\\{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\081F6267FDDAAC049A3F8AD6A6FA2E41\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\ProductName = "Printix Client"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\PackageName = "6b58b6.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\PackageCode = "A3CB67CE6FE718140BF435663BEDA986"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5484946F8013B247A643FF05DC7424C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5484946F8013B247A643FF05DC7424C\081F6267FDDAAC049A3F8AD6A6FA2E41	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\081F6267FDDAAC049A3F8AD6A6FA2E41	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Version = "33685505"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Media	msiexec.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PrintixService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PrintixService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PrintixService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	PrintixService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PrintixService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PrintixService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PrintixService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	PrintixService.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1600	msiexec.exe
1600	msiexec.exe
2768	PrintixClientWindows.tmp
2768	PrintixClientWindows.tmp
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
1612	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe
2876	PrintixService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2052	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeSecurityPrivilege	1600	msiexec.exe
Token: SeCreateTokenPrivilege	2052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2052	msiexec.exe
Token: SeLockMemoryPrivilege	2052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2052	msiexec.exe
Token: SeMachineAccountPrivilege	2052	msiexec.exe
Token: SeTcbPrivilege	2052	msiexec.exe
Token: SeSecurityPrivilege	2052	msiexec.exe
Token: SeTakeOwnershipPrivilege	2052	msiexec.exe
Token: SeLoadDriverPrivilege	2052	msiexec.exe
Token: SeSystemProfilePrivilege	2052	msiexec.exe
Token: SeSystemtimePrivilege	2052	msiexec.exe
Token: SeProfSingleProcessPrivilege	2052	msiexec.exe
Token: SeIncBasePriorityPrivilege	2052	msiexec.exe
Token: SeCreatePagefilePrivilege	2052	msiexec.exe
Token: SeCreatePermanentPrivilege	2052	msiexec.exe
Token: SeBackupPrivilege	2052	msiexec.exe
Token: SeRestorePrivilege	2052	msiexec.exe
Token: SeShutdownPrivilege	2052	msiexec.exe
Token: SeDebugPrivilege	2052	msiexec.exe
Token: SeAuditPrivilege	2052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2052	msiexec.exe
Token: SeChangeNotifyPrivilege	2052	msiexec.exe
Token: SeRemoteShutdownPrivilege	2052	msiexec.exe
Token: SeUndockPrivilege	2052	msiexec.exe
Token: SeSyncAgentPrivilege	2052	msiexec.exe
Token: SeEnableDelegationPrivilege	2052	msiexec.exe
Token: SeManageVolumePrivilege	2052	msiexec.exe
Token: SeImpersonatePrivilege	2052	msiexec.exe
Token: SeCreateGlobalPrivilege	2052	msiexec.exe
Token: SeBackupPrivilege	2084	vssvc.exe
Token: SeRestorePrivilege	2084	vssvc.exe
Token: SeAuditPrivilege	2084	vssvc.exe
Token: SeBackupPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	860	DrvInst.exe
Token: SeLoadDriverPrivilege	860	DrvInst.exe
Token: SeLoadDriverPrivilege	860	DrvInst.exe
Token: SeLoadDriverPrivilege	860	DrvInst.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeBackupPrivilege	2564	dism.exe
Token: SeRestorePrivilege	2564	dism.exe
Token: SeBackupPrivilege	1980	dism.exe
Token: SeRestorePrivilege	1980	dism.exe
Token: SeDebugPrivilege	1612	PrintixService.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2052	msiexec.exe
2768	PrintixClientWindows.tmp
2052	msiexec.exe
1264	PrintixClient.exe
1264	PrintixClient.exe
1264	PrintixClient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1264	PrintixClient.exe
1264	PrintixClient.exe
1264	PrintixClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 604	1600	msiexec.exe	35
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 1600 wrote to memory of 2632	1600	msiexec.exe	36
PID 2632 wrote to memory of 2636	2632	MsiExec.exe	37
PID 2632 wrote to memory of 2636	2632	MsiExec.exe	37
PID 2632 wrote to memory of 2636	2632	MsiExec.exe	37
PID 2632 wrote to memory of 2636	2632	MsiExec.exe	37
PID 2632 wrote to memory of 2900	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2900	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2900	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2900	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2632 wrote to memory of 2556	2632	MsiExec.exe	41
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2556 wrote to memory of 2768	2556	PrintixClientWindows.exe	42
PID 2768 wrote to memory of 2772	2768	PrintixClientWindows.tmp	43
PID 2768 wrote to memory of 2772	2768	PrintixClientWindows.tmp	43
PID 2768 wrote to memory of 2772	2768	PrintixClientWindows.tmp	43
PID 2768 wrote to memory of 2772	2768	PrintixClientWindows.tmp	43
PID 2772 wrote to memory of 2544	2772	net.exe	45
PID 2772 wrote to memory of 2544	2772	net.exe	45
PID 2772 wrote to memory of 2544	2772	net.exe	45
PID 2772 wrote to memory of 2544	2772	net.exe	45
PID 2768 wrote to memory of 1452	2768	PrintixClientWindows.tmp	46
PID 2768 wrote to memory of 1452	2768	PrintixClientWindows.tmp	46
PID 2768 wrote to memory of 1452	2768	PrintixClientWindows.tmp	46
PID 2768 wrote to memory of 1452	2768	PrintixClientWindows.tmp	46
PID 2768 wrote to memory of 2956	2768	PrintixClientWindows.tmp	48
PID 2768 wrote to memory of 2956	2768	PrintixClientWindows.tmp	48
PID 2768 wrote to memory of 2956	2768	PrintixClientWindows.tmp	48
PID 2768 wrote to memory of 2956	2768	PrintixClientWindows.tmp	48
PID 2956 wrote to memory of 2912	2956	cmd.exe	50
PID 2956 wrote to memory of 2912	2956	cmd.exe	50
PID 2956 wrote to memory of 2912	2956	cmd.exe	50
PID 2956 wrote to memory of 1632	2956	cmd.exe	51
PID 2956 wrote to memory of 1632	2956	cmd.exe	51
PID 2956 wrote to memory of 1632	2956	cmd.exe	51
PID 2956 wrote to memory of 1556	2956	cmd.exe	52
PID 2956 wrote to memory of 1556	2956	cmd.exe	52
PID 2956 wrote to memory of 1556	2956	cmd.exe	52
PID 2956 wrote to memory of 2404	2956	cmd.exe	53
PID 2956 wrote to memory of 2404	2956	cmd.exe	53
PID 2956 wrote to memory of 2404	2956	cmd.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6b58b6.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A73CB615512903BBA7CEA43899DC6BD9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\files"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2EFC764E319132A45E5CE9B754DB71B2 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\files\PrintixClientWindows.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\files\PrintixClientWindows.exe" /MSIEXE="C:\Users\Admin\AppData\Local\Temp\6b58b6.msi" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\is-8IL20.tmp\PrintixClientWindows.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8IL20.tmp\PrintixClientWindows.tmp" /SL5="$6017A,5919142,119296,C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\files\PrintixClientWindows.exe" /MSIEXE="C:\Users\Admin\AppData\Local\Temp\6b58b6.msi" /VERYSILENT
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Windows\SysWOW64\net.exe
        
