Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10-10-2024 09:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mahr.canto.global/s/SMEPL?viewIndex=0
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://mahr.canto.global/s/SMEPL?viewIndex=0
Resource
win10v2004-20241007-en
General
-
Target
https://mahr.canto.global/s/SMEPL?viewIndex=0
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Drops file in Drivers directory 4 IoCs
Processes:
vsbsetup.exeDrvInst.exedescription ioc process File created C:\Windows\system32\DRIVERS\evserial9.sys vsbsetup.exe File opened for modification C:\Windows\System32\drivers\SET5B6B.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET5B6B.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\evsbc9.sys DrvInst.exe -
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
Processes:
DrvInst.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\884D4EB820ABE1D81F01B3637597B49E1AF7C5D1\Blob = 030000000100000014000000884d4eb820abe1d81f01b3637597b49e1af7c5d10400000001000000100000005a25f6e82e5acc54eea54c6b386257030f0000000100000014000000e8660b376f5647c3be7da9766e75eb452401d024140000000100000014000000ad8a933dbbf6ecb9c436074439f405843fc52ab91900000001000000100000000cf3ee5e3f3c98e88810a50791bdcb315c000000010000000400000000080000180000000100000010000000531cad3df47ed4855e0d8862b9d303344b0000000100000044000000340036004400450036003400310033003000320037003100420036003100440031003300410030004600410046004400390034003600350033003700370043005f00000020000000010000004e0500003082054a30820432a003020102020703f2d33c588495300d06092a864886f70d01010505003081ca310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e31333031060355040b132a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72793130302e06035504031327476f204461646479205365637572652043657274696669636174696f6e20417574686f726974793111300f060355040513083037393639323837301e170d3133303531343034353731345a170d3134303531303036343234375a3075310b30090603550406130246493110300e06035504081307757573696d6161310e300c060355040713054573706f6f3121301f060355040a1318426c75656769676120546563686e6f6c6f67696573204f793121301f06035504031318426c75656769676120546563686e6f6c6f67696573204f7930820122300d06092a864886f70d01010105000382010f003082010a0282010100c447c6a518d5479ad3dfc4fdd6e77727b85cc4ef487f4db293529a6c92c859126abf3a111b5f9ef908a0cb1392361c59ef9ab616b6d9b2061208997fa3065378eff0825e21007ba9c44338f7502886a258bbac06e98d6d2d930337baee2a4ddc808c588347a1ff2b4e0dc8abcdb05095b9c4e55e4f326ccaf074cca1f766c67d1824b7932f98e6c5054d0589417e9f88f0ec9b0af4ddabe28f3dc16980eb5bbf4abaecc26558a45a3b7381163fef66fffae6eff3e11aa248c22b68256c0f814c956561612c5900a73d6f0c7c3d1842122b81bbbce1c6e8f5fdfb6551900279c63104293db741451172522d1b1c93c9faed1b799dbe3d7d684bc84de3128886210203010001a382018730820183300f0603551d130101ff0405300301010030130603551d25040c300a06082b06010505070303300e0603551d0f0101ff04040302078030330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676f64616464792e636f6d2f676473352d31362e63726c30530603551d20044c304a3048060b6086480186fd6d010717023039303706082b06010505070201162b687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f30818006082b0601050507010104743072302406082b060105050730018618687474703a2f2f6f6373702e676f64616464792e636f6d2f304a06082b06010505073002863e687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f67645f696e7465726d6564696174652e637274301f0603551d23041830168014fdac6132936c45d6e2ee855f9abae7769968cce7301d0603551d0e04160414ad8a933dbbf6ecb9c436074439f405843fc52ab9300d06092a864886f70d01010505000382010100612882ad3e9ca645af638e92220b39a9148630280f2c4feb320446d9d715828a10d838ca9e219716e6d19eac75e34f14f6144f0cec45cb8a17284c5891b75edb16a3d2cbb9703cfd60032eab25ce34c2f50ba9cb461e24a047fc0b9d78b004020b222467807565a472be90b93559a66b640db88d115c8805b7340f7f085de8d1a631a500a2cf26113bedb3b3f5ad9580904b32df60ad1b6c2d25b63457955379937d33f2a25a4b945a1373773dcbaac68b41c06e3e31b888ea3595f0f71bd6035543f4baee258b2a02effe750823a3d9fabecd6b2b31c6794889cd9bdbab47451ae7e6ac96a7cce0eb1b1013a5bf599e2ce62d933815ea03d4053cefa3d940c0 DrvInst.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe -
Executes dropped EXE 17 IoCs
Processes:
SetUp-MarCom.exeSetUp-MarCom.tmpFtdiPreinstall32.exeFtdiPreinstall64.exeAntPreinstall32.exeAntPreinstall64.exedotNetFx40_Client_x86_x64.exeSetup.exevc_redist.x86.exevc_redist.x86.exedpinst_amd64.exeCP210xVCPInstaller_x64.exeVSP Eltima 9.0.exeVSP Eltima 9.0.tmpvspdxp_install.exevsbsetup.exeMarComProf.exepid process 2876 SetUp-MarCom.exe 1428 SetUp-MarCom.tmp 752 FtdiPreinstall32.exe 2848 FtdiPreinstall64.exe 3876 AntPreinstall32.exe 3764 AntPreinstall64.exe 1400 dotNetFx40_Client_x86_x64.exe 4940 Setup.exe 2888 vc_redist.x86.exe 4596 vc_redist.x86.exe 4300 dpinst_amd64.exe 2580 CP210xVCPInstaller_x64.exe 4696 VSP Eltima 9.0.exe 1420 VSP Eltima 9.0.tmp 2856 vspdxp_install.exe 4548 vsbsetup.exe 680 MarComProf.exe -
Loads dropped DLL 32 IoCs
Processes:
Setup.exevc_redist.x86.exeregsvr32.exeregsvr32.exeMarComProf.exepid process 4940 Setup.exe 4940 Setup.exe 4596 vc_redist.x86.exe 3344 regsvr32.exe 1320 regsvr32.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe 680 MarComProf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
Processes:
DrvInst.exeDrvInst.exeDrvInst.exeCP210xVCPInstaller_x64.exeFtdiPreinstall64.exeDrvInst.exeDrvInst.exeDrvInst.exeAntPreinstall64.exeDrvInst.exeDrvInst.exedpinst_amd64.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\SET59C7.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\evsbc9.inf_amd64_5f0cb8d558a7c8d0\evsbc9.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4c0016b3-12bc-7340-a1de-0aa863c418c3}\usbserial.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\slabvcp.inf_amd64_9063be87f4abb1a5\slabvcp.PNF CP210xVCPInstaller_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\evserial9.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt FtdiPreinstall64.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\i386\SETAF47.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_b7c6f1ad9f999c33\amd64\FTLang.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_b7c6f1ad9f999c33\ftdibus.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\SET5459.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8e41c16d-cf8c-a849-ad7a-1b71ba86a4a9}\x86\SETB1C5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4c0016b3-12bc-7340-a1de-0aa863c418c3}\usbserial.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\x64\WdfCoinstaller01009.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8e41c16d-cf8c-a849-ad7a-1b71ba86a4a9}\SETB1C7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ant_libusb.inf_amd64_54173307afc55815\ant_libusb.PNF AntPreinstall64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\amd64\SET45B1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\SETAF45.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\SETAF46.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\SET59B5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{539556bc-4b22-8745-ae31-13bc94115bff}\evsbc9.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\evsbc9.inf_amd64_5f0cb8d558a7c8d0\evsbc9.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ant_libusb.inf_amd64_54173307afc55815\x86\libusb0_x86.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\amd64\SET45A1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\dfu.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\x64\silabser.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\SET59C7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\amd64\SETAF42.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_b7c6f1ad9f999c33\amd64\ftd2xx64.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8e41c16d-cf8c-a849-ad7a-1b71ba86a4a9}\ANT_LibUsb.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\SET59C8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\slabvcp.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\x64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8e41c16d-cf8c-a849-ad7a-1b71ba86a4a9}\SETB1C6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8e41c16d-cf8c-a849-ad7a-1b71ba86a4a9}\ANT_LibUsb.