Malware Analysis Report

2024-12-07 16:37

Sample ID 241114-az4kessbmg
Target SPSSStatistics.exe
SHA256 84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282
Tags
defense_evasion discovery persistence privilege_escalation
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282

Threat Level: Shows suspicious behavior

The file SPSSStatistics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

defense_evasion discovery persistence privilege_escalation

Adds Run key to start application

Indicator Removal: File Deletion

Blocklisted process makes network request

Enumerates connected drives

Event Triggered Execution: Component Object Model Hijacking

Enumerates processes with tasklist

Executes dropped EXE

Drops file in Program Files directory

Loads dropped DLL

Drops file in Windows directory

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 00:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 00:39

Reported

2024-11-14 00:46

Platform

win11-20241007-en

Max time kernel

114s

Max time network

203s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\RegisterSPSSWin = "regsvr32.exe /s \"C:\\Program Files\\Common Files\\IBM\\SPSS\\COM\\spsswin.dll\"" C:\Windows\system32\msiexec.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\MSIEXEC.EXE N/A
N/A N/A C:\Windows\system32\MSIEXEC.EXE N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\L: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\P: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\Q: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\E: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\X: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\Y: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\Z: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\M: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\S: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\N: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\U: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\R: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\T: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\V: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\H: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\W: C:\Windows\system32\MSIEXEC.EXE N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A

Indicator Removal: File Deletion

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\tasklist.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\IBM\SPSS Statistics\cef_100_percent.pak C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\fr\spsswatt.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\translations\ko\LC_MESSAGES\R.mo C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\JRE\legal\jdk.crypto.ec\Copyright C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\DLLs\_testimportmultiple.pyd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\dtracedata\gc.stp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\es\admpkg.err C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\ko\spsswcox.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\license\R\LA_zh_TW.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\translations\ja\LC_MESSAGES\R-utils.mo C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\syntax_xml\FLIP.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Traditional Chinese\poll_jointprob.sav C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\site-packages\pip\_internal\operations\build\wheel_legacy.py C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\relimport.py C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\test_weakref.py C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\decimaltestdata\randoms.decTest C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\foreign\tests\testEmpty.R C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\Matrix\doc\SuiteSparse\CHOLMOD\SuiteSparse_metis\README.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\syntax_xml\DO REPEAT.xml C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\Tcl\lib\tcl8.6\tzdata\EST5EDT C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\survival\doc\approximate.Rnw C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\Tcl\lib\BWidget\images\opcopy.xbm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\conjoint.sps C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\mgcv\html\R.css C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\common\ext\bin\spss.common\mcgzlm940r.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\grDevices\afm\Helvetica-Oblique.afm.gz C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\English\tcm_kpi_upd.sav C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Korean\stroke_valid.sav C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Spanish\ceramics.sav C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\fr\spsswmea.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\pl\spsswbam.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\tcl\tcl8.6\tzdata\US\Pacific-New C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\common\ext\lib\spss.neuralnet.9\messages_de.properties C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\ru\odbcdac.err C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\zh_TW\spsswkm.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\site-packages\setuptools\_distutils\bcppcompiler.py C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\tcl\tcl8.6\tzdata\Asia\Nicosia C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Korean\oms_simple_outline_example.xsl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Simplified Chinese\carpet_plan.sav C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\jackson-core-2.10.0.jar C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\pl\spsswc2v.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\doc\THANKS C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\Tcl\lib\tcl8.6\tzdata\UCT C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\JRE\legal\jdk.naming.dns\license\license_zh_TW.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\ensurepip\_bundled\pip-22.0.4-py3-none-any.whl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\test_email\data\msg_40.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\Tcl\lib\tcl8.6\tzdata\America\Rosario C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\Spanish\oms_bootstrapping.sps C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\library\translations\pl\LC_MESSAGES\R-compiler.mo C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\as\lib\com.ibm.websphere.security_1.1.37.jar C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.rmi\license\license_in.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\it\spsswkme.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\lang\ru\spsswsim.sbb C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\test_posixpath.py C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\test_email\data\msg_20.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Python3\tcl\tix8.4.3\pref\WmDefault.fs C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\America\Yakutat C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Looks\MonocolorContrast.stt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\America\Monterrey C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\Tcl\lib\BWidget\progressbar.tcl C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\Samples\English\oms_percentiles.sps C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\JRE\legal\jdk.net\license\license_el.txt C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\doc\KEYWORDS.db C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\CellText.toNumber+2CCellText.VarName-method.html C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SystemTemp\~DF67211664435FA9A1.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFDB7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140esn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut41_F9C72E03F6A8478CB90AE7973BC3BCCF.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140ita.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut411_06C87C114C2940F1BCB2F28B5CE34DBB.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140esn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e58d2b0.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut411_06C87C114C2940F1BCB2F28B5CE34DBB.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140enu.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140ita.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\1033.MST C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e58d2ae.mst C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF22B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vcamp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140cht.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140enu.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut5_3FE6ADB2FAD04C65950E169A5E077908.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF9DAB0F82559E4CCD.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140kor.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e58d2ae.mst C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140chs.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut_FC6234543D9D453DA3C347C94AC517C1.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut_FC6234543D9D453DA3C347C94AC517C1.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA9D7.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFD6227F96D2670D16.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vcamp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140jpn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut31_4704467906FE464E826BAB51C4D7AA5E.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut41_F9C72E03F6A8478CB90AE7973BC3BCCF.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF9AE668D30F2FCD41.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIF895.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{BCAFD496-0E48-478D-95F5-84926F298FC0}\stats_shortcut5_3FE6ADB2FAD04C65950E169A5E077908.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e58d2ad.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140jpn.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140rus.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFB26.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0 C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140chs.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140cht.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\694DFACB84E0D874595F4829F692F80C\30.0.0\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\licenseinit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\regsvr32.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000089ac4f3df1c89d300000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000089ac4f3d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090089ac4f3d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d89ac4f3d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000089ac4f3d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\SPSS.UIBuilderDocument C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A199BED0-5755-11CF-8BEF-0000C049C20D}\TypeLib\ = "{7ABA5FEE-0D61-42C9-B5D0-8492FD2E938C}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A1D2E40-5281-11CF-8867-0020AFEE30B1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\694DFACB84E0D874595F4829F692F80C C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SPSS.SpssServers16.1 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SPSS.SpssServer16\CurVer C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wb9ent.BasicNoUIObj.9\CLSID C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{520B6B8F-594D-4C15-AD84-D04B1BBBB540}\7.d\HELPDIR C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06a99f99-a318-4f1b-a2af-0e31b5f7b7ce}\ProgID C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B20ABC70-3858-11D6-8F7F-0000861EF01D}\1.0\FLAGS\ = "0" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FF3-F6F6-11D1-9C09-0060975001E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{70779001-F6F6-11D1-9C09-0060975001E5} C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{70778FF7-F6F6-11D1-9C09-0060975001E5}\TypeLib C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45BDC066-C39C-11CF-BF2B-0020AFF9DF1B} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FEE-F6F6-11D1-9C09-0060975001E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABC7E-3858-11D6-8F7F-0000861EF01D}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B20ABCE5-3858-11D6-8F7F-0000861EF01D} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABC77-3858-11D6-8F7F-0000861EF01D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49806483-5026-11CF-8865-0020AFEE30B1}\ = "ISpssDataCells" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FF4-F6F6-11D1-9C09-0060975001E5}\TypeLib\ = "{520B6B8F-594D-4C15-AD84-D04B1BBBB540}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FE6-F6F6-11D1-9C09-0060975001E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FE5-F6F6-11D1-9C09-0060975001E5}\TypeLib\ = "{520B6B8F-594D-4C15-AD84-D04B1BBBB540}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B20ABC75-3858-11D6-8F7F-0000861EF01D}\InprocServer32\ = "C:\\Program Files\\IBM\\SPSS Statistics\\WB9ENT64.OCX" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{BAA5D084-0CB9-4AA8-B209-1422013FFE0C} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FF6-F6F6-11D1-9C09-0060975001E5}\ = "ISpssIGraphHistogramElement" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E615F40-5D45-11CF-A4B0-444553540000} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABC7A-3858-11D6-8F7F-0000861EF01D}\TypeLib\Version = "1.0" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{B982EC22-4058-11CE-BD75-00AA0059033A}\TypeLib C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{5E615F40-5D45-11CF-A4B0-444553540000}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{70778FFA-F6F6-11D1-9C09-0060975001E5} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{520B6B8F-594D-4C15-AD84-D04B1BBBB540}\7.d\HELPDIR\ = "C:\\Program Files\\Common Files\\IBM\\SPSS\\COM\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\694DFACB84E0D874595F4829F692F80C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FF6-F6F6-11D1-9C09-0060975001E5}\TypeLib\Version = "7.d" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{520B6B8F-594D-4C15-AD84-D04B1BBBB540}\7.d C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABCEC-3858-11D6-8F7F-0000861EF01D} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wb9ent.PPG2\ = "PPG2 Class (64 bit) v9" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FFC-F6F6-11D1-9C09-0060975001E5}\TypeLib C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{F2C77741-7D17-11CF-8879-0020AFEE30B1}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Interface\{70778FED-F6F6-11D1-9C09-0060975001E5} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{816A7DB0-707B-11CF-AFA7-0000C07ABC0D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FE9-F6F6-11D1-9C09-0060975001E5}\ = "ISpssIGraphAxis" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FE4-F6F6-11D1-9C09-0060975001E5}\ = "ISpssIGraphConnector" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A199BED1-5755-11CF-8BEF-0000C049C20D}\TypeLib\ = "{7ABA5FEE-0D61-42C9-B5D0-8492FD2E938C}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\SPSS.DataFile\DefaultIcon C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{953FE483-A2BA-4518-8476-83E5E3A64610} C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B20ABC72-3858-11D6-8F7F-0000861EF01D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7500DD0A-8D97-4B36-829C-06D687112BCF}\InprocServer32\ = "C:\\Program Files\\Common Files\\IBM\\SPSS\\COM\\spsswin.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a6426eb6-ea7b-4dea-b0ca-ae0d94302a08}\TypeLib C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABC7D-3858-11D6-8F7F-0000861EF01D}\ProxyStubClsid32 C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SPSS.DataFile\shell\open\command C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FE8-F6F6-11D1-9C09-0060975001E5}\TypeLib\ = "{520B6B8F-594D-4C15-AD84-D04B1BBBB540}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SPSS.DataDocument C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70778FF6-F6F6-11D1-9C09-0060975001E5}\TypeLib\ = "{520B6B8F-594D-4C15-AD84-D04B1BBBB540}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A1D2E42-5281-11CF-8867-0020AFEE30B1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{574ffd07-f659-4bc1-94d5-6a4d95ac475c}\ = "ISpssIGraph16 Class" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wb9ent.PPG1 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABC71-3858-11D6-8F7F-0000861EF01D}\TypeLib\ = "{B20ABC70-3858-11D6-8F7F-0000861EF01D}" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45BDC065-C39C-11CF-BF2B-0020AFF9DF1B}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7ABA5FEE-0D61-42C9-B5D0-8492FD2E938C}\7.3\ = "SPSS Statistics Legacy Type Library" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7077900D-F6F6-11D1-9C09-0060975001E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{350BF6E4-F29C-41A6-87F4-B4AB5BA702B1}\7.3\0\win64\ = "C:\\Program Files\\Common Files\\IBM\\SPSS\\COM\\spssrtf.tlb" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F06D3868-54E3-47A4-8346-3C6A9B4460CA}\ProgID C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B20ABC72-3858-11D6-8F7F-0000861EF01D}\TypeLib\Version = "1.0" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\SPSS.UIBuilderDocument\shell\open\command C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\MSIEXEC.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\MSIEXEC.EXE N/A
N/A N/A C:\Windows\system32\MSIEXEC.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A
N/A N/A C:\Program Files\IBM\SPSS Statistics\stats.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3516 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe
PID 3516 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe
PID 3516 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe
PID 2736 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe C:\Windows\system32\MSIEXEC.EXE
PID 2736 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe C:\Windows\system32\MSIEXEC.EXE
PID 2068 wrote to memory of 2072 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2068 wrote to memory of 2072 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2068 wrote to memory of 2072 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2072 wrote to memory of 2228 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 2228 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 244 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 244 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 1572 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 1572 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4420 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4420 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4404 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4404 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 860 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 860 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3792 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3792 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3492 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3492 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3372 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3372 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 2760 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 2760 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4920 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4920 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4872 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4872 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4796 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4796 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 2960 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 2960 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 5060 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 5060 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 900 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 900 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 1576 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 1576 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4388 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 4388 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 1160 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 1160 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3664 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2072 wrote to memory of 3664 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 2068 wrote to memory of 2024 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2068 wrote to memory of 2024 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2068 wrote to memory of 4392 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2068 wrote to memory of 4392 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2068 wrote to memory of 4392 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4392 wrote to memory of 1492 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 1492 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 2352 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 2352 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 4504 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 4504 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 4100 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 4100 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 1648 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 1648 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe
PID 4392 wrote to memory of 1324 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe

