7d704f3e4738c31ea83b41a2246c54027c2d6b9fcf915258e9dae170c765de1b

Analysis

max time kernel
162s
max time network
170s
platform
windows7_x64
resource
win7-20241010-es
resource tags

arch:x64arch:x86image:win7-20241010-eslocale:es-esos:windows7-x64systemwindows
submitted
21-11-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PatchMyPC-HomeUpdater.msi
Size

52.1MB
MD5

90cd4318f192766e5a748312a91b8ec4
SHA1

938e4590715babc03b6d436ee944eef0163be12d
SHA256

7d704f3e4738c31ea83b41a2246c54027c2d6b9fcf915258e9dae170c765de1b
SHA512

a1fca167cab1ee9862ca7cc4492ae30f7887dbbb2719bb0d5855f67c32fc17cbe3f35ff95a018a4b544a76a80edc635d215a5c833268ce2c5973b3b6f6962992
SSDEEP

786432:Ec5d3fVmrjV7eIAt0wOTZPtJ4+qwHnhvc:Ec5dPVmrjV7eIlwOTZ7qSC

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

msiexec.exemsiexec.exeMsiExec.exe

flow	pid	process
3	2224	msiexec.exe
5	2224	msiexec.exe
12	2720	msiexec.exe
14	2720	msiexec.exe
18	908	MsiExec.exe
20	908	MsiExec.exe
21	908	MsiExec.exe
23	908	MsiExec.exe
25	908	MsiExec.exe
27	908	MsiExec.exe
29	908	MsiExec.exe
30	908	MsiExec.exe
31	908	MsiExec.exe
32	908	MsiExec.exe
33	908	MsiExec.exe
34	908	MsiExec.exe
35	908	MsiExec.exe
36	908	MsiExec.exe
37	908	MsiExec.exe
38	908	MsiExec.exe
39	908	MsiExec.exe
40	908	MsiExec.exe
41	908	MsiExec.exe
42	908	MsiExec.exe
43	908	MsiExec.exe
44	908	MsiExec.exe
45	908	MsiExec.exe
46	908	MsiExec.exe
47	908	MsiExec.exe
48	908	MsiExec.exe
49	908	MsiExec.exe
50	908	MsiExec.exe
51	908	MsiExec.exe
52	908	MsiExec.exe
53	908	MsiExec.exe
54	908	MsiExec.exe
55	908	MsiExec.exe
56	908	MsiExec.exe
57	908	MsiExec.exe
58	908	MsiExec.exe
59	908	MsiExec.exe
60	908	MsiExec.exe
61	908	MsiExec.exe
62	908	MsiExec.exe
63	908	MsiExec.exe
64	908	MsiExec.exe
65	908	MsiExec.exe
66	908	MsiExec.exe
67	908	MsiExec.exe
68	908	MsiExec.exe
69	908	MsiExec.exe
70	908	MsiExec.exe
71	908	MsiExec.exe
72	908	MsiExec.exe
73	908	MsiExec.exe
74	908	MsiExec.exe
75	908	MsiExec.exe
76	908	MsiExec.exe
77	908	MsiExec.exe
78	908	MsiExec.exe
79	908	MsiExec.exe
80	908	MsiExec.exe
81	908	MsiExec.exe
82	908	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF	DrvInst.exe

Drops file in Program Files directory 3 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Patch My PC\Patch My PC Home Updater\PatchMyPC-HomeUpdater.exe	msiexec.exe
File created	C:\Program Files\Patch My PC\Patch My PC Home Updater\updater.exe	msiexec.exe
File opened for modification	C:\Program Files\Patch My PC\Patch My PC Home Updater\updater.ini	msiexec.exe

Drops file in Windows directory 34 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\{20F7796B-F6AB-4715-9814-7D3C49A8D6B8}\ModernHomeUpdater.ClientApp.exe	msiexec.exe
File created	C:\Windows\Installer\f77dff6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI995.tmp	msiexec.exe
File created	C:\Windows\Installer\f77dff3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB87.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF182.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77dff4.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\volsnap.PNF	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIF701.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{20F7796B-F6AB-4715-9814-7D3C49A8D6B8}\ModernHomeUpdater.ClientApp.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF55B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF451.tmp	msiexec.exe
File created	C:\Windows\Installer\f77dff4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDDC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI138.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f77dff3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEED0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF068.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCF0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIEFDA.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

EnhancedUI.exePatchMyPC-HomeUpdater.exe

pid process

828 EnhancedUI.exe
2124 PatchMyPC-HomeUpdater.exe

pid	process
828	EnhancedUI.exe
2124	PatchMyPC-HomeUpdater.exe

Loads dropped DLL 51 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
908	MsiExec.exe
908	MsiExec.exe
908	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
2220	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
856	MsiExec.exe
1328	MsiExec.exe
1232
1232
856	MsiExec.exe
1328	MsiExec.exe
856	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe
2524	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2224 msiexec.exe

pid	process
2224	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

EnhancedUI.exeMsiExec.exeMsiExec.exeIEXPLORE.EXEMsiExec.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EnhancedUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
discovery

