floxif | b910a6ffaeeb982bdb88a390c554c327e3eeb65ad2157c66b21f271c6e72818f

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
Size

27.3MB
MD5

b5564521e7f0c7ef8ceefe141469e90f
SHA1

dbb2be0989e75f8d30b6cdd03b4ae1a9db2d7c03
SHA256

b910a6ffaeeb982bdb88a390c554c327e3eeb65ad2157c66b21f271c6e72818f
SHA512

b1b8d40a40890cc4e56d885a2435075c638c48a706bd517b11a1e797a0c57890f4227c56df3b1daf793b7027634f70d5e69b9191929b1dca5c1ac76c581296ca
SSDEEP

393216:dYnK/WGHjJIhMeoUzx3/g/WyUXM0rFfTAtZfeV3qyauJC5PL0IV8PRG/2Zze3qGo:2mHleVx3/2EbAOV3qc05TRVwc/0CfNA

Score

10^/10

floxif backdoor defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0007000000012101-1.dat	floxif

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET344A.tmp	usbinst.exe
File created	C:\Windows\system32\DRIVERS\SET344A.tmp	usbinst.exe
File opened for modification	C:\Windows\system32\DRIVERS\ctxusbm.sys	usbinst.exe
File opened for modification	C:\Windows\system32\DRIVERS\ctxusbm.sys	usbinst.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000012101-1.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
2724	TrolleyExpress.exe
2656	redirector.exe
596	icaconf.exe
2372	SetIntegrityLevel.exe
564	concentr.exe
400	SetIntegrityLevel.exe
1988	Receiver.exe
2384	wfcrun32.exe
2964	concentr.exe
2596	usbinst.exe
1692	usbinst.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2724	TrolleyExpress.exe
2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
1232	MsiExec.exe
1232	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
2804	MsiExec.exe
776	MsiExec.exe
776	MsiExec.exe
776	MsiExec.exe
2656	redirector.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
2952	rundll32.exe
596	icaconf.exe
596	icaconf.exe
596	icaconf.exe
596	icaconf.exe
2372	SetIntegrityLevel.exe
564	concentr.exe
564	concentr.exe
564	concentr.exe
564	concentr.exe
564	concentr.exe
564	concentr.exe
776	MsiExec.exe
564	concentr.exe
776	MsiExec.exe
564	concentr.exe
776	MsiExec.exe
776	MsiExec.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
1988	Receiver.exe
2904	msiexec.exe
2904	msiexec.exe
2904	msiexec.exe
2904	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConnectionCenter = "\"C:\\Program Files (x86)\\Citrix\\ICA Client\\concentr.exe\" /startup"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	usbinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	usbinst.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
7	2904	msiexec.exe
9	2904	msiexec.exe
12	2904	msiexec.exe
16	2904	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	TrolleyExpress.exe
File opened (read-only)	\??\V:	TrolleyExpress.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	TrolleyExpress.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	TrolleyExpress.exe
File opened (read-only)	\??\U:	TrolleyExpress.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	TrolleyExpress.exe
File opened (read-only)	\??\W:	TrolleyExpress.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	TrolleyExpress.exe
File opened (read-only)	\??\J:	TrolleyExpress.exe
File opened (read-only)	\??\M:	TrolleyExpress.exe
File opened (read-only)	\??\Y:	TrolleyExpress.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	TrolleyExpress.exe
File opened (read-only)	\??\T:	TrolleyExpress.exe
File opened (read-only)	\??\Z:	TrolleyExpress.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	TrolleyExpress.exe
File opened (read-only)	\??\A:	TrolleyExpress.exe
File opened (read-only)	\??\X:	TrolleyExpress.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\e:	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
File opened (read-only)	\??\I:	TrolleyExpress.exe
File opened (read-only)	\??\K:	TrolleyExpress.exe
File opened (read-only)	\??\L:	TrolleyExpress.exe
File opened (read-only)	\??\P:	TrolleyExpress.exe
File opened (read-only)	\??\Q:	TrolleyExpress.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	TrolleyExpress.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x0007000000012101-1.dat	upx
behavioral1/memory/2104-111-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2104-122-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2104-1151-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2104-1156-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-TW\ProgressNotificationCommonUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbm\ctxusbm.cat	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\de\ControlPanel.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\concentr.chm	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ja\CPViewUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\icadlgUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\ProgressNotificationCommonUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\wfcrunUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\ja\ControlPanel.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\de\PrefPanel.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\License.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Citrix\ICA Client\msvcp80.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\x64\Microsoft.VC80.CRT.manifest	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\NativeMessageBox.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Configuration\Trusted_Region.ini	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\vdcdm3UI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ja\wfica3UI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Citrix\ICA Client\MFC80DEU.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbr\ctxusbr.cat	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\concentr.chm	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\pcl2bmp.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\en\icalogUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-TW\statuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\vdmmn.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\wficaUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\ctxmui.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\MFC80KOR.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Citrix\ICA Client\MFC80CHS.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\cst.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\ProgressNotificationCommon.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ko\wfcrunUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ja\wficaUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\cstUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\module.ini	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\concentr.chm	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\icafilesigningUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\RSMHook.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\appsrv.src	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\AxWfIcaLib.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\ctxlogUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\migratUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Configuration\module.ini	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\cstUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\MFC80ESP.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\migratUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\vddvc0N.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\vdtw30n.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\icavern.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\statuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\wfcrunUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\ControlPanel.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\SRProxy.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\vdfon30n.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\vdzlcnUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\vdzlcnUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ko\ctxmuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\npicanUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\npicanUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\RSMHook64.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\redirector.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\ctxmuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\nrhttpUI.dll	msiexec.exe