"C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe"

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\SPSSStatistics.exe /q"C:\Users\Admin\AppData\Local\Temp\SPSSStatistics.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}" /IS_temp

C:\Windows\system32\MSIEXEC.EXE

"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\IBM SPSS Statistics.msi" /L*v "C:\Users\Admin\AppData\Local\Temp\SPSSStatistics30Log.txt" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="SPSSStatistics.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 57FD13158BA46FBADF310A619CD409F6 C

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{456800EE-C34F-4356-AD33-4DB4EE02BBD8}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6FD83D1B-26A3-4E26-AA5D-92EF45BA6F7F}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C472A49A-1716-4774-BF44-B38DFF7C63B7}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA3F64CB-9AF4-47F5-BE23-AF8212B7C419}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D0620A8D-697A-42FA-A778-BB8F8FA14B49}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DFF87D89-A66F-454F-A396-64D24000544F}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D25D983B-2754-4CDC-8E94-AB76DF3FA001}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FB0AC50-5DA7-4AFD-9D92-29D39CEEED75}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C19954AE-B06F-47A5-9E53-5D2D5539B6FE}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A63E1D5-9F41-4F8D-A0D9-01633C29FAB9}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A876544-3587-4939-9425-D497093FC21A}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B271E0C-9AA7-4A0F-95AD-265F5CD2F22C}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{67C0FAE8-9EA5-4567-8141-DF770AC31CC1}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EEAD4844-B37D-4206-B8B9-5E3BED82452B}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{88739D37-1E1E-48D0-A9F5-84F6931AD216}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84151B50-1C99-488A-8577-6691CC402B68}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0BEF92BD-2EDB-403D-A799-07C0C14E84C4}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8DC7AB2-AAA2-46F8-8D94-F676F5E3E366}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4533451-3103-45F1-9F24-FD6C84F6FB57}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33615B52-2047-4C15-8906-CFFC57D4C6DE}

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F59E7808105DBABB52ABB6381CDF8719

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D2D9080A-2F58-40ED-BD40-C6E72AD70CF3}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{03B56AAB-AE2E-425D-AEFE-D9A154A77AC4}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3CFF2F4-DB7B-40AC-BE3A-4C3F47E47609}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD73F4F5-A949-4EE6-B5F3-89642F366CA9}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{63E9E092-8061-41FC-9A1A-D73A8FAE5F77}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1D37700-4BCB-4A04-B9CA-29562401EDF7}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9FE024BC-F273-4709-9B4C-AB5B3ADBEFF2}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0911FDFD-211D-411B-8318-3BA47B56DA7B}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CC26B52A-C48F-4BA0-A144-53F8ED44F41F}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDD8048E-FE36-43B5-B255-19273733EF92}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C47811DB-31AF-4290-BB53-C10A494C93FC}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{484FFF4F-3759-46E9-B100-4EBBA9C9352B}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D4C42F1-40C0-4264-A9B1-9B381B8AEDA0}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9166CF65-CC7B-4BE1-A5E1-971FFC24F687}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F7BCCD4C-C509-4F3A-8960-33078E0AF705}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D30780F0-F0A6-4830-A274-9EC2D9D4E798}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E841D829-43C2-42E7-812E-D37CF5D04F62}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58DAD30B-CBBF-4A9A-859A-16334C563D9D}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CF23E93-48B6-45CA-A596-10DE70E1E4C7}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD5A6A9D-FD55-43CE-A286-C1B54FE9CC2C}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{98A436D9-9041-4811-9C10-9719B2006202}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7887ED20-BA5D-471C-B910-9D7F35FF753F}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA126024-BD40-498F-BF3B-2FD0E2CFA2A6}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2E6CA8B-0DBE-4AF4-BFEC-62CD884F059A}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1AE95974-1380-4AB3-9C2E-013228A210F8}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8CDE6113-F5EB-43B3-9306-C68CA37CB1A5}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F9B3193-26B9-43F5-8B45-8B5C213A7821}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DBCFC6DF-CBF2-48E7-9F25-3177117801C3}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4529E89-EC82-4FE0-9411-EDA1843D8E3E}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{141018C7-A3B7-4E5F-9F50-02B0C05C27E8}

C:\Program Files\IBM\SPSS Statistics\licenseinit.exe

"C:\Program Files\IBM\SPSS Statistics\licenseinit.exe" -f 1200 -v one -q

C:\Windows\system32\CMD.exe

CMD /C DEL /F "%SystemDrive%\Users\Public\Desktop\IBM SPSS Statistics Subscription.lnk" | RD /S /Q "%ProgramData%\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics Subscription"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" DEL /F "C:\Users\Public\Desktop\IBM SPSS Statistics Subscription.lnk" "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" RD /S /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics Subscription""

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F2F88B30-C33D-4B1D-A8B5-F19B052AE833}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FAFC385E-D923-41EB-A880-5843D4ABBBCA}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{811F1096-C85D-492A-B07B-7C2A245F61D1}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F3B04BA-0572-4130-9F95-C392DA01BE90}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC82DBA8-3766-41DB-9BEB-BDC64EF41F02}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DDDB6BF8-B86D-4B9F-952B-143F5534DFBB}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{65CA55C0-2B4C-4E79-BF56-21F0ABFACE6A}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94E4791A-5E3C-476C-AF63-A2A677ED7021}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1E8E3B8B-8A3E-4EB5-A099-8B9ADDD81DEC}

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7BAC211F-4BE4-494A-99C2-61CB3A52F372}

C:\Windows\system32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\Common Files\IBM\SPSS\COM\spsswin.dll"

C:\Windows\system32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\IBM\SPSS Statistics\WB9ENT64.OCX"

C:\Program Files\IBM\SPSS Statistics\stats.exe

"C:\Program Files\IBM\SPSS Statistics\stats.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}"

C:\Windows\SYSTEM32\tasklist.exe

tasklist /FI "IMAGENAME eq stats.*" /FO CSV /NH

Network

Country Destination Domain Proto
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\~2826.tmp