System Time Discovery
T1124

Processes:

iexplore.exe

pid process

2452 iexplore.exe

pid	process
2452	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0cb48602d3cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{928CBEE1-A820-11EF-9E29-C27C6C4BA51B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b1319000000000200000000001066000000010000200000009c8d7e6da30dfcfc7f394f491ec7cef93defb1b383acdccdedef506a3b5c99ec000000000e8000000002000020000000c1675bb9f4a943a86072cf1f62626a596209b9d6b24506b91a342f45230708669000000084b70bc528cac0bb976d51150c32800d509d50a2c981e2597311447b0eec9349c7df27bd1b30bac2f04e61316705fbe71d367aa893c64525c64c97729bf7a2a6db3e13cca1d62c41371924c98b400db60249f2f1465e1475f7974d633c7cdfd26b38f6ed346b9c637616aa2a27c2a60945b2cf8fad065f39d017c659b9b1096bd5525160a75493ec2d6f4a34c1c5223340000000144dd130bca5ed6bc37e74e8d3bbb6dfd605fb76b71b48d50323a251d48f4b8e05f2df0b7d807f79ff64c76bd81cdea9f6e422aff9b5c622db3e2c0e836e1265	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000691eab4e4e48b2dfe5bea494467dc4269b6ef6d45f927d859ef53987cd2109a8000000000e8000000002000020000000df5378976d0bdea5c5620a06921247c1f3235097e51a4ed01cce7474e9011219200000002b9f5fcd6084fa9a608d3e8726d345ba55addcae8259e1a59f753c969e81bb9a400000005092819e4bc761204d77c379a682536b0e3424da5dac4d0ba9479b2b14e705f81f0819fa0025f1fde3e10fe981e56c513dba8e9fcd67ea5e3e0c32a1877ddefb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF\LanguageList = 650073002d0045005300000065007300000065006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe

Modifies registry class 24 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\ProductIcon = "C:\\Windows\\Installer\\{20F7796B-F6AB-4715-9814-7D3C49A8D6B8}\\ModernHomeUpdater.ClientApp.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6977F02BA6F51748941D7C3948A6D8B\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\ProductName = "Patch My PC Home Updater"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\PackageCode = "212D4F7BB937CBD47B1419A811E16BA0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\75593349A9357AD47B797851C47137B2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\75593349A9357AD47B797851C47137B2\B6977F02BA6F51748941D7C3948A6D8B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\PackageName = "PatchMyPC-HomeUpdater.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6977F02BA6F51748941D7C3948A6D8B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\Language = "2057"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\Version = "83886085"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6977F02BA6F51748941D7C3948A6D8B\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MsiExec.exeEnhancedUI.exe

pid	process
2524	MsiExec.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe
828	EnhancedUI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2224	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2720	msiexec.exe
Token: SeTakeOwnershipPrivilege	2720	msiexec.exe
Token: SeSecurityPrivilege	2720	msiexec.exe
Token: SeCreateTokenPrivilege	2224	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2224	msiexec.exe
Token: SeLockMemoryPrivilege	2224	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2224	msiexec.exe
Token: SeMachineAccountPrivilege	2224	msiexec.exe
Token: SeTcbPrivilege	2224	msiexec.exe
Token: SeSecurityPrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeLoadDriverPrivilege	2224	msiexec.exe
Token: SeSystemProfilePrivilege	2224	msiexec.exe
Token: SeSystemtimePrivilege	2224	msiexec.exe
Token: SeProfSingleProcessPrivilege	2224	msiexec.exe
Token: SeIncBasePriorityPrivilege	2224	msiexec.exe
Token: SeCreatePagefilePrivilege	2224	msiexec.exe
Token: SeCreatePermanentPrivilege	2224	msiexec.exe
Token: SeBackupPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeShutdownPrivilege	2224	msiexec.exe
Token: SeDebugPrivilege	2224	msiexec.exe
Token: SeAuditPrivilege	2224	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2224	msiexec.exe
Token: SeChangeNotifyPrivilege	2224	msiexec.exe
Token: SeRemoteShutdownPrivilege	2224	msiexec.exe
Token: SeUndockPrivilege	2224	msiexec.exe
Token: SeSyncAgentPrivilege	2224	msiexec.exe
Token: SeEnableDelegationPrivilege	2224	msiexec.exe
Token: SeManageVolumePrivilege	2224	msiexec.exe
Token: SeImpersonatePrivilege	2224	msiexec.exe
Token: SeCreateGlobalPrivilege	2224	msiexec.exe
Token: SeCreateTokenPrivilege	2224	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2224	msiexec.exe
Token: SeLockMemoryPrivilege	2224	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2224	msiexec.exe
Token: SeMachineAccountPrivilege	2224	msiexec.exe
Token: SeTcbPrivilege	2224	msiexec.exe
Token: SeSecurityPrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeLoadDriverPrivilege	2224	msiexec.exe
Token: SeSystemProfilePrivilege	2224	msiexec.exe
Token: SeSystemtimePrivilege	2224	msiexec.exe
Token: SeProfSingleProcessPrivilege	2224	msiexec.exe
Token: SeIncBasePriorityPrivilege	2224	msiexec.exe
Token: SeCreatePagefilePrivilege	2224	msiexec.exe
Token: SeCreatePermanentPrivilege	2224	msiexec.exe
Token: SeBackupPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeShutdownPrivilege	2224	msiexec.exe
Token: SeDebugPrivilege	2224	msiexec.exe
Token: SeAuditPrivilege	2224	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2224	msiexec.exe
Token: SeChangeNotifyPrivilege	2224	msiexec.exe
Token: SeRemoteShutdownPrivilege	2224	msiexec.exe
Token: SeUndockPrivilege	2224	msiexec.exe
Token: SeSyncAgentPrivilege	2224	msiexec.exe
Token: SeEnableDelegationPrivilege	2224	msiexec.exe
Token: SeManageVolumePrivilege	2224	msiexec.exe
Token: SeImpersonatePrivilege	2224	msiexec.exe
Token: SeCreateGlobalPrivilege	2224	msiexec.exe
Token: SeCreateTokenPrivilege	2224	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

