a847b574c6b43c4e5b517bc1487fca6bf83e0f4b3d7517ee32506289a099ee42

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b58b6.msi
Size 6.4MB
Sample240921-yttp2a1apb
SHA256 a847b574c6b43c4e5b517bc1487fca6bf83e0f4b3d7517ee32506289a099ee42
MD5 ed38e3d4ba9a727b436994c2de44b49a
SHA1 e1b528f4437613cde1cf9dddd5414de76a28f8fa
SHA512 260efdd8de9b845a2d5689257d2f4ffe182e7493b643b0525813dd001dbc36c05238d02b00a556f6c29c8547a54eeecea1dad606dd9ee6991678f00c55d645a7
SSDEEP 196608:FBstEAABrjAQq8v8R9hZugbD2RDUrn0P:FKVA9vSPRiUz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3624	ICACLS.EXE
5456	ICACLS.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PixWindowsUI = "\"C:\\Program Files\\printix.net\\Printix Client\\PrintixClient.exe\" -console"	PrintixService.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	3172	msiexec.exe
6	3172	msiexec.exe
8	3172	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Modifies Windows Firewall 2 TTPs 21 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4476	netsh.exe
4344	netsh.exe
5332	netsh.exe
5344	netsh.exe
3748	netsh.exe
4792	netsh.exe
3320	netsh.exe
4964	netsh.exe
4360	netsh.exe
4820	netsh.exe
2428	netsh.exe
1884	netsh.exe
5100	netsh.exe
1208	netsh.exe
3136	netsh.exe
1072	netsh.exe
416	netsh.exe
5300	netsh.exe
3584	netsh.exe
4580	netsh.exe
780	netsh.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6E9B0B66BE414FEACBD1DDD204A39E96	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	PrintixService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6E9B0B66BE414FEACBD1DDD204A39E96	PrintixService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\printix.net\Printix Client\unins000.dat	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\unins000.msg	PrintixClientWindows.tmp
File opened for modification	C:\Program Files\printix.net\Printix Client\PrintixClient.exe	PrintixClientWindows.tmp
File opened for modification	C:\Program Files\printix.net\Printix Client\uninsports.exe	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-O2C7B.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-AI5N0.tmp	PrintixClientWindows.tmp
File opened for modification	C:\Program Files\printix.net\Printix Client\PrintixService.exe	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-91ABD.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\unins000.dat	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-NEO8H.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\is-LI40D.tmp	PrintixClientWindows.tmp
File created	C:\Program Files\printix.net\Printix Client\PrintixPackage.txt	cmd.exe
File created	C:\Program Files\printix.net\Printix Client\PrintixService.InstallState	PrintixService.exe
File created	C:\Program Files\printix.net\Printix Client\is-P4LIL.tmp	PrintixClientWindows.tmp

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Installer\MSI175A.tmp	msiexec.exe
File created	C:\Windows\Installer\e58434f.msi	msiexec.exe
File created	C:\Windows\Installer\e58434d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4467.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Installer\e58434d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\MSI490C.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\MSI17B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4468.tmp	msiexec.exe

Executes dropped EXE 9 IoCs

pid	Process
4484	PrintixClientWindows.exe
1448	PrintixClientWindows.tmp
5208	_setup64.tmp
4540	dismhost.exe
5592	dismhost.exe
3232	PrintixService.exe
4304	PrintixService.exe
1140	PrintixClient.exe
3696	PrintixClient.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3704	sc.exe