        net stop PrintixService
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop PrintixService
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\is-M02GK.tmp\_isetup\_setup64.tmp
        
        helper 105 0x27C
        5⤵
        Executes dropped EXE
        
        PID:1452
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\printix.net\Printix Client\open_firewall.cmd""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2956
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix SNMP, UDP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:2912
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix PDP, UDP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:1632
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Raw Print , TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:1556
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Jobforward, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:2404
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Redirector, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:840
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Task Manager, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1652
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix UI Communication, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:920
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix IPP Print, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:968
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix PDP, UDP" protocol=UDP dir=in localport=21337 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:2168
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Jobforward, TCP" protocol=TCP dir=in localport=21335 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:620
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Redirector, TCP" protocol=TCP dir=in localport=21336 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1644
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix UI Communication, TCP" protocol=TCP dir=in localport=21338 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:1704
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix IPP Print, TCP" protocol=TCP dir=in localport=21339 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:1448
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Capture, TCP" protocol=TCP dir=in localport=21343 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:332
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix SNMP, UDP" protocol=UDP dir=out localport=161 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:2284
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix PDP, UDP" protocol=UDP dir=out localport=21337 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2940
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Raw Print , TCP" protocol=TCP dir=out localport=9100 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:2960
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Jobforward, TCP" protocol=TCP dir=out localport=21335 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2436
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Redirector, TCP" protocol=TCP dir=out localport=21336 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:580
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix UI Communication, TCP" protocol=TCP dir=out localport=21338 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:1544
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix IPP Print, TCP" protocol=TCP dir=out localport=21339 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2652
    - - C:\Windows\system32\dism.exe
        
        dism /online /enable-feature /NoRestart /featurename:Printing-InternetPrinting-Client
        5⤵
        Drops file in Windows directory
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\dismhost.exe {DF770EF6-1DBB-41AF-8CEB-4DA930C74E13}
        6⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1592
    - - C:\Windows\system32\dism.exe
        
        dism /online /enable-feature /NoRestart /featurename:Printing-Foundation-InternetPrinting-Client
        5⤵
        Drops file in Windows directory
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\DA65F775-7069-47EF-90BA-CD0753509127\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\DA65F775-7069-47EF-90BA-CD0753509127\dismhost.exe {5834986F-8EF8-47B7-930D-45BC2EF5CF33}
        6⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2312
    - - C:\Windows\system32\net.exe
        
        net stop spooler /yes
        5⤵
        
        PID:2868
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop spooler /yes
        6⤵
        