msiexec.exeEnhancedUI.exeiexplore.exe

pid process

2224 msiexec.exe
828 EnhancedUI.exe
2224 msiexec.exe
2452 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2452 iexplore.exe
2452 iexplore.exe
1584 IEXPLORE.EXE
1584 IEXPLORE.EXE
1584 IEXPLORE.EXE
1584 IEXPLORE.EXE

pid	process
2224	msiexec.exe
828	EnhancedUI.exe
2224	msiexec.exe
2452	iexplore.exe

pid	process
2452	iexplore.exe
2452	iexplore.exe
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exePatchMyPC-HomeUpdater.exeiexplore.exe

description	pid	process	target process
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 908	2720	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 828	908	MsiExec.exe	EnhancedUI.exe
PID 908 wrote to memory of 828	908	MsiExec.exe	EnhancedUI.exe
PID 908 wrote to memory of 828	908	MsiExec.exe	EnhancedUI.exe
PID 908 wrote to memory of 828	908	MsiExec.exe	EnhancedUI.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2524	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 856	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2220	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2220	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2220	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2220	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 2220	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2720 wrote to memory of 1328	2720	msiexec.exe	MsiExec.exe
PID 2524 wrote to memory of 2124	2524	MsiExec.exe	PatchMyPC-HomeUpdater.exe
PID 2524 wrote to memory of 2124	2524	MsiExec.exe	PatchMyPC-HomeUpdater.exe
PID 2524 wrote to memory of 2124	2524	MsiExec.exe	PatchMyPC-HomeUpdater.exe
PID 2524 wrote to memory of 2124	2524	MsiExec.exe	PatchMyPC-HomeUpdater.exe
PID 2124 wrote to memory of 2452	2124	PatchMyPC-HomeUpdater.exe	iexplore.exe
PID 2124 wrote to memory of 2452	2124	PatchMyPC-HomeUpdater.exe	iexplore.exe
PID 2124 wrote to memory of 2452	2124	PatchMyPC-HomeUpdater.exe	iexplore.exe
PID 2452 wrote to memory of 1584	2452	iexplore.exe	IEXPLORE.EXE
PID 2452 wrote to memory of 1584	2452	iexplore.exe	IEXPLORE.EXE
PID 2452 wrote to memory of 1584	2452	iexplore.exe	IEXPLORE.EXE
PID 2452 wrote to memory of 1584	2452	iexplore.exe	IEXPLORE.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PatchMyPC-HomeUpdater.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8548DBDC2027511889D0A5633431C0C6 U
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\MSI8559\EnhancedUI.exe
    EmbeddedUI.exe /embeddedui 2224
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86C7D2E05305DDA1A0510185A3A71542 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files\Patch My PC\Patch My PC Home Updater\PatchMyPC-HomeUpdater.exe
    "C:\Program Files\Patch My PC\Patch My PC Home Updater\PatchMyPC-HomeUpdater.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win7&apphost_version=8.0.11&gui=true
      4⤵
      System Time Discovery
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C0F291CC22EA8C4E14D806E9F52DC98
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:856
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 71FEC0D8D956F315492EDE24DF8ED2CE
  2⤵
  - Loads dropped DLL
  PID:2220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 81DBF533B62F4254DC0E765CE9DFFDC1 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1668

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C0" "00000000000005E0"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77dff5.rbs

Filesize
2.3MB

MD5
4cf7f80a7949efa767f47b97f42451ab

SHA1
f0ad94d31717e6a89d57e5c9dad5486908c75f1a

SHA256
e21f03666daec27a8709922f9c2243e0a616cee31e9f13ae12ddb0d8d1711f59

SHA512
41bb4092ca32b9782585e3d7893fddbb1ae7334aaa7e578481898f7187d249e073064e27f7f46fd2bd42f285bfe5ae901904b01aeabada271f9ea7c5cbddb1b8

Download Submit
C:\Config.Msi\f77dff7.rbs

Filesize
580B

MD5
df7c2c8773094bc02fedc515a31c2f96

SHA1
31571b06b696d44b069aac9c97e085e8a694086d

SHA256
aa59b10c4ef10fc5a57405899336e170488a30344b8bf840c645fc415bf9ba09

SHA512
fceec5cbe6f7b5bda59354b17878c75edfb866d2216c2055560ef1262d5167510bb5c4cb766785f72d0eeaf195a45e17ca5c07e7a19f366135495aecea9a07b7

Download Submit
C:\Program Files\Patch My PC\Patch My PC Home Updater\PatchMyPC-HomeUpdater.exe