MD5 398e28aace51c530c66ddf56043e9f79
SHA1 dce1644a7e19249ea2c81b2748454605256f28d0
SHA256 55a3253f00703356ab63c621e2a05a70ed9a4fca32a89d99990ff27949e96db9
SHA512 e9881a46e9a3326ff840eff35e4661617cb4bd5298e362799928faf157e738fe9ddd362b8787c5956534ea8d9450b013262f8ce4c8ddac3fc1270a3a9d901abf

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\_ISMSIDEL.INI

MD5 90132cfabcbbf384dd9d2aa0f4ab9fbb
SHA1 5c7c47c5b61ca2e40ae29f5d15758f4e5048d57c
SHA256 13fdac739123b8b51f8ec4afe504451a8b88192e39bce664572a38db18f615d7
SHA512 5750358feb6d59325ab175801a2d7cf5cb67b6dfb8735d01030d9f38172c291d40658dd84397d71f1b27df32ae2a4c0b78dfb215037b802a548a48ab65430012

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\0x0409.ini

MD5 a108f0030a2cda00405281014f897241
SHA1 d112325fa45664272b08ef5e8ff8c85382ebb991
SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
SHA512 d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

C:\Users\Admin\AppData\Local\Temp\iss4AA2.tmp

MD5 52f9aaf4c8a586b54fd36745fe535b4a
SHA1 e762e747f3e55e8b2585433761a8a6ec1ec14686
SHA256 3635ab61ee4d46de5ac705ca7e2a54201743592e127c7e1f14863e1a50fb348b
SHA512 67da00a0c184595c583cd2d6869f658302052bc28a2bfe31564ae47620f9539771fbdfad01835c92103794114fa4b770ff0a7b6c4521d98d6f340890ad269c0e

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\_ISMSIDEL.INI

MD5 b3128bdadfc6cd2e970fb5eedbd69335
SHA1 67c18332a4be55c5a30899fa49b28d2e5b0649e4
SHA256 edc7fc4359cc2ab78448b6f01d171218bee8a682fa13ca7a5433ad518de30637
SHA512 203eb6adf514e2f088b55d57e93a5ff3b29503707ccd92366f4cdfcb3e65d60b5dc793eb2b719b81a718b3339689b9f5cb8545823332693ef2fb6741ef003883

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\1033.MST

MD5 761b2ca8f48668109f468d8ce6560f07
SHA1 a15d3365b9e80b5c2e3a872e443d8facb0517b86
SHA256 d74e5b8073a18fd247318861ece2da371d6ec4396630c0538d2e453c2eddc6a2
SHA512 b41b5820199296096fd64342a04925bfde4f08d95f0deefbe542267b243181a73abddd4ba7ecc0bfffaaeaacbd7fb6cfd5a2cfac55b22103bfbbade2cc0685f9

C:\Users\Admin\AppData\Local\Temp\MSI5C83.tmp

MD5 f174086a71fa34b4a612ea330f0df3db
SHA1 d317e17f3d70cbb82829bfac8b90600887433c01
SHA256 c30c8a461175ae3240c7a835c9a4946a913a54e55f4b87f42b729c685a40448a
SHA512 946c8fd10db3f87a813576af81106c40544754852fad7eaa1095cd5ed7d6b817488ca443ae83f3dbb9e512bba461661d9602da0c2470d9d79725eaecf1a9fc76

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\setup.inx

MD5 7a3b2e25c36012684fd92d2183dfb6a3
SHA1 0197b83cf727ee322f72984a583e35d193b0984b
SHA256 f7488c0b03db0f3e9c6539cc22c00794988f2d6ae557e1eaaaa7b1cfde7f2dfe
SHA512 8a60a0bab9fa6862f12514e98e94bd8dfe01a807884b43bca3226f19c834cdba285b1a33d1f9436ac716670e4c4e93a7b9ca2008376f17654903ecc5d2353744

C:\Users\Admin\AppData\Local\Temp\{89E43640-47B9-491B-A055-C8EA36229882}\IsConfig.ini

MD5 8e5a630bcece4631ed246ef68a0be767
SHA1 ffb5f811c637ec92bab713bbab6f01dc22d52bd8
SHA256 dfc38905e864217786cd6134613ce9a35fa028af14a485e7a58492ffb79a747a
SHA512 a276ed41c8e220d9ee5ecd99ca44a991b0dce73fac8a4242ab5ffe69df01b60b93d9db596ff0d880108e36751b30ace62403269ffa61de2c0d5e3d7ae1e04cd4

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISBEW64.exe

MD5 95324884824522e3fb1385eaa651b3c2
SHA1 7f0006b6df6c66748ab9542662c04a055d0f6497
SHA256 c74fef6e38c4439c7d652449869a92121e43df373b0a0cb5498bb7a79eaa0990
SHA512 df4b2b6c834b2348ad5abf5f3a127b7aa9ebb7a10c78212f4569e9049092aac19c7adacc99f9becb93239a35a902efe10fb59473d3d9691a313c764bfa6a19a4

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\ISRT.dll

MD5 f5749e8fc6419afdb27283ccc57f25af
SHA1 abe645b76d05b831e86e94abe870883618c8c6c6
SHA256 ed05b093f2264f166b5c9305141dbdfc320668c34f5d164aa68879a58c0e7c43
SHA512 6b7844e16748c2a0ea01c1b3841ddc09f0abc408003ef681807580834359f609443ca6d3b2df7d4e580d22ad7deabc63d01e169cae271c4ea9ad5445fb3a1208

memory/2072-257-0x0000000010000000-0x0000000010114000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\_isres_0x0409.dll

MD5 034f2d2a1eee7aa3031599d7481bef7d
SHA1 599ab430f1c69e6ca67914b6b834bd6ca81f6552
SHA256 36d4a1cc41f68238d197ea4510b93718c1e6a93a9c17a8169db95130371fbecf
SHA512 289af5525e70e592aa54857eba267e102eb8be33c8d69041fb23f6c2482cf5a34a88e4dc2affbe8a61caa5acf92d1b4e8de5a2d871da4f00c90d6e077d05326f

memory/2072-261-0x00000000035C0000-0x0000000003787000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{53980D8A-D5FB-4411-A2C0-1F54C12AECD4}\String1033.txt

MD5 b1acdf057f7fdb3260f1ad36ba758768
SHA1 e89532c68e44f7070974a7a54e9de30087cc3c41
SHA256 c3e9d7cc1568c07cbe6c334c69c656bbed5930de0a284ebfeb1e0aceea6c5f1c
SHA512 8f2b17b60e789c08f1adbc3685e184eca20e87cf30191223eae82b8ec65ad797ef4711bc7149d1ccf4151c56e23604fdfb5969ff4bdf33608b04d1e18baa13d2

memory/2072-283-0x0000000010000000-0x0000000010114000-memory.dmp

memory/2072-286-0x00000000035E0000-0x00000000037A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SPSSStatistics30Log.txt

MD5 93578ff99d062e5e123b76fb989800cb
SHA1 d1b09f88b4b2fd80a12c15e2f886eb7be5e1c880
SHA256 7fcdd44ef1fb8310b491ba72e18dc76ec838c1af996a71b4ad8d15045f8fcec1
SHA512 29119e4484a3602e40a5d43e9640a244aabcda1641d0abc6097dc38bd716a1c2d3b86e733602456fd13668e63cfb11d19d96cb570bf2c38b2fa269c8c7ef1331

\??\Volume{3d4fac89-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1c80ff01-ecd3-4064-9ef6-c30e428767e2}_OnDiskSnapshotProp

MD5 8c353ede0f59714e4c9b8cc32f5ba6b8
SHA1 3e90a266c0712ada5f8083b360ff58047135ca76
SHA256 96e7ddf1cc0c12f5f5224f15eb481674c9e2ead70e4da19eb590f1ed473588d3
SHA512 d106cc18a2962c181d1f082e2c416188d08fbcbd9777753ac70e1664b10190f73e8ea85685cc159716fa6f8b4f946929a9c4d74d0d0a4bc3da3acd0b2d17ae78

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 bff3d8d6fe277f72cd65385b44db8ee5
SHA1 5bf75bd3a0a5d4a0c10611fdea3ecca1ef75d633
SHA256 86e528b5564e14f2920d583c77062a486c6c6f4cb8dfca18dfc5b0ecfbe7c0c1
SHA512 06396146b528fe233d6081d7a4cdd27765955f9abe7c9865173a0b3a0981071d03b5f414042502f81a5c2e669e355b344af955c33e8d54a51ad80258e3915d59

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_56FFB95274D0EDD1F3DBAE491D8F5D08

MD5 b88245405b1126cfdf235f7588906404
SHA1 b712a19646e11978574220522d768959f0454f5d
SHA256 b1cedad53206c56341025579dece40ac77a8647ce632092648f4e63141ea34d7
SHA512 80ffeaa75b9e1cb0b663e7c6351cfe9214027f9736de52af93dc546945133467c8c53fbe116140d21afff0a14b1d19bc58ec43c7cb90225d92ffbd0fe22c4604

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_56FFB95274D0EDD1F3DBAE491D8F5D08

MD5 ec6b1e24b0280c17427f2a5976f4b03f
SHA1 7cf3d5c9008a8c34d8067d34d83e238bc34e2a85
SHA256 8c416181bded51b94b6b388d282760381232ad6bc4df5b3fcbbff0fafa4d47d7
SHA512 39b0c5a40394f3bd1aea7ebdd7cd431647319b753b6415d91b5e3a55442e2e41b41ee086853eedf7ec89bfe30ab096cc42309fa64273cfef373ccd6b3458224c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