Loads dropped DLL 44 IoCs

pid	Process
2884	MsiExec.exe
1652	MsiExec.exe
1448	PrintixClientWindows.tmp
1448	PrintixClientWindows.tmp
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
4540	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
5592	dismhost.exe
1652	MsiExec.exe
2884	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3172	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 63 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrintixClientWindows.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrintixClientWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d6be30f9a4b6bc740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d6be30f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d6be30f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd6be30f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6be30f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\PrintixClient.exe = "10000"	PrintixService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\PrintixClient.exe = "10000"	PrintixService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	PrintixService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	PrintixService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	PrintixClientWindows.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	PrintixService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	PrintixService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = a805000090d2c19a610cdb01	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	PrintixClientWindows.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	PrintixService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	PrintixService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a191118b1e25581cf315e1ba009294ef032f39533f0bda3095a109805e5eb9ab	PrintixClientWindows.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	PrintixClientWindows.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073005c007000720069006e007400690078002e006e00650074005c005000720069006e00740069007800200043006c00690065006e0074005c005000720069006e0074006900780053006500720076006900630065002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073005c007000720069006e007400690078002e006e00650074005c005000720069006e00740069007800200043006c00690065006e0074005c005000720069006e0074006900780043006c00690065006e0074002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073005c007000720069006e007400690078002e006e00650074005c005000720069006e00740069007800200043006c00690065006e0074005c0075006e0069006e00730070006f007200740073002e0065007800650000000000	PrintixClientWindows.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 9cf9bbad0d843b68e2c2048414af5a98cb8ca5eaf6a2bb3ba483aeab3f0c6b96	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	PrintixService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	PrintixClientWindows.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	PrintixService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\ForegroundLockTimeout = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	PrintixService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\ForegroundLockTimeout = "200000"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	PrintixService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	PrintixService.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\PackageName = "6b58b6.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5484946F8013B247A643FF05DC7424C\081F6267FDDAAC049A3F8AD6A6FA2E41	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\PackageCode = "A3CB67CE6FE718140BF435663BEDA986"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\ProductIcon = "C:\\Windows\\Installer\\{7626F180-ADDF-40CA-A9F3-A86D6AAFE214}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5484946F8013B247A643FF05DC7424C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\081F6267FDDAAC049A3F8AD6A6FA2E41	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\081F6267FDDAAC049A3F8AD6A6FA2E41\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\ProductName = "Printix Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Version = "33685505"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\081F6267FDDAAC049A3F8AD6A6FA2E41\Clients = 3a0000000000	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	msiexec.exe
4568	msiexec.exe
1448	PrintixClientWindows.tmp
1448	PrintixClientWindows.tmp
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe
3232	PrintixService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3172	msiexec.exe
Token: SeSecurityPrivilege	4568	msiexec.exe
Token: SeCreateTokenPrivilege	3172	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3172	msiexec.exe
Token: SeLockMemoryPrivilege	3172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3172	msiexec.exe
Token: SeMachineAccountPrivilege	3172	msiexec.exe
Token: SeTcbPrivilege	3172	msiexec.exe
Token: SeSecurityPrivilege	3172	msiexec.exe
Token: SeTakeOwnershipPrivilege	3172	msiexec.exe
Token: SeLoadDriverPrivilege	3172	msiexec.exe
Token: SeSystemProfilePrivilege	3172	msiexec.exe
Token: SeSystemtimePrivilege	3172	msiexec.exe
Token: SeProfSingleProcessPrivilege	3172	msiexec.exe
Token: SeIncBasePriorityPrivilege	3172	msiexec.exe
Token: SeCreatePagefilePrivilege	3172	msiexec.exe
Token: SeCreatePermanentPrivilege	3172	msiexec.exe
Token: SeBackupPrivilege	3172	msiexec.exe
Token: SeRestorePrivilege	3172	msiexec.exe
Token: SeShutdownPrivilege	3172	msiexec.exe
Token: SeDebugPrivilege	3172	msiexec.exe
Token: SeAuditPrivilege	3172	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3172	msiexec.exe
Token: SeChangeNotifyPrivilege	3172	msiexec.exe
Token: SeRemoteShutdownPrivilege	3172	msiexec.exe
Token: SeUndockPrivilege	3172	msiexec.exe
Token: SeSyncAgentPrivilege	3172	msiexec.exe
Token: SeEnableDelegationPrivilege	3172	msiexec.exe
Token: SeManageVolumePrivilege	3172	msiexec.exe
Token: SeImpersonatePrivilege	3172	msiexec.exe
Token: SeCreateGlobalPrivilege	3172	msiexec.exe
Token: SeBackupPrivilege	5304	vssvc.exe
Token: SeRestorePrivilege	5304	vssvc.exe
Token: SeAuditPrivilege	5304	vssvc.exe
Token: SeBackupPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeBackupPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4956	srtasks.exe
Token: SeSecurityPrivilege	4956	srtasks.exe
Token: SeTakeOwnershipPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeBackupPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4956	srtasks.exe
Token: SeSecurityPrivilege	4956	srtasks.exe
Token: SeTakeOwnershipPrivilege	4956	srtasks.exe
Token: SeBackupPrivilege	5076	dism.exe
Token: SeRestorePrivilege	5076	dism.exe
Token: SeBackupPrivilege	6104	dism.exe
Token: SeRestorePrivilege	6104	dism.exe
Token: SeDebugPrivilege	3232	PrintixService.exe
Token: SeDebugPrivilege	4304	PrintixService.exe
Token: SeSecurityPrivilege	4304	PrintixService.exe
Token: SeSecurityPrivilege	4304	PrintixService.exe
Token: SeSecurityPrivilege	4304	PrintixService.exe
Token: SeSecurityPrivilege	4304	PrintixService.exe
Token: SeSecurityPrivilege	4304	PrintixService.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3172	msiexec.exe
1448	PrintixClientWindows.tmp
3172	msiexec.exe
3696	PrintixClient.exe
3696	PrintixClient.exe
3696	PrintixClient.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
3696	PrintixClient.exe
3696	PrintixClient.exe
3696	PrintixClient.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4956	4568	msiexec.exe	94
PID 4568 wrote to memory of 4956	4568	msiexec.exe	94
PID 4568 wrote to memory of 2884	4568	msiexec.exe	96
PID 4568 wrote to memory of 2884	4568	msiexec.exe	96
PID 4568 wrote to memory of 2884	4568	msiexec.exe	96
PID 4568 wrote to memory of 1652	4568	msiexec.exe	97
PID 4568 wrote to memory of 1652	4568	msiexec.exe	97
PID 4568 wrote to memory of 1652	4568	msiexec.exe	97
PID 1652 wrote to memory of 3624	1652	MsiExec.exe	98
PID 1652 wrote to memory of 3624	1652	MsiExec.exe	98
PID 1652 wrote to memory of 3624	1652	MsiExec.exe	98
PID 1652 wrote to memory of 3784	1652	MsiExec.exe	100
PID 1652 wrote to memory of 3784	1652	MsiExec.exe	100
PID 1652 wrote to memory of 3784	1652	MsiExec.exe	100
PID 1652 wrote to memory of 4484	1652	MsiExec.exe	102
PID 1652 wrote to memory of 4484	1652	MsiExec.exe	102
PID 1652 wrote to memory of 4484	1652	MsiExec.exe	102
PID 4484 wrote to memory of 1448	4484	PrintixClientWindows.exe	103
PID 4484 wrote to memory of 1448	4484	PrintixClientWindows.exe	103
PID 4484 wrote to memory of 1448	4484	PrintixClientWindows.exe	103
PID 1448 wrote to memory of 4520	1448	PrintixClientWindows.tmp	104
PID 1448 wrote to memory of 4520	1448	PrintixClientWindows.tmp	104
PID 1448 wrote to memory of 4520	1448	PrintixClientWindows.tmp	104
PID 4520 wrote to memory of 2592	4520	net.exe	106
PID 4520 wrote to memory of 2592	4520	net.exe	106
PID 4520 wrote to memory of 2592	4520	net.exe	106
PID 1448 wrote to memory of 5208	1448	PrintixClientWindows.tmp	107
PID 1448 wrote to memory of 5208	1448	PrintixClientWindows.tmp	107
PID 1448 wrote to memory of 4220	1448	PrintixClientWindows.tmp	109
PID 1448 wrote to memory of 4220	1448	PrintixClientWindows.tmp	109
PID 4220 wrote to memory of 4344	4220	cmd.exe	111
PID 4220 wrote to memory of 4344	4220	cmd.exe	111
PID 4220 wrote to memory of 4964	4220	cmd.exe	112
PID 4220 wrote to memory of 4964	4220	cmd.exe	112
PID 4220 wrote to memory of 5100	4220	cmd.exe	113
PID 4220 wrote to memory of 5100	4220	cmd.exe	113
PID 4220 wrote to memory of 1208	4220	cmd.exe	114
PID 4220 wrote to memory of 1208	4220	cmd.exe	114
PID 4220 wrote to memory of 5332	4220	cmd.exe	115
PID 4220 wrote to memory of 5332	4220	cmd.exe	115
PID 4220 wrote to memory of 3584	4220	cmd.exe	117
PID 4220 wrote to memory of 3584	4220	cmd.exe	117
PID 4220 wrote to memory of 5344	4220	cmd.exe	118
PID 4220 wrote to memory of 5344	4220	cmd.exe	118
PID 4220 wrote to memory of 3136	4220	cmd.exe	120
PID 4220 wrote to memory of 3136	4220	cmd.exe	120
PID 4220 wrote to memory of 4580	4220	cmd.exe	121
PID 4220 wrote to memory of 4580	4220	cmd.exe	121
PID 4220 wrote to memory of 3748	4220	cmd.exe	122
PID 4220 wrote to memory of 3748	4220	cmd.exe	122
PID 4220 wrote to memory of 1072	4220	cmd.exe	123
PID 4220 wrote to memory of 1072	4220	cmd.exe	123
PID 4220 wrote to memory of 416	4220	cmd.exe	124
PID 4220 wrote to memory of 416	4220	cmd.exe	124
PID 4220 wrote to memory of 4792	4220	cmd.exe	125
PID 4220 wrote to memory of 4792	4220	cmd.exe	125
PID 4220 wrote to memory of 5300	4220	cmd.exe	126
PID 4220 wrote to memory of 5300	4220	cmd.exe	126
PID 4220 wrote to memory of 4360	4220	cmd.exe	127
PID 4220 wrote to memory of 4360	4220	cmd.exe	127
PID 4220 wrote to memory of 3320	4220	cmd.exe	129
PID 4220 wrote to memory of 3320	4220	cmd.exe	129
PID 4220 wrote to memory of 4820	4220	cmd.exe	130
PID 4220 wrote to memory of 4820	4220	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6b58b6.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CF77A198222EB14108701CF42BC8C8F7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\files"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C0726286DA549061F779261EA6306C4A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\files\PrintixClientWindows.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\files\PrintixClientWindows.exe" /MSIEXE="C:\Users\Admin\AppData\Local\Temp\6b58b6.msi" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\is-0Q51V.tmp\PrintixClientWindows.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0Q51V.tmp\PrintixClientWindows.tmp" /SL5="$D0068,5919142,119296,C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\files\PrintixClientWindows.exe" /MSIEXE="C:\Users\Admin\AppData\Local\Temp\6b58b6.msi" /VERYSILENT
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\SysWOW64\net.exe
        