        PID:3060
    - - C:\Windows\system32\net.exe
        
        net start spooler
        5⤵
        
        PID:856
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start spooler
        6⤵
        
        PID:1720
    - - C:\Windows\system32\net.exe
        
        net start LPDSVC
        5⤵
        
        PID:2496
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start LPDSVC
        6⤵
        
        PID:1680
    - - C:\Windows\system32\cmd.exe
        
        cmd /c echo "C:\Users\Admin\AppData\Local\Temp\6b58b6.msi" > "C:\Program Files\printix.net\Printix Client\PrintixPackage.txt"
        5⤵
        Drops file in Program Files directory
        
        PID:1652
    - - C:\Program Files\printix.net\Printix Client\PrintixService.exe
        
        "C:\Program Files\printix.net\Printix Client\PrintixService.exe" -install
        5⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Executes dropped EXE
        Modifies Internet Explorer settings
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c sc failure PrintixService reset= 0 actions= restart/60000/restart/60000/restart/60000
        5⤵
        
        PID:2564
      - C:\Windows\system32\sc.exe
        
        sc failure PrintixService reset= 0 actions= restart/60000/restart/60000/restart/60000
        6⤵
        Launches sc.exe
        
        PID:2856
    - - C:\Windows\system32\net.exe
        
        net start PrintixService
        5⤵
        
        PID:2596
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start PrintixService
        6⤵
        
        PID:1900
    - - C:\Program Files\printix.net\Printix Client\PrintixClient.exe
        
        "C:\Program Files\printix.net\Printix Client\PrintixClient.exe" -register
        5⤵
        Executes dropped EXE
        
        PID:1652
      - C:\Program Files\printix.net\Printix Client\PrintixClient.exe
        
        "C:\Program Files\printix.net\Printix Client\PrintixClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1264
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003EC" "0000000000000568"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2924

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2800

C:\Program Files\printix.net\Printix Client\PrintixService.exe
"C:\Program Files\printix.net\Printix Client\PrintixService.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /delete /F /tn "PrintixService"
  2⤵
  PID:3060
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /tn "PrintixService"
    3⤵
    PID:1808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 1888
  2⤵
  PID:1148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1960

C:\Program Files\printix.net\Printix Client\PrintixService.exe
"C:\Program Files\printix.net\Printix Client\PrintixService.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:2320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /delete /F /tn "PrintixService"
  2⤵
  PID:2108
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /tn "PrintixService"
    3⤵
    PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 1848
  2⤵
  PID:1860

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f76eace.rbs

Path C:\Config.Msi\f76eace.rbs
Size 7KB
SHA256 865b6a1d4b834e4536d9f0803ef1b88e6b1c1affc1bc9dd747c51c49cf58f32d
MD5 6795fbb44a03ea59f0f26a1a589f7fee
SHA1 8d6bd51509aca6820f5a4b51d81b8eb5478365dc
SHA512 959d774fb8d6c7ac92ce77fadc5cb04b1fc20eee0fe640c8086e7543b5f671db24a1550ff467ae89b75d6fef6c24ae024eb5e9f0df58efa9abf92706d85c4a08
SSDEEP 96:MquqWpoKeeBIr6m1UaU1x+5CsAqKNaU1x+5C6jbvO6lAqAHA65LZBgJGICopljb6:M2De7uchuc97bopM
MD5 SHA1 SHA512 SSDEEP

Submit Download

open_firewall.cmd

Path C:\Program Files\printix.net\Printix Client\open_firewall.cmd
Size 2KB
SHA256 744a3484929315f4ae35a24dc7a896b9cac492f265995ac128285bfbdaf89902
MD5 a51d11953b618b2c42e86bb634c317b9
SHA1 cbe594474be47bde9a88ddc75e9d3277e39e43f8
SHA512 0daa95f6f6361662392289abff310adc2c455674e7ca2ae97e7e1980bdd035dc386e6a8e8106541465141d5a76e4e2073d30a37effba31130de5d96ecde925de
MD5 SHA1 SHA512

Submit Download

F2E248BEDDBB2D85122423C41028BFD4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
Size 1KB
SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
MD5 78f2fcaa601f2fb4ebc937ba532e7549
SHA1 ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA512 bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 053c066e22fe117322d3f392175ae909b408c7bbf2fde23b0696a04aa52d9d6c
MD5 0ae121f4d720f31a3c790325b043715a
SHA1 6b80ba9e6e3443d5ed051e43b461df1ef96859c9
SHA512 4f45be8a3d4a4ed195a72a89e3ddb6fcb4f17d47caedae35899f15ca59312572ce4033bc0acab26225fbcb086260625eb2a639e3aa3f127e8bbefe1299f2383c
MD5 SHA1 SHA512