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\SET45D2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\slabvcp.inf_amd64_9063be87f4abb1a5\slabvcp.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{539556bc-4b22-8745-ae31-13bc94115bff}\SET5AE0.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\i386\SETAF47.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\i386\ftd2xx.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8e41c16d-cf8c-a849-ad7a-1b71ba86a4a9}\x86\SETB1C5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\evsbc9.inf_amd64_5f0cb8d558a7c8d0\evsbc9.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\x64\SET5457.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt dpinst_amd64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32}\SET5458.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f9866b0-c293-4741-9cd4-6a4398532a32} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\SET59C6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\SET45D1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dfu.inf_amd64_a13b0024242c0fb7\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ant_libusb.inf_amd64_54173307afc55815\amd64\AntUsbCoInstall_x64.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ant_libusb.inf_amd64_54173307afc55815\ANT_LibUsb.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\SET45D1.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\dfu.inf_amd64_a13b0024242c0fb7\dfu.PNF dpinst_amd64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{bb968877-99c1-3a4b-8133-fc5796cb50d8}\evspd9.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5a0939b0-f4e5-d542-ba2e-f968e3bb00fd}\amd64\SETAF43.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_b7c6f1ad9f999c33\ftdibus.inf DrvInst.exe -
Drops file in Program Files directory 64 IoCs
Processes:
SetUp-MarCom.tmpdescription ioc process File created C:\Program Files (x86)\MarCom\is-4KNHQ.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\is-754UH.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-EBCSH.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Help\de\is-BSITI.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Elias.Common.Serial.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\D2XX\32-Bit\amd64\is-D8PG3.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\D2XX\64-Bit\i386\is-CK56N.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-H1RG7.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem\is-C8FK7.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\ANTUSB2\is-DUF9V.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\ANTUSB2\amd64\is-MTFMQ.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\i386\is-F7KKN.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-MG4TE.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-FMOMT.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-NKO17.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\is-7S4RV.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\is-828AA.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-D9624.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-4IAG8.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\i386\ftlang.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\is-ND2NO.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-GOSTJ.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-GUKIK.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-1D0VB.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Elias.Common.dll SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Newtonsoft.Json.dll SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Driver\FTDI\D2XX\64-Bit\i386\ftlang.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\i386\is-RRLRI.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-P108E.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-E6HGE.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-T67PE.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_dongle_driver\windrv\amd64\WdfCoInstaller01009.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_win32\is-HEHGT.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-936D2.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-L33K7.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\D2XX\64-Bit\is-T0H41.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-2LQDB.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-QCPSB.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-IPF1V.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-AVS15.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-KG02E.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-RMRPB.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-6FF6V.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Driver\Steute\x64\WdfCoInstaller01009.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\is-2PP8U.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-4LTH0.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-2B8E3.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\is-VHR3V.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\Static\amd64\is-UP571.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-J88F5.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-G4RPC.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Help\Alt1\is-M4IGB.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\i386\ftbusui.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\ANTUSB2\is-VMAMM.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\amd64\is-12EDL.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-44RTQ.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-7GF5A.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-1A1SR.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-3ROLN.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\MarFxHook.dll SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-T1VSA.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\Mem1\is-RI4FR.tmp SetUp-MarCom.tmp File created C:\Program Files (x86)\MarCom\Devices\is-OA86R.tmp SetUp-MarCom.tmp File opened for modification C:\Program Files (x86)\MarCom\Driver\ANTUSB2\amd64\AntUsbCoInstall_x64.dll SetUp-MarCom.tmp -
Drops file in Windows directory 36 IoCs
Processes:
MicrosoftEdgeCP.exeDrvInst.exeDrvInst.exedpinst_amd64.exeDrvInst.exeMicrosoftEdge.exeDrvInst.exeDrvInst.exeMicrosoftEdgeCP.exeAntPreinstall64.exeDrvInst.exeMicrosoftEdgeCP.exeCP210xVCPInstaller_x64.exeDrvInst.exeDrvInst.exeFtdiPreinstall64.exesvchost.exevsbsetup.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\inf\oem8.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log dpinst_amd64.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem9.PNF DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\inf\oem7.inf DrvInst.exe File created C:\Windows\inf\oem7.inf DrvInst.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\INF\setupapi.dev.log AntPreinstall64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\DPINST.LOG CP210xVCPInstaller_x64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem9.inf DrvInst.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\DPINST.LOG dpinst_amd64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log CP210xVCPInstaller_x64.exe File opened for modification C:\Windows\INF\setupapi.dev.log FtdiPreinstall64.exe File opened for modification C:\Windows\inf\oem9.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log vsbsetup.exe File opened for modification C:\Windows\inf\oem8.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\inf\oem6.inf DrvInst.exe File created C:\Windows\inf\oem6.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vspdxp_install.exeSetup.exevc_redist.x86.exeVSP Eltima 9.0.tmpVSP Eltima 9.0.exeregsvr32.exeMarComProf.exeS e t u p-MarCom.exeAntPreinstall32.exevc_redist.x86.exeregsvr32.exeSetUp-MarCom.exeFtdiPreinstall32.exedotNetFx40_Client_x86_x64.exeNOTEPAD.EXESetUp-MarCom.tmpcmd.exeregedit.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vspdxp_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSP Eltima 9.0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSP Eltima 9.