MD5 50c2acca85675897b36b7b4be3146abf
SHA1 73f0c48a8fb60ec92eba17c7a901703234cd0f8f
SHA256 0463055a40e90c7b44ae7273a2480f8fc5ac657eb7cdfd2f1d7e44129ccd5e76
SHA512 1902e8b97988e3d68b02047d68686bf3c68b36e262014f0b40ef920d066b83f21fbbaca5ec3b3c37c961fc06ee39a2fafe42a896d54f1a4fc748a31d71ba3e61

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

MD5 a51926c1927f2ba031d4c17321acb82b
SHA1 05807bdd69689c59138c8801336d519d639d7f04
SHA256 0180d46ac9275f1f0cd1e39058d5d3889a33cf77a90fb793364dbb5c2339ad86
SHA512 8c1cdc732a09c9f6198e46a9822ce6539d8f0311b76ec306798b64cb34231c15cb3584c66c0e536f27e29d7f61b8cd3e7a9f62aec823d70189faea65d976604c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

MD5 de60388f3921fe0cd4272d7fc99a4bd9
SHA1 4726073b006c9b54cdcb378212dee2cdd4bd622b
SHA256 9e8579e6133a72d13a0704175fb50353bef2876e04e0b510d32791e47ac94c31
SHA512 84325efe7125e5c12adbfb5edd96147e3211c8128e02183effa7db9c52255f8ce1ff20eae5eb50e999cb4a8528ea3f8b4fb09e5fe85478559688c1b208691e0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

MD5 11141d8b81f4a980392064a9cd3ccead
SHA1 5fb348fb57943a98592c96b5fee03151d79ef7b7
SHA256 ee4b51ea46c3b7b6e2a29ceede9d58074583a79a53e2dcd26fb460e8bd959f62
SHA512 064f6c86423a8701244cd59e50ab3f503658ea72b0fb232a4ee66cec7a419d2a4958d62ea94ebeb6f810e1eb3dbf8e21c6838e9f7010ce6ece4cec3d5ec8e728

memory/4392-323-0x0000000010000000-0x0000000010114000-memory.dmp

memory/4392-326-0x0000000003300000-0x00000000034C7000-memory.dmp

memory/4392-335-0x0000000010000000-0x0000000010114000-memory.dmp

memory/4392-336-0x0000000003330000-0x00000000034F7000-memory.dmp

memory/4392-343-0x0000000010000000-0x0000000010114000-memory.dmp

memory/4392-344-0x0000000003340000-0x0000000003507000-memory.dmp

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\Copyright

MD5 9b9c88587b5e07b6c5bef68198889f05
SHA1 800b6a17bee83f31e93b1d5a0af2b5b59e32b695
SHA256 ccf01160e021fc8a421b83815bf451f7798c801139b71da456b212df4c6c2210
SHA512 f1d33a0b2c8de47aed4a6cec05cf9375b6af779300efc99820d46e40facd74eb5e99ba1228f70cad72ce57246cbe9a7141ab1cab5ce04d481b5c2f8d2efa453c

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_cs.txt

MD5 789169c2ef93600c18550ec5fbb2d274
SHA1 7bf39454028d0ee23b93c745d8e2e5a175ebfd03
SHA256 d8169f78bcf9c4a2c79c7e958d4e3af62632171557581a82cf2cbe9b5ff2e60c
SHA512 d9279553c7004b37bb9032053ed8ee718842f80aa2cd5ac7df23f40cee2153716c92c33003ca0861c043b819381c2f9d5fe9e0eca8c592ee85f30784b7f80a5c

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_de.txt

MD5 588fa3c376b9eed1bf33721cbca4bb70
SHA1 2b29358d7aa2c5c260232a09ba53788ae47cc45e
SHA256 6fd8c25fde705c8ae7607d08ec58db31087b4763449f5d2deb74329d94be8f1b
SHA512 518cac488ce9e9f6719c67f670839d62a8b8bc6b5c0b9c91413e6ad05be43b6299751a90cd84ecc5c4bec3d40db10fe8171d148de2992701e529c5c2ed078dbc

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_el.txt

MD5 fc199aa211bc29631b7b8349052c6940
SHA1 acc04a3bd36646ac5abd2db837961b8b31a85bbc
SHA256 856fda1bf53f22671bd01462a63be7f823f008d0d3d6bc8abef14f0d21bdd04d
SHA512 036ec60df9acb32fe84939980981a0caa1d8b10fb7f77ec35009a3fe7de6883dcf7e18d8e732dda88c35d306806a5c0d8543240c84b5b97176f068b4d29b0e09

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_en.txt

MD5 7fba517577e5799e347330371cbd542d
SHA1 bd64e405349f6b2ebfb6115c4eb84da6afdc01f8
SHA256 f0fcce24fd0b9dbbe9e2b430d66bdbdd85c6241d041e919b06d77b37953dd530
SHA512 5d75281d046accd2317863c076517246e7e22e6026258c7c1aa18ed2ec21af431e5fd8a0ff06ade1cd8f199a87e519a38b13d36cb221fceb5e2ec0e4678c8ca1

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_es.txt

MD5 040c06edebace806dcd05470e820da53
SHA1 2a9f30b9453ed0a5543e9138f94fa5f14e3bb43c
SHA256 cee88fc929dae8a23e0078674c92f458330866319c3737aced8e2b5f307168aa
SHA512 3dcdd9d0da5d7068d951f054963e119648f69409e1cafd383912c3fe1b09a95f87a93e6b20d823d4a8a1996f913facb8b016ee9540cb6ae6dd4c9ed3bab643f5

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_fr.txt

MD5 833fec06ed2d2a819b342c925fcfbba7
SHA1 79e8feefdff660f940d75b6328c8d34eeaa91861
SHA256 758e50cf911a730e97b81ce2d707f9cdec91d542b576b4e860ea208e42ed9ba0
SHA512 de72f9e02a1455da1cc69c31eeebdfd4a76bbae554d6ee0d83e127ec990104a21079c109b7d0dd9b576c23635fb03b42ff2338ddf83661af328e338a38e452f4

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_in.txt

MD5 f91d59adf296321aba4c33117f880bbe
SHA1 0a409e388e5e0211ed99c97a2bccdd72d62a0931
SHA256 1be77b545b4bba231e1f720a3f85492e52f1d689be389cf0924c7a1cc9036ff9
SHA512 7bdb99c8d4940506cb9d24df0584f2850e03b481c0b457c711af1ee3d92019badb933b6433295517afabe8d576c00f9852cae13b86c98300f2faaebe9cd4e5db

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_it.txt

MD5 ee547075d1d4ce94f31bf42450d04791
SHA1 e5ead4c14d736e0b75231aa136a097039938550f
SHA256 f9b32514a9e367fcc3cfebbb7f9d00e64ddc3dd206651036e2cdf5e77df22377
SHA512 5ad6a097a2f9a11500b21cea908a26bda09ff41b26efa909a1382313e554dfd87e7306fc1b93346905cd442b611c227a544cd4791f9a18610b314b814669458c

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_ja.txt

MD5 793f19d8da09ac9c1d4f79c3151dd602
SHA1 502a315a1fe91e0d363600b9ceec416396589937
SHA256 071454b4a1da487b5658a2adc46ef1f12271ee8e06f10b1079270ad942ade048
SHA512 9b206eaf1af712004eb50d54f56c006251155a4dc07ac72f8612013ec0ebe33faeefccb59f1c241beb8d643abcc330c7e03d19705d5725dddcc8033dcd9967ff

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_ko.txt

MD5 e72e25ec4ef86d336d27f4bb3d4def38
SHA1 21b3834c3545bc1fdcabb2e0cbab084a42ffce1b
SHA256 2959ba933addc5cac943db7c115af34c6e82da57afcf36c69da35c1018063bf2
SHA512 1b81fbd52e6c11b5f20b6ede205e937dbc7a936fd4b3cb2bf5e79478eada5bf0a0d50f5b750baa02ad04c1b624c9c7b5ab08d6f599ca97e28ea12b71dff8d7b6

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_lt.txt

MD5 e1a0cfcdbf2535ca8acfe25e4bf79da7
SHA1 9b96a752f3c06262f3d5f3ced3954bfb7bd5f7ff
SHA256 380953bef5bbfea6b46def7ad9059fea78799e303dde8e1a8d6b836a961c6f3b
SHA512 ff6ad2217c2c80b15f168ecfc9f7df6613e9499f293ab6d5f85f7cc1afa8bdd9277d632c800fb4fba5a6975592cc659a69de5e7b923b606a4ac07cda9c746ca4

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_pl.txt

MD5 bb7d25fe144c08801d67040e72f66465
SHA1 df04e67da23e4826b5b6b9e5812c7179343290f9
SHA256 a3a8e7777ba42d961bb967445f43e1b9bea911128a4a90565fd1b07eecc90a7b
SHA512 83a2c635d20f46b24157097a37f6ba89ca6ca649ad3fd3ef6bb6e0b75b0c24eb78542a80b66f227f700eb6a893a863d9f5c754ce2f7e63b65d7ac3ef8d33565b

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_pt.txt

MD5 cbba19a5394aff11f0d4693471d32ce7
SHA1 57c48af7aacf0e707c460c15cf5fca6c2899673d
SHA256 2826372d4615c385708035a01cb7da302ca8fd0a17e72ada0ebfcaa019e0a38e
SHA512 c4bc4ba34432ce92f5972619c79b9971afcca4894676375be263468f15d2b945666fe3b56e1023c03a2956614066c9b5e26281811b2513bc7c1c2b14ff66c602

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_ru.txt

MD5 b397942d724a57d4fa55419f00ad91d2
SHA1 90cd5b4fb2971ce6f1e805f8eba78c22ee57b46b
SHA256 ee7018cb61e882dcbed96f9d80da06614f43063f8837e571bbdf5c3e0c9204e7
SHA512 c806932231f1e3bc31c60ec9d614ddd8e6ecf93cf79f1c16d29fd67043941cfaca4d6471c18b88c5aef95fa12ab7691743ff2a7a80ff21071c116b4dbc4c4eee