Drops file in Windows directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI23AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e41b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI230A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e425.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D25.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e428.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B30.tmp	msiexec.exe
File created	C:\Windows\Installer\{7BD3DC6D-A2BE-4345-B6EE-D146193DB18F}\liteico.exe.827545C6_7013_4DE1_8E6C_DAEE4C57F54A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2339.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2758.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e424.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e418.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI354C.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e42a.msi	msiexec.exe
File created	C:\Windows\Installer\f76e42b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e42e.ipi	msiexec.exe
File created	C:\Windows\Installer\f76e418.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e42b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D66.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e425.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3142.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	usbinst.exe
File opened for modification	C:\Windows\Installer\{9D431014-9F90-4335-A58E-8A14B0BD77F1}\Receiver.5A09B6C6_C238_4B5F_A9E1_AFF142EFAE23.Shortcut	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AF1.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e42e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3375.tmp	msiexec.exe
File created	C:\Windows\Installer\f76e41d.msi	msiexec.exe
File created	C:\Windows\Installer\f76e422.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI235A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2389.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{7BD3DC6D-A2BE-4345-B6EE-D146193DB18F}\liteico.exe.827545C6_7013_4DE1_8E6C_DAEE4C57F54A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3027.tmp	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	usbinst.exe
File created	C:\Windows\Installer\f76e41b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2132.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e422.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3413.tmp	msiexec.exe
File created	C:\Windows\Installer\{9D431014-9F90-4335-A58E-8A14B0BD77F1}\Receiver.5A09B6C6_C238_4B5F_A9E1_AFF142EFAE23.Shortcut	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e41f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2457.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e428.ipi	msiexec.exe
File created	C:\Windows\Installer\f76e41f.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	usbinst.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2716	rundll32.exe
2952	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	redirector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfcrun32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrolleyExpress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	concentr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetIntegrityLevel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Receiver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	concentr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetIntegrityLevel.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}\AppName = "wfcrun32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}\AppPath	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}\Policy	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\End User Experience\RECD	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress5	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\SSL\SSLCACert1	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveReadAccessA	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveReadAccessM	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveWriteAccessS	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey2Shift	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\Saved Credentials\NRDomain	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\Local Credentials\UseLocalUserAndPassword = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\DisableDrives	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveWriteAccessC	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Mouse\MouseWheelMapping	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveEnabledG	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress2	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Reconnection\TransportReconnectRetries = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Multimedia\SpeedScreenMMAVideoEnabled = "*"	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort24	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Thinwire