        net stop PrintixService
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop PrintixService
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\is-27TFB.tmp\_isetup\_setup64.tmp
        
        helper 105 0x4D0
        5⤵
        Executes dropped EXE
        
        PID:5208
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\printix.net\Printix Client\open_firewall.cmd""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4220
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix SNMP, UDP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4344
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix PDP, UDP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4964
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Raw Print , TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5100
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Jobforward, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1208
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Redirector, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5332
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix Task Manager, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3584
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix UI Communication, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5344
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Printix IPP Print, TCP"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3136
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix PDP, UDP" protocol=UDP dir=in localport=21337 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4580
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Jobforward, TCP" protocol=TCP dir=in localport=21335 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3748
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Redirector, TCP" protocol=TCP dir=in localport=21336 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1072
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix UI Communication, TCP" protocol=TCP dir=in localport=21338 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:416
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix IPP Print, TCP" protocol=TCP dir=in localport=21339 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4792
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Capture, TCP" protocol=TCP dir=in localport=21343 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5300
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix SNMP, UDP" protocol=UDP dir=out localport=161 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4360
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix PDP, UDP" protocol=UDP dir=out localport=21337 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3320
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Raw Print , TCP" protocol=TCP dir=out localport=9100 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4820
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Jobforward, TCP" protocol=TCP dir=out localport=21335 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2428
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix Redirector, TCP" protocol=TCP dir=out localport=21336 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1884
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix UI Communication, TCP" protocol=TCP dir=out localport=21338 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:780
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Printix IPP Print, TCP" protocol=TCP dir=out localport=21339 action=allow
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4476
    - - C:\Windows\system32\dism.exe
        
        dism /online /enable-feature /NoRestart /featurename:Printing-InternetPrinting-Client
        5⤵
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\dismhost.exe {65BD0260-08BC-454A-9B75-376A2359E938}
        6⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4540
    - - C:\Windows\system32\dism.exe
        
        dism /online /enable-feature /NoRestart /featurename:Printing-Foundation-InternetPrinting-Client
        5⤵
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\40DFF12D-AF2C-4D68-B857-BD072FDD0A42\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\40DFF12D-AF2C-4D68-B857-BD072FDD0A42\dismhost.exe {3F27A990-9422-45DC-9BD2-DFF76ACF2486}
        6⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5592
    - - C:\Windows\system32\net.exe
        
        net stop spooler /yes
        5⤵
        
        PID:1592
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop spooler /yes
        6⤵
        
        PID:5892
    - - C:\Windows\system32\net.exe
        
        net start spooler
        5⤵
        
        PID:2780
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start spooler
        6⤵
        
        PID:444
    - - C:\Windows\system32\net.exe
        
        net start LPDSVC
        5⤵
        
        PID:2160
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start LPDSVC
        6⤵
        
        PID:1900
    - - C:\Windows\system32\cmd.exe
        
        cmd /c echo "C:\Users\Admin\AppData\Local\Temp\6b58b6.msi" > "C:\Program Files\printix.net\Printix Client\PrintixPackage.txt"
        5⤵
        Drops file in Program Files directory
        
        PID:4024
    - - C:\Program Files\printix.net\Printix Client\PrintixService.exe
        
        "C:\Program Files\printix.net\Printix Client\PrintixService.exe" -install
        5⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Executes dropped EXE
        Modifies Internet Explorer settings
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3232
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c sc failure PrintixService reset= 0 actions= restart/60000/restart/60000/restart/60000
        5⤵
        
        PID:1060
      - C:\Windows\system32\sc.exe
        
        sc failure PrintixService reset= 0 actions= restart/60000/restart/60000/restart/60000
        6⤵
        Launches sc.exe
        
        PID:3704
    - - C:\Windows\system32\net.exe
        
        net start PrintixService
        5⤵
        
        PID:3472
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start PrintixService
        6⤵
        
        PID:2380
    - - C:\Program Files\printix.net\Printix Client\PrintixClient.exe
        
        "C:\Program Files\printix.net\Printix Client\PrintixClient.exe" -register
        5⤵
        Executes dropped EXE
        
        PID:1140
      - C:\Program Files\printix.net\Printix Client\PrintixClient.exe
        
        "C:\Program Files\printix.net\Printix Client\PrintixClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3696
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /C dsregcmd /status
        7⤵
        
        PID:5236
        
        C:\Windows\system32\dsregcmd.exe
        
        dsregcmd /status
        8⤵
        
        PID:5496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sign-in.printix.net/tenanthub?intent=http%3a%2f%2flocalhost%3a21339%2foauth%2fauthorize%2f%7btenantdomain%7d%3fstate%3d1ad3d2c5-09c3-451a-bfb8-ce67518d8ac7%26client_id%3dPrintixClient
        7⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8b0646f8,0x7ffa8b064708,0x7ffa8b064718
        8⤵
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        8⤵
        
        PID:4344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        8⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
        8⤵
        
        PID:2360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
        8⤵
        
        PID:2080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
        8⤵
        
        PID:1692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
        8⤵
        
        PID:2596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
        8⤵
        
        PID:396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        8⤵
        
        PID:2480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
        8⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
        8⤵
        
        PID:676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3607424910382711932,7051625069625022297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
        8⤵
        