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MarComProf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language S e t u p-MarCom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AntPreinstall32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetUp-MarCom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FtdiPreinstall32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dotNetFx40_Client_x86_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetUp-MarCom.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exeDrvInst.exeDrvInst.exeCP210xVCPInstaller_x64.exeDrvInst.exeDrvInst.exeFtdiPreinstall64.exeAntPreinstall64.exeDrvInst.exedpinst_amd64.exevsbsetup.exeDrvInst.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 CP210xVCPInstaller_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags FtdiPreinstall64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 AntPreinstall64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dpinst_amd64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID dpinst_amd64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 vsbsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs vsbsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID FtdiPreinstall64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs AntPreinstall64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 CP210xVCPInstaller_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs CP210xVCPInstaller_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs dpinst_amd64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID FtdiPreinstall64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID FtdiPreinstall64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs vsbsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom FtdiPreinstall64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 FtdiPreinstall64.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeregsvr32.exebrowser_broker.exeregsvr32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1365AD2C-8652-8EBF-E819-8FD113C6C2E9}\joihIIcqpgO = "CCXj}_G\\]r|kJ}ZK" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1365AD2C-8652-8EBF-E819-8FD113C6C2E9}\mkyWqffuzjqp = "jYLHNeWR_YtUBrP" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System browser_broker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\Programmable regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\{2F259514-BA31-13D1-B2E4-0060975B8649} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\TypeLib\ = "{5BFD1F7E-4A0A-4DE1-9BA3-A9E71C22CCD7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49CD4B3F-7BB6-4952-BA69-158CF9B03EA6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 99ca387ffa1adb01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VSPort.VSPortAx\CurVer\ = "VSPort.VSPortAx.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\MiscStatus\1\ = "132497" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\Version regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63BFB825-3877-46BB-99D3-47084EDCF250}\ = "_IVSPortAxEvents" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\VersionIndependentProgID\ = "VSPort.VSPortAx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63BFB825-3877-46BB-99D3-47084EDCF250}\TypeLib regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\canto.global MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1365AD2C-8652-8EBF-E819-8FD113C6C2E9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5BFD1F7E-4A0A-4DE1-9BA3-A9E71C22CCD7}\8.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\ = "Virtual Serial Port ActiveX Control 8.0" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 089dbb96fa1adb01 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1365AD2C-8652-8EBF-E819-8FD113C6C2E9}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\canto.global\NumberOfSubdoma = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1365AD2C-8652-8EBF-E819-8FD113C6C2E9}\GnqwPkbmdn = "tEX]wHZO\x7fxtbU_MRy^FFP}oGHz" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\ProgID\ = "VSPort.VSPortAx.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\Version\ = "8.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49CD4B3F-7BB6-4952-BA69-158CF9B03EA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0947E75-CDA3-445F-A577-14A3D40EFCAB}\VersionIndependentProgID regsvr32.exe -
NTFS ADS 3 IoCs
Processes:
browser_broker.exeregsvr32.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\MarConnect--MarCom Professional--4103401--SW--DE-EN--v5.4-01.20241009180714518.20241009180714518.zip.figzd6y.partial:Zone.Identifier browser_broker.exe File created C:\ProgramData\TEMP:2F259514 regsvr32.exe File opened for modification C:\ProgramData\TEMP:2F259514 regsvr32.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 2820 regedit.exe 4020 regedit.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
SetUp-MarCom.tmpSetup.exeVSP Eltima 9.0.tmppid process 1428 SetUp-MarCom.tmp 1428 SetUp-MarCom.tmp 4940 Setup.exe 4940 Setup.exe 4940 Setup.exe 4940 Setup.exe 4940 Setup.exe 4940 Setup.exe 4940 Setup.exe 4940 Setup.exe 1420 VSP Eltima 9.0.tmp 1420 VSP Eltima 9.0.tmp -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 4864 MicrosoftEdgeCP.exe 4864 MicrosoftEdgeCP.exe 4864 MicrosoftEdgeCP.exe 4864 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exevsbsetup.exeDrvInst.exeregsvr32.exeregsvr32.exedescription pid process Token: SeDebugPrivilege 4600 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4600 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4600 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4600 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4692 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4692 MicrosoftEdgeCP.exe Token: SeAuditPrivilege 4712 svchost.exe Token: SeSecurityPrivilege 4712 svchost.exe Token: SeLoadDriverPrivilege 4548 vsbsetup.exe Token: SeRestorePrivilege 2228 DrvInst.exe Token: SeBackupPrivilege 2228 DrvInst.exe Token: SeLoadDriverPrivilege 2228 DrvInst.exe Token: SeLoadDriverPrivilege 2228 DrvInst.exe Token: SeLoadDriverPrivilege 2228 DrvInst.exe Token: 33 3344 regsvr32.exe Token: SeIncBasePriorityPrivilege 3344 regsvr32.exe Token: 33 1320 regsvr32.exe Token: SeIncBasePriorityPrivilege 1320 regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
SetUp-MarCom.tmpVSP Eltima 9.0.tmppid process 1428 SetUp-MarCom.tmp 1420 VSP Eltima 9.0.tmp -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMarComProf.exepid process 2664 MicrosoftEdge.exe 4864 MicrosoftEdgeCP.exe 4600 MicrosoftEdgeCP.exe 4864 MicrosoftEdgeCP.exe 680 MarComProf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MicrosoftEdgeCP.exeS e t u p-MarCom.exeSetUp-MarCom.exeSetUp-MarCom.tmpFtdiPreinstall32.exeAntPreinstall32.execmd.exesvchost.exeAntPreinstall64.execmd.exedotNetFx40_Client_x86_x64.exevc_redist.x86.exedescription pid process target process PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4864 wrote to memory of 4868 4864 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 752 wrote to memory of 2876 752 S e t u p-MarCom.exe SetUp-MarCom.exe PID 752 wrote to memory of 2876 752 S e t u p-MarCom.exe SetUp-MarCom.exe PID 752 wrote to memory of 2876 752 S e t u p-MarCom.exe SetUp-MarCom.exe PID 2876 wrote to memory of 1428 2876 SetUp-MarCom.exe SetUp-MarCom.tmp PID 2876 wrote to memory of 1428 2876 SetUp-MarCom.exe SetUp-MarCom.tmp PID 2876 wrote to memory of 1428 2876 SetUp-MarCom.exe SetUp-MarCom.tmp PID 1428 wrote to memory of 752 1428 SetUp-MarCom.tmp FtdiPreinstall32.exe PID 1428 wrote to memory of 752 1428 SetUp-MarCom.tmp FtdiPreinstall32.exe PID 1428 wrote to memory of 752 1428 SetUp-MarCom.tmp FtdiPreinstall32.exe PID 752 wrote to memory of 2848 752 FtdiPreinstall32.exe FtdiPreinstall64.exe PID 752 wrote to memory of 2848 752 FtdiPreinstall32.exe FtdiPreinstall64.exe PID 1428 wrote to memory of 3876 1428 SetUp-MarCom.tmp AntPreinstall32.exe PID 1428 wrote to memory of 3876 1428 SetUp-MarCom.tmp AntPreinstall32.exe PID 1428 wrote to memory of 3876 1428 SetUp-MarCom.tmp AntPreinstall32.exe PID 3876 wrote to memory of 2856 3876 AntPreinstall32.exe cmd.exe PID 3876 wrote to memory of 2856 3876 AntPreinstall32.exe cmd.exe PID 3876 wrote to memory of 2856 3876 AntPreinstall32.exe cmd.exe PID 2856 