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_sl.txt

MD5 ed3c64beddf21f2fe3cbf80e9d1b57dd
SHA1 1646555f55e5cf92eaea753165036e11c8fc713c
SHA256 6193343d10d5b1ba9df3fdbec74599ee21800ac7c3ec50d4a9e629005514822b
SHA512 849c8d83f518717e98fe0bcdad8013f4bbcf62a7f92191e2b72c9489b57027b07b00a6d5eef9deef3698f747e1b36b0e3cb8bbf404e6385901e85399e17c2442

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_zh.txt

MD5 5c02f46c58ed27c707004bcbb00fa50e
SHA1 a0c1452c1c462fc79d1aff78fa8aef4812227146
SHA256 bd847073178daf435031bdb51efd42c416f9ae8ce28d3f4db664259fc224c62b
SHA512 1e876b20b69c254b80e32b990d5d8e57c747f3f9638e7f11b989b210626e43d05c466617f36b5ad6b1f9acfb9e2ec9e9d705232c2daee6ad178d7762d5b1515a

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_tr.txt

MD5 8c575cf5b2fe7b929c1d837798708a4d
SHA1 5bc533227359dde30490ed5064977fac1fd43e6e
SHA256 d1abb6f6c7849501b9f9ff4fbb6985142e9998cdee501455fdd00e101809718d
SHA512 3356ca99eeb996b235bfcf722a80e6a2fef2b48ba714fa9b89588cd6d7a3345b798ce8116797b09c085cc51e0f498a407eee731537bb9fd91ba325eaf918a4a5

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\license_zh_TW.txt

MD5 9d0e3f641ca08ee21c10dd7bf6a1bfb6
SHA1 5e02cfc5ca537ff77050e70e5dd1b01abdd148d8
SHA256 5cb4c6a867839be8be97c06bf269dcf310adbd24fad3c315cbd04b8101973e0a
SHA512 1debd83331bc6872ba5b22a4d741c98409a2ee2150ed0c7134398cd20886cbed8970a2c09d79700d6065821e6584a42ae2fb44148c61c50598848ad8659e047f

C:\Program Files\IBM\SPSS Statistics\JRE\legal\java.logging\license\notices.txt

MD5 fa8b18deedf675763516d078002d682e
SHA1 74b76bb0a8c3596923cfb5ff0b248e27d798e468
SHA256 c14f3038d1c0d4d64bdfd15251040aab0f6c3fe2c501a72a93f04112f02f4f85
SHA512 3e4ff5e3dfcb0e1235d3494d706e4e7e95b9eab452c9ecd3eabb316c62f93930d3b1d81e555450617f3799d7d85b8498665f08332e7160071d6adefdcbe773ee

C:\Program Files\IBM\SPSS Statistics\lang\it\defaultViewerAppearance.xml

MD5 e533948d4e9331394967eacb117343cb
SHA1 a513f92b2e96c7d7d8f97951c4cca663cbaec29d
SHA256 493367447503548b0e1fe54d482eaffb90db2e844a9b8641651c2e298f05278d
SHA512 633d49630ed8aa6bcaee8459c9391cf34f1e793ac482759cbcc5d8a8636598c3716d8ce105f5ce3ccad6cc9dc7a92d8ac072cf30c9166db1269e5126559ec406

C:\Program Files\IBM\SPSS Statistics\lang\it\spsswalt.sbb

MD5 149aac878dc0257697372a8a78e67d36
SHA1 3fbbda358f22bdab58d9d14bc623ecf92540d445
SHA256 00631827e89be5ea625cd862fb672a1b33ff4390ab2614ab76373217f04c9495
SHA512 b25ef9629305ad29fd6451fba90269dec16052fe2dd6a2461fea556075c8579100100a32be8db608e306ac002595a5dc7226527859b446275f644b2f37988467

C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\test_importlib\extension\__main__.py

MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

C:\Program Files\IBM\SPSS Statistics\Python3\Lib\test\test_importlib\import_\__init__.py

MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

C:\Program Files\IBM\SPSS Statistics\R\library\cluster\html\R.css

MD5 8b9362669af13540a86a3ac6cf22f99d
SHA1 f82d594f75385b39433be0337f32970c3ce2456c
SHA256 52144cf4c349f7f2cf131342f81bbc43c6514ba2274556815df88918fdeb189b
SHA512 da578cf25926bb77cb7d6ff14cd8fa79da527ba40c577ed8f4f83cf438f3d81b10319d23a40e21ce380110eed4507849428be78eef3f7e4a0ab98cb7f5a0286d

C:\Program Files\IBM\SPSS Statistics\R\library\codetools\Meta\features.rds

MD5 6e92f4cce1a21912f8cb6b1ee6c329b7
SHA1 550f9e968cf5db6c5912c05b445e5447ed5b5307
SHA256 ddfc254aade30c78a3d69f42c0d1a909f0c4c0413fae18c30cb3e448b96ddb8f
SHA512 fe5521211c400bfdff3098ad059682c8c8e0fdc242b735dbf0a94dc04ff2230e1bcb0a9c34ea3ee148ff89aa6044091fe77f8640c7c82ed7e6702298a0af053f

C:\Program Files\IBM\SPSS Statistics\R\library\compiler\R\compiler

MD5 d6c68f1fe41ced6e98a766a3757313da
SHA1 12c0d3d6e3f5b5d749c93feca122cba34b466ab5
SHA256 570ca456b280cdeb201ef5ebdf22dc8f80092e2c0c68e33c7f73340e420f3759
SHA512 6824a8335bc36af7808471fe603e2c4fc7b77bd08d61df060b80444424563b0764de87aad8d6d20e926d02aa20e22528ffa8ed517af5f35a01acfa8bd2a90590

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\BasePivotTable.Footnotes+2CBasePivotTable-method.html

MD5 d9b1090cdf6f9ce1c901a1cba1c3d4da
SHA1 671e7580bc2967d4f9e832715cfae691d8db0c36
SHA256 95e93542ba9a7ed1f6e5966665111fbe2699ef65243fc310a8d0ed531cd45930
SHA512 be6d4718d909bff00aabf31e40ccddc2666f76602f54156624d5762e36cd4a3d7a31bebd29644e30cccee5d47c0dc93bf27c9ac86e49320365335d5751df9df5

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\class+3ACellText.Number.html

MD5 46798cc265111ce86d4d2dbd39d122e4
SHA1 ec8391f31474a8f0da55daf5a32f982ce165549e
SHA256 bdcfc2894f47430161f20fda05204d56bd35f40457b69b6604a30476d90d9fb4
SHA512 6b82310e2979ba27bec7b127bee4214393934864a52b487f8d847f1a84525496c44ef7b127496269b820dd00624394fa4dedb931c1786e59e5ce307839ed06e5

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\class+3ACellText.String.html

MD5 731146c8d19d19fed70385831c7cd309
SHA1 62f7d559b8d71db283bbeab47f266bb897e5f436
SHA256 f07e47fb10ec83d48f5c674ed665b0dba21d59662c5b27706a87df2e3d8abdb8
SHA512 733c1192fd932b76955ff9a817a1a3c383b984694bd8476bd754bb4ffcd65b4c501bcce2e16ed954e9894e20775feed04d441f2fbf620244871d6345635a9681

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\class+3ACellText.VarName.html

MD5 08df1dfc784fa5c7b9b749ee92f33ba8
SHA1 e3a0b0c5bced0ac94885a5f5d464d4d1ccd584f3
SHA256 c5635935bbdfc7066fd78093c4246596a5b2ae862c5169c2fd10eb4abd804408
SHA512 68621b32962d7f65cf0486281eabdc26d79bd5b7e4b599883e58371b3f6990620dffc1320c79f5d0351a496153f9c2ed38814402b144c5e2bfa45f368193940f

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\class+3ACellText.VarValue.html

MD5 241862aa8ec6e3cc1a9e4a7756ea205f
SHA1 7b81cc4e703293035ec1019ba68ca2311b42a92b
SHA256 eb32ed49d980a2ce45aee3fb975a591f1e68d830f3cc88a39c823ffffb936527
SHA512 c73e2ad0b1c1782fe10de8c2a81519d768c9cd2fe2ec1133e771810287a6f576ae8ad30723da1bed51a832a8645672d212f6fb9771a21603e180ba06741ab10b

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\spss.Dimension.html

MD5 93e27fbedf5af37270533c2f52fe35ce
SHA1 b6be6286e4b25c7398d8ee44db44f4c1cae57ee5
SHA256 d494e2d87b6be2d50b56ffab242cce2e1debd5eef770f364fcbe0dddd7d399ca
SHA512 c86858dc8837edf9c051e6f937b4b2b039fce5557f41a922a7018cba4d8414a0c38145c25b887566fbc661f8f237e815c680c44fddaf65079238d76f0e85d09f

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\spssdata.GetFileHandles.html

MD5 b9b15ff2c812cd13aae1451c9b04c47c
SHA1 59ed93716cd27b4bb79f36d7fe75aa9e92a872df
SHA256 11cc2d88c12247ee38418d0855c6b7c7bc946a32e90d2867c5c014ca06ec0bc2
SHA512 d313bb0650a3f8298165bebd9a072098ca985f4e7e2165cbddb93a8d6e40d69e23d72f826f7f51c0f9d4067b614e54555c1601105815e7152c8c912a985b903b

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\spssdictionary.EndDataStep.html