        PID:1020
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3304

C:\Program Files\printix.net\Printix Client\PrintixService.exe
"C:\Program Files\printix.net\Printix Client\PrintixService.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /delete /F /tn "PrintixService"
  2⤵
  PID:3228
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /tn "PrintixService"
    3⤵
    PID:3296

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58434e.rbs

Path C:\Config.Msi\e58434e.rbs
Size 7KB
SHA256 729e0fb9586733a1097efab58ded56cf826ef9445641c94a72111d026742122b
MD5 d2f9639378c8fa545b15a76db1f8206c
SHA1 4ba07ba6f5ec64992f02ca5df0837c22ae9e1893
SHA512 6d703e427004ff929bae8701780b877d6feafd02f5223e75f41035ec06a261986f5f5ed557f4677695d80f1829bbe3d71998aec7f3cfccbab1ae074e6361cd79
SSDEEP 96:uquqWpoXeuijaaU1x+5CsThqKNaU1x+5C6jbvO6lThqAHA65LZBgJGICopljbCOO:u2Xet8ucIRuccZ7bopM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PrintixClient.exe

Path C:\Program Files\printix.net\Printix Client\PrintixClient.exe
Size 1.7MB
SHA256 c26ab8dc5da3c1d555e137ac725a2a0c1af5fa73f12154893856159df394458f
MD5 134aac6a190d8931ea328527f9eac1b1
SHA1 0f5e0926a8f649a1c9f794d43021be8f6476bbb4
SHA512 b8479fa38638c5b8841f8391dae52dfc1ac6aefb90a54e57a02c9a38f2f329d385eb46f846059e9b95dfc0b6dcde9d0c23a3a682e97227afc3670dfe61fd248d
SSDEEP 49152:MEp5jAUZGQzr1k8we6b5fk7ikNXAWM14j:BRZCjbVkNq1I
MD5 SHA1 SHA512 SSDEEP

Submit Download

open_firewall.cmd

Path C:\Program Files\printix.net\Printix Client\open_firewall.cmd
Size 2KB
SHA256 744a3484929315f4ae35a24dc7a896b9cac492f265995ac128285bfbdaf89902
MD5 a51d11953b618b2c42e86bb634c317b9
SHA1 cbe594474be47bde9a88ddc75e9d3277e39e43f8
SHA512 0daa95f6f6361662392289abff310adc2c455674e7ca2ae97e7e1980bdd035dc386e6a8e8106541465141d5a76e4e2073d30a37effba31130de5d96ecde925de
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6E9B0B66BE414FEACBD1DDD204A39E96

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6E9B0B66BE414FEACBD1DDD204A39E96
Size 727B
SHA256 12ba858ba60e8119e2b48571a1824af999384159a0c536faa27b3e3b3169700c
MD5 0eff759c6c649036e657eee266ee6749
SHA1 dbb74b9b7e302980b78330a0ab6048a60c77f2aa
SHA512 95dd298e2afe6255ec3613d01d4d6417ffcf5d437f8d83ea02fc64b4184ee00918407571697e0d2b89ddc4ddb862ae5766cfe70a530953285246bea20a80382c
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 434912e0cc19994c5358c6f30aa91dd2c70877233aeae5c31fb690ecdd32c3c7
MD5 b92cf6fc88b582ee49f3fdf67df47b5a
SHA1 3e66bfbf092d06730327573ff6d34815a31eddf7
SHA512 34e1a8a041731c37e911efa738a97fa9f4063ce24dab6acaac7fe12ea88eea439d0cfc3ccbd0d226c3f06f929a5e72dec3c5889f704a31042c84876fafb84aae
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6E9B0B66BE414FEACBD1DDD204A39E96

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6E9B0B66BE414FEACBD1DDD204A39E96
Size 404B
SHA256 173e82ac374d0557d649437e75998194fd38f00f939425b2eca62fd5da9555f9
MD5 8423ab7b7f483022be2f65c1986b6291
SHA1 252c7d3f274322750f3949a948252d5a186dc367
SHA512 f19c281a055de0e697abb71a594a5f67ec1a73d20d344c2d8138373068788330fb8b0aafdd6695f83877e8215a29986042f49992464d05cfc7b58357ae099d74
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 a06771e8da554a7b5ba41e8758305036d23d6251e7db739ec0f8b0741102a561
MD5 3650f7b1aebf6dbf482b651fc3389d46
SHA1 f57d0850283bb4462bc4553b1cfcc991d1d9f2f9
SHA512 aa04a8a13e495ce0843feaf578529de4fe23e8e863a4d6dc564d02feca5fe1712e5f2a66b58725deeeffbf6cae082a12e82b9c43e6784376ef4cea6679f7d699
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
MD5 983cbc1f706a155d63496ebc4d66515e
SHA1 223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA512 d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
MD5 111c361619c017b5d09a13a56938bd54
SHA1 e02b363a8ceb95751623f25025a9299a2c931e07
SHA512 fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 297KB
SHA256 97f916d4ab690309075307eebe13e09471bcf8f074d5727251d04e71aa33833f
MD5 c3605c458479b4c54edbdd647d542538
SHA1 1140f88cd7b07176d717a856542dd83466c4d191
SHA512 d014d8036414ba862314f5e5252b3e97dbcb213b8d4175d45f3ce2b24be2f67319a585bc452b7fce80ecf32ed1409901e7b06dbbe2828f2b59baf9c199e01032
SSDEEP 1536:ggKtcCCdzMHw3bw0Wu8TWW/WWWWEWcWOSJa+TKe0sgWW3W56IWsWAWWzWWbWW/Rf:P/CuzMHw3bgKmYS
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 3b122bc3a692ad5e0645fff1668850f67ed388503bcc8a23179bdd7f45ad756d
MD5 9997d28845d862b8f5eb5cf31a3b6cda
SHA1 6993093d4af5b91f30beeb35da16360f75f81ffe
SHA512 1cf238ae9dedfa7bef9adf8449c72630725ce1218d435cf232294695e1b4835e56e899d5a6f110377cc115e604508738d5a1e5f8ce1f59835182894866eaa518
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 877B
SHA256 db3ea27f56cf49ddf933fb84198ccf7cf3a671580ab7330b9f7c1290ba58d15e
MD5 3d8c153ec1debdc64cb9285ecc4233f9
SHA1 5631eeee24f171f9b85ca1bb3ee86b95889920c2
SHA512 fa25462e22885de57214eb1cb5d5784102e7538c965195730186cd003502e715a2c095d90f01c7c4343e3db24415bca35a7dd65c09923bd799aeb58197c82b95
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 10cc0e57eef634c111269d48370013afca0f3f66c3bde3186d616d4f1f741dd3
MD5 9a5f81df3cac099f85dcb1ae3451b6bc
SHA1 74509fe9800c4f84aa3ddf52d2e429f8993870ca
SHA512 020afbab4ea7b14b0fbb28e342d06c00fa472acdc44d7853e08ee2ca6d9d830c08cb5839950a878fac9be35eae9fda290556fe1815718b334eae07aaad1b0e58
SSDEEP 96:ngk/hN1AsbwpvWMoiVmdeH2FBdb+UWQyV+VDCziEwb:ngk/P6EGWMXw+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9e541b5f9221b69db74754e55b82e39dfb9a33632afc5368343d4418cda14c29
MD5 fe8a1c190042813b943b9b5a31676f68
SHA1 e24900ef38c3fbb045630ceca7f00b0dd1ea6f6f
SHA512 d5e15ff7d3bc1f16cf6bdf8ece6832454cbcdb2754966f21c976e245aacbfa0942b2fdbb16307586e788f840aa84ad5153f7b2db3735ec1667eacd97923ef082
SSDEEP 96:ngk/MBN1AsbwpvWMoiVmdeouH1j2EBdb+UWQyV+VD7AiEwb:ngk/s6EGWMYuHhp+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a561a20c5bd2e437508c64565c0694f875a36c14add937ae0996f970ced28f63
MD5 a273cde544402d8b379b2db1b6245a16
SHA1 becb4149fb5701aad111acf242bf55d3115915e6
SHA512 3cc73fd06a53a27ed5b8144b659c749310bd7463adcfd3310d24b9f6281a0e0d679c1d02527ddb98ea63578ec45d50744aca26ce7816fe33f434635511bc3018
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoYe2RUjd6fIcM/bo5ZxxO:A9iIxuERzA83h09RZxY9xAqZxxO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppxProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\AppxProvider.dll
Size 554KB
SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
MD5 a7927846f2bd5e6ab6159fbe762990b1
SHA1 8e3b40c0783cc88765bbc02ccc781960e4592f3f
SHA512 1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f
SSDEEP 6144:TiBcTKZ54SpjXqHKVM8GoxYJwUbdjQzFAPdi3tebF5yf+Q6yLn7xTPBc3:uBFXWUcyziktebF5nn
MD5 SHA1 SHA512 SSDEEP