wrote to memory of 2820 2856 cmd.exe regedit.exe PID 2856 wrote to memory of 2820 2856 cmd.exe regedit.exe PID 2856 wrote to memory of 2820 2856 cmd.exe regedit.exe PID 3876 wrote to memory of 3764 3876 AntPreinstall32.exe AntPreinstall64.exe PID 3876 wrote to memory of 3764 3876 AntPreinstall32.exe AntPreinstall64.exe PID 4712 wrote to memory of 2028 4712 svchost.exe DrvInst.exe PID 4712 wrote to memory of 2028 4712 svchost.exe DrvInst.exe PID 3764 wrote to memory of 4804 3764 AntPreinstall64.exe cmd.exe PID 3764 wrote to memory of 4804 3764 AntPreinstall64.exe cmd.exe PID 4804 wrote to memory of 4020 4804 cmd.exe regedit.exe PID 4804 wrote to memory of 4020 4804 cmd.exe regedit.exe PID 1428 wrote to memory of 1400 1428 SetUp-MarCom.tmp dotNetFx40_Client_x86_x64.exe PID 1428 wrote to memory of 1400 1428 SetUp-MarCom.tmp dotNetFx40_Client_x86_x64.exe PID 1428 wrote to memory of 1400 1428 SetUp-MarCom.tmp dotNetFx40_Client_x86_x64.exe PID 4712 wrote to memory of 3592 4712 svchost.exe DrvInst.exe PID 4712 wrote to memory of 3592 4712 svchost.exe DrvInst.exe PID 1400 wrote to memory of 4940 1400 dotNetFx40_Client_x86_x64.exe Setup.exe PID 1400 wrote to memory of 4940 1400 dotNetFx40_Client_x86_x64.exe Setup.exe PID 1400 wrote to memory of 4940 1400 dotNetFx40_Client_x86_x64.exe Setup.exe PID 1428 wrote to memory of 2888 1428 SetUp-MarCom.tmp vc_redist.x86.exe PID 1428 wrote to memory of 2888 1428 SetUp-MarCom.tmp vc_redist.x86.exe PID 1428 wrote to memory of 2888 1428 SetUp-MarCom.tmp vc_redist.x86.exe PID 2888 wrote to memory of 4596 2888 vc_redist.x86.exe vc_redist.x86.exe PID 2888 wrote to memory of 4596 2888 vc_redist.x86.exe vc_redist.x86.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://mahr.canto.global/s/SMEPL?viewIndex=0"1⤵PID:1020
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2664
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:2824
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4600
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4868
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1272
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3456
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3000
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_MarConnect--MarCom Professional--4103401--SW--DE-EN--v5.4-01.20241009180714518.20241009180714518.zip\MarComVersion.TXT1⤵PID:1920
-
C:\Users\Admin\Downloads\MarConnect--MarCom Professional--4103401--SW--DE-EN--v5.4-01.20241009180714518.20241009180714518\S e t u p-MarCom.exe"C:\Users\Admin\Downloads\MarConnect--MarCom Professional--4103401--SW--DE-EN--v5.4-01.20241009180714518.20241009180714518\S e t u p-MarCom.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\SetUp-MarCom.exe"C:\Users\Admin\AppData\Local\Temp\SetUp-MarCom.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\is-NP6HK.tmp\SetUp-MarCom.tmp"C:\Users\Admin\AppData\Local\Temp\is-NP6HK.tmp\SetUp-MarCom.tmp" /SL5="$20452,85763104,117248,C:\Users\Admin\AppData\Local\Temp\SetUp-MarCom.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\FtdiPreinstall32.exe"C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\FtdiPreinstall32.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\FtdiPreinstall64.exe"C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall\FtdiPreinstall64.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2848
-
-
-
C:\Program Files (x86)\MarCom\Driver\AntUSB2\AntPreinstall32.exe"C:\Program Files (x86)\MarCom\Driver\AntUSB2\AntPreinstall32.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regedit /s AntDriverCtrlFlags_QuietInstall.reg5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\regedit.exeregedit /s AntDriverCtrlFlags_QuietInstall.reg6⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2820
-
-
-
C:\Program Files (x86)\MarCom\Driver\AntUSB2\AntPreinstall64.exe"C:\Program Files (x86)\MarCom\Driver\AntUSB2\AntPreinstall64.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c regedit /s AntDriverCtrlFlags_QuietInstall.reg6⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\regedit.exeregedit /s AntDriverCtrlFlags_QuietInstall.reg7⤵
- Runs .reg file with regedit
PID:4020
-
-
-
-
-
C:\Program Files (x86)\MarCom\Driver\dotNetFx40_Client_x86_x64.exe"C:\Program Files (x86)\MarCom\Driver\dotNetFx40_Client_x86_x64.exe" /q4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
F:\04759164cb881f02f0fe5b7dca\Setup.exeF:\04759164cb881f02f0fe5b7dca\\Setup.exe /q /x86 /x645⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4940
-
-
-
C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_win32\vc_redist.x86.exe"C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_win32\vc_redist.x86.exe" /passive /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_win32\vc_redist.x86.exe"C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_win32\vc_redist.x86.exe" /passive /norestart -burn.unelevated BurnPipe.{85D82D8D-29C4-4C69-99E3-554784334BCC} {F654B1D0-4BD1-4AF6-9DA5-854E8FFEDCF9} 28885⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4596
-
-
-
C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_dongle_driver\windrv\dpinst_amd64.exe"C:\Program Files (x86)\MarCom\Driver\BlueDat\blueDAT_dongle_driver\windrv\dpinst_amd64.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4300
-
-
C:\Program Files (x86)\MarCom\Driver\Steute\CP210xVCPInstaller_x64.exe"C:\Program Files (x86)\MarCom\Driver\Steute\CP210xVCPInstaller_x64.exe" /SE /S4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2580
-
-
C:\Program Files (x86)\MarCom\Driver\VSP Eltima 9.0.exe"C:\Program Files (x86)\MarCom\Driver\VSP Eltima 9.0.exe" /VERYSILENT4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\is-K82RA.tmp\VSP Eltima 9.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-K82RA.tmp\VSP Eltima 9.0.tmp" /SL5="$90206,1330796,121344,C:\Program Files (x86)\MarCom\Driver\VSP Eltima 9.0.exe" /VERYSILENT5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1420 -
C:\Users\Public\Documents\MarCom\vspdxp_install.exe"C:\Users\Public\Documents\MarCom\vspdxp_install.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Users\Public\Documents\MarCom\NT6X64\vsbsetup.exeC:\Users\Public\Documents\MarCom\NT6X64\vsbsetup.exe7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" VSPort.dll /s /i:"Mahr Esslingen#000GUZ-XT2M4J-BV6PTU-Q8DH20-R6YRZ4-3NTWXA-622F31-3C6EDA-5D8EB0-9BB5CB-62A2E8-756793"6⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" VSPort.dll /s6⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\MarCom\Readme.TXT4⤵
- System Location Discovery: System Language Discovery
PID:3240
-
-
C:\Program Files (x86)\MarCom\MarComProf.exe"C:\Program Files (x86)\MarCom\MarComProf.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:680
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "28" "C:\Users\Admin\AppData\Local\Temp\{a9fb6faf-e23d-5d43-b90c-5063be761615}\ftdibus.inf" "9" "44522b27f" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files (x86)\MarCom\Driver\FTDI\FtdiPreinstall"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2028
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{2f8f603a-77e5-984b-8671-653cf9616edf}\ANT_LibUsb.inf" "9" "48f6e236f" "000000000000017C" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files (x86)\MarCom\Driver\AntUSB2"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3592
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2e516f62-e3de-9b44-a972-b474134cd0a0}\dfu.inf" "9" "448afa067" "00000000000001A0" "WinSta0\Default" "0000000000000174" "208" "c:\program files (x86)\marcom\driver\bluedat\bluedat_dongle_driver\windrv"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:680 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{9b923b87-3dba-9144-b977-7435c855c481} Global\{3405fb71-1ee7-e045-bbb7-ccb28419093c} C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\dfu.inf C:\Windows\System32\DriverStore\Temp\{9e8d20fe-3f9a-d541-b040-6ad66c52cf21}\dfu.cat3⤵PID:4388
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4348ba8f-f3e0-2a48-ac48-0748b765a102}\usbserial.inf" "9" "4241759f3" "0000000000000174" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\marcom\driver\bluedat\bluedat_dongle_driver\windrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4544