MD5 00ba9a74145e27d93a296da097f5e802
SHA1 415e0a6fb6595e60042196f5e08f0b64c4605dd7
SHA256 2ef1cd44f12172e643e9fd62bf64180ee7f1de7b4c25fd6c84854ff3f1dc4104
SHA512 2a0fefde031ca54e7242e6d11b7b49ae6c319bf64860e1a2a856c6e28665a2d38edfd84a3212b0ffae9ab08f0f4de77fca6c5957627c6928f4028c00f015183f

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\spsspkg.GetSPSSLocale.html

MD5 6cf3d72eb7bb8987c3dbaa4bf02d62c8
SHA1 f96314dab3a23c74617af6b95bd82a6882d905f5
SHA256 f713932477cbf445388d92ba69ec6d6172766ef09a76be908a1228cdd5ec66a3
SHA512 3908b004bb90eaaa7caeb9019cba3376320528535311348bab3d1f22a366a68a95ff09fc1607949d9edcf2c1c4d78456104e55ca9c1d50ada9c3013eaddd9b00

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\spsspkg.SetStatisticsOutput.html

MD5 ed322e5da9ad4b771f72531e28405390
SHA1 4b365bbc8b141b107950132cdec6c4394b08a80a
SHA256 dd5809a537e1591c4093bac046c7a38a9ce914e977f80d698b83bcbba2f58a5d
SHA512 c089a5badddb2a0e2c5d1351460c9458901c34d92b6799d8e8c6c02d0edc3c88cb39b1691f761b25a86f42d3318523e7396e42548279371b5b50ad3ddbb6a3fb

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\spssxmlworkspace.html

MD5 8a5c1788a9548dc27ea3c4961f3fdf6f
SHA1 cc75bbacdb8164d27f6e4af8f0a47b820c104144
SHA256 596f89418a8fa3611d9508ac2e3c68e4641014672d4dc5dd02f177bf309a2245
SHA512 aabb4851f0af64a3c3189740e523372eb6816a6b8ad666ba4e5401690a70154ec8ef9b6392318683791c6edfaac9a37860d80a2b8e119cbc8f84b4794f9052b1

C:\Program Files\IBM\SPSS Statistics\R\rpackage\spssstatistics\help\TextBlock.append+2CTextBlock-method.html

MD5 eeec2398988ef6ef3e20fac28523fee9
SHA1 b4c13e80f19ea5b59cf6c154eae8a3a345b0d851
SHA256 15cf77eabcb7c9f732cbd5ef72aa619ccb00795472e1f08470cf07f578b73ba3
SHA512 3f0b868aca02c9c915dc5ab40c4185bbe89cafcf808115c5e1138eb69014e739cbfa9e384d7650cea33d4a320ff15a2cecc13afe8fa76d4c33eee1b7629ea8e3

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Greenwich

MD5 9cd2aef183c064f630dfcf6018551374
SHA1 2a8483df5c2809f1dfe0c595102c474874338379
SHA256 6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
SHA512 dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Africa\Banjul

MD5 09a9397080948b96d97819d636775e33
SHA1 5cc9b028b5bd2222200e20091a18868ea62c4f18
SHA256 d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
SHA512 2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Africa\Djibouti

MD5 86dcc322e421bc8bdd14925e9d61cd6c
SHA1 289d1fb5a419107bc1d23a84a9e06ad3f9ee8403
SHA256 c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
SHA512 d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Africa\Kigali

MD5 b77fb20b4917d76b65c3450a7117023c
SHA1 b99f3115100292d9884a22ed9aef9a9c43b31ccd
SHA256 93f19e9551d58868ae5820752d2c93a486124c364463dc9c9489d0458f8bc682
SHA512 a088c2a4c7d72717257c3125c7c2aca28463d68306ea452afaad75b8a0f9e5730a8d9c430d14668809717a672dc63c4816762acb046b339da662da421a6d65df

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Africa\Lagos

MD5 8244c4cc8508425b6612fa24df71e603
SHA1 30ba925b4670235915dddfa1dd824dd9d7295eac
SHA256 cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
SHA512 560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\America\Curacao

MD5 adf95d436701b9774205f9315ec6e4a4
SHA1 fcf8be5296496a5dd3a7a97ed331b0bb5c861450
SHA256 8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
SHA512 f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\America\Toronto

MD5 8dabdbbb4e33dcb0683c8a2db78fedc4
SHA1 a6d038ecff7126ee19ebb08a40d157c9a79964cd
SHA256 a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f
SHA512 35bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Asia\Shanghai

MD5 09dd479d2f22832ce98c27c4db7ab97c
SHA1 79360e38e040eaa15b6e880296c1d1531f537b6f
SHA256 64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
SHA512 f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Etc\UCT

MD5 38bb24ba4d742dd6f50c1cba29cd966a
SHA1 d0b8991654116e9395714102c41d858c1454b3bd
SHA256 8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
SHA512 194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Europe\Isle_of_Man

MD5 a40006ee580ef0a4b6a7b925fee2e11f
SHA1 1beba7108ea93c7111dabc9d7f4e4bfdea383992
SHA256 c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
SHA512 316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Europe\Oslo

MD5 7db6c3e5031eaf69e6d1e5583ab2e870
SHA1 918341ad71f9d3acd28997326e42d5b00fba41e0
SHA256 5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
SHA512 688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Europe\Skopje

MD5 6213fc0a706f93af6ff6a831fecbc095
SHA1 961a2223fd1573ab344930109fbd905336175c5f
SHA256 3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
SHA512 8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Pacific\Wallis

MD5 ed097511ad5bd6a55ab50bdb4f8e2e84
SHA1 cb335dbaaa6de98cf1f54d4a9e665c21e2cd4088
SHA256 bd3e94c56eca786a6d761f34163f404804c698bc7c59a8badf494c2f89b083cd
SHA512 d67cfc7b067b2c51db96e3cbeafa1367606907a5a59271a66643fe049fe81c34cbbaa5647147c4958ec28c9a926e44e632b0e20d54703c1569cf4a593e12c087

C:\Program Files\IBM\SPSS Statistics\R\share\zoneinfo\Pacific\Yap

MD5 4f050684532a74c1021f00ed1705305c
SHA1 65f9954328a5fda173ff0ce420428d024a7d32c3
SHA256 7a2fd78e68910cb87e454f78bafcfd0822084451f5af45fb58bfac07ee8317ad
SHA512 fdd735b45927456db652e261705c610fe2b346eca9ce1b97878883559474212247ce342a6b922da19646204181966f39662d375ce0d6a23a65766eb954c80801

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\a_scoring_model.xml

MD5 4b5d7befda04f499cc43bda041109544
SHA1 6d896480aa480b0a77908536ec381fc2a3941036
SHA256 b6be30eb781dd06afe85b5a88cf228743fe1d4ae3473a00eb396793bfde46981
SHA512 538b6a4871b3067778de172b0932c9b449649630478d22451bfba875c5f30fe1dc6e79b4e79389f2ff4ed9ec3a0abc13a27e42e554480f248ea28705a30ff981

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\broadband_models.xml

MD5 d6ac29b3069df13993366e449bb94941
SHA1 84d4db4056dac13ea140042128b01691743500b0
SHA256 028630b40f54d01e1ca426ce831a8ea35c059e5d08d205d1220e543ea35baab3
SHA512 7cd232c2491fd1ab0b333df6157ede14b1a531abe7aa391c5dbaadab6544acb159ee32b5dd0cb117c281e6ff34064fbf684a6f5103366f1502cd11dff9ea4309

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\catalog_model.xml

MD5 3ff15822c7991744aa6a6cc7b835c7f0
SHA1 ffb89cabfe9408684b083556dc0ad8063d71c487
SHA256 cc3ea5de712d0db9a9f21c6d4d045deff4895805548f9226fa9f0cf0776f6eb0
SHA512 ad40356e8b7cbc57530993e8a281309de880087053bc08fe672e5406bbba66f805995880f244f7411e20d9ee10e5f1704cef4127b099c6d0ec3c51b5c9e4da0d

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\CreateData.sps

MD5 254e23309797640c9aff4761aa919c51
SHA1 1bce81c885cac7853219ea0904b49c43c13133ee
SHA256 b2154c8e5ea23f32ceb74b8758e1f28a1cd4a3f4cf01d2d752b3da500d0640ec
SHA512 ad05156faccdda8d4da79632fe5037a512c75c5f60622d08d480c8f0662f31f92a51438af36bd47d27aa40842adb0c5bf1867068576d92331bcb1a6e506536e1

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\customized_frequency_tables.xsl

MD5 27f5b0d4a67e946d5970b4570897bb50
SHA1 2cf7e8d1031c8e9ce261e17d73e759187fcd7fd4
SHA256 c7a9c9d70850d7c87849314aaffc4a91bfdff3f41aa3f115dee50d16820f871b
SHA512 b0c1975b144a04c84109ed21eaf9b664f22b401fa9a4e2e4f5d5082050bc2463b26ee15394e48e0bdc4c7a8c2f097cd6a4cdf491a9dceecca6147333aeb580db

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\detectanomaly_stroke.sps

MD5 a84890102cb46839deda71b68a041f9f
SHA1 e65f11145fc02e664bfad9f11d46c168415f3615
SHA256 ba33eff5ac281b091447c91421bed71b2db56d728e910f2f5fb476d647972dae
SHA512 68587fe7af16f67aa0eaea7b5deea13f64b62e129f57cce4b32d90f9531ef4d685e9c80a076c2aaf1cb6526e9357223318a9e22e91bc894a60fbe90aba1d00ed

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\oms_simple_outline_example.xsl