Submit Download

AssocProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\AssocProvider.dll
Size 112KB
SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
MD5 94dc379aa020d365ea5a32c4fab7f6a3
SHA1 7270573fd7df3f3c996a772f85915e5982ad30a1
SHA512 998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca
SSDEEP 1536:yV9TBLzWvVZtglIDIQdgDbEyuh9UHsTj2HUWli7HlzuTPxwQ:yH1uL6IdgDWjUHeEhyuTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

CbsProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\CbsProvider.dll
Size 875KB
SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
MD5 6ad0376a375e747e66f29fb7877da7d0
SHA1 a0de5966453ff2c899f00f165bbff50214b5ea39
SHA512 8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18
SSDEEP 12288:kqe4tO+jP4PZxP2gv4MefWfN3bGJ0mqs7xBU99l7gghi000U:ko4+UP3P2pMefWfN3bGJpv7QLl7hi0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCore.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\DismCore.dll
Size 402KB
SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
MD5 b1f793773dc727b4af1648d6d61f5602
SHA1 be7ed4e121c39989f2fb343558171ef8b5f7af68
SHA512 66a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed
SSDEEP 6144:2pFC8Q92GEAjR53dcPFj2loO4KwbPnRKQo2:2pxQ92QjR5tEKCkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\DismCorePS.dll
Size 183KB
SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
MD5 a033f16836d6f8acbe3b27b614b51453
SHA1 716297072897aea3ec985640793d2cdcbf996cf9
SHA512 ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871
SSDEEP 1536:UA5jxij1/4CL6FFJbK1hipbLEXt0GAwlPat:UA5jAj1QCL6FFJ+1hipPEXtpXlY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\DismHost.exe
Size 142KB
SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
MD5 e5d5e9c1f65b8ec7aa5b7f1b1acdd731
SHA1 dbb14dcda6502ab1d23a7c77d405dafbcbeb439e
SHA512 7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc
SSDEEP 1536:16iNEP0SZpv0aVyo0rbRmiUwhjgPp9X6E79KfmeCUhNs4+Au0ceacoM1f/TnbsnG:1rEME0FgH6ERKf3/lb/Rw2siUuaqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismProv.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\DismProv.dll
Size 255KB
SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
MD5 490be3119ea17fa29329e77b7e416e80
SHA1 c71191c3415c98b7d9c9bbcf1005ce6a813221da
SHA512 6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13
SSDEEP 3072:cKvrcFu+XXythARfaBAUGNDBOZlUsJY/xL6LyzH7vt/MEhpw9nF:kFBXytcaCUGbOZlUsJaxO2z7vtxhK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\DmiProvider.dll
Size 415KB
SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
MD5 ea8488990b95ce4ef6b4e210e0d963b2
SHA1 cd8bf723aa9690b8ca9a0215321e8148626a27d1
SHA512 56562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b
SSDEEP 6144:Hx/vIsFo3S/cEeMykrx++h0kra+gIEmHK:Hx/vrs0FeGxf7ZVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfuProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\FfuProvider.dll
Size 619KB
SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
MD5 df785c5e4aacaee3bd16642d91492815
SHA1 286330d2ab07512e1f636b90613afcd6529ada1e
SHA512 3566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745
SSDEEP 6144:Dl7JmNA6s7wJzYlfa4QsFIKDys3NvGvcIKifgRw/zJkwT/F0MOAYIfsA46ItKata:Dld6A67qjFVKVSw/au2A4DclSZkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\FolderProvider.dll
Size 59KB
SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
MD5 4f3250ecb7a170a5eb18295aa768702d
SHA1 70eb14976ddab023f85bc778621ade1d4b5f4d9d
SHA512 e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569
SSDEEP 1536:sexLd+GGpAR1uFs4mrYNjTURz6dZiFj1EOt4Pf2:skUG+EIFRb9TURz8iFJEOt4n2
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\GenericProvider.dll
Size 149KB
SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
MD5 ef7e2760c0a24453fc78359aea3d7869
SHA1 0ea67f1fd29df2615da43e023e86046e8e46e2e1
SHA512 be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f
SSDEEP 3072:WvIVEykJhkBPNN9/Y/6xOi/xHVpbe01cPKZoq:WvsEyChkBPNN9NNDbeacPLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\IBSProvider.dll
Size 59KB
SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
MD5 120f0a2022f423fc9aadb630250f52c4
SHA1 826df2b752c4f1bba60a77e2b2cf908dd01d3cf7
SHA512 23e50735c06cef93d11873fc8e5e29fc63dcf3f01dc56822a17c11ca57bbfb10d46fac6351f84ba30050a16d6bd0744a08a4042a9743a6df87ac8a12e81e2764
SSDEEP 768:hANsBtL+LsOHEeZMG8c4cWamUMvyARy0VnrI3Lebvdqvp7UYr6wD1PQb8/:UmsLsOkeacfmDjZriSTU22P28/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImagingProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\ImagingProvider.dll
Size 218KB
SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
MD5 35e989a1df828378baa340f4e0b2dfcb
SHA1 59ecc73a0b3f55e43dace3b05ff339f24ec2c406
SHA512 c8d69e37c918881786a8fdab2a2c5d1632411b1f75082aeb3eb24a8ba5f93dcb39b3f4000e651f95452263525d98fd1d3cb834de93bed16fa6f92ef271c3a92a
SSDEEP 6144:SR2jvbWvfuzAWkVUtqlk7AlP1GB2wNBG6:SR2ymvkm2wNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\IntlProvider.dll
Size 296KB
SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
MD5 510e132215cef8d09be40402f355879b
SHA1 cae8659f2d3fd54eb321a8f690267ba93d56c6f1
SHA512 2f7b2ec0e94738838f755759cd35e20ab2138b8eca023ee6ef630ab83a3de1bc0792f12ea0d722abe9a6953626cbddf8ba55ea32fc794d2df677a0625e498ab0