Graphics\EnableOSS = "*"	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\SSL\SSLCACert4	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Smartcard	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress13	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Clipboard	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathJ	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveWriteAccessR	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\VirtualCOMPortEmulation = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Thinwire Graphics\DesiredColor = "*"	icaconf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\Unknown Region\AllowConnection = "0"	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy\ICASOCKSrfc1929Username	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Reconnection\TransportReconnectEnabled = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\SSL\SSLCiphers	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Smartcard\SmartCardAllowed = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\DVC_PlugAndPlay\POSDeviceAllowed = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\CGP\SessionReliabilityTTL = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathD	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Thinwire Graphics\PreferredLaunchMonitor = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\End User Experience\COCD	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Application Launching\LongCommandLine014	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey14Char	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy\ProxyUsername	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress14	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Client Update\UpdatesAllowed = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort21	icaconf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\EnableLockdown = "1"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Application Launching\LongCommandLine004	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\Kerberos	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Keyboard\KeyboardTimer = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveEnabledA	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveEnabledL	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort7	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort30	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Zero Latency	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\Unknown Region\Lockdown	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\LocHttpBrowserAddress13	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\CGP\MissedKeepaliveWarningTime = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy\WpadHost	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveReadAccessE	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Application Launching\LongCommandLine012	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Keyboard\TransparentKeyPassthrough	icaconf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/x-ica; charset=ISO-8859-1\ = "IcaMimeFilter MIME Filter"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{785A16E9-4E42-4C87-84AD-BFB4A60570A3}\ = "_IScreenShotEvents"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49813E6D-17FF-41A1-9A7B-95C3D5B44185}\ProxyStubClsid32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0262990D1C8D56C4BA7D652E71147519\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{68A8653F-5787-48E3-A0D9-B2C33FAC824A}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3D3FCA3F-FA3F-4ACB-A793-DF6FFACC991A}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F6A8DB8-51DF-413D-946C-F424A3168C35}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{C45B7921-9578-4E38-92B1-18346DA5B84B}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D6CD3DB7EB2A54346BEE1D6491D31BF8\WEB_CLIENT	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.9\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IcaMimeFilter.IcaMimeFilterPP\CurVer\ = "IcaMimeFilter.IcaMimeFilterPP.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C43C22AF-CC33-43c0-9E0E-E843087AE46C}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{239D08F9-0EC1-43F1-96D9-D11C3FB10A8E}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CtxRedirector.Component.Cmpnt\CurVer\ = "CtxRedirector.Component.Cmpnt 1.1"	redirector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F6A8DB8-51DF-413D-946C-F424A3168C35}\ProxyStubClsid32\ = "{1EFF7739-9BDA-4295-BC07-383554CAAC84}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9C25DF55-32BE-46E6-A0BE-844F4C937651}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{785A16E9-4E42-4C87-84AD-BFB4A60570A3}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClientProp.2.3\CLSID\ = "{238F6F85-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IcaMimeFilter.IcaMimeFilterPP	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{238F6F82-B8B4-11CF-8771-00A024541EE3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CCMLib.CCM.