Submit Download

F2E248BEDDBB2D85122423C41028BFD4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Size 254B
SHA256 68102d8ce12d020a59701e86e1b821222502133cfda5be479ce8bee138d76220
MD5 3c8469790b6962f6abd2b8e2846f1d92
SHA1 c1b43e9b1359e3127dc17e2ff38ef2d348d670f4
SHA512 d505fcc09574c6afaa712bb5ecd4186804b0a14966b33abe8cba3593974eb848eee364a15b8157016ca60a97dd5364b0b8d0c287606147a77a7eeeeafdbd9d51
MD5 SHA1 SHA512

Submit Download

CbsProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\CbsProvider.dll
Size 744KB
SHA256 b641d944428f5b8ffb2fefd4da31c6a15ba84d01130f2712d7b1e71c518805bd
MD5 efcb002abc3529d71b61e6fb6434566c
SHA1 a25aca0fc9a1139f44329b28dc13c526965d311f
SHA512 10ee2b20f031ca5a131a9590599f13d3f0029352376705a2d7d2134fcd6535a3b54356d1b4d0b3fb53ac5ca4f034f9afb129a4f601159938680197ea39ea0687
SSDEEP 6144:UHPuthhkBD4LYSG2tMA5eURzbw3dD2QGleUV6P0prskNQRj2JbKyAnIWn3GJETGD:d5DZMA5/adD/wNskaj2JO1nIc3GA+
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompatProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\CompatProvider.dll
Size 179KB
SHA256 328e5fbb6f3088fd759d855e656cd4c477b59f6a43a247954d1fd9050815e6cb
MD5 6a4bd682396f29fd7df5ab389509b950
SHA1 46f502bec487bd6112f333d1ada1ec98a416d35f
SHA512 35ced350482c94d22c85cd1b98890d01baed0da1c35a114d2cd6373d08969be764282f7a9d8ff0dd1dff3fae42e4ea20d3194c352364901b23ca2f375bd02751
SSDEEP 3072:ENU3b0JkZ1SyD8n/abDCMIGSOvQxoBkP:EQb7Z1SyD8/a289
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCore.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\DismCore.dll
Size 283KB
SHA256 7c675710ae52d5e8344465f1179ec4e03c882d5e5b16fc0ba9564b1ea121638f
MD5 f2b0771a7cd27f20689e0ab787b7eb7c
SHA1 eb56e313cd23cb77524ef0db1309aebb0b36f7ef
SHA512 5ebd4685e5b949d37c52bb1f2fe92accfa48dd4ef585c898f3982eb52f618064fc95c2f98532ca3e7007d0ef71c1fe91887ce3dc0a563f09bc2c5f59f3a3082a
SSDEEP 6144:41oqY3hkca8cWbKsX1W0oeKVpWI5PnNREdA/oQ:4y9a8cWOsX1WBeCF5PnNaMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\DismCorePS.dll
Size 109KB
SHA256 abaada27d682b0d7270827c0271ac04505800b11d04b764562e4baa2cbc306a0
MD5 5488e381238ff19687fdd7ab2f44cfcc
SHA1 b90fa27ef6a7fc6d543ba33d5c934180e17297d3
SHA512 933e99749c68b3e9fe290fe4a1d8c90732ba13092d8cd9cac64f8e6583c8dcfbf25a4bea122966bc5d7d92e3a21210365a03b52274d25d704de52631e1fb0412
SSDEEP 768:CPXx17jrHgO1StkxjgBjsRP5bpccM0xnk1x0oe5zlrIMzHgGRK5RhVWf:GXx1/rHgO1SNmR1y0xnk1IRK5ZWf
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\DmiProvider.dll
Size 425KB
SHA256 e6c93305d886bff678bd83b715bb5c5cbb376b90b973d9dd6844fac808de5c82
MD5 fc2db5842190c6e78a40cd7da483b27c
SHA1 e94ee17cd06fb55d04bef2bdfcf5736f336e0fa0
SHA512 d5d32b894a485447d55499a2f1e02a8b33fb74081f225b8e2872995491a37353cf8022f46feeb3ca363b2e172ab89e29ab9a453692d1a964ca08d40230574bf6
SSDEEP 6144:IIz60LyxRBSQ/qZHWmPP5zzivblhGYhWvuuE:pODRkQCZXFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\FolderProvider.dll
Size 52KB
SHA256 af0a38b4e95a50427b215eebc185bb621187e066b8b7373fb960eac0551bec37
MD5 c9d74156913061be6c51d8fc3acf8e93
SHA1 4a4c6473a478256e4c78b423e918191118e01093
SHA512 c12f75a6451881878a7a9ed5de61d157ea36f53aa41abf7660e1cc411b2ddd70ff048a307b1440cfdf1b269aeff77da8cc163ad19e9e3a294a5128f170f37047
SSDEEP 1536:KO0ibbJbb5nEqMYRpRSH3oozrqqh//gmP:Qibb95EqPuHrnh/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\IntlProvider.dll
Size 306KB
SHA256 b92cf901027901d7066e9ee7ac8f3b48a99cfb3a3ddd8d759cb77295148943c1
MD5 bbb9e4fa2561f6a6e5ccf25da069ac1b
SHA1 2d353ec70c7a13ac5749d2205ac732213505082a
SHA512 01f4e6d51a0acb394693191b78cefa28759903036636a1d64f90c60dc59c948c78dd38df6fb2be149245622eadf8b2627c6767bf2aa2e0e56e6b52f0b91cc79e
SSDEEP 6144:JLuGk/ZlHmP3w0Nioo5DhxGbqC4zE0jsxS:F8/ZlHmP3w0fEDDGbqC+aS
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\LogProvider.dll
Size 104KB
SHA256 83c0f61cc8fc01c789c07dd25f58862e0710088e6887716b1be9ee9f149adefc
MD5 62de64dc805fd98af3ada9d93209f6a9
SHA1 392ba504973d626aaf5c5b41b184670c58ec65a7
SHA512 7db48f240df566be9a4b836807f97e8169d58edfa699de69be35b3977e442da3fea4f8b38d359d50f4d5afcf8547c8f66329e5ec855efbc5402ce88458d67e28
SSDEEP 3072:wTRhM075bQ2HKBk8p8SJJLFJCAMX0Igx7DAJoNH:cL5c2HqeUJLvMX0Igx7DAJoN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\MsiProvider.dll
Size 211KB
SHA256 8a85869b2d61bad50d816daf08df080f8039dbeb1208009a73daa7be83d032bd
MD5 45ff4fa5ca5432bfccded4433fe2a85b
SHA1 858c42499dd9d2198a6489dd310dc5cbff1e8d6e
SHA512 abbe0f673d18cc9a922cfd677e5b88714a3049ad8937f836b5a8b9bddac5ddbad4dc143360efc018dcd3a3440aa3e516b1a97f7cd2fa9a55cb73739dedef1589
SSDEEP 3072:YsUz6fixetpsB06IVlNQ2/MEq+HCdAUt5OQlUoMI:HUmfiW6+6IVlNQ+cdAqX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dismprov.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\dismprov.dll
Size 182KB
SHA256 f351c3597c98ea9fe5271024fc2ccf895cc6a247fb3b02c1cdb68891dac29e54
MD5 8ca117cb9338c0351236939717cb7084
SHA1 baa145810d50fdb204c8482fda5cacaaf58cdad0
SHA512 35b4be68666d22f82d949ad9f0ce986779355e7d2d8fd99c0e2102cd364aba4a95b5805269261a9205c1130bdd1f5101d16146d9334c27796c7f41f2c3166c35
SSDEEP 3072:3vvMMRRLxhtr4mpyuOJLwKpZlrw9fmbyg605xxWORS:3XnLxlDyZlG0
MD5 SHA1 SHA512 SSDEEP