MD5 dca53f33c84a072028d8c1be86ebb0d9
SHA1 0e859272ef86e295d518d499c5e3a10a15aa2d0f
SHA256 4f599cfeee1acd8b29b8af92b4079b56de1050c83d81f4beca292fd202bb8576
SHA512 85508e94d6ae463d4031dae5a9b775e3e07f937dc9dac81c6baf294b134914f9a1e3bc1a976db995d0329013ffd82ae2c84fe3a39268f89e583190a572f14c56

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\OutputCreate.sps

MD5 4d899e9069b90cd1ca59ed5b2615c256
SHA1 b00964ff023e6a92f0a2a42d5e7a929898e9e490
SHA256 b790c1ec600439f6eff51b473c983251646c131c54a6cb3fa172820b525a9997
SHA512 9b9a818cb3ccb57877ea7c5834f1d0152931f49b67565a1592fd8b9a55dbdd19dc1ba70e8905cff3d91c19404439e0887894d70f5daf96b03d680b4d16fad397

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\out_msdemo.SPS

MD5 c0067c140d3372c7a3da04bad0022afb
SHA1 6c7f7b6fe7236bdf9e03334870d3a6f355b4f1c8
SHA256 bfc2c8f57b61918d230b0253296cfabc1150f33aac2893909d7328f85423917f
SHA512 65d0e493e0e2d71182b490cd8755373d52746ca7a030386d16391c0e4148e74715b9035a331d02e9ce7f4e93fb3137a8b4fbf0541d50539a004b1b0a1908ed59

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\prefscal_behavior.sps

MD5 4e334c9ae5fc2d6b8cd7368aee922ac6
SHA1 0bd222bd55e23474c462ff93b7868d8d9366add9
SHA256 7829e5ede864f12d46bf8794efda6c9b409c5184113477759ff6288b09f9462a
SHA512 3fd231a0ba176df1f1a83d3e91f7a6f79a0f30664c2e47780b8faabb11258274566d889437acb50fabe35dd2637fa9d628a9375c40eeebbddcaa13fcd3f71e47

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\Ridge regression.sps

MD5 a85354a840fdae16a2814fec4a11eabc
SHA1 2ca7d7133adb701c6ad174e5bea61251f28cf05f
SHA256 413b826d04db20ba4876a6e6c5ad8d2c6647cb59066670bf62fd74e8514cd0ff
SHA512 59169b12b70809a0e65c9454f6c16379b266ab1dc5f1b34c1347d721eed836094174d0df4f63f034b84b3f0a11fe13e93261ccd1bd520778bccf7a96faffed17

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\RunButton.jpg

MD5 f945f2f74e1a339233120921959b2b5b
SHA1 9c8b0b512ef9ae9819601e271627fe7c7e3a9055
SHA256 1ffbf06080f36822569a434d99b3e47efa5627d6c15791cbb7862f9bba829cb8
SHA512 1129a27eadfa50475d903ef2b6137696bc7e1a91adf010d8b10ecf7503b737e5f2630bee5ad805023b437872f9870f527ea7471b553ff8f29eadf46ef2350b13

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\scoring_models.sps

MD5 1a5b50e5abac5411e1de874e743368e0
SHA1 85cf1a9bd1e4993d4c1938e7de79dbecfac32d94
SHA256 288635a5b0b213615685a8bf56a0942e7a693fb6b0bb8ae84c521c0d20d33855
SHA512 242c76680068c34b077dd8597969834e151e0c53cf22933ef7a393b36b00a71090f02f88bcdc4129690d70579971f2d64d8c7f4cef1f15ee1a017538bb9fa458

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\scoring_transformations.sps

MD5 65e7b2cc0aeeca56b6d973b629cf6f04
SHA1 95e7f1fd67e9e84744e3bf8809d5c2268c159b8f
SHA256 d6019a6b5e648b913c99491c4de63d098db14ae8a539f3ee91f4774f3d2f88a5
SHA512 6610c73fec8fd205e8aac2362931f3307606da3e4b5b1ae5ec25e3c060938c0eea636d65a3210e3d8549dbdab52c2fd46b3b4ac79ef7290635ebc03c0189e4a8

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\srs.csaplan

MD5 5f0092c65f8ac6bc071d9596abd16633
SHA1 60b0124c23f25df537e9f5f9af5de211feb7c266
SHA256 486bde7c787a1fdc0abd1ea4b74010db6ea2918e358d541accaf9d121549e457
SHA512 e33d1fec1cb772daf8ffc98e0e82421f2dd24c662896cf12166b60141acccc93ee72a2e0015939f991aeff70d5f387b0c60aa44f725eeaa41a2ead303cdcd844

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\workbook-correlations.spwb

MD5 b6bf69b4abde19cf1bb3a6bc684ab123
SHA1 607d10695dd60cd6b11609633aca9be044a5c23b
SHA256 23b6182f696f35898360b8c19de0ae28f6b638bf231d6d892286793d92b61a4a
SHA512 11a993db97edf906fa63e3555c9021305d3bb4f53e170095363afc905fec988da97132cb94ff1a64e1f1bec836fd425cbba3afa3bb1ecb9dc9544b5ba127faca

C:\Program Files\IBM\SPSS Statistics\Samples\Japanese\workbook-means.spwb

MD5 99d1b5922ccb0254e05b0ec804c97638
SHA1 179d9cdb0a8667e0cb37ffeb79f5d55efa4d5a54
SHA256 2ef57a64b66122da6ec150b23a513880eb2a540b302312db49f9d7d45d1c2363
SHA512 304ff6e8640a89f967779367df5df32216e073f2243c947029344784f3ab37e8f041f769e4e7926aed973ad2534084150d4590632834225c37ce30fd66a122a0

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\bankloan.csaplan

MD5 df3a2b9965d2cad27ace425302fc626f
SHA1 6fb209469d9ba5ec1223b5bdbf06ade1e07963e5
SHA256 4856223238c523a3498d5a5f7ba7b9b926b0f8735116072e9c4558d417385cd3
SHA512 d650504c0cd168ca4482c6d12af8a1d67e3631faa1504b3f43525c2fa3a98b6b4e946c5534c799cb0c0411926e13037502cfea157a073170a2497ddea8d1050a

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\conjoint.sps

MD5 9278dde4f0fb4b97731120ee5ae7f7b1
SHA1 4cb314f2f267aba688bb07bbea55708dd7091a54
SHA256 8c5cfd5cf70287414cdaffd6e7b1dc83202c29379111250ff5cf99186d2c90ec
SHA512 749f71989ee2bcc0a76b5f0eeb33ade99b653b99317556b80a050465540f84d0735bf8c84f601812e1fafcc7f68f4006f506295c3dd6610ad69ac28942865904

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\demo.mdb

MD5 b071f27964840b252cde25a4c2685dd2
SHA1 a5f2dd740ddf5f9cb960191146cd20315dbc8406
SHA256 6481d8d4e59e5d8af2778591ba062f93a6a5fc258ba6f2b8b3e767af4ad6e828
SHA512 93a3b311c52c799e228a39e4e26b9ed10da6764677bf64ef6cd810610cd05972e574011900d27201ac7a59f156bf23bc25a758eed0a48703a199764a8a6edfd2

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\demo.csplan

MD5 e8ad530a449afaf9a733a0cb3278370e
SHA1 b185252eafd2914be48960c52d440aa138386d2c
SHA256 92833517fd8b940226b0200d2e0ee6b428df72bce75c76ffe785e5e7529ec61d
SHA512 de4e089ce602604beb007cd611939252138c3c09fb990cd57e8fb209e7da40d70b6d8cb3a5bde08e6e4f0a2a53955666631b64d7b4b68b25209d9b216e037686

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\grocery.csplan

MD5 6a39cefadb354894de67b502d4cb6129
SHA1 ed14c87a837b36404a5cdbfe458ffb43a9adf5a0
SHA256 fedd3136abd1bde3936d1431077aec2e87ce4d61c7ccc7465e96728dae2e64a7
SHA512 5929f07dfd57ce57cc3937e546654aebd2ef13cc041facf26a4900e26363e52399f86c2dff8c3de3e712834410af7037701a14ced625ded5d286c7c1f5d2a377

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\naivebayes_bankloan.sps

MD5 bf3e732cf21a7fa2838428a3f679b2f1
SHA1 4df54b2cace2662a578688eba1eda8cf64c49c36
SHA256 fb94cc5f966531db563df4f0191c45f822e4107d85a15e2ed51ffbd67ab1e4e9
SHA512 5588b42b0ce1145eb3fb038429f2c92264d8005e0e629b8bc6cce6dc0d8fe1aafba5b09769926b123a267e65cc62a8c846f654c1da60ad6080f2bf91f4897036

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\naivebayes_customerdbase.sps

MD5 1ad60301eb73a33395a542d587326357
SHA1 b1bfdb8b62b26cd214c6e272bb7fb8492d14c613
SHA256 975f3557fdcf6931d81c8b4e621ec18eff42d79ac5428675de54d700a86e0725
SHA512 20717eed905dadc8921c6635f2aaeae42b452b5991303bde1b5909aaf230be5037183bb8ae748d52563ee739e09cef5f26f92e7ebe70c51e587af6bb10c12ea0

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\nhis2000_subset.csaplan

MD5 85617c143111ee8e4cf423796265d810
SHA1 cd5a4e0e19ad41b7e79615517ecff1cdb53dc7e2
SHA256 754575902e437234c226ad6b890102f77d52e4913e3380b3de2e32de491d368d
SHA512 77801ba5a977b239d1c788d8ccafdf6da022714fc074e4f186f2da8eb2072f8ab104063e613156c725287b531b7e83830b0147ceb98ff5ee8c07c2df8492728a