SSDEEP 6144:D20d1ONlCQZ8RWbKJqHVp13hbTPaTUMPo+WKOLv:K0d1O7CQuRhJGjgUYWHLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\LogProvider.dll
Size 77KB
SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
MD5 815a4e7a7342224a239232f2c788d7c0
SHA1 430b7526d864cfbd727b75738197230d148de21a
SHA512 0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349
SSDEEP 1536:X9mLBNlc4Rd1wbNA7elgn0+r+GEJ8a0qMX0Igx7DAJoNxPyCp:XMLlBRd1kSels+T8a0qMX0Igx7DAJoN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\MsiProvider.dll
Size 207KB
SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
MD5 9a760ddc9fdca758501faf7e6d9ec368
SHA1 5d395ad119ceb41b776690f9085f508eaaddb263
SHA512 59d095246b62a7777e7d2d50c2474f4b633a1ae96056e4a4cb5265ccf7432fed0ea5df9b350f44d70b55a726241da10f228d8b5cbee9b0890c0b9dc9e810b139
SSDEEP 3072:lAHjL5MM39qnOOL1QZaFsrMQ72dmTcWI+fByuc+RAuI/bB0MoutygIQlUoMIVWE:lAHfyMkraaSrGwnjfBIXbdtyyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\OSProvider.dll
Size 149KB
SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
MD5 db4c3a07a1d3a45af53a4cf44ed550ad
SHA1 5dea737faadf0422c94f8f50e9588033d53d13b3
SHA512 5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde
SSDEEP 3072:mT/wD4tK821qqa4SzpVYJyAu27gH3MgDXGy:mTasK6LpVObgH9DX
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfflineSetupProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\OfflineSetupProvider.dll
Size 182KB
SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
MD5 9cd7292cca75d278387d2bdfb940003c
SHA1 bab579889ed3ac9cb0f124842c3e495cb2ec92ac
SHA512 ebf96839e47bef9e240836b1d02065c703547a2424e05074467fe70f83c1ebf3db6cb71bf0d38848ec25e2e81b4cbb506ced7973b85e2ab2d8e4273de720779d
SSDEEP 3072:bk8F4zlDtDlWY32LCG3F4l96gsFYrykP57S7moSFiO36CzPvOFX:bk8OzljW3CoSl9eOmU7sbE7PA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProvProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\ProvProvider.dll
Size 753KB
SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
MD5 70c34975e700a9d7e120aaecf9d8f14b
SHA1 e24d47f025c0ec0f60ec187bfc664e9347dc2c9c
SHA512 7f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260
SSDEEP 12288:X/ck9AStILSQfhJI1UOAibcu978/ftYEGVRU8rbcgWte6QP:PckaLSQpJI1UeUKEKFfetTQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupPlatformProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\SetupPlatformProvider.dll
Size 159KB
SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
MD5 1ae66f4524911b2728201fff6776903c
SHA1 68bea62eb0f616af0729dbcbb80dc27de5816a83
SHA512 7abf07d1338e08dc8b65b4f987eaff96d99aa46c892b5d2d79684ca7cf5f139d2634d9b990e5f6730f7f8a647e4fbb3d5905f9f2a5680250852671599f15ee69
SSDEEP 3072:Z5h05CD/pmthkAKPXzXDhfjCN6XbU7focR/lMmrcAK7kG0:Z5T+4Q+b4t1rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\AppxProvider.dll.mui
Size 22KB
SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
MD5 bd0dd9c5a602cb0ad7eabc16b3c1abfc
SHA1 cede6e6a55d972c22da4bc9e0389759690e6b37f
SHA512 86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c
SSDEEP 192:WqLBjDHbtptJt5MNxWJtrtutAtKt0tptj/eCk6tf6voFeSMoLH7/x9Wg+WA:WqLJDrLpMyYWbWoFelCH7Z9Wg+WA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\AssocProvider.dll.mui
Size 8KB
SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
MD5 8833761572f0964bdc1bea6e1667f458
SHA1 166260a12c3399a9aa298932862569756b4ecc45
SHA512 2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8
SSDEEP 192:x/Akc8dT8EC1y/vYsCAFdUTFLrNmAYKkA48UGtqWKKWr:TtsRbIWKKWr
MD5 SHA1 SHA512 SSDEEP

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\CbsProvider.dll.mui
Size 53KB
SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
MD5 6c51a3187d2464c48cc8550b141e25c5
SHA1 a42e5ae0a3090b5ab4376058e506b111405d5508
SHA512 87a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba
SSDEEP 768:s34QoxGHbXqhu7dCJ6zoROa9fOLBzZoL/ug:s34QoxGHb6huJCJ6zoROa9fou/ug
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\DismCore.dll.mui
Size 7KB
SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
MD5 7a15f6e845f0679de593c5896fe171f9
SHA1 0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4
SHA512 5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca
SSDEEP 96:w4aiiiWwdwCg/PCpQcBK8Cq9ovnwEWDOWwo:JpaJWDOWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\DmiProvider.dll.mui
Size 17KB
SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
MD5 b7252234aa43b7295bb62336adc1b85c
SHA1 b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f
SHA512 88241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358
SSDEEP 192:C53q+0W6eHJr6dVD4hN2J63092HdHUcbR1b0apWuzWRvWt:g6eHJr6dVwH3J9bbvbHpfzWRvWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\FfuProvider.dll.mui
Size 9KB
SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
MD5 dc826a9cb121e2142b670d0b10022e22
SHA1 b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9
SHA512 038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b
SSDEEP 192:/9Ulo7nI+5XnEhLADlDS+d4LfS65Xocb1CEdWcCWn:DLI+5XQL+d4LfS65XJBCEdWcCWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\FolderProvider.dll.mui
Size 2KB
SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
MD5 22b4a3a1ec3b6d7aa3bc61d0812dc85f
SHA1 97ae3504a29eb555632d124022d8406fc5b6f662
SHA512 9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c
MD5 SHA1 SHA512