Filesize
27.0MB

MD5
939d9c12f0e38f23a7ad1a8946d256f9

SHA1
a8bb1add888a7740704bba00a5f71b6db16d0279

SHA256
942c964c31455fe66e1adfefdd361a84d2c584c419ef9742ecc01e759e9a90b1

SHA512
33cdaf189326053457e395ab1b229c3bf2d660cd610770f406e200fce320858c58f3ea7ca0ba26494ba41a7a3062efb5ad82d988673cf49fe2efd0d2277c9f47

Download Submit
C:\Program Files\Patch My PC\Patch My PC Home Updater\updater.ini

Filesize
182B

MD5
9e7c72c8d2ef63162608671adcbef63e

SHA1
a48e29e43d210b6c308b081bd244db9bc70dec1e

SHA256
606f0f6f481afc9af195e2f96f94180f8397c086020c8ca229fec3cfba5d5679

SHA512
4604469999017b42c7c571131872bcc385c3c99556f38058dc880a669477c3ed58bc33e6da88c5fe3dbe2ea231bc2ca1653acc185c5afc14e953cf809b06a09b

Download Submit
C:\Program Files\Patch My PC\Patch My PC Home Updater\updater.ini

Filesize
470B

MD5
b62c53aec0cf1f54a56fb601852aaf3e

SHA1
7f03ee7fa0cfff1567423f141e6e1812d361ec5a

SHA256
edf0b724fafd3069218eb881e00a4feccee798e0b66216363e066dac0717eeab

SHA512
77927847cf8be0c26a40523e6931e6115db9788d3ead32000a38a7a6c980d1bfcbf43ef36ee80073a7007a90209def23898be535e66ae6a1855909a99a02780b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Patch My PC Home Updater\Patch My PC Home Updater.lnk

Filesize
2KB

MD5
7859887fda575a895f1fb18e60e4f4c3

SHA1
155810a34c713dfa384784eabce61ba92c4d8e7e

SHA256
88f88986995f1d29b2e6604d577bc2534462189ebf13e4195a925f17385e7ce1

SHA512
dc8dc0776e78f6b6f58d9ff9e8d9b21971aad2493b786c893c87766e92c72071d9f1370bbe27382e76fcaaadf4b89b3a100a228f9ba02e89f210b40ccd20191c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
719182e07998ae9226d45680aa1fe178

SHA1
8f8b03c110c129cb3a35841ed959de7a7266ffec

SHA256
8f1d64c2c4dbb6ca892083e4b4a8bdb4585597e1269c218340c6b12517bb3dbe

SHA512
2df474f0ac4d1ef93b14deda32c5476da130bc41f37c0a5cd0c271c990914613c3c788116a4b87d44876695f71e5a131847fdf96d609364c06cb2f5ed6ce76a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_22680070D4112A4A43F2AA0FE1640CB1

Filesize
727B

MD5
5231046f6cfcd63f6cd370369f488bd3

SHA1
ea8e6b8fd1bdbe64d12be4358d7490d4516af8da

SHA256
e2034379edff9c7a4e9e46713c7a90e4211ae2b179148a36be31d71d629f184a

SHA512
605d62a9462e5bf9909b4b05fee85a49300b7d95eeabf3f35afffb39a8004e64f12d4bd7ae94e4ce6f5541cf7171226a84fd6cfb0c3c2ae61bd2c563765d30cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
4f2f44acff5c280ecd26b5e7144aff24

SHA1
d542052f27cf058cd2bd7d74e75deb8a009bb334

SHA256
c9725747ce7f281ac09f3a2287a236369b00e99f310eb837c45b2b4f66b82030

SHA512
33d4fcb341e625103b16af3f7b37f4fed5e8d56256980e341fff71356d1a1296192741b96be97de703d8f54af24e3438d0a514edb621ee6e42b1dc4d79089d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
974a69ee7814b12b8ff78d599d66884c

SHA1
8171ec77f093f479101670218c4d1bd2c52b86b0

SHA256
7e94a1bc11420f6a08c0e0ab150b576dfd49251ddec37f1c477e81b5cdb346ac

SHA512
50891bd6e15430ca269f36700aa51db3c8e57638065e72d07d57b71065801795a008b66023863bc745270f25af4be0b2f307430c423261f6a895a419767ac3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
76c5cc2686f8c44890d4fe0df35367cd

SHA1
b8abe58c316788e72896680f6cee4e7f83e1222d

SHA256
995a4ce1621b773a77a29ac907a8a2e5159f9b6211a5498374f2991e7fea0d52

SHA512
af6b80039bf81f24b9196a5a1a36c47c7f90411400b6f8e1f228c44276236c59f5ecf3b9114d80edc806c34a1e5a68a61ceb0b1089e09f9b8a0b47fb725173c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_22680070D4112A4A43F2AA0FE1640CB1

Filesize
408B

MD5
a331fc6faf8b4719a56aea459b3a0a19

SHA1
825a215841e0caa62b1a9410a1926c9551fd6b66

SHA256
5d01216c37f33cc3b3027ac72c0b3092527fa0349c51a7c89fee2b649afb346e

SHA512
8834ba099becdef07f6d62549335d57592bd4033353a5e69adfe03568a067019e09cbae50bf35e6a6c08d0b45194f0ce83ae15d7d9f2ee567380f8b0947dbcf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcad8c57a721afcbea3a6d4c24f57851