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\CbsProvider.dll.mui
Size 32KB
SHA256 d13f068f42074b3104987bfed49fbf3a054be6093908ed5dea8901887dddb367
MD5 724ee7133b1822f7ff80891d773fde51
SHA1 d10dff002b02c78e624bf83ae8a6f25d73761827
SHA512 1dfd236537d6592a19b07b5e1624310c67adff9e776e6d2566b9e7db732588988f9ae7352df6c3b53c058807d8ed55fafc2004a2d6dc2f3f6c9e16445699f17b
SSDEEP 384:Dvr6EFTNC7wmxGROa+JnvNRQf/rfKZlNYMAiui35RJAd4OViczIq4x7owkyxekop:DdT4smxGR9qzAYOghJOoLmJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompatProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\CompatProvider.dll.mui
Size 12KB
SHA256 fe0719cf624e08b5d6695ee3887358141d11316489c4ea97d2f61a4d2b9060cd
MD5 9085b83968e705a3be5cd7588545a955
SHA1 f0a477b353ca3e20fa65dd86cb260777ff27e1dd
SHA512 b7f12f7ac1e6942f24f4bf35444f623cc93f8a047ebc754b9599d5df16cab4d3745729d11b4a3abfdc06a671e55ac52cac937badd808825906f52885f16f2c1c
SSDEEP 192:PaDFvzNGKykEBaZbeNRZs5JAdN6riB70BEG1WWo7WM:C55tykEB0beNRZs5JAd4OB77G1WWo7WM
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\DismCore.dll.mui
Size 6KB
SHA256 a650578a4630e1a49280dc273d1d0bbdca81664a2199e5ab44ec7c5c54c0a35e
MD5 f18044dec5b59c82c7f71ecffe2e89ab
SHA1 731d44676a8f5b3b7ad1d402dfdbb7f08bdc40c6
SHA512 53c23acddab099508b1e01dcc0d5dc9d4da67bc1765087f4a46b9ac842de065a55bac4c6682da07f5a1d29a3d0c1d92a4310e6b0f838740d919f8285911fa714
SSDEEP 96:1aiiiWwdwCg/PCpQcBK8Cq9oqEWB3OWwC:pp6WB3OWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\DmiProvider.dll.mui
Size 15KB
SHA256 6991fb4bfd6800385a32ac759dd21016421cb13dca81f04ddcaf6bf12a928ccc
MD5 ee8c06cd11b34a37579d118ac5d6fa1d
SHA1 c62f7fb0c6f42321b33ea675c0dfd304b2eb4a15
SHA512 091cfa7d9b80e92df13ba829372dfb211214f4221e52fbf3f558ebb7f18736ad9ad867ea0d0ddf8938def1b4db64a12d0df37c2eaf41727b997f4905dd41fed1
SSDEEP 192:7+0W6eHJr6dVD4hQf3092HdHUcbR1b0aYWw8vWt:I6eHJr6dVH3J9bbvbHYWw8vWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\FolderProvider.dll.mui
Size 2KB
SHA256 14bec7c4bb6cf1ee9049ef8820ec88bf78f2af75615f7a3fb265ef4b45c30e4d
MD5 cab37f952682118bac4a3f824c80b6ac
SHA1 6e35b4289927e26e3c50c16cbf87eb3ac6f3b793
SHA512 de9089adaa85f37201526b8619f697be98a7d05353b21b6d835f4d56803732380316359ba8b3c8ca7c14a9bf7cf31a7eff3c866a8f303ef737eb63573e01aa19
MD5 SHA1 SHA512