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1EFF7739-9BDA-4295-BC07-383554CAAC84}\ = "PSFactoryBuffer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.3\ = "Citrix ICA Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C45B7921-9578-4E38-92B1-18346DA5B84B}\ = "IEvents_SessionSharing"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C22A8C9-B8C8-4B0C-8063-D63F18DB075F}\ = "ILauncher"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{ABCAD60C-D071-4683-AC98-50AEB736B2A2}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68A8653F-5787-48E3-A0D9-B2C33FAC824A}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49813E6D-17FF-41A1-9A7B-95C3D5B44185}\TypeLib\Version = "2.9"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IcaMimeFilter.IcaMimeFilterPP\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{785A16E9-4E42-4C87-84AD-BFB4A60570A3}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E61FEC89-CFBB-43A1-AC1D-4656D3714F4F}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEInterceptor.InterceptorBHO\CurVer\ = "IEInterceptor.InterceptorBHO.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Citrix.ICAClientProp.2.1\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinFrameICA\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68A8653F-5787-48E3-A0D9-B2C33FAC824A}\ = "IEvents_SessionError"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{238F6F81-B8B4-11CF-8771-00A024541EE3}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{785A16E9-4E42-4C87-84AD-BFB4A60570A3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.9\CLSID\ = "{238F6F83-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2\CLSID\ = "{238F6F83-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A502C16-CFAE-4BB0-B1F9-93ACADDA57BB}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B371833-5E4F-4B72-A8F6-CB8E762999F4}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238F6F83-B8B4-11CF-8771-00A024541EE3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/x-ica;charset=MS936\ = "IcaMimeFilter MIME Filter"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ica; charset=MS936\Extension = ".ica"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F2D9E63-D224-47E4-8111-32DBB016A4C6}\TypeLib\ = "{238F6F80-B8B4-11CF-8771-00A024541EE3}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238F6F83-B8B4-11CF-8771-00A024541EE3}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{919B1DD4-91CE-455A-9CB3-437BFE502117}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C43C22AF-CC33-43c0-9E0E-E843087AE46C}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5FE65B49-6E43-4F1E-A1BB-AC6552EC96AE}\ = "CtxRedirector.Component"	redirector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9B123F490B54521479D0EDD389BCACC1\D6CD3DB7EB2A54346BEE1D6491D31BF8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ica\Citrix.ICAClient.2.9\ShellNew	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinFrameICA\CLSID\ = "{238F6F83-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B371833-5E4F-4B72-A8F6-CB8E762999F4}\TypeLib\Version = "2.9"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CtxRedirector.Component.Cmpnt\CurVer	redirector.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D6CD3DB7EB2A54346BEE1D6491D31BF8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2\CurVer\ = "Citrix.ICAClient.2.9"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IcaMimeFilter.IcaMimeFilterPP.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24FD31DB-3560-4C78-8950-30F03352D830}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CBACA88C-FA22-4B27-9F2A-7A0517227FE3}\ProxyStubClsid32\ = "{1EFF7739-9BDA-4295-BC07-383554CAAC84}"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2724	TrolleyExpress.exe
2724	TrolleyExpress.exe
2724	TrolleyExpress.exe
2724	TrolleyExpress.exe
2904	msiexec.exe
2904	msiexec.exe
2904	msiexec.exe
2904	msiexec.exe
2904	msiexec.exe
2904	msiexec.exe
1520	MsiExec.exe
2904	msiexec.exe
2904	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
Token: SeRestorePrivilege	2904	msiexec.exe
Token: SeTakeOwnershipPrivilege	2904	msiexec.exe
Token: SeSecurityPrivilege	2904	msiexec.exe
Token: SeCreateTokenPrivilege	2724	TrolleyExpress.exe
Token: SeAssignPrimaryTokenPrivilege	2724	TrolleyExpress.exe
Token: SeLockMemoryPrivilege	2724	TrolleyExpress.exe
Token: SeIncreaseQuotaPrivilege	2724	TrolleyExpress.exe
Token: SeMachineAccountPrivilege	2724	TrolleyExpress.exe
Token: SeTcbPrivilege	2724	TrolleyExpress.exe
Token: SeSecurityPrivilege	2724	TrolleyExpress.exe
Token: SeTakeOwnershipPrivilege	2724	TrolleyExpress.exe
Token: SeLoadDriverPrivilege	2724	TrolleyExpress.exe
Token: SeSystemProfilePrivilege	2724	TrolleyExpress.exe
Token: SeSystemtimePrivilege	2724	TrolleyExpress.exe
Token: SeProfSingleProcessPrivilege	2724	TrolleyExpress.exe
Token: SeIncBasePriorityPrivilege	2724	TrolleyExpress.exe