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\oms_simple_frequency_tables.xsl

MD5 f346c17bc04b11c608645f7e4313da0e
SHA1 39ae0c0dcb55e839f3fa7c000c796d219b19a5e7
SHA256 3070ed6b43f215b42985da34fe96496d951e8823d8da511a51d6baaa21b0d87d
SHA512 2275a4541802d559d5839bf9c5c0d567a9421fbf0c16b059aae9353514f1738e30ec0396daa85856db353b4fd2458b239580ef75bac0c530261177208270f8ff

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\poll.csplan

MD5 873fe7a32719cadb74669c72d94c4846
SHA1 b3223a0d5a19185213fdb37e8c9b53fe828a44a3
SHA256 33bbbe23ab42c4379e9ffd481433247b499b683e097ab24d538f92a8a07b4198
SHA512 d4cd876e7a61c29cae29a30cfc9e86fe18a868f13b9d381d40ed51a0fe6e1fccf5e12ce0aaace706495b04bb4bd5f82e4480edad360f15e22cc1ae532d6e0c89

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\prefscal_breakfast-overall.sps

MD5 0dedaa4491e8b9e2f8678cedad2eeb64
SHA1 a75771dc13da1bcb80f5a251d7ac6a42f86c2f38
SHA256 23f8c1e1e3ba26816ae24b9ea501ade9b5c0ba2e49f7ee9b3392ef9d82bffc69
SHA512 a842fe005f4cfb0eee0ef57aae5ba50ab24c5a61840790f949afc0fb8017908548ef1d84c78340564af7f13fb121463aab20a957c04e52415b0f00f9ff2d8f77

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\property_assess.csplan

MD5 6d57f1da8990f16cf46de728c77f63da
SHA1 0bae686f58d0157b797f75728cb6e9c496dd0c87
SHA256 fbde1e1b64c44a2aa8a66f8e800589efdcb36d1a828b3b8c8f99cc6ac6b91bb4
SHA512 eb59b29aafec8953debc5ac5e991b5f508759a0b317d86be6f5d903f9fb801808db597901b7f78bc340ac99bf28cb15a8aad44564b77d86ed1d4e8153c337e49

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\recidivism_cs.csplan

MD5 7a2643d9940d8c0abe7c69d0734799ff
SHA1 63d1643db1ddacd6f32206e0bddb1a4d82799f70
SHA256 925467f957d1e42e2ae0c55f71af5629639227e63cfa24167beaab43f12a1066
SHA512 21dd96d5fed1f8c0d7e77526ce5c47261a419684b9d379a5399f49a59bb2a74401182d977931e3b6d27c42c0522b8534a8c14fe8b5cfb32f61825b6f0689e385

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\scoring.sps

MD5 cc4bed56d465f6fef408e6c7b6d29d15
SHA1 2eb3625e08d62a3996691d0596546e4923e4f498
SHA256 275b502195b41793f69253e3253cb4d3a2eccf029e9ced8039bb2a84f81545ec
SHA512 353229e05f80ebf22b35d5812636ae9338004a507b84ebd8a31a8537a9f57e7fb8ac25a82d15b2126941d888a0e1b64b1ec4841ed03340d9109ec1876f12690b

C:\Program Files\IBM\SPSS Statistics\Samples\Korean\selectpred_customerdbase.sps

MD5 ccbf98b22a660a74dd3e7a54f2d2fa68
SHA1 9ac790adfb0c83ddb2f9c7310036d75aa5ebd33d
SHA256 42cd355aad0c0f8154c8cf874f7e37ec85e23c5b8811db1b9d757412cbcf4608
SHA512 8b52e7f4ae219a5d4712bb2aff9d5e96b11f4af2e874cc41f534dea0941dd26a84934f4fd92b72274eaa6ef68a3693f56b4b6f852f64b1d6e8c9a33c368d9641

C:\Program Files\IBM\SPSS Statistics\Samples\Polish\oms_percentiles.sps

MD5 1ac4dac885921746ab854e427f1bfecb
SHA1 467695300d4cc0a526a4c63c5f1fdc3ef77a47ba
SHA256 f77aa3ef2eefb53ec4bbd891739f4b121386a14eda1c81214f3e6ad084a7d0d6
SHA512 820bf452ca061fe999999f9f35018d3086061104cc6e7ab6ff8ecc65a5b57793e1d2b196688f6652eb1e0b461ad704efe7a1a2937fd4a4e460bd20d9223bdaaf

C:\Program Files\IBM\SPSS Statistics\Samples\Polish\prefscal_breakfast.sps

MD5 438cbca94691e4f4477728ea1b4fbdca
SHA1 db3bb9206406207702765e9fcc20ddf4c62288e9
SHA256 23764a545400fcafb540aa2c28eb5549da63e524cca33bba56fd7ba7a91e098d
SHA512 f69fca202a9ff3fe8d1639e962e4e26cc6df6dff3025e11c7b5a6774b3969354c893bcb65be57e212579612ebecaa6de3ba74db3a05a12a13e99922fdf72e9db

C:\Program Files\IBM\SPSS Statistics\Samples\Simplified Chinese\oms_bootstrapping.sps

MD5 845f4a7ba8bc8e1020d81f29852b2e38
SHA1 606f24e9c2d1d6135e850442a4a0112319288044
SHA256 dabb51e45e24aba3cdda34ac2931d8ee095b763ab0cd3ee3e994695ce3e8e69a
SHA512 1785439c0d321527854523c51386d36713926cd2010dd1ab2027e72279454948c2d335c84bc6365e42dc1bb39239360ab63306f7c8a383db0c03d72559551a2f

C:\Program Files\IBM\SPSS Statistics\Samples\Traditional Chinese\smalldemo.sav

MD5 b548049ff7d7e0ce777d22bf5ac30251
SHA1 7445dd7054239629224d291c3bd97df97b22057d
SHA256 9864c31a786555942389d56850dfd71f12e4eea931fa7cd48b4b75b5461d4c93
SHA512 83f77aa3b3a6922b46abae90c97a99010c4ae0a8ff1527826d35e5f918aea0ea23949ebbbfad326047434b9d6d3afe1c20c8a3ed9e36b192947e5cee9422be03

C:\Program Files\IBM\SPSS Statistics\stats.exe

MD5 a401f0996462cec8d523090e1c99bfd6
SHA1 a002e85ca6240ff35c6dcd20c12be64ec7afda68
SHA256 91ce47856d62f86042428ed7bb64a45efdea662a8bd7f80ffc618d10014f5b64
SHA512 407f34d792143385083f153420b1026dc36b810adcc0422a6ec1b24bef7d4ae588479764019c37d8aa504eaa7f99432b88fc7c1b91cb60b6649b7235151cd185

C:\Program Files\IBM\SPSS Statistics\commutelicense.ini

MD5 722ee55d20c095435495ec4d5a199cd3
SHA1 8932190c66f0b6e377aef13acfca6f0b1ec278ec
SHA256 27a90f4d5ae5ed375304be396095dbf4ab00ab32dc01a510e58fe358f6530cf1
SHA512 9a264cf888067dd4b996afe8d80540c7dc08fa972910015daa660e2dd6c6b9ebaa1efe2459728970c2d7f554e378db2bd74195fa86e6aa63407fd488d941a91f

C:\Config.Msi\e58d2af.rbs

MD5 52b35fc440d430476d4ffe4018653602
SHA1 094c6105215477cbc8c2b2285b26e2e105353924
SHA256 b78cb3655c028029b9f4072e7efa86e30b7e0a020d0a6e5e88ee34a79bae91a7
SHA512 95243321d7466ec3990ec720a55b2ff015acf7aa6d9ff9e522e22e3306594d5a8996ce87c29ab7469e0bf97759978774540d708cbfda29dc8b16ea814aadcd9b

memory/4392-16165-0x0000000010000000-0x0000000010114000-memory.dmp

memory/4392-16166-0x0000000003350000-0x0000000003517000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\_ISMSIDEL.INI

MD5 11424e02490591c142f4a6d4d6d6b532
SHA1 d4797f6019e27ed9fe644fefee94f04a38844eac
SHA256 c2a2bed6a336aae76d0f19450e90fab1f3ad2e02799a05d2cda2a47349951271
SHA512 9ab8149f9d3dbfa9972716940694654fe26631cff42c11ecf453935110d9ceb22132526db1a63f0ab018e6785f133cbadf658f97ae3d70ae5080b09dd2af022c

memory/2940-16192-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16177-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16292-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16281-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16236-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16235-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16230-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16232-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16233-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16234-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16227-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16228-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16231-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16229-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16221-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16226-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16225-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16223-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16220-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16217-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16222-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16218-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16214-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16216-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16215-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16182-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16181-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16211-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16205-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16195-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16183-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16462-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16187-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16269-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16184-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16219-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16179-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16213-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16212-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16204-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16206-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16201-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16191-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16196-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16193-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16175-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16189-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16188-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16461-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16186-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16185-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16180-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16176-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16178-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16207-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16199-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16202-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

memory/2940-16200-0x0000029A92A40000-0x0000029A94A40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{2218B2F7-904F-42D5-9DD1-91C87BAA8F0F}\_ISMSIDEL.INI

MD5 c10f0c1c213324eb2d479d8617a58197
SHA1 5d830ffc7950e47de2a7f9efafca8425c37a382c
SHA256 06d38311dc59cf5a078491d01fe65e579b3c5d72764bf93e35ae24cd74a805be
SHA512 6b73dd20de1f288999bf2590f8cf095f5804ae2648ab85d136a919ffe0e0430180c91a46b2ad6192104ee8802d982f70bc0fcca87cd8189a5be3e04312d1a702