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\IntlProvider.dll.mui
Size 26KB
SHA256 b7bcc0e99719f24c30e12269e33a8bf09978c55593900d51d5f8588e51730739
MD5 0bffb5e4345198dbf18aa0bc8f0d6da1
SHA1 e2789081b7cf150b63bad62bac03b252283e9fe5
SHA512 590e8016075871846efff8b539e4779a1a628de318c161292c7231ca964a310e0722e44816041786c8620bff5c29ff34c5f35733ee4eac74f3abfae6d3af854a
SSDEEP 384:mL/n82qyIMbnSRGClJVFa06QWQ0QdQbWVJ4WX:mL/8Sfn6GCJFsQpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\LogProvider.dll.mui
Size 5KB
SHA256 f5c89ba078697cdb705383684af49e07cdd094db962f0649cad23008ae9d6ce2
MD5 f909216cf932aeb4f2f9f02e8c56a815
SHA1 c5cafe5f8dad60d3a1d7c75aa2cf575e35a634f2
SHA512 5dca19d54f738486085f11b5a2522073894a97d67e67be0eadbe9dc8944e632ae39b24499d7ff16e88d18166031697a238ead877f12cbb7447acca49c32a184a
SSDEEP 96:XXM6czix6RXToVSHvoXBD3LXnvoJnoN6yvG8vIREWgQrWws:HMniIh0IHAXB7DnAJoN6yO8wSWgQrWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dismprov.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\en-US\dismprov.dll.mui
Size 2KB
SHA256 55e9ae098def76e7388d7d069746dbd136ae243357ece23b77f2365f0b2ff76f
MD5 9bc5d6eb3e2d31bbdbffe127a1b3cdbf
SHA1 b253025c442aefe338b4c7ebea2f7d808abc9618
SHA512 f9968554737d181d4b7d0366f40f0c9a2039b59796986964413fa08f031f5529411b2741eb8ea3d8c312112b2038e6a58d891d090a42672c3d1c782b859f2e08
MD5 SHA1 SHA512