SHA1
c14bf423cc1ca926e6aadffe4628bb4b6bc0b8eb

SHA256
da76af6fe1077fcccde8503e009ae32807e29ac24e785c2a8124913ec3c58ac2

SHA512
e36ee6df08d02007790717180fe7902e80f4736a8ada3a45b6cacbf165bd49e710e2318b3294cb86619decfebb70f0ac4ed478702f4363b817ca12ab563a5da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6e60818210e4dd1eab24e5adc46bcc7

SHA1
b07dd9ec43fdd804c5049104e67e4567c75bd506

SHA256
34f25e51460605195b18fcdc5ab39da079fa60f595156b987f2f3d34f80b8423

SHA512
18e0801d235915b705002462f57845146f361d31d967a49168dea2197fe1d7609e2b784f44a14585f43b6739efbd2d31be01a3c00b022667682afa85a0656ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f77f666827d2f67fda2e81878b6b2b2

SHA1
0c348bd39bed51e303bd463fe2dcfc0f63b44bae

SHA256
a048736cb0ca46420024e615b0f6b3b40be41c2a7f7c27f0290608b91499542b

SHA512
2bba3600a731d80cf6a92aab38afa0ec4255badd18c64e4d4fd5a039241270bdf26d696bbc3ff34cc4abbfa026fe29e2057b82cbb6c3e5de01c106931128ec0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66f950816372bbc265166234e7f4de6f

SHA1
b618e3317ddfdb4d6b533da1a63fb49e0fab3470

SHA256
19e19640aa6ecee05d6268b42526f078e12367b612f85c418e1fda973a16488f

SHA512
8c19323689e65de1aca9eb8ebecc820fc02589363d2f773e47fc14a3ea7390f01b3843e0496123fe847fd5af65a56b0b336716d16b0feb8c28b7588053d5251f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86136d3b9977e870c719824b201383dd

SHA1
ae0140f7c4f8506d5a540ab786b52654f11c9e47

SHA256
6bde5bb01d54f7c206ecf288285b3d94c09bdc3e687cde5e35d390b21f138e99

SHA512
861d3bbc5fc3c233df40c46d6e7a7b2d064b11dab380538ab9886008c5453da0a76426f72420768ad012e07d21dacc7a6517ff824cf484b6174ef6457c67edb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10144f9c2cf376f27b18cbcf72b2b5dd

SHA1
516fc46311688591ddcbbfc3a6d066a2c889ef69

SHA256
c9315d028cbef544c29ce448855f1b943f51fc3411cf975c963c8dad715934d7

SHA512
a934097a3b642c1fe1bf0c82bbd282af20aec15e334bb83aa314f0263854aa25e540b2970b9605e905cc6223a9b8776b617bf8004fbdb706a265484f0c66d6ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d80f243a7351545062fcbf1a6adb42c

SHA1
a8ccd8d171804d9fcc90e8bc3d045787faaae0cf

SHA256
664b606f344130644c23d53dbc53bd83f83b8cb4d51a7026f33f5ad670d918d9

SHA512
2375db6746d568662025fef646c0c2d265bc4e0f29e9f36d55563aab6d9961ba6bd285065fd81ab8fe7839b3d4aafb56971b4bd9e2d0fa8d65af4c42917bd5e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31669ff48f535c9c1904e81f376b514

SHA1
b8832b740c188a8060a76ffcf76cec0d43d3dde5

SHA256
e6e202c9a76a832dd9b548e19805d623f1e33de4faa316565b43ccf412c2fd19

SHA512
a57bf82db315316fd32793094973d9722c644f8c798b91ec785da75684ce275d8e65d82f6eae5959cf299705d13ad450999642d353438e1e5920125c068601ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccee2384177ba2b0e5180c9e527fe1a9

SHA1
140561d66091a8948cf8bad5ce2cd6a40221aaf5

SHA256
7ea65d3b2f673521460227ba6fe9c91cd1fcf57b8fee4d7b97f450f5623d74a4

SHA512
a9270805097b8ab5587db3eb9c476d065f89a7c94bbffe28f9db410f57b0711fbc2a449347ce1bc2894c61bd32c44b00ab9fceac16120e9c159e82fe306e7a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41fb8ff427420f80f466d76cbff7f6d3

SHA1
88e8a34aa641ebc05b183a7af82b58310fc531e5

SHA256
3c1611ede6b1c238244014a652589a07c876a13e2b232732055e2d82860c69bb

SHA512
7a9c3aa3529a2ebe070411303b12e09464450bb0b84e4b89399e5f077b419522925d032974845de3c010a3d2e5ba071e4065338b37add5641206ee69f3dafe0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb91df5f30e06bc8bcd025a8062cc95f

SHA1
4646478ad73881250ad26c97d29ac93fb28ff281

SHA256
41030e1c80f253e1e2bce8d80f519242ae878544ad204f4f31426345fe44fd34

SHA512
79e866e3d8fa1f02ac2c93af8017caed16462aea741c15b610ce02a00c08b1cffd91b9817cbf4de3da5618af1ad1c71056e9404a47d6ea1e67a97c66537e6b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cd2c39e18f7735d8856e7da6397968e