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\GenericProvider.dll.mui
Size 5KB
SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
MD5 d6b02daf9583f640269b4d8b8496a5dd
SHA1 e3bc2acd8e6a73b6530bc201902ab714e34b3182
SHA512 189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50
SSDEEP 48:ycW8d55p3lDPjLULeCH8C/FcWNlGHQlzQttIZWO9u8bK5WwHgw:l3lD3COWAcQLEWAeWwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\IBSProvider.dll.mui
Size 2KB
SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
MD5 d4b67a347900e29392613b5d86fe4ac2
SHA1 fb84756d11bfd638c4b49268b96d0007b26ba2fb
SHA512 af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662
MD5 SHA1 SHA512

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\ImagingProvider.dll.mui
Size 18KB
SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
MD5 f2e2ba029f26341158420f3c4db9a68f
SHA1 1dee9d3dddb41460995ad8913ad701546be1e59d
SHA512 3d45d7bcf21d5df56b516fc18f7dc1bf80e44258b0c810b199a7bc06047a547060956c9d79575b82d9b6992fb5fe64f5b0ef1e408363887ae81a64b6ff9fa03e
SSDEEP 384:WEPs6ATPNW8mc8jRd9kPQ/ih6uXJeEkWblWk:WEPs6MFW8l8jr9L/ihcEZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\IntlProvider.dll.mui
Size 27KB
SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
MD5 2eb303db5753eb7a6bb3ab773eeabdcb
SHA1 44c6c38e6ae5f9ce9d7ca9d45a3cc3020b1353e4
SHA512 df1c8cefed4b5ef5a47f9bc0c42776611b3af709938a0900db79c6c9f4fae21acbbb6c4b1cad3c5a2051b622fe7e6e01486d34622742a981623fed933f1b1427
SSDEEP 192:FmXnvvMzYr9Hw2PWJh0nCI2rFvAp2ZHwdg/nGaZ5XJVFLdcgUrWLD/QWQ0QdQJWC:FOn3MMbnGjGClJVFa0bQWQ0QdQJWZ4Wq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\LogProvider.dll.mui
Size 6KB
SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
MD5 8933c8d708e5acf5a458824b19fd97da
SHA1 de55756ddbeebc5ad9d3ce950acba5d2fb312331
SHA512 ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f
SSDEEP 96:zXM6czix6RXToVSHvoXBD3LXnvoJnoN6yvG8vIUEWNrWwv:LMniIh0IHAXB7DnAJoN6yO8wFWNrWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\MsiProvider.dll.mui
Size 15KB
SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
MD5 c5e60ee2d8534f57fddb81ffce297763
SHA1 78e6b0e03c8bf5802b3ef429b105d7ae3092a8f2
SHA512 ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc
SSDEEP 96:2TRzAa2VDHWUt1qaoe3em2G6BHWPrem2vopuLcvy6em2bxVoa/b1mA5ICHH00H0X:2TRSDzRXQdoa/5ICH/AbQZL8ZK1WcoWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\OSProvider.dll.mui
Size 3KB
SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
MD5 0633e0fccd477d9b22de4dd5a84abe53
SHA1 e04fb5c3acb35d128c1ea6ee6fb0e9b3fe90d5a9
SHA512 e95ed1d8069d6f200f0a2ea8dd7688404af9db9ce5e229afcb625a1f9eb46ac9e7a1c2c4c5ce156b190514415679e82e213732e8e890ed1a89af9026e4e73fe3
MD5 SHA1 SHA512

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
MD5 015271d46ab128a854a4e9d214ab8a43
SHA1 2569deff96fb5ad6db924cee2e08a998ddc80b2a
SHA512 6ba678da0475a6b1872c2e2c151b395a4d97390bed4671d3f918aab5e69cbc9ceafe72c3100ba060ac6586fd37682499fdeef7d7b1ab10f5ec2411c1438ed438
MD5 SHA1 SHA512

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\ProvProvider.dll.mui
Size 4KB
SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
MD5 b8a8c6c4cd89eeda1e299c212dc9c198
SHA1 f88c8a563b20864e0fc6f3d63fadda507aa2e96e
SHA512 4a6f0dac5b3b18e4942ce5f51b566ce3ba465baa43457384ee785d1c0e7c33f9b9396a143aac0398a34e4e2f7d704ba06d3cc68761fd3cb6f53f4043a906e475
SSDEEP 96:aQt9FbyFAMLhFAgd+J8W8kyMLLyDEWQWSZWwA:aQt9wDlYOKWQWSZW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dismprov.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\2A0986D6-AF14-4389-A880-9441F5E43992\en-US\dismprov.dll.mui
Size 2KB
SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
MD5 7d06108999cc83eb3a23eadcebb547a5
SHA1 200866d87a490d17f6f8b17b26225afeb6d39446
SHA512 9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002
MD5 SHA1 SHA512

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\files.cab
Size 6.1MB
SHA256 e7cb4a04b0f02b30f8d0501023447a5190b4fd0f23dc4d4036a0276afc3197cb
MD5 e98898a2aae696be40f054a2eb86708d
SHA1 44c975d01a621d289c1bee952dd766ef380ae2ea
SHA512 e959be068a96a46135c0869505f8ffecffe136d8ab79a51c236391084e877df817e05ff7d9775c58f257e7af9be80faedf4e13598b589bd9a3fb2c4d41440c14
SSDEEP 196608:cBstEAABrjAQq8v8R9hZugbD2RDUrn0P1:cKVA9vSPRiUzM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PrintixClientWindows.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\files\PrintixClientWindows.exe
Size 6.1MB
SHA256 a5a5debf18e6af0419fad0219e9088ee872411ce1cab7c4e179ffb3cc7423659
MD5 7d625c060d4babdf1fec089e70e0215e
SHA1 0b75925fb16f43f2dd05a37362eac58a154a60d4
SHA512 824f1aa96483848a08f5fb21ab71cb780faf4783fa5fec113529bfb61c55babddce29eff50c71567862dad759696afbf7d31fafe86a865ef662641b487fdfb9a
SSDEEP 196608:3c16VgVty2/PvfiihyhD2F+QCELUgAcqt:3DeVBXDgCfUFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\msiwrapper.ini
Size 1KB
SHA256 32e5890169e8b1406322f9a83fd1042775c2e77529de2e56b6eadc658c2782a0
MD5 cb4b55052647cf90238b2c9a8d48f01a
SHA1 3c486845e653b5b25a11d068775c3183f5dd0947
SHA512 e213b00ea14c2fa8bd77778dd6ade07901bb81ee551503dda83a6d2fe323cbf6d5104040ff0ee3dd5d385252cc3c9cd4f36977e779901b78e05f4379390bb9cc
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-8fddec65-88a4-4da5-bd30-015d1e267873\msiwrapper.ini
Size 1KB
SHA256 ea09b27dce14b9e6043e5ad9b85ce411369bc2e772a501055a809aa47a0f8d05
MD5 bc9312dd5064bb0f3d713e328009214d
SHA1 b969b7d4c91a83ae9a6525b3bc7429d366ffa058
SHA512 8fa80afc96df463cde7937f6e2914ad55690121a23134ac2b6ceeee69bb6a071ad686cabbb87f6c0702eba9f487a877d7976bc829dc326af3a6790d41488278b
MD5 SHA1 SHA512