Submit Download

wdscore.dll

Path C:\Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\wdscore.dll
Size 265KB
SHA256 3f6dd990e2da5d3bd6d65a72cbfb0fe79eb30b118a8ad71b6c9bb5581a622dce
MD5 7b38d7916a7cd058c16a0a6ca5077901
SHA1 f79d955a6eac2f0368c79f7ba8061e9c58ba99b2
SHA512 2d22fe535f464f635d42e5b016741b9caf173da372e4563a565fa1e294581f44330c61e08edfe4c08a341ebd708e2ad08614161c0ee54e8dea99452b87d1e710
SSDEEP 6144:750/qCtAFbCDjacN6iRD8Yv1/AXn4IjmLsHe:AHtANCDjacnQW1/SD
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabACF4.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabACF4.tmp
Size 29KB
SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
MD5 d59a6b36c5a94916241a3ead50222b6f
SHA1 e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA512 17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
SSDEEP 768:hbIXHqGVBV+xrk2TY+Awydbvk18hbhMtSsQgCE7:hbIXHqGVBVYrU+Ar788LuYs
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabC3DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabC3DD.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\files.cab
Size 6.1MB
SHA256 e7cb4a04b0f02b30f8d0501023447a5190b4fd0f23dc4d4036a0276afc3197cb
MD5 e98898a2aae696be40f054a2eb86708d
SHA1 44c975d01a621d289c1bee952dd766ef380ae2ea
SHA512 e959be068a96a46135c0869505f8ffecffe136d8ab79a51c236391084e877df817e05ff7d9775c58f257e7af9be80faedf4e13598b589bd9a3fb2c4d41440c14
SSDEEP 196608:cBstEAABrjAQq8v8R9hZugbD2RDUrn0P1:cKVA9vSPRiUzM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PrintixClientWindows.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\files\PrintixClientWindows.exe
Size 6.1MB
SHA256 a5a5debf18e6af0419fad0219e9088ee872411ce1cab7c4e179ffb3cc7423659
MD5 7d625c060d4babdf1fec089e70e0215e
SHA1 0b75925fb16f43f2dd05a37362eac58a154a60d4
SHA512 824f1aa96483848a08f5fb21ab71cb780faf4783fa5fec113529bfb61c55babddce29eff50c71567862dad759696afbf7d31fafe86a865ef662641b487fdfb9a
SSDEEP 196608:3c16VgVty2/PvfiihyhD2F+QCELUgAcqt:3DeVBXDgCfUFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\msiwrapper.ini
Size 1KB
SHA256 6a3f3536a0ee332275c8b001ce5ce30bff682a087642c5f4a489ead01c2ea057
MD5 b7e7a6ec4699c3561c85890995c8943e
SHA1 99f2840b58175d916625c677185f37505777fa34
SHA512 da7d726f5dd66f98f7530158ea281e099840be9e96ea820b5719a32ddcb8170632982089b5610e3ca5dca400656080810def8b520529614f2c486ba6a16f8258
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-e0c34490-4d39-4744-9ca2-5c396b54b8b9\msiwrapper.ini
Size 1KB
SHA256 0681b84de2445eff628e45d9ee4e28d509eb98c0018e0c5560d9c78fccd2eac8
MD5 8600253803c73d8041a1b3ceb772a318
SHA1 8adfe4744557f1adaa0c90241ce96370bd56f502
SHA512 d46d0d58eed4d0756dfff03556688d8dcf65cad63462979bc7111c564d1343c7681ac6d2206edd4dbbc772d94b0b12286f256a70bdc1d80ed5afe28cf4cb28d8
MD5 SHA1 SHA512

Submit Download

TarC400.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarC400.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 151KB
SHA256 b902bd60b8e3a21d344f5d046a67403f6b7357a6aad859333e6edf81854c22a0
MD5 9cbe62209c9585d816b313ed837ac217
SHA1 e8162486234525699df2b7d0b849f393c59c36de
SHA512 1541ceff6406f2d6fcea2def30ca0d72646b2430ecc9d44eae36192c2708fb2a9e192533f50fa2c42baf4e9f60926526fb0b04c89561d778cc9bcd45f662a7e4
SSDEEP 768:KzFs9nmvE7S4FA6obe0sVbqqQxqhkTqQH8PolrQsvy+rxXQ0t7Cf53Iplqp+bKJ3:BL0Y0kftZBHfX2USxoFHuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 171KB
SHA256 6c6ddc6b6bf27e499a54244ba81551c3177953a3410bf02c29738519b377cbed
MD5 51557aef987554e0d95b534a0095b14f
SHA1 4b92df60352e506fa2b4ea7a45ba6496e8b5a397
SHA512 44a9020f1bcd968ba56bfd958038a22732d04042aa622802381bc97fe262394eb525005b80d3133461c0aa99444a448477aa828314487d9950ae6ab37cdc6ade
SSDEEP 768:KzFs9nmvE7S4FA6obe0sVbqqQxqhkTqQH8PolrQsvy+rxXQ0t7Cf53Iplqp+bKJx:BL0Y0kftZBHfX2USxoFHuluwM
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 60f7219c253e24fcb2e991885b002d757124497a0d96a0a597cfa61bdd8f862b
MD5 0794791b6db4eef6bc2040ba326f8625
SHA1 1f3d9c4c1edbb8858ee7e39a05273ecbee4bb4b0
SHA512 e10e79a78ed46db1a643e1fad0e271f55c793bfb7447cfe5ff05c8bac7701762e02ce070770586407065ef599dce1df93cda972f91710fcf36254e3520e37e3d
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 565f1205122d9eb4fff4b751fec8c507b5b1ac70ca39367661f5137d37f1422e
MD5 52db18239bd07fff71d6205c144841c9
SHA1 54567832be12dbffb714c9af57be2c211d5c20a8
SHA512 e926650f9985df0767b0779eb274ad730a029e79d5f83d244de925e7ffa62bf7a67460e73a278535a5f65912484d4aab4efe7c9b61c09ab8c414edcc62b884f1
MD5 SHA1 SHA512