Token: SeCreatePagefilePrivilege	2724	TrolleyExpress.exe
Token: SeCreatePermanentPrivilege	2724	TrolleyExpress.exe
Token: SeBackupPrivilege	2724	TrolleyExpress.exe
Token: SeRestorePrivilege	2724	TrolleyExpress.exe
Token: SeShutdownPrivilege	2724	TrolleyExpress.exe
Token: SeDebugPrivilege	2724	TrolleyExpress.exe
Token: SeAuditPrivilege	2724	TrolleyExpress.exe
Token: SeSystemEnvironmentPrivilege	2724	TrolleyExpress.exe
Token: SeChangeNotifyPrivilege	2724	TrolleyExpress.exe
Token: SeRemoteShutdownPrivilege	2724	TrolleyExpress.exe
Token: SeUndockPrivilege	2724	TrolleyExpress.exe
Token: SeSyncAgentPrivilege	2724	TrolleyExpress.exe
Token: SeEnableDelegationPrivilege	2724	TrolleyExpress.exe
Token: SeManageVolumePrivilege	2724	TrolleyExpress.exe
Token: SeImpersonatePrivilege	2724	TrolleyExpress.exe
Token: SeCreateGlobalPrivilege	2724	TrolleyExpress.exe
Token: SeCreateTokenPrivilege	2724	TrolleyExpress.exe
Token: SeAssignPrimaryTokenPrivilege	2724	TrolleyExpress.exe
Token: SeLockMemoryPrivilege	2724	TrolleyExpress.exe
Token: SeIncreaseQuotaPrivilege	2724	TrolleyExpress.exe
Token: SeMachineAccountPrivilege	2724	TrolleyExpress.exe
Token: SeTcbPrivilege	2724	TrolleyExpress.exe
Token: SeSecurityPrivilege	2724	TrolleyExpress.exe
Token: SeTakeOwnershipPrivilege	2724	TrolleyExpress.exe
Token: SeLoadDriverPrivilege	2724	TrolleyExpress.exe
Token: SeSystemProfilePrivilege	2724	TrolleyExpress.exe
Token: SeSystemtimePrivilege	2724	TrolleyExpress.exe
Token: SeProfSingleProcessPrivilege	2724	TrolleyExpress.exe
Token: SeIncBasePriorityPrivilege	2724	TrolleyExpress.exe
Token: SeCreatePagefilePrivilege	2724	TrolleyExpress.exe
Token: SeCreatePermanentPrivilege	2724	TrolleyExpress.exe
Token: SeBackupPrivilege	2724	TrolleyExpress.exe
Token: SeRestorePrivilege	2724	TrolleyExpress.exe
Token: SeShutdownPrivilege	2724	TrolleyExpress.exe
Token: SeDebugPrivilege	2724	TrolleyExpress.exe
Token: SeAuditPrivilege	2724	TrolleyExpress.exe
Token: SeSystemEnvironmentPrivilege	2724	TrolleyExpress.exe
Token: SeChangeNotifyPrivilege	2724	TrolleyExpress.exe
Token: SeRemoteShutdownPrivilege	2724	TrolleyExpress.exe
Token: SeUndockPrivilege	2724	TrolleyExpress.exe
Token: SeSyncAgentPrivilege	2724	TrolleyExpress.exe
Token: SeEnableDelegationPrivilege	2724	TrolleyExpress.exe
Token: SeManageVolumePrivilege	2724	TrolleyExpress.exe
Token: SeImpersonatePrivilege	2724	TrolleyExpress.exe
Token: SeCreateGlobalPrivilege	2724	TrolleyExpress.exe
Token: SeCreateTokenPrivilege	2724	TrolleyExpress.exe
Token: SeAssignPrimaryTokenPrivilege	2724	TrolleyExpress.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1988	Receiver.exe
1988	Receiver.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1988	Receiver.exe
1988	Receiver.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	TrolleyExpress.exe
2724	TrolleyExpress.exe
2384	wfcrun32.exe
2384	wfcrun32.exe
2384	wfcrun32.exe
2384	wfcrun32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2104 wrote to memory of 2724	2104	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	30
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 1232	2904	msiexec.exe	34
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 2804	2904	msiexec.exe	35
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 776	2904	msiexec.exe	37
PID 2904 wrote to memory of 2656	2904	msiexec.exe	38
PID 2904 wrote to memory of 2656	2904	msiexec.exe	38
PID 2904 wrote to memory of 2656	2904	msiexec.exe	38
PID 2904 wrote to memory of 2656	2904	msiexec.exe	38
PID 2904 wrote to memory of 2716	2904	msiexec.exe	39
PID 2904 wrote to memory of 2716	2904	msiexec.exe	39
PID 2904 wrote to memory of 2716	2904	msiexec.exe	39
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2716 wrote to memory of 2952	2716	rundll32.exe	40
PID 2952 wrote to memory of 596	2952	rundll32.exe	41
PID 2952 wrote to memory of 596	2952	rundll32.exe	41
PID 2952 wrote to memory of 596	2952	rundll32.exe	41
PID 2952 wrote to memory of 596	2952	rundll32.exe	41
PID 2904 wrote to memory of 2372	2904	msiexec.exe	43
PID 2904 wrote to memory of 2372	2904	msiexec.exe	43
PID 2904 wrote to memory of 2372	2904	msiexec.exe	43
PID 2904 wrote to memory of 2372	2904	msiexec.exe	43
PID 2372 wrote to memory of 564	2372	SetIntegrityLevel.exe	44
PID 2372 wrote to memory of 564	2372	SetIntegrityLevel.exe	44
PID 2372 wrote to memory of 564	2372	SetIntegrityLevel.exe	44
PID 2372 wrote to memory of 564	2372	SetIntegrityLevel.exe	44
PID 2904 wrote to memory of 400	2904	msiexec.exe	45
PID 2904 wrote to memory of 400	2904	msiexec.exe	45
PID 2904 wrote to memory of 400	2904	msiexec.exe	45
PID 2904 wrote to memory of 400	2904	msiexec.exe	45
PID 564 wrote to memory of 1988	564	concentr.exe	46
PID 564 wrote to memory of 1988	564	concentr.exe	46
PID 564 wrote to memory of 1988	564	concentr.exe	46
PID 564 wrote to memory of 1988	564	concentr.exe	46
PID 2904 wrote to memory of 1520	2904	msiexec.exe	47
PID 2904 wrote to memory of 1520	2904	msiexec.exe	47