SHA1
d6903431330da1f382f9e2c5bd60d50b7331a00c

SHA256
4ea73b2c5eff489252fb5e0f89e15f0d4da2d45ac0bcd30f15fda7c8db58d5a2

SHA512
587dc19ee529e42ca32311469d11f3b0494f9e1931e86b4954a479eeafb80b89ff9eb3b1fc525f322b291bc1f50a770d3173d3238412729cbc7bca97ead88edd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c09ce11284c7f8a001d157d9991d641b

SHA1
a59d357042677f23c2981cdaefa9bf7e9e9e797d

SHA256
fc6001a0ebd4480b1268b8fc94406d5022260534456e52229397eecca9de2f07

SHA512
668df92b4ae50c225cca6f8728d3f257a3dc68fc2f801c20a1627f86af95f838abff708a5880716a2da4127dc0c0eb5238662b38f7b65a58bbb2f97121caf189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a354d08ec21da38050dcd562811eeac8

SHA1
476c07fea81c49b5f26662e855100c597112cd4c

SHA256
70d0443ac7846e883e8899e89c558f1d85a4fc988466a6932ba26d0c1174cf4c

SHA512
e1469fe00c84652358831ec0905c6211bb551dc14c31415e3642c79587054e81ad4d274aac4eff5088e4149fd33f36662ee9d25a27362101d023cce04f0e674a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
af289895aa922e29051fff18c8e11b7b

SHA1
84e5943fa78b4519a56482596933913276a676d6

SHA256
09574feb03a3b9f5dfe6eeaff4db6e6b447082e529d8abd30d30766401863ebc

SHA512
bf5a92d73710a9e28042c25c37fd2f97233785fc68970734e497e168785d0b4a78f3b8b665b939c54554b23b3469b09ee320d4a456a7afa24c3a292027e3402d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1d4d206b1ef9da44556b3beb5af53427

SHA1
d47a60f42b1802e23d2af1d27be199b08943b872

SHA256
829c5abd28cc51c412683ef038f30a53622bf34861d86181f6b8415f85f4f549

SHA512
db145a93ed7080d9240a8f9b467dc0294fc1c23db9bc1f2f22d78380fca4d9ab34d1235ec5ee93d95fa24b2a7692582b1ab0c0aad48ac1de962ffc11c9a27ab1

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\67167f270d96e6db370a449a\5.0.5.0\tracking.ini

Filesize
84B

MD5
9e21da2ebcb75aea61b58a8a45a23ffa

SHA1
e6142b56d1e996f913d9c86c735254dd178ea3bb

SHA256
54855865ef125f1fcd00cc88636e4ec5a9e27c6a2e360c50d97db29d964ab483

SHA512
b377ca33d296490ed66d4677e55b8784eb7aa0313308b7ed2e99c661d14d03afb64f06c91129e6b8901306b63e682449025a72dce5ec3c902767a25e24e347b1

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\67167f270d96e6db370a449a\5.0.5.0\{A14BB0F3-C4AD-48BC-B376-BC7AB3119B2E}.session

Filesize
45KB

MD5
844841543d88d6d642a55b33f0ea1393

SHA1
89a3bc00f378874c86ea056a42de7015eb60f028

SHA256
cad2b6d04c0b321ca242facc55fd6fb571870494d18bd8d30155b21fef09e306

SHA512
db5ad38f3303c218b2a6e2df16135cc8ee6fb8ee831829a947dd530d6a5fd922911410db5e0d9f85017267ce44b63ce91c983a989bd6b5f644cecd3a97d3d86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\HomeUpdaterIcon_512x.ico

Filesize
368KB

MD5
312763060691450c526fd10e36c1a652

SHA1
a4a6668f675c812470bf4922a6cfd83d50b7dbba

SHA256
466d5cec4533319ea60526572612cd7601c15e2bdc9a936b686693a1f68c5065

SHA512
0bb1655a4c5e322d4d1e8d38d419723d3945a9b2e1bd96e5c8303c2830ff162aa366f8141711c4fbdf83c8d083dae6b2d15a13cdf74a29b7add67e72485e9c3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\HomeUpdaterInstallerImageLrgVcenter.png

Filesize
36KB

MD5
0c3b6463a7531ab8ea5ee1487faff136

SHA1
dbba0d98dfe668479e4009089af6b8ecc3c3657c

SHA256
880bac6e058ad6d0f8aaae0a3f5e2c876e7b0c995f44c7606250825f62e1f09c

SHA512
bc24a147013d18b5060387bada30971f87eb53e1980786613c58f06bf3d60fe28e5f3d9599887c8fd93bfc4ab2b3c16a5ef0c9f9d161ad8111b65a3fe8f4c4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\HomeUpdaterVariantSizes.ico

Filesize
134KB

MD5
2a0f3ad57986895bbbb00cf44b78e8e1

SHA1
2dc73af2b1870c4742482bf1cac3c58c87721676

SHA256
4bad55787cc29a06388e7ed351b45ee7ebd911a178f110e6a7a5b14d401dd289

SHA512
2c53268147af77efbb2478ab35af31f5ae1f0e4d85114249d7b84fdf93e4ed42c6d70c258e15a81463e877708cd6bf6c44efbcf06bd3cfa0d4756c8a5749806e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\ProgressImage.png