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{6a45ac40-6618-eb48-9e19-04d8e84ed19c}\slabvcp.inf" "9" "49fe42bcf" "0000000000000164" "WinSta0\Default" "000000000000019C" "208" "c:\program files (x86)\marcom\driver\steute"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4720
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0968d407-2bc8-6046-a0ac-d51ebccf1c6a}\evserial9.inf" "9" "4ccdef8eb" "000000000000019C" "WinSta0\Default" "00000000000001A0" "208" "C:\Users\Public\Documents\MarCom\NT6X64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4544
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{94411ded-e035-9747-a979-a3e5a4627a16}\evsbc9.inf" "9" "44fb335b7" "00000000000001A0" "WinSta0\Default" "0000000000000174" "208" "c:\users\public\documents\marcom\nt6x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:676
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem9.inf" "evsbc9.inf:947a44d0838aed2e:VSBus_Device:9.0.369.0:vsbc9," "44fb335b7" "00000000000001A0"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
PID:4856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD512e29096bd05a79c9f13e21ae1627b8a
SHA1b3b2a31206503c11cbeac587ad77dfbe7fe501aa
SHA2568d0d3c0420c2f970ab7ba96d7223b63ad71205c97cc87a53ac247a0e829756d4
SHA512c72a4b8ce79689249319c21a98cd71d183a719f7f93acd3b2510579acb9add101f47c63252cf7ad26d7e32ab4f53cbfbfed70d21bc0fe15570b388b5407210fb
-
Filesize
56KB
MD5fd8621730814ba0c8552a057dbabc2e6
SHA190057ffab3c8367988ffcafc051ecfac13816aa4
SHA2564d50cd88c5f26ab1d71c419a30d07667a8abc28b8bbe0f8bdc43e4f2aab9a929
SHA5124143f26716f527c2395909c7c30c9813f561b2a7f27fcf2823b4ff1de7c9aca52eef7bd26b84d5c100ee248441ae031c901c283682986235115656de50a91ed8
-
Filesize
56KB
MD5a0d8116feba7f633a88c9ed53c0dccb5
SHA1fa9e67dbf039e449c31d5ce9c528e2846e4bf808
SHA256ee4781de467fe8769517fdf548bc6199068d29a7b84b59d465cb75bc134f1f7d
SHA512734c84b30bd7341f4d54d6f26d7baef2daf02b138a8145cea2c5bff1a31df1733c78b9d96f9a0b3d34cc6a23af062ef26639cfd9f3cdb208f4361e66a0e656b7
-
Filesize
14KB
MD5ae7057a92a800337762709de388eb9a6
SHA1f53a2d52366a4274eb485f7fa799e8b263d786cc
SHA25683e1a47d2b893f26674a57c157e47da5eca6b41781c32b9947d8c713e2b4745e
SHA51203e28cfa0a72a9ff4278fc14ec95187f1af524d93b33a95eb9833ba021c9008a0f01634dccea07cc0d60261dd17ebbd6ba2ff2146e3684e7d5e92706fbf22d32
-
Filesize
56KB
MD5e5328e3beda06d130da52aa8ff34ec6d
SHA1f7e843e47d7209e978c3f33db66e7281fce309cf
SHA2569090c81de6b5336153381a140bf6f815f8171bdbe7258e395a3d7db80f9eccc7
SHA5122e6e5b266baf136c7bc32b45bee0b3b28dc6831f16fb8b34675290c7e1c8a7594f520e895e76482bd7a882faebef3727accac4cde9211baabe0dda8c641acf62
-
Filesize
56KB
MD5d30a13815fe39704fdf07bcb470f20e0
SHA1871db068af3ca581ca9fc51475b6cce09c9e33ca
SHA256444ddc305821e9ead066c3c35b9c2fa4884a0a3cbc075ebb2c6f7440f68fb269
SHA51244aea28ee874644465610b5002d2cd9d758fda281c540a82ab72eb12597f40502d5555b1d2575d70bfbbb5f97e311fc3d46ab35fa83a10eb3222fac3cb0d2758
-
Filesize
56KB
MD525a962cac4b3ed393f261469d393c33a
SHA1448f6fa6cfc1fccdccea5441983b9e2f684f003b
SHA256ed1162497290dea52b4998edd05b94a62744c4d0be7ed2d777bee913c6041f82
SHA5128fee5cccbcf2ce7e1ca08664b91e8e3c9b23ec915092e7454fdf46a4f946e829b0db8fa68b45d0358a696507f9e6d581ad5e6924f3346df07570230597c7d481
-
Filesize
56KB
MD50b81696970b891b6cd0e511aaa6ee653
SHA1b146350db889f363f1311f022e51350178b3ef35
SHA25646532b337a8872a3a960f60329199f5aeb7705a77d3e25f0b6d244f547ac80b7
SHA512ee9035c1efa73015afe34a84c6eaae6d96a537fc143e0ed3792ef9d4e141897e43bcbc5696bfefe8fd62f4b5820b89bc592346f9dac5ec1ae2a9382e01b0edc8
-
Filesize
56KB
MD5f3eb3154881d718e773288c91f809b22
SHA1b44164f31f511fb11fe8213180540e2e37f5f140
SHA256458ec643d73c25188d73db3bf6767f9453908c92ad336ac6083d6a51c9c636c7
SHA512e1348bd6f577a68c78b047e2564cc3a2007d38bd8e63037ac7a836a07e43704f3e3341a4681b402daa83eb2ef247629920650cf56748febb31a41b20383a2196
-
Filesize
14KB
MD58ab0a4c79560158629f2adf2919c1e05
SHA13a92654be8b9f5a8b35c5b145d026ff15b58c926
SHA256ceacf74a3cc14207f8b26d5055c22dad519a23715221b5ebd4c7aa10786dd0a1
SHA512045adee476690a8012423868dafa61c287ed78d0b6e601f5e357c5663c7018f1b9398316424eb5d00bf9d3e5a5c9973ec658b33ee9b4afedb55bd9ae33d98531
-
Filesize
56KB
MD5fdba803c0e7750334e3548639b3c7bd6
SHA17089c4bd225fabdd71ba25d43b0933ef5fe15935
SHA2567fcc84ddf61b8dc629c97e187e8543e26bf21b5ee164a3f65bf71bc215f7750e
SHA512da85a25f03ec41485d13bab8c09789f07f4def8fa7fae6bfe2af4dae1dded56dc4a99d5a8e42600a5e7afd8ce1e7dee9326f866eb23aa2c0caf4eee480ba2115
-
Filesize
14KB
MD5529ba830b89231afc431210db67274e3
SHA11332b2d0c68a36dfc852b35433afe5a9ac805ad4
SHA256a164472ebd3b181619064584f58e9277d53ae88afe15ae237c8a77f9176991ad
SHA512d56a6f447a5a7fecb1976b849162a16a04a3b2f020b5cf07bd85abb36a46a6c57a1ac096da8577b47bc6b6818b8e1f994696b8884248821cf26f04cd15529de9
-
Filesize
14KB
MD509877e74bf4061ed0224b64537471bbc
SHA173624b6b47e5ec93e086b98c4d5427d1e81eb8d2
SHA256a96fbdc0ce64d2cda0c2cbab9d65a031ef9fb4e68220a8492fb5d687574199ea
SHA512bb5cc81713455e20d1cd7a1419e6ee4dcc6f25e3d2363ef952d04daddafa5729fa1de514fccd9d748c8bf1a05bb9aab7e017ae08ca7f53f023f3635fc72c4b56
-
Filesize
14KB
MD57da80c35880d9f836870f146fb7d6e4f
SHA1d6a0c3e7ebaae52d8be688973afe67c1da14036d
SHA25614383f9e6f62fc217a0b30bacb0f535541dbe5a6770dd7b84a51006c088a8f54
SHA512144af73dc0646d31e7819647314c7162884453e7879f7ac3140a014e5a578feed65d201d2d195fed686ea4dace1cdd765210ae0b91a265b129e18c6209c50919
-
Filesize
14KB
MD52253f6547340cc53a9c2102cf6aa4de4
SHA13075909999353c842b15005c7f0e27f3dd3ee780
SHA2566d227b3134453e5e537bfe056ef7035159d736223cf92e0864c17bc876d6de01
SHA512b7bbe9e895b7e42ef58a65d8ec5e272d1923d3ad29e0582c840f78fc50d1ddd2f6d75aed59189a41fd8cf6e99d626363d99413faf70d45a8bb26323246ca0578
-
Filesize
56KB
MD510c8be10875b94d86bad7781fb27f492
SHA121a427a23f8c3203def3eb9e9b8247fd5ae869d7
SHA256f395355f6a98fd99a77750d0226f519a697f5b5b85ba0c2eb825a02f2b02968a
SHA512aeec1efaaf9a136fbafe4f43b26324aabff7ea564eb65060866bfa2f594f1814415c53b2e2236857c8248d96444b429e2de48d73bc313dc5211c553696879dd7
-
Filesize
14KB
MD5d6d1916e8583328d3b529f3fd0f9cb94
SHA149a04fbc52984280514a2bfa7ec6d29ca7637388
SHA2567000223f6e96129f258ffd4c3b5572c7ef9dcf03f4a290daeaa2d7613e62c9ae
SHA51227673e7237a0f129029e00d6b6e9c8c8dc7f1a4df5197e371b9da4e4c059421d9b8ca3a34442a77e59fc3ea7ae682b195d5f2731b7ad713c7330af8863e1cf33
-
Filesize
56KB
MD5b28369325db1a9a2768e64070b68efd8
SHA16d2147b9af4ff586a633c27d2c4191b2e70160ad
SHA2568856f0fec8474f86e8a5e7a97aae188e8a268c950295f72fbbad64f3c77f87e1
SHA512162e0a088ed2e6697458e6cf3918f6f2f4ad0e3aa0eeed5a42f0140d5fb569428b8fa6b10e8d38ee697f362d017b19c4d1cdf1bd539c4053f1115c89f19fb79c
-
Filesize
14KB
MD5dbdd2b0c1429a93fe22e1469417077c3
SHA15df7ef03baa0a6875ea3779749f43577f5c16d65
SHA25650f7719e43c13c0467cbc09c35858d0b5197dc9c76a7ce5ef6acf4d353f67cad
SHA5122009b78a08d35977d7f82d99c0cad1d762066d0b35e18512dcce574a4d237cd0fa16f6313d7ac8a2e2233c679e3bf94a7941addad5f4e7cfc7503fda241ba103
-
Filesize
56KB
MD5d10220eea6f1fb1e38e8f91116b4945a
SHA1a75ff42afc657962f3412223d960be41a089bbe1
SHA256a7c0098fe1a621374da6ddbfa2d5d947d5a759abcc3242606c21472dc31b40b9
SHA5123eacb4d82d58ce05aa1383d1bd46c32ee812e07f2b45d474e1af66df659198f9e9b1f8b7b106a645e75a7a868792974c6b452eb3e6c29b176c4bb48d9841d35f
-
Filesize
1.1MB
MD51b6473ee30779891aa7c678f3267e239
SHA1b5f3137bb9ece21bc620d9769aba6d35ac93bd9c
SHA256c8b65bfb6ddf43cc11ada2a0d8e2a0fe0efe380a0bdbb18fedebd0d0fda40b6f
SHA5128951b0aa6df03908432bdcf21bd5224cc78580105ae8b1153713d4c0aa5d751695e96b96fa5fe106acb1744e9b408dad9483dc7bf75a2b1cf9f07b4d85588aa4
-
Filesize
1.3MB
MD5b9635aeb6c67ca61d3f1854f2db2bc30
SHA1558cc639effbc5cee1332b013032224e093ee7f0
SHA25618ef5ce817d5d0e1970af7464a73fdc69306765dbc39d01775aad97453b19f52
SHA5129bdfb553ef24e7ece4eb9f109d1119cd2ea6f976ab80efee0ed210dbc39648ea1fb85dfaaccf5527dccb170d86c1d10a5434a6dc0703fa01afa12f72f174f7bb
-
Filesize
1KB
MD566e200bd27a76764394183c869bd0122
SHA1d38c6687bc5329ca47d2f4c847df2d15b0af468b
SHA2568b45a1870d87afc36fb263ec3304d6f1ded5397e44c7e79a8548f7d964817f5b
SHA51257c36bfba3e24c137df11fc2a40a50727df415b19ae48b3d718e09fb67d8b81867ef12d9848edd6f930a5d4f3ef0f4e03624e848cb3d8695515e6978adab1b05
-
Filesize
12KB