C:\Users\Admin\AppData\Local\Temp\2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\TrolleyExpress.exe
  C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\TrolleyExpress.exe "C:\Users\Admin\AppData\Local\Temp\2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2724

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31A72EFC81ADBBF40EC93CD0B1635206
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1232
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 851889122773F1818E42DF09710FDC84
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15D09A5E591754D4CF86CE4EA8B26071 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:776
- C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
  "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /regserver
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2656
- C:\Windows\system32\rundll32.exe
  rundll32.exe icaconfs.dll, ApplyConfigurationA import --replace -f -all "C:\Program Files (x86)\Citrix\ICA Client\Configuration" --RunAsAdmin
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe icaconfs.dll, ApplyConfigurationA import --replace -f -all "C:\Program Files (x86)\Citrix\ICA Client\Configuration" --RunAsAdmin
    3⤵
    - Loads dropped DLL
    - Access Token Manipulation: Create Process with Token
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Program Files (x86)\Citrix\ICA Client\icaconf.exe
      "C:\Program Files (x86)\Citrix\ICA Client\icaconf.exe" import --replace -f -all "C:\Program Files (x86)\Citrix\ICA Client\Configuration"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:596
- C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe
  "C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe" $concentr.exe /startup$M$2724
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
    concentr.exe /startup
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
      "C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe" -autoupdate -startplugins
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1988
- C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe
  "C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe" $redirector.exe /startup$M
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 57B6DDA8AFDC258681DB82C701C13418
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files (x86)\Citrix\ICA Client\x64\ssonstub.dll"
  2⤵
  - Modifies registry class
  PID:2152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33DB63C85603B95EE18A7D72DF9FA63E M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6DBF54EC2F800DE2CCF6EA078434C51 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1100
- - C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe
    "C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe" InstallHinfSection "DefaultInstall 128 C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbm\ctxusbm.inf"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:2596
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Modifies data under HKEY_USERS
      PID:1552
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:1088
- - C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe
    "C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe" InstallHinfSection "DefaultUninstall 128 C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbm\ctxusbm.inf"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:1692
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Modifies data under HKEY_USERS
      PID:2056
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2320