Submit Download

PrintixClient.exe

Path \Program Files\printix.net\Printix Client\PrintixClient.exe
Size 1.7MB
SHA256 c26ab8dc5da3c1d555e137ac725a2a0c1af5fa73f12154893856159df394458f
MD5 134aac6a190d8931ea328527f9eac1b1
SHA1 0f5e0926a8f649a1c9f794d43021be8f6476bbb4
SHA512 b8479fa38638c5b8841f8391dae52dfc1ac6aefb90a54e57a02c9a38f2f329d385eb46f846059e9b95dfc0b6dcde9d0c23a3a682e97227afc3670dfe61fd248d
SSDEEP 49152:MEp5jAUZGQzr1k8we6b5fk7ikNXAWM14j:BRZCjbVkNq1I
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismHost.exe

Path \Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\DismHost.exe
Size 94KB
SHA256 a5b3bf53bcd3c0296498383837e8f9eb7d610c535521315a96aa740cf769f525
MD5 9a821d8d62f4c60232b856e98cba7e4f
SHA1 4ec5dcbd43ad3b0178b26a57b8a2f41e33a48df5
SHA512 1b5273a52973dac77ad0ef7aa1dda929a782d762ab8489eb90dff1062dd4cc01e4f7f4157266a2abcf8941e91cf4aa5603de1dd8ee871524748e0989ebaa37d3
SSDEEP 1536:ii+r8WRh/WjGs85JTmcNC/3qVWwYwQKDT8YZ5J:N+rfh/GGzJK1/vwYwfT8YZ5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll

Path \Users\Admin\AppData\Local\Temp\8008C809-11E5-45DA-AD39-617162CC76EA\OSProvider.dll
Size 124KB
SHA256 2c325e2647eb622983948cc26c509c832e1094639bb7af0fb712583947ad019c
MD5 e7caed467f80b29f4e63ba493614dbb1
SHA1 65a159bcdb68c7514e4f5b65413678c673d2d0c9
SHA512 34952d8a619eb46d8b7ec6463e1e99f1c641ce61c471997dd959911ae21d64e688d9aa8a78405faa49a652675caf40d8e9e5a07de30257f26da4c65f04e2181e
SSDEEP 1536:cyGbcUj3VFkwWqkUACZ3nLKNsSG066jtsgII4umanQzNhbOb3esaNloC6uRMxNjC:w5DVFhAJedAgbODemvbKo1xQlqtWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

PrintixClientWindows.tmp

Path \Users\Admin\AppData\Local\Temp\is-8IL20.tmp\PrintixClientWindows.tmp
Size 1.1MB
SHA256 6827bac1b0539af7c98db22350d36fb1f0df39121a2682a9acbd0579cd50757e
MD5 e4958c2ddc8db18c1cd9253234761f86
SHA1 708e680c17918a025abcf868f8167ac33366934a
SHA512 71162cbee39a4126aff1b9c19a8aac3f194a38f81afe46cec8d9b9f227f8575bc4ef5d8b3ce2e39596957567d4d80028b602ab64921b060018333dc3dbca4f9a
SSDEEP 24576:i1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G7vxyxkFi:SQdhZgEN6GnJYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

InnoCallback.dll

Path \Users\Admin\AppData\Local\Temp\is-M02GK.tmp\InnoCallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
MD5 SHA1 SHA512 SSDEEP

Submit Download

_setup64.tmp

Path \Users\Admin\AppData\Local\Temp\is-M02GK.tmp\_isetup\_setup64.tmp
Size 6KB
SHA256 b20a8d88c550981137ed831f2015f5f11517aeb649c29642d9d61dea5ebc37d1
MD5 526426126ae5d326d0a24706c77d8c5c
SHA1 68baec323767c122f74a269d3aa6d49eb26903db
SHA512 a2d824fb08bf0b2b2cc0b5e4af8b13d5bc752ea0d195c6d40fd72aec05360a3569eade1749bdac81cfb075112d0d3cd030d40f629daf7abcc243f9d8dca8bfbe
SSDEEP 48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-M02GK.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIEFA6.tmp

Path \Windows\Installer\MSIEFA6.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-881-0x00000000003B0000-0x0000000000A5E000-memory.dmp

Download

memory/1612-882-0x00000000003B0000-0x0000000000A5E000-memory.dmp

Download

memory/1652-1059-0x0000000001070000-0x000000000122E000-memory.dmp

Download

memory/2556-279-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2556-1058-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2556-297-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2768-294-0x0000000002110000-0x0000000002125000-memory.dmp

Download

memory/2768-472-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2768-473-0x0000000002110000-0x0000000002125000-memory.dmp

Download

memory/2768-1057-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2768-877-0x0000000002110000-0x0000000002125000-memory.dmp

Download

memory/2768-727-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2768-322-0x0000000002110000-0x0000000002125000-memory.dmp

Download

memory/2768-321-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2876-1042-0x0000000000F80000-0x000000000162E000-memory.dmp

Download