MD573ff3e765738fdbd7947d26f63a86440
SHA1f9d2a789f9cff8cec36b544f53877c80f1f73c46
SHA256b37e1136892b1336bec201f6026bbf7336fd9824f172270d8c4606767c822e7a
SHA5127a86044df1d2e81b8d6643a1ea6e3fb27462fdf59ef063aeda6103668747945ef4472127a7e95218c65d70eca73e12a2f8cc53d95b9b794cb3005240dd058cda
-
Filesize
462B
MD50e6da61112d7d146a08daadd919a5a77
SHA19d907aea20b35c3d67ce7e63d354f1c8d0d1e102
SHA256b020ab6df3cd469ac6988c769d58e22a6a9aa287ac517c99c90e3dc6fe8d290c
SHA512bc87114c379b4a312b6a3421585aeb8efff81a292414752a000faf2ed932552abe98aca029f2813064ec2430bdb9c8a4c366635e5c6fce7b1409126871e4b0e8
-
Filesize
12B
MD5673554a0aa7100beda88477b0edd6b40
SHA144975c34a024a0d54213c2f288fdcfcbaf880138
SHA256099fc1c72b6d3297dd85d684ea6034689230943fd8b9eac70a2f72e0694527f6
SHA512104eb669a3d27a683fe6e06749d7736a8a920d4cb03e921d506ef6093d8a5fb7448fe03df6acbb51bd1f51cfc91281d1fdd5400817135533dbab1d11ce8f8100
-
Filesize
1.0MB
MD59943923b51214161cf16643a5b6c0c1e
SHA1fb9f5577b42e4b28381af899bd95282e9054ecef
SHA25654e2c53e5898748d11a1f0cbd9f3c94123af04b000155ce00512d58dece467ed
SHA5123da1ef138f912e1892f01e6d022e089fa68f51c54354cbd99461435b7f1f145344d1d24dbf5ef46c3533052dbe238ab2d4b77d491bb443a4feeeb1f93ea61287
-
Filesize
1.3MB
MD5e5a0d810d8f2fb6760dd252f15999c47
SHA10e7eecf2fefb367aa09bc6510291ed9e4b8973c4
SHA256657b271ea1cbd7ccbe33a28afd5f6c850666e80b336a063479901375b47fbcab
SHA5125c2309686af4bee4dd609b5025342c7eee96e0258b4ae7e2498a4e3bb9f54342ab55d7f26aa9288d672b39f10866eb15cba965fb158e317f9938579677698ebe
-
Filesize
983KB
MD5ad8b4a2a1808c0d366164c4ef69aee3b
SHA16ccf27160591d0ac0005c36aca31c74c2ffc986a
SHA2562142fe5fe33a1b15c92310aa358d8751ec99c48ccab309af3b37fdead4becc75
SHA5125a05a251e6b2f9deda580f5c29da9b18c9600b04a3a0be5d61b103c13e348aa1a1425d6b265955ccbf2a1f2fabf8c15cf5b0cf8c76e329ecbe109985f5b86136
-
Filesize
874KB
MD5eb69bd10286a66fe2bd9946967848c03
SHA103786b15d0d35735b6804b5686d9fb222d3b0380
SHA2567dece164634351a6f47588aa27109ca48454c782254122ecce7360dff559eea7
SHA51206bdf33f82e27f7ce656f5de9549ceeda5d5649e94dfdebfe209e66b17816ab0b915c00da605812651b88521630c119cb74cc5c42f5b798ac8c4568dfb48a297
-
Filesize
63KB
MD5c2885ac796b11af0b3eb4f6d305c205e
SHA174076ea76a2543d523bfc1e97695f7f9f70de1bf
SHA25694c3b96bdc73610cd926353c97b0918ec9515f7da64f57f15240d3966a5c2d38
SHA51211b8438457d3c3cea226a02b1ceb83eefb90459e538921b0f3b855783bbdafbed20efeb1f62164f2b866c181d58825c6cecf71707258e2031c4b7475cff4ae86
-
Filesize
209KB
MD55085bdd7167c74464f21e463fb0b7c0a
SHA100f0255300336e8a57d27c0d6260656fd3d57829
SHA2561d0f04c67da0c6e62c236d90123cbb2e89709f1e960f24ed0ba07fa691f47f99
SHA512c6898282371533fdf80cf95b431541169b551715dc2122c5318557efbbe593d21195f6d26c7617a3ee4da8e144fa755d95f128e886285874379eecdff1c0ef08
-
Filesize
250KB
MD5bb854269ed4fcdd96ddac2fd7938c5b3
SHA1c9f89e6d15aab0a348611eed941e2a145830eb7d
SHA2560a776a6191c81d3682bb8d6784b45faea858a3dbfbe4e1345386068e02fb7d60
SHA5120cec61b713315977363dffa95a29caa2a96e40892e14f1bce24500a13ae62ec0ad8fcf1ac621ac578ae7cc5db1222bb2a33de5dc464610925a5afc274afb79c8
-
Filesize
53KB
MD5036a6ed7a51e73ae2c0acc6bd814e326
SHA132ce8f5df256cc01f79fbccf88f43b7c5fe5a058
SHA256278c9a9a7b0167507f750d67d278ac77d98fe06873e250bede9ae4177c69e8b8
SHA512e2be4eaf2ed591d18a938ef37115afd13c430337603cb332d67cf72f81717708372dc53db579f678970172bf95fbe04190b1fbf3a5b833ebfd7e3ea1c1bbedba
-
Filesize
83KB
MD5196c9bddbef9b6d0973f398bef5b2eee
SHA1c68ad88223ad70e6a7ee69da6142d9a6aa4eccee
SHA256d4f9c5ced1e33446b45bd2affa6e716b4332af8716477a80437220ac20c6dfe0
SHA5120e7b871a66fa43621e27568188cecc8895bba4a417f624b5a65816b48565f71f3dea6a9c90a393d87a9fc945965b9b92578e01fbc3b8e938159dd1907d78b634
-
Filesize
73KB
MD535fd2bb5131714e657b7ab3a78642854
SHA169b32abcda0973721b6a1ad8d06bcb4bf63f8cc4
SHA256c24ac6d4e0e76b39625fc9051e092439642c3a10122f712c11a562860703f27a
SHA512351c7a6d41573175dccfc4923db7c3dee1d752bf003f454ca3268320903e307664409ea08f72b2d1e8be067ca4b2deca96966a6692eef570e9c17f98166bdbf1
-
Filesize
106KB
MD5f7a0aaed16041897f88e4c438a57e78c
SHA136cd8e64c9535d743a451d223d3addf638334005
SHA25672777139f330a2e7653c0b5d427b57172275edd4535c5f743bb0ade50037a0f5
SHA5124246cfe369253b99152c4c6c4d9e296119817a30779afd2bbfb35fb677f70cb4c98ce1a4ac65c13ddee713f2f4b841aacad724178c1f02cb9222181f83480f9f
-
Filesize
18KB
MD56dc95e9a3b69764abb0279977987cd94
SHA1ed5dc14b19638d3eb1496fd8316875fcc77c3211
SHA25663a8e3782eba06f4a86691a101b64ed7a8d4e9415ca5eb3c0e669fe3db877928
SHA512b0f9275a8634d0ea248fdbc1e1682642c9ff3b8832c1f63f37f8f59673f43ab604f8bd890477e9e5172380a42a40417b9139c9affdb7ef2bf492337deb46fb06
-
Filesize
196KB
MD5cdeac2611e103a0f935189829cfc99a8
SHA17c72ec6cd0c724d5b1526fb19bcd6c2020877a35
SHA256c8d561a0f6e11970d1d70c790cfe78fa098788b12e57f54b715b110c615f806b
SHA512c58d3af33f51da982f78358411174e97a2292cbd2f86325a3c82ab65d85ef4fe1dc76e92c2e68f4b988d328c5afb48e332ac57b6aab71ec778b5e812e48bd36a
-
Filesize
19KB
MD5a794957c0b8f0f45bd8354ea2ec24cfc
SHA1a32b31b30dfc9e10f59f5594ff48d20759130169
SHA25661d081d7afc5f699460a4d34b0cd9ee1e81afaa0b03d9d47e0f38737724a29a2
SHA51229f156351ecec2fa04e985fb8976dfd5ad7b926190e7032f6b14b2101d127c5a1de4e3a79d6591576551b045d49b1cadb333e1a6eb282bcbe67b733d63e03e78
-
Filesize
51KB
MD5346e8968e2563f2fc9bb9b0a01e5f9df
SHA14b86f7b460094c68ce72a57518b4ffc9f33e65e6
SHA2562fa6bab36be094e225d3cf814a84cfb643819f4af82b11a55f65b60abb429bec
SHA5127a66da623fcf8c53b33e18d4010c807481ffa56be0eb18672783ad09fc21c74f098f6127a1fa732bd8dfd0903ea1852e2795d10ea3a4c64d49c46597a50a3c83
-
Filesize
67KB
MD5fef14208203edfac97135a75218d3722
SHA1a4a7c36b25c6ddf58e2b25f21402671371e9b978
SHA2569fabdabc53b8174bf19d53f08cd838db9ab6cb124360ec22c66473d1bb1c4577
SHA5124a4bbcb5ba5b60d3d879b3ae50408c0d7b3fead8e1f84bcd20d2bb8118f16346b3363f1918d92121f16880d264d0dc044e2c70206be3a1d248cf2c402042e251
-
Filesize
102KB
MD5b1aec925ccddd3f6825c8b3874fdb896
SHA138624538523780953193bdf6a507ffdf4e2c3b1a
SHA25661032f868403855527e2fc91d176da07213ed190f93a9f99ee9f0cfb783e59fc
SHA512164e9946c89ff11c2deadd7378a32a34ddc521b0b82304b69a1ef06cba17d5462789b91f60f795a51bfce9c55a4cebbd96675950c519266193a445a5a7c40690
-
Filesize
71KB
MD5e4cf4c1f9e3d57a66850f484c08e9ecf
SHA1baba8b919ed196029c4facd4d3b6452a35275e91
SHA25648f1e8d28c060eeb8e8c61d07b15df62d2f172fa34f2bae834c5c76f2a30f1c4
SHA512d863dd046cc5486972b3e355e092ceeaa0362a5e445b8c673255ffab3d989e1d8350e40dce4a77ef2adf3938b70246b76a05837b2ee4bff53bead6273c9f45ba
-
Filesize
213KB
MD5ec44c778a64dcd18bc98a7316e4664f0
SHA10baf26d07ac076901f474ab50142f4812e986d66
SHA256751258bb040197c7c10683a74b38a1b1aef9c68ca9a58ce2168c8a62cb913371
SHA5120e9fc117d9915d3a213fb06fe901c484849c63c683b29cbf7002b36fbac24ccc6e56ed0f7f7188347146e2f030d24e8a8be20fdd28c3c8bf6c2b0fd0276639ff
-
Filesize
60KB
MD5d6e3667f5e2bc6afc50308b480de2999
SHA1c66fd9da6755def80e1ee421b0ecbb8106723b90
SHA25682eaaa4105fa1df8fe516bec815a7634db6aabcd176726e63761ad315f2c43ef
SHA512e1db819ed14196a48ca22bb879c649d1ff14f06919bdb0c04795355adefe9be295f61e335388e29fb5a8d3f8206b3711651397d08947bc605110912ca18121b9
-
Filesize
5KB
MD5c9e7b18f155d639f8ec1dee75b776adf
SHA16849f67bacd4da5a5b9d46803e6850d0be8b3826
SHA256dd6d037222813e2fc878ce9b3d7197a864201072c01622d9cbf5b8463cd6a05e
SHA5124bd44df659888f4fd96c5a06ef90e2018f60201b7a37eeb2d605872280c1a862a41de7312491740ebdb45fe94885ca5ed4a5eb376e0cef2491f60bd8500aea19
-
Filesize
37KB
MD5ddf5dda0d9c77aa541f9a971d8e2d8bc
SHA1ced8fe607d6f958724acac4f0d6cd1da815c1194
SHA2569176282ce22e20b6d0e384987bc2e060f66a8fb76545de49341026134cce2e7e
SHA512456d464838f66c43e652c5fa630039a7d610fb2fe4073a3fee11e23ad66938af65617aefc5ec5f8783cbd4b53cf9d9ceadbf1cb0b0584a07c5bd2289232726c4
-
Filesize
5KB
MD5577772f78ebfd15e2eef029284520725
SHA14c8545eeb6143b6ad3858b5d1e0aee76040b1435
SHA256fe9a14ca08865506207d1458d9948801d88720dd1a4e8d02e65ec92d12e890fb
SHA51230ba7c15e42abeeaaafe20ec6443c2d07af4f9beda511b0357341918e00939d6d826eab72a48bdd4c4b11bc4f39ccde85936e800acf9205f27d55f0827a19fa2
-
Filesize
11KB
MD55ca8640e6171a81f3203db577c674493
SHA1393d217a384fca9fa355a3389273055b6988059e
SHA256c60f69484dfb97d81b5814f5b25844b892d5f0f20d7fe71c11fb9b3dd6bd8bfb
SHA512496039b9271a29831a56481b8aff1034b217d64af15c7943a2fd6a84252d22188c6823a7aa6ca205582ce0897dfe181d19cd58bb3e372b7152be8845ad31dedc