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
"C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2384
- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
  "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Component Object Model Hijacking

T1546.015

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Component Object Model Hijacking

T1546.015

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76e41c.rbs

Filesize
22KB

MD5
ee50d3fca328f4a87139eeeb3489a23c

SHA1
3521bbbe69ad20fc0cbdd8418e6708f86c268edc

SHA256
eb3f1f4a6ebfbb82ea6cdb1d388e37f6483f85debd37d36c91183142966143df

SHA512
dfaac02989198b2579972c1063d78d6ad623b75c35c5c5483ccead3b20e0bd73c48db58a4de68cbbdbbe8003f6a107aec78dfe6d77a6908581c171b703e7c097

Download Submit
C:\Config.Msi\f76e41e.rbs

Filesize
454B

MD5
5e84044a78d6c81f43c21ba340990ea2

SHA1
9049100dad39d4ba165dc2b929a5aa890ca55690

SHA256
95065bac9fd616fb2ce45768e6e9dc9a200f5c25a090e94c20066cfe56bcac5d

SHA512
e9033e422b0d1343ebe7c2c91eff0de656391cb0ba64712c2bedf58081656563e830bca903a30d90e1c1047b516670e6a4007b135f157fe6d94cbace737e96cf

Download Submit
C:\Config.Msi\f76e423.rbs

Filesize
1.1MB

MD5
2acc1fbff682e091763f7301a824d357

SHA1
28b494c043d19ab98f0ce5b57208246479bed21c

SHA256
aa878a7eeac230c62937fc961a7336a05ff0b4ab56047fcd29ff01e6d167bd72

SHA512
e871d653d3a12acb0853734fbc71ae525dd64ecd71af327d46838eab0a52a024ef1a6c71cd5ff77e621d1e0e350a4fbed5e06604dc62a58d2af7a8be63da2c4c

Download Submit
C:\Config.Msi\f76e429.rbs

Filesize
92KB

MD5
8c2ab578042b8c7d53f2f62469e38da1

SHA1
944bfac1d479d79bc96ded64d69f6de1e7af4291

SHA256
5f252983fe5a06a32ffe94b473224c7892e8024dfd4dbae458601605983f31bb

SHA512
064484fb8858e40d55ed74a9ec4f62cfc464ef0e5298ada7ed2f73e8e5517b64c59521cba71e9ea207b5e05eb546429700a1199cf6b9486a5a29e4548d946146

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Configuration\usertemplate\All_Regions.ini

Filesize
21KB

MD5
f701cccbbe12fad3992f2cfb8cf21000

SHA1
a1f273788f08890ace99e34faba1aa861cda34c4

SHA256
f8b519e0b27c559277a9d417a4b3d16c9758f2f416b97e18e9c987aa2711d22c

SHA512
ba6e21582048837a92b3a8009dc721b27e1c47d05d1c0132dc49e545d6d07cea2b14a59f973ef9a35a06a284c22610ffaef502b7350dafb3f005ff00388c9034

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80CHS.dll

Filesize
40KB

MD5
afa7e91c8c9566e03fb1620f95230b93

SHA1
75057a0e936032ec9cbc77559241720f58bfab84

SHA256
4eaf1750a573bab5c853e7714efcc84ff2fcf992ad935fd01af9e2a5bd01a93a

SHA512
b9c34166555f42d4a4e754131fd2868b4fc2965ac8519a6eeed8a32f6c67e1e6e5b4daa93175967f5f687d8333ca53c4d183a2177191a81bc01e89b7cbdc9bb3

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80CHT.dll

Filesize
44KB

MD5
2dca32742f80bb37e159b651f8eef44b

SHA1
dcd0265fbe8efd63c235ed4611aecc4b935c057c

SHA256
a7eaf2b5df991654500ffed95d3950a46dd0fe05cddcccd77490f125e22b80d6

SHA512
40e1533f6989955f537d556ab28ff0be44658309eef5d40093bf3fcec39ad85ea14bb2b880ff5c067ccfc257a35361c25aac087e0463bafe39fb265b8a0825ee

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80DEU.dll

Filesize
64KB

MD5
1e6719ebeb1d368e09899a9d0ddfad70

SHA1
fc510a6dbe0d9180f203af651e186979b628675f

SHA256
734eb909c54a0a1c53aa5177727660b1c64f3d261b222feaec76fc5853300661

SHA512
c5753b79d97204c130a2c0a46d7717e74c140d207a446918df113a6c460f538afe0a48af52360d8a501104283311667ce8dd23b4d3e65b7ee99939a791c25ad6

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80ENU.dll

Filesize
56KB

MD5
9090454e6772f7cfbce240bf4dc5f7e8

SHA1
3afd27af1fbb5d2efde463869a1e6465affbcdd8

SHA256
a532044dfd1fa6463516125ea74c250762de4dacbe613f8ad2ff72d50c0b9585

SHA512
4691138b2e32447a6300a17967c1221153b5b514ee0edcd25a135dce2a6eefea9cc7f3fc516a9b3482feb62dc190a7f4192bcf15d9793832f828078557e24cdf

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80ESP.dll

Filesize
60KB

MD5
d47599748b3ecf645c47caa0bc24a7cd

SHA1
2f47846b9308fe4b444363f0863f394a1b13c938

SHA256
10fd5eebe39acd996309da073b247b365cbc0f48f43da3062463ea9f712319ca

SHA512
30b0f056123657eaca8f97138e1ca5c2981575420938ee7ed645e4d62f2a159c011eff08c2ee20ac68504bd59d890dbc030718a9ba185871b07dee9851cf2608