Filesize
1KB

MD5
8c903c7a534cd12c8eea9582068fb39d

SHA1
ed049dcebc99857fa90043861c5619c776f8e937

SHA256
efdf35f6be917e4cbb41482226f2b475537f1d3de9d415933ed499a89342eae1

SHA512
baf4487948277bb04392b81f2ac211b96f6adc37545a3ddf60df50721329b6d967bfd85eb9048c1c343094d37350f90f988fca3ba587f31b3e96734b9ff05a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\aboutbtndark.png

Filesize
1KB

MD5
b51b54b77e9cbfdb1063f7487c1c07ec

SHA1
8a8a7036cfbc86a537447bf71b9f6795923db8b9

SHA256
9d7243c688264329a8cb9e22da00b651e0a9407741d722e03dd67cc8b3ee1335

SHA512
04cef1aa3a530e7f03054369450eb42f36bf45c13c7445adf450ec4635a8601447c5bb6e978b3adabe9021019644681bf1609539eb548dd50ada973aac0c6555

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\buttonimgs

Filesize
1KB

MD5
7633f00ea029a3b988c354441f0f4722

SHA1
a72a74af68d006a35efcf9be6fe3424ff31fb84c

SHA256
ed127a86f01d767643af667c1d52525a3cb7632713b981896af72628da7ee7fa

SHA512
52c70cbd6fa3cc292a1d5b505b272d88b6f950eac4d24df750b7c8ce5bcacdff9fc9fdd0ccff8f081d05852559ae187f50d4e6b4f5f95e8c648a658d4b9a03b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\buttonimgsdark_v4.png

Filesize
1KB

MD5
9da277bfddf1010c939a47e19783f894

SHA1
d3daba841debdf102d2aefe47964b881ca852f76

SHA256
2f83e4c5b8e081cc5a1dd9c2ae5b233f9dce900b632de2bae1c235267a804775

SHA512
3357c0ede9d0978b8520c2eb1f2f88c3c664bd0ef25ff81d70e89c147dcf935c8fe52dd6af6762d468415de43ab3111e25efa257e0dacc4cf0a4887fc2b86793

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\checkboxdark.png

Filesize
1KB

MD5
da526c0caa0495a9c96ecc574cc5ff20

SHA1
f570c7cda9594f68950ebfad4497863eddf55097

SHA256
205a20e410235b12b18cf6b48e69edf1d8dc28e6ea9f4896baf3adeff33260ba

SHA512
600ea6951973b3f3efcb8649030ddedf223927b9cced03e8ce99b818f6a26b0d3f0f0075af0c696593db9086f422147ffa35dc4ba8fc10061fb4922024ad0c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\checkboximgs

Filesize
1KB

MD5
bf7ac146eb80de9d4d3e6b5a7998ebbf

SHA1
532b1bae084af1bb3a8880c47a509ce1bb804df3

SHA256
73616e9e679089cd5c580d5ef9cc96859f13509af8150fe081d67a1935ce4885

SHA512
ea5ed62de728d88cf598b0b9bb1da953b2ee7675cb71d04f022ce41b2697e0f02bef269181c09ede6c28c6946dd8944abbb487ab4be8b190fc9b72423ca4a905

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_828\custominstallbtn

Filesize
914B

MD5
fb33dcad5260941fc9261b1f378d5775

SHA1
5bfbefc05e1d1f41b10974b1ca43495053ad95f3

SHA256
9ccbc0baba2efe3424610a0f282626e2364473c5afc5cd6d485e6673bff3a862

SHA512
7cc5481fbcb4e4f0420da5196a209124f615c0b42e2f1ff5da444ac13c0d8698b5f20472ee1743c126d0bbdc6241e2ccbb58f6ac0970dba6aff74189d600f0eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab100A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2445.tmp

Filesize
997KB

MD5
ee09d6a1bb908b42c05fd0beeb67dfd2

SHA1
1eb7c1304b7bca649c2a5902b18a1ea57ceaa532

SHA256
7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752

SHA512
2dd2e4e66d2f2277f031c5f3c829a31c3b29196ab27262c6a8f1896a2113a1be1687c9e8cd9667b89157f099dfb969ef14ae3ea602d4c772e960bc41d39c3d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI329E.tmp

Filesize
886KB

MD5
1d51848e7512c27af22cdf0213e11cf5

SHA1
d35ab52e49c82bb72f0ad7c7568035e8a41564e4

SHA256
0b73497f2ad7a4a04f36b8d46816c5404ba828d7feeca90b3abe28599e9c4619

SHA512
b6513f1ab6af820fd139ba5fe5399268077c328b8dbd19471db203f94f6aec2702baaec37209b4056531cab56d54b09f6d446f0f398befa1cc9cd4f77e65e079

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI337A.tmp

Filesize
1.1MB

MD5
e83d774f643972b8eccdb3a34da135c5

SHA1
a58eccfb12d723c3460563c5191d604def235d15

SHA256
d0a6f6373cfb902fcd95bc12360a9e949f5597b72c01e0bd328f9b1e2080b5b7

SHA512
cb5ff0e66827e6a1fa27abdd322987906cfdb3cdb49248efee04d51fee65e93b5d964ff78095866e197448358a9de9ec7f45d4158c0913cbf0dbd849883a6e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3BE5.tmp