-
Filesize
11KB
MD529a416e493dd79825c742a3e668b847f
SHA10efdbcb5e96f0c2519e4bab3acff9710d0110630
SHA256036e53ac494a2d8e6c69b510f96e9446e910c96f64bbbe8eb60b6a226ef03838
SHA51263b033e9c1b28af2f09ed2c2ca4785efa5d8fd3a4ad98bfa18fb765c7ae8bfbfe15fea5ddcd16a85f3266f0092b9cfb229cbd33ba154d12f547305fa2c2027be
-
Filesize
8KB
MD53e6dac7821d07f919a38df90b86e3c78
SHA1b9aa87b6f55f0f27b09d40436a52c4d5b081d2aa
SHA25622fecb982248292fb7d4347252106274f036dc100e388343910bf671e93ac009
SHA512c2bf9b1215e3210295fd8db0e34f5f765e68bc9dcaf4b3b9597fe3433b4c90c507a3ede819c80ea51e6ec54a36efdb9c09fb71b29ac4e4c97ae3069f45e4c870
-
Filesize
41.0MB
MD51cf262f35322d6c9c7a27fca513fc269
SHA14cd67f609f89d617d2b206341b8c211e1b88b287
SHA256ddb54d46135dc4dd36216eed713f3500b72fc89863a745c3382a0ed493e4b5da
SHA512663123cbc508c6bc483b7a2630a055c160c56a1c067f2a417a4e91c1bb55b8be5b041a2a76216b594b1adfa47345c8da6f2c80e4a2b3fe0b32f380cf28ebb093
-
Filesize
4.5MB
MD577038ee63b375abf661ca4e897c6f676
SHA1552f8a344b39c56db1b875a3fc2ba236d0165a3a
SHA2565453cb9bad014374650989cae8e55f11bb60eb7db6587d44e50fc93af3244f59
SHA5128575d8aba9cd0a27481eed0f3e49781f98a298ddf74866c987f98f10a69c31daa3e872d29d60093c540f3fb97e8a8fcafc79809a739fc78fd8a90531106f5d2f
-
Filesize
39KB
MD511e32422a438f17911a6909abb348cbe
SHA1af7b75007f9d17641f3f94b15fadd3da54d8df15
SHA25640b241e149832fc4728245f0adbccc65effed34122a63afaa80f7000cb048d98
SHA512ee480f64a7b1a735eb0dd523df233546dc5206cc3aebf0759dfc387a36fc2f0b4ab84b990901dce458489b2c69c78de5b47ef34b01a23a6db1cda90c10274186
-
Filesize
69KB
MD5291fe0ed7880c51cf4a8c78d04e8b701
SHA1d5d22e60981c2b10ae37ec562b88f3c7e21ef91b
SHA256324dfb28d4c6bf475ab4c68032dcb111f2c2d356a27504c7cfcb4c3e4833b74c
SHA51248248b5a33e32f8e8dcd6ba73f5bd7738b89bfba0aac34371dbb5efd12d7c238ff6bccbd920bded1447b8210710a0b0d01ba85a47865b5328fa6e362bb6445ce
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0H4D9VJ9\index[1].htm
Filesize33KB
MD541c54562d56abb4f15c321b7933c167b
SHA19fe247b42ceb439f085d2318fb6f06b89fb64e62
SHA256f4bf850b389f83419228b3c13e31201d2b672c54bc52bddc44664e813bd5e5f4
SHA512606bba92e60583161ecf9ea905bf9ea2d561a6db307b2f23c5c6bed67e67a2cb1052095bd81df659d75e8a40046a418e47bf8ff6febee4b54ef578dd1fe51178
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BLZJPBB5\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UHOV4U59\favicon[1].ico
Filesize14KB
MD52375529df3c45bd592aa441a11d9e50b
SHA15e79a035cd1d5a1d16fb18e98d3e9b50de5788f0
SHA2568a7c32b16155df24c05eb2c529a33f39cbb3954e062ddf0f872c43c55dc6b367
SHA51233d5391a5a9f0185222dfb7c829175ba4156dc6a7ef0a7ebbe5ac14365dcdf47aeed4f7309e588d86a6e011779b385a34cc944106a78c7aa318052e5caa5fad2
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6G6HBQJ3\MarConnect--MarCom%20Professional--4103401--SW--DE-EN--v5.4-01.20241009180714518.20241009180714518[1].zip
Filesize24KB
MD58630d79df4793e97b1fc71ac6d5a2568
SHA1629469bd37f42acb56f5d5e409f26081520410f3
SHA2563b1600d4e96af6076c8e2b40c02bfb96ea9fbab9223bf99fd4475b9bef267bc5
SHA512f8d48a5e46c78a562cc565e8a3bed704a6a3bc2ec4de1310a06b0acb536f4de8742bc9032a834b2cc8199ffb89ed2d345c417d4c1490b80a89abde10be725bc7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
Filesize1KB
MD5098a97d053d5b918947bbd6b101b02f5
SHA16a98be83781a440b6b4535b124331c7b3e7f2cd2
SHA25661d2732bb99ca0e729a02607ceac09fe8a938ea120992ae9e9e5f28231bd2cd2
SHA5129bd1283f18856549d533cdd08bf1231f89b9be8d01c88a8f9f12a6b65c3545ef76ae0e69c5db4d3c0d0db649408ee44818549f9ea01b60f809c345efea8212bc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Filesize1KB
MD5df87d75b8bb6a5634fef4940de77f651
SHA1bc16e290f6a736151388623c8ca039d280eda6c6
SHA25665fc498b1f38aa7114c7039764f1278771af14b99e0f4cd60d552b4a533d0604
SHA5122ebd03044bce2c8b7abdba7bb49a5fd1abd775c9074dbbf344b04de95b9135652dbe05c219709cbc468ceea636b46f2540ff44882511d7dcba0214103bed94de
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_E4A494FD0A91CD3C725529A7EA89E098
Filesize471B
MD50e904e71f07ec4c44a1f70384bc4192e
SHA11912f673f1721d4e2bf538254848d9bce7175160
SHA25643b0442c1918cd11268b77a026f9ae453af69d10ef09a3013bb6685f408cf3b1
SHA512444846c5b5d729e5050b9015d71489993d741842d00ae7f758b201f8f6e9cf0e0c75c136fffc7a2f2df99d81cf95955dbaa5ec70ce827a2e3cda904e38487939
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Filesize2KB
MD58e9c4e490f52f2fd25de45a1ff45840a
SHA1f8cb045ed958b33af2edd5ac6b794faaf1400c7a
SHA256aac14d84a71d7e40ce8030c3317051209677ff604c86e95e61f52d75acef5fc6
SHA5120b4851a017b8785cac68665a804b93c4359b27c922cf470512325063103c8d1345e959e5f08ba7a73aaa3874960dbd55debcaaa68ea2306e68770e32d9cda143
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Filesize1KB
MD5101472ac7c019268b3dd5b74030d502d
SHA103dc622f378f5d6c53f8f343ac24554b0be5581d
SHA256cbeac064bb2f61fd246f9a2740d7cc3003686cd8d16603061397b7e35b842e26
SHA512f672cefb27abc5de6e18b839930109dcd0ee9a89a829fdd1ec62abd104883f08bda46be8e41b05126d2682df93ce10b2fa59cafa0ed0b0a39e3a9ae2f3b0192d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
Filesize434B
MD5599067ac76c655601bff30cd2947dc02
SHA1ca80e44301be5b8b3c4e3cd957cee5a772d7278c
SHA2564591adca792db78e065a55a7f0e069428b213b66f449cad3069e93bf13fcc2ba
SHA512dae8fcd66c7a97b6a58970d32e62a3491bae0f382544bfce04cd3fe8d0661683b8155ef1165815489244ba894c105c4e67b1439dd24994c4d5218637c18e7776
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Filesize438B
MD554202d4ee7b8023854bfc7fe75944cc3
SHA1eca4b2669099b196f5d5d04118a6ad52855aefea
SHA256a85e98d39ec8f5b0d11eb6077a6e3080fa54b047dd8e9ff3659f891b3208e109
SHA51280a1a815d8d7e3dc650608c62359fa1dc2efc215bd807b0a1a0fb7598bf1168713f232cb8f1916a553652a811b3ce991d448b6e77fb050bade6418e456e9bb8e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\83D863F495E7D991917B3ABB3E1EB382_E4A494FD0A91CD3C725529A7EA89E098
Filesize422B
MD504e3b704a31e9b539c7b58d8399e8742
SHA117498828709b41ea8ddacb5682483823a1c2ba4a
SHA256f6bcf62387f148e9c5c78211805c5440f520e2849dd456039552143657f8e34b
SHA51209ef78e6373229cbc46c518d667845b4f81438003a103a588dc246372ac7cce110cafe88942df9e49c6b4720bb4c50e7d95802a727c7ff7c5e265b943a1febfb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Filesize458B
MD5e6901d81a566d296b0743920c92984e0
SHA1b4496412321b4a5ddc0104ea11a4a9f4a5c56f65
SHA25676a00e740a12e50969011ef434409e7c67fa716900cdb9e2bd5452b2744c4d34
SHA512c3575dfebea299beba9baf7d0a4653d3c24d5a4f1197c3db6a83ed4330c2c1757663bd01cdb475584c40370dae9e3d0a558fee158b7ec692e121aa04ea066ed1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Filesize432B
MD50789df790d8ecdfce18e716720ee57a6
SHA1b40a27a058954d77783a936f8a42e87cf59278a6
SHA256f3a05519ee317a5abb5627f2b3d137803457d8a0a4fe515380ec0fb78a2536f5
SHA512d1830d4db2ce9cd04fb5a0484bc402bfacd24d26a05c7858776f949ee2da9d2ea7c1fdc61ef69b57caeb73e1317a9f4147b668f5847cd0816edc3d0b12cf769d
-
Filesize
17KB
MD565cdd87c427ad4b2ffc37eed6b1aede0
SHA1e6b21d581ac8e8bfff2d59411e6d8e1541614be9
SHA256d6dac8085f06f7cac203a3d873269ed83d6d01039d0fe87d19f7bc99c76908ca
SHA5127f14807e8aced1ad5a8bb2b9d2a5b87e51be3f3b3f0f27373c5ceb7d6c24f19dbc0363e1708695bf56d6b6a44eab3a883a3df8d13188abbd9e1b4fee323a55fe
-
Filesize
1.1MB
MD5302e11ab876edb6c8ab42ad4e9310732
SHA117b395ee4346ab45368ea61dc0d61cededbdb60d
SHA25659d945d06976e149dcf12101110d263c6707b2a9528c0ba4966d4a722103f872
SHA5128dd4695cdcc9de105c54884f3599384a45ac78e6d168ef737851176cdbfb1790e69932a1102d13a331529914b5a79606def4eeb2cb89dc8557bcde8ef571faa7
-
Filesize
2KB
MD56dcecef04672e7658f9447f428c85a27
SHA1e7f00c36d33e28506a21eb048097426b245fe16f
SHA256caf802d5bb6274fe9aeba3479b30eaa7150d73a6109d2d5f3262fff18567aca2
SHA5121445be7eb22d8c75f147539273b172c189a8af86d75a93870669bf46d47393f88149d45198b656c524ea50e9e66a5eacace786e07cfe9afa45cad87a03a92b14
-
Filesize
8KB
MD584a9a6df2f3347c1bbec1f447546f340
SHA1d22ace0c21b1d7aab1c38b6e44162b5d8fa57814
SHA2569f2a4b403ffe038e29ea40dff16a326351e92a0f5650ffd079f3c61b1cf129cf
SHA51212d4e4d50283719e616df1b6ddf96d7396a821e93bd6979b95c38a8e8bad9850d308792bfa1248033318a0ec6f8cf170452797a873c65fa3fd52477b0fb9c377
-
Filesize
39KB
MD55e711396e34c2fc752d3082c0220f5e1
SHA1588b14ef04a78057c78e5631f712ca3a9d010dda
SHA2567a2c1b360e6f7234919ce1ff6c9d908fdc0ad2c558899d8658ea9cd7776573c2