Submit Download

PrintixClientWindows.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0Q51V.tmp\PrintixClientWindows.tmp
Size 1.1MB
SHA256 6827bac1b0539af7c98db22350d36fb1f0df39121a2682a9acbd0579cd50757e
MD5 e4958c2ddc8db18c1cd9253234761f86
SHA1 708e680c17918a025abcf868f8167ac33366934a
SHA512 71162cbee39a4126aff1b9c19a8aac3f194a38f81afe46cec8d9b9f227f8575bc4ef5d8b3ce2e39596957567d4d80028b602ab64921b060018333dc3dbca4f9a
SSDEEP 24576:i1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G7vxyxkFi:SQdhZgEN6GnJYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

InnoCallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-27TFB.tmp\InnoCallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
MD5 SHA1 SHA512 SSDEEP

Submit Download

_setup64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-27TFB.tmp\_isetup\_setup64.tmp
Size 6KB
SHA256 b20a8d88c550981137ed831f2015f5f11517aeb649c29642d9d61dea5ebc37d1
MD5 526426126ae5d326d0a24706c77d8c5c
SHA1 68baec323767c122f74a269d3aa6d49eb26903db
SHA512 a2d824fb08bf0b2b2cc0b5e4af8b13d5bc752ea0d195c6d40fd72aec05360a3569eade1749bdac81cfb075112d0d3cd030d40f629daf7abcc243f9d8dca8bfbe
SSDEEP 48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI4468.tmp

Path C:\Windows\Installer\MSI4468.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 244KB
SHA256 039edd464187e3f53b46b1deaf7c0debe47605d3057d4a290af3cbd66882bc16
MD5 7250581495176859f23ee286b0ac96b6
SHA1 5e9dd82f34b313ec4382b9238992f29e418179b1
SHA512 ff673859427a13b0ebbd471fad7c86007347ba56539eac6c3d37438b52a25629f5ab5c52d096f7b1cbda08e7f6c2d4f23de77831f946e5f5e18692065ffb46d8
SSDEEP 1536:DbcoOv5Tgf/gLG1Q/OcagKbIvOgC0eblnzCLD1bt:Xco05i4LgyOtPbgHC9Jn+H1bt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpD83A.tmp

Path C:\Windows\Temp\TmpD83A.tmp
Size 2KB
SHA256 4c9ab44ba2a8a1e1ca09bbe4004291097a836ad75d3e89d67840086570bbad03
MD5 4a6073b133e15004491f74decfc1c65f
SHA1 6b967e3a8df05a66b37e02b49b31497834137a72
SHA512 ba18b943d7b28a47434b0daa4c906751dc24efd1cd309585593891cd44e55866383c603acf84c359735b077fb7e19bc6f1c028b3ae98ec32b6af058d12671b49
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.7MB
SHA256 e3271164009b46d7a5932c1808a27c6c0ececbce133243244f37fe7d933f3078
MD5 ad379d7dd7022c13564082e45d0afb9a
SHA1 9c302cc73260dd0f608b359ba4b41bb14a363a21
SHA512 2b3050583892f076c484197ad9a77ef7de454e416331c2cd194a4882b5dcf8fd01b51a22001a3422fc919e9a43c1db89db832a607d498b7aa76217fae21da494
SSDEEP 24576:rSqm41CIdoO/vvTL0QwOHnGgjzfpSAhKEDAtp7wmq2KsBDMm4x1/LKwFn:F
MD5 SHA1 SHA512 SSDEEP

Submit Download

{7aaca539-3625-4672-9540-24d248c094a2}_OnDiskSnapshotProp

Path \??\Volume{f930bed6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7aaca539-3625-4672-9540-24d248c094a2}_OnDiskSnapshotProp
Size 6KB
SHA256 d700da11233ff8f4465d0828519029c98271eb1ff008dcfc43161a85a00703da
MD5 62245236d018ebd7ccc3147de634c840
SHA1 58be13ee8fd2a23a9e292c8eaf1f5b81ed853e1b
SHA512 45ca57c3a1b93c795cdf948b127a2cc632b97e2c17f6ee8e097142c15b59379298e4ae5eb61544aa5748a1a9e56f6c751918805f43ccb54b6851ef73ffaa09c9
SSDEEP 96:FOE5+II74nDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:gg7IUb++lVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1140-787-0x000002119C070000-0x000002119C22E000-memory.dmp

Download

memory/1448-788-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/1448-734-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/1448-774-0x00000000029C0000-0x00000000029D5000-memory.dmp

Download

memory/1448-773-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/1448-444-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/1448-445-0x00000000029C0000-0x00000000029D5000-memory.dmp

Download

memory/1448-118-0x00000000029C0000-0x00000000029D5000-memory.dmp

Download

memory/1448-117-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/1448-91-0x00000000029C0000-0x00000000029D5000-memory.dmp

Download

memory/1448-735-0x00000000029C0000-0x00000000029D5000-memory.dmp

Download

memory/3232-741-0x000001A0BE310000-0x000001A0BE360000-memory.dmp

Download

memory/3232-739-0x000001A0A3850000-0x000001A0A3EFE000-memory.dmp

Download

memory/3232-740-0x000001A0A3850000-0x000001A0A3EFE000-memory.dmp

Download

memory/3232-743-0x000001A0BE360000-0x000001A0BE39C000-memory.dmp

Download

memory/3232-742-0x000001A0A4310000-0x000001A0A4322000-memory.dmp

Download

memory/3696-810-0x0000022677100000-0x0000022677628000-memory.dmp

Download

memory/4484-77-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4484-95-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4484-789-0x0000000000400000-0x0000000000428000-memory.dmp

Download