Filesize
324KB

MD5
4f17c2364ddc2715d92688da3f954373

SHA1
054a9de08a1719ecdc772ff88b560ec60587cdde

SHA256
da3d066167e07202062186d10608f37ae5a87b05bbc518de45d86acecb76add3

SHA512
168b3c9905fe8ff7101be2d238e56a2a90185e9eb48b5c8290bd64bb1e0e8b73af488f9386e0c8175dd023b14b185f7743462df605fcf9861c47eec35da70bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI70d4a.LOG

Filesize
101KB

MD5
893339067639ddcd6b4e422b2b04addd

SHA1
6ac7493b148f60ef353390732a7b4e698465b99a

SHA256
342706a2017e25f95c3149e3b9eadb1485c600e5787989f312e5c6a3b7f3dd18

SHA512
34c9d9b14206836d25b53d8ff128f6b675d989d8afcc55814321195ed3f5a744281573733d6bc8e327cab039c9747f49f25e4c90f5464f808ddb5633cc5f46c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8559\embeddeduiproxy.dll

Filesize
312KB

MD5
bd46d7634e2bd65c94b0c57003511c53

SHA1
eaf0b6e0f4bebf51de81d6dfce3753573148fd68

SHA256
0abb111356e0bc3899331a020f6ba22d0701bb3f3bf79c01bfd039e35a968689

SHA512
bc6cb20e65e427ab669133e060227cb58fd43929c501718112fb83d2b79f7a065a4cee1233fdfa2e00f94499a33823b4f8130bc660820e0cf071b4b894947c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar105B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI138.tmp

Filesize
220KB

MD5
4e8128658ddd99d57fe33a49b847f71c

SHA1
8b1b264ed31c1275f8b6d87ef4c59d810b9471f2

SHA256
37258f62d1e88c7c71d773a9944d2e88a2269b576470042623e57b5cff459b84

SHA512
3af709d6adf16be7659c53a94889fa555a380603086272b34a2b46119c3b8260adb31abf9e817afac9a7d2213a6236a223552783b39f91f65e7194de27da5da6

Download Submit
C:\Windows\Installer\MSI8B9.tmp

Filesize
879KB

MD5
bd3ff2df6feef5b9efadc7faa0b128ac

SHA1
00f649909fa4adb523133da4e95a130193598932

SHA256
91b67a83d1dce44af9c9df58005009d6ad0e0a037ac37b7919daa764c196c99c

SHA512
76823f5ea9532d6531e0c1991c9bd293e5edf062c9f7c2ce7b3f77a5d141486844108db0a9cff1808e4b7e6845d5a3cd31a80ba81c074f2caf5564ed83b92e72

Download Submit
C:\Windows\Installer\MSIF451.tmp

Filesize
396KB

MD5
163e750fcf53df3639dfddcdd3206e56

SHA1
2859ca10d30edfd8eb704530a6e0069e44a0c833

SHA256
b78f7adb3fc99902a50dae748de4834c4363dcc7b0352efe6dade091895fd37f

SHA512
e5ac3a8417a83df4ffa5acf078752011fe088adf275f744f22d3c43d141f8290871ad778d3fca621f641aa75718b32cc7accc398207b65fa61f4ce95a5b1ee4a

Download Submit
C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_neutral_7499a4fac85b39fc\volsnap.PNF

Filesize
5KB

MD5
5e961b1e105c3b3e61e882a553bf5355

SHA1
a5410576b80da1982c64fd9bb81b85f6bc7cd12d

SHA256
1b68210cf77bbf95273c182120e0e38bc6750b361a5c2725319afb753dcfc0d1

SHA512
943d43bb77968c9d1df98076ec4a344c01596b2ae7771ce37dd10389ff96eadca91412106f404da5b54fb345d6e0e845259c8cec4537ff4d23c46a5a4e8d756a

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8559\EnhancedUI.exe

Filesize
3.9MB

MD5
8307a6d4f7b38e17969620c9affd11c4

SHA1
1dcb61e526a0becefb4f477dae32927bca825cbb

SHA256
50f54e0f63695c39524d331b8dc49aa4ff62c540661dcbcd69bec9cfaccf19a7

SHA512
a4a442ce89eb528bb7c244130abc2af4ace56f5696e4356cf3cdcb84e4eb2d37b491f41130fb79f886a088dfd261cf0d9a81a236993a41a1097ff8bd07ed15c6

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8559\InstallerAnalytics.dll

Filesize
1.1MB

MD5
f3d0d2776bab52020228e030f3dc20a8

SHA1
ff0e1aa1526f5e9234b176deb93d25ba185b16c9

SHA256
2cf277a1060bd9a9c6c22482ec607bd7b6f15c02b1421db173cbf97297c12405

SHA512
7e1adf3533a79fe46d541266b3c0b38ae5a0ceb11386aeebf55890d7dfe36d71200508a6cd007e0721cc23a19219acba9799fc77b784e8e3527e98702de95702

Download Submit
memory/856-476-0x0000000000A10000-0x0000000000A1A000-memory.dmp

Filesize
40KB

Download
memory/2220-485-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download