SHA512aa396a00dbc83840f5244f6359d292bffdcffb3743a6356931304014e8872b565a7ff73372fdec949d4c2101293727a00f9b9e9a7ac690789fa7e1b53d1240f5
-
Filesize
128KB
MD53894034121e9b1653722d73927e41c0c
SHA11e289beef33d2ef8d7671abe7fba3ae938e16904
SHA2563ef2e811df0521171b9cacd2c9f900358d64423f035293b912cd71cec4e72e24
SHA512b8b6545b4e690ec191a93994b50563ac699e12531440420625f00c587ee8dc1bbfe99c3b7d4dd9054a49517eedd8968a6215ef1843de2a9ae7f9ec757f4f204a
-
C:\Users\Admin\AppData\Local\Temp\{2e516f62-e3de-9b44-a972-b474134cd0a0}\amd64\WdfCoInstaller01009.dll
Filesize1.6MB
MD54da5da193e0e4f86f6f8fd43ef25329a
SHA168a44d37ff535a2c454f2440e1429833a1c6d810
SHA25618487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
SHA512b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
-
C:\Users\Admin\AppData\Local\Temp\{2e516f62-e3de-9b44-a972-b474134cd0a0}\amd64\WinUSBCoInstaller2.dll
Filesize979KB
MD5246900ce6474718730ecd4f873234cf5
SHA10c84b56c82e4624824154d27926ded1c45f4b331
SHA256981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
SHA5126a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
-
Filesize
7KB
MD5ef5966172939de9ddabdbc1a81fe0958
SHA1372b764fa423397eddae25984a0664e60ed78f55
SHA2562e57f1f85366fc5c48f60f4f388ac76fd7b291f679613414f3c791de2d625764
SHA5128fe578ebe8dec68f80182db44850457aa8949f84b7cea372bbb9209375425fb88d565edab7400734bde204fe76766302e9d4431c9c816f17ea628a013644fc69
-
Filesize
6KB
MD5a4e5771776c01456b52c9c7dd9e7c9b0
SHA1f84194c1262177d1dcd692f453b7181fab9a1edd
SHA2566d8504de691d3be4d41cad4f7c76092e0c964fe6aa28b1b76814390fa29a6aab
SHA512b6ab181e064131998a74da9963290679a909aa8327b6bc87e131f66ff0b08a198f6e27e64265e0e39f50e34a539a51bd251fe781d7c251e3253aa3a4628deb36
-
Filesize
10KB
MD52d359581c77a5d9cc21f2e696fccf76b
SHA1d5ac2645cb1432d3c447dc07c8cc56d9691ef2fb
SHA2560ee4ca9ca94127f953e569fa6be9596d12b123c0cefa0927e68ad8f8287dae74
SHA5123278d5b5ec9d5a29a3dd8f0a18ff39d9a2a23e15037192a737e25b8bda184c245b24636baadb83e642b79de4fcfb6b82b0f31cc2b4da0620c2d3652377cf8025
-
C:\Users\Admin\AppData\Local\Temp\{2f8f603a-77e5-984b-8671-653cf9616edf}\amd64\AntUsbCoInstall_x64.dll
Filesize48KB
MD5ba029f618770b6ddbb5eceb161df78a8
SHA148913d7e093b3f3c40579e11bba5375669ebe384
SHA25655880aba57e6f35960b7e810dcd6fd4f65ff4c1e49d96ec2172bfb1800f7197f
SHA5129e1b89714986fe56b619adcc4d7a9c78fed3bb044067e7bf24c82bb2da6266b40cf6f60e7a6bf19a9830879e48748d2d045a6df0384113d3c8483e66aecc0eb3
-
Filesize
73KB
MD59cdc3af86784c278e613584ef8b4d572
SHA15bb79d1d2b82ab9d9d6dd66f7e9ed28b76c26aa1
SHA2566b34b5fc18d2985c4e0909dd4a07b1058d351cd53f2a82565128c41d25c2685e
SHA512d635ccb47687da5865cd2d252b7809bb1a4022f3eca649b7825e0240791945fa2199d42ed1673c199766aad44902117d1c288f09e8216f847776fd35edfb4c68
-
Filesize
43KB
MD502538e602280c07438c94489dcbe77d5
SHA1e1c9295a8980486fec38b4af2186a577a591ce46
SHA2562e2b60e5fb7a274f4945444d5edb058e62cac268c5336ff8f4b9e82245095211
SHA512c3d824051fe3d0609a9b7915885e699f9571245c824b938464b4e2ff6138ec299245a45a1189dbcb68218a2ef198e6ed6fd7ff48227f82ae1f5fd59d40077f67
-
Filesize
65KB
MD532dbf187ba54c67b889f45202cca8111
SHA11d748e0329cd455e902d25c1d58bd2b724bca569
SHA2565d675c21d0eb0a4bb98f21c13e369ec72163ae3ab1aed7bfe92caeef38eca5d6
SHA512514e90b37ddde1116291f3e684103592edd4495395d05b290fac7cbd0803d1e64a59ed2ca0f52f386cdd0556f7cdbd6c301b24d2e9a29c668da94b844b022a48
-
Filesize
5KB
MD501b29a0a4b8046e41c1072fc2d9ce74e
SHA109eb956ca1d483157321725653063c7e4f7aceab
SHA256e5ecdceb203a4bd669610157ca723768c11dd97930d60bd4a7ffbc14cf5ac224
SHA512afccc9fd31810da5da788aef9cd1c147b5eb7d67eeb64d2108854077015da0dd16c9bef68721050a0f4ce8574a3da9c78ece212aaaa9208da41aa6f46f0e3302
-
Filesize
3KB
MD537bab992be62b5b3583cc62c7e8e8362
SHA1878a67092cb9ff045b99d0bd3cfc307141c554a9
SHA2569f995c41c0a69d3a073ff8a11c79d202506b42c71a212ff1b80a33587f9b165a
SHA512cea3d9a8959d425f6ceefc0b99182309d6d47202607a73e4caa797dff52dc495bbc22d61948d97291f6b73e5c85c532fc3284107b5fe6a03aa61711ac9028f18
-
Filesize
10KB
MD577977f089483dad377d88a456195d949
SHA13f35bc97d43c760d8ead5335d61baf3e490f85ab
SHA25651c7367db0d17235c08bdb87a268b5b7bd72ee5214abde49de1bcb7a9268c04d
SHA512ac16fbd765948db4f24e73ae7dac5b22d614a6b16a1b48029cb7b0a571f904591c99085107d419fa8faffde7035bf52f1ae7470c84fa88fd0ae6b368a40fa499
-
Filesize
14KB
MD5c0894c7be655b1fd56abd55b1797670a
SHA19e2c239d42290b984a9e2b350a67af8bc8bd11b9
SHA256de3a1425168424b610f9ba974a7552dc55cf0bec4d043e0c8f911cc81ec789b1
SHA5122852fa18dbe2dd39e98803ae4fd10a2a04da076b89079a726cbd4af56ed157ce3dd69181427c1422a5ea42b54035ce2d8f08be3bdaa330cdb94dded4ac749803
-
C:\Users\Admin\AppData\Local\Temp\{6a45ac40-6618-eb48-9e19-04d8e84ed19c}\x64\WdfCoinstaller01009.dll
Filesize1.7MB
MD5fc7f3d13a29978107e13dd182448f9df
SHA196f93240098ae84815ebae8be78d5e31596d4565
SHA256712d16542a881275041dcb788b279a6992caa22b286e0f6a2ce45513ec8241f0
SHA512d374bf1bcf0b568f8c581258b5d3ddaf31b180fa2b231e17bf2f2c3f8cede8de3574e29bddfc0dc1112c3a8338897a586a4bcdba3c5a9686facd91927baff318
-
Filesize
108KB
MD574343fe7d336d4d82afccd17504e93bc
SHA1603f53b11618692562422838be39d4b505391f7a
SHA2561d48f035f271593792e6bf15ee480fbb9013fb95deb37860f7f933b5c0e08203
SHA51266e751205813581909bc5a31a8abcb9a8fb74c8624b6abab3d515680a2fafe8c11575b6f835e5a8be3fb711ea63ab13318fb47ffbcda93af9a21d2c7a85f30bb
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
8KB
MD5eae532655318d50e3135f1e77a312256
SHA15f96df56a0eeefe8679eeb9e8f3b7b1c7ad80174
SHA256673f8adbf3fd815908ca492e12901779cf4c0513334dca039627717d01422fc5
SHA5121186656ac1c25a5da865f0d32201bc261fac0dd762bb04361a80f4cef55a2da0d1aa96f07cb19783a5bf9904f5223bde280452af5bbcb1c57a74bdbfe330d528
-
Filesize
124KB
MD5f1831467d68d64adb65cb3e80870c984
SHA1125dbd712356435ecd29896f8bafdb43b8bbc4fd
SHA25610b174cb3c968ab5d9c37e084ea9b31b01cd2d9bfe55da56d4782272e4619eb7
SHA5121c81297c97d36348281e9c033683b051e56fcf0bcc235b558c339faa3a7381667697de19ebe7cf45a719f90072d0212dbb8afa096665e4a5b11c1de99dbaab1b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2KB
MD55a84982cc1d33bd4788f0963418119f8
SHA11fc4e704b47a454a667e82aba642166e7b505099
SHA2566868cf0ce9ba8e6467081b30b0124c60d02e0c76c9d7c55ac011925f2454a493
SHA51270d90fb1ee8c3e8a46620af1632beb2c676abc19e1fabf9ee23f92df3afe8ba6af36265cd40d121c8db55e2a7f387743d754b1f534ff852a650fd4296e1fe559
-
Filesize
1KB
MD530bf3a196f6503c0d4565acb3cae19a1
SHA1063ecd317a58094023815cf4cb6c60690051baa6
SHA2564014cd4e1b4a096a3cfb841ebd5502ad3acf456404fa56fd3e763c479d9f7a99
SHA512f2911b1405dd0bf72505eb956dc88ac8662d14ffdd0e4ea908cfee214608979bb88b2302d7c8b6ec28e7a5dc1f71ef1ce177bdf204d3ea3495b77ba17780c928
-
Filesize
1KB
MD54efc5d41d325f04b8feeb474870c9ec6
SHA1e2a7faab6dc2a55f1674fa50a558b8aa09b65d07
SHA2561e5424a8211e1431c7c4e91d027c803e808b4bf866271a0aa2af5cbda687fafb
SHA512c8313340e49b4f2387214ae312aaaaa48dcd03a46b6ba54fadcc93f0e7ff51b213b2b76ca4c73d162f427f88e881bc54bbb847eab5671f9ec6ea39bfcf1301b3
-
Filesize
93KB
MD57b8a172a677a27e4ce5fcb23c1dadae0
SHA1715717cc0e5c5c933161a428e8bbb34c8bac3229
SHA25638aaa13298b01a6550a616704c4420bb492b24b3a25427acc55de6a960a3d6ae
SHA512e48bb928a071914760fdf678dee96e98be41cf70a25ae356a4cba693098f2038192d8faa2cf6cfd23ab531941598521670c8a71ce5b1bed141a18b491790f949
-
Filesize
93KB
MD50ad0a5d00d6a7df7e7595d930450bd81
SHA12bd5bd7e06e477a5f9096927486e0e7528a112b8
SHA25617447b27d883b1eb132818e3bac84172acec7bbedccb58e45d2b1d45953a694d
SHA5124f637a5ef85f09ec401550f85df02eeb0abe37e9703acee4225d9f5295abd797e90aeb47c4640e152c7a630824b476ee30f00373a30dd7b82bf88bfe88d8b4b2
-
Filesize
93KB
MD539c205a431664be7734fbd40235296bf
SHA186286781cf9ded8061c40ab3a9fa3d7a08dc02ad
SHA25621eada73e825de572de935211450f5d6e1cecf408f709608d92083dd3739bf04
SHA5128ca0a50f4f6e0b30bf34b4ff7e4011e258c819f647e949da647a780fd37e7fef9a329537aed6343401f7722469ba3e9ff9b05864094dccf4351fabdcf044cc49
-
Filesize
76KB
MD5006f8a615020a4a17f5e63801485df46
SHA178c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA256d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
SHA512c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
-
Filesize
788KB
MD584c1daf5f30ff99895ecab3a55354bcf
SHA17e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA2567a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
SHA512e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3