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80FRA.dll

Filesize
60KB

MD5
eec2f9e4d790bccdbc542715ab613579

SHA1
8993e9f0cc4657e40866efba0cab7e077060cea8

SHA256
e283b055a0b9f522ff415b78f100542255aa07cb17c1eeb3885e75326d9dbc66

SHA512
89c083c820798872f3feecffccc1a5ccef9a367c8af2170ec06b04a64a234dd03cdfe250b31b5969f87caa8e7ea8393fbcbbcbf16d83c35105814501b6be08e8

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80ITA.dll

Filesize
60KB

MD5
cb23b162ac655f24c6711a5f5df348c6

SHA1
e4e0e803b9297b0937824c53f227598998229463

SHA256
6498ee1449b61b40e2dab46f0b3dfa15f17590d7aa87919580748ec9d4bc2c55

SHA512
460d235818cd83d9020a13f47b24aadc777e4bdc81a6387d8bb59daf37eaf930c70ace5e238fe2fa34491a03b3972f11a4bdb8d30ff98801acff82630b6d24a2

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80JPN.dll

Filesize
48KB

MD5
012031b19f0a9f6431997c79e1893822

SHA1
2265c92b3ed9ec169e2c362e448b0e3f449528a3

SHA256
ed296b3dd004c8845a7015a3a5ef3a92331e30535204a02995323681cbd342ab

SHA512
b4cca371481b349546ad09c40461258a99e5ad6cf7b66fe040a37f90071c420cc41e74f495141a490b4848b66da876ad8b91ac7c14a328cf5c4ccaadfd3e226e

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80KOR.dll

Filesize
48KB

MD5
fec4610f1174136b1d3db2ae37924ce8

SHA1
ba94e77bb29b9b74ea8e2a8fd005dc3083166f3c

SHA256
a6d0b3d20e67c26f7c247f2eeb8dba723b396b118a1b9eaa4568c474826ea740

SHA512
9144a0243e41ec17628a740913a745261346efa2dff3f61d48ccf186f30a1527f6a4f5cb3f7f7727d7bfd4103e9fc90cae1e0cefbc1d8d042218d9d2ea869a36

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.CRT.manifest

Filesize
1KB

MD5
541423a06efdcd4e4554c719061f82cf

SHA1
2e12c6df7352c3ed3c61a45baf68eace1cc9546e

SHA256
17ad1a64ba1c382abf89341b40950f9b31f95015c6b0d3e25925bfebc1b53eb5

SHA512
11cf735dcddba72babb9de8f59e0c180a9fec8268cbfca09d17d8535f1b92c17bf32acda86499e420cbe7763a96d6067feb67fa1ed745067ab326fd5b84188c6

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFC.manifest

Filesize
2KB

MD5
97b859f11538bbe20f17dfb9c0979a1c

SHA1
2593ad721d7be3821fd0b40611a467db97be8547

SHA256
4ed3ba814de7fd08b4e4c6143d144e603536c343602e1071803b86e58391be36

SHA512
905c7879df47559ad271dc052ef8ae38555eac49e8ac516bc011624bf9a622eb10ee5c6a06fbd3e5c0fa956a0d38f03f6808c1c58ee57813818fe8b8319a3541

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFCLOC.manifest

Filesize
1KB

MD5
1d77377f1e874be0fb362e06a39d5167

SHA1
8088aec7cadc8396613b208a94338269dd6b25a8

SHA256
b072669158d28f4ae2db5feba220712f9fefc79b555be848534416b5b9a4e698

SHA512
8ad30ad3501d93a8979eea89b52ac8c9319e78deffa6bde3602e1be10d81b91af83cfc40a919a960e51263258599e495cf8ed09b074d29f541781f52f986461a

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe

Filesize
434KB

MD5
51d5ee69b5fe0a8ed137d60922138dae

SHA1
5d12e59ef7081125ecd1c99a145982cf1b34d923

SHA256
bc6e4f0d4d52e115fb36a97ef5bffe2d46c2ebcfc4a0bc115aeac79e73967479

SHA512
b569d832665f264a262acbfa4e307ad589d04e5daaf4650cc00759f151a3ae81835586a50790c52ff58d3d194631a5a76a380942ce0ffd56cf39981fd3b53070

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Wfica.ocx

Filesize
574KB

MD5
754d77bb79f53e77b69968e29fd9b44e

SHA1
1faf2e1f2ec00195c817338d6d274b6487483e7d

SHA256
3665325e356946de061ec035ce2c26239be467bd47c9007a8b0bf03f9df3da44

SHA512
183422f9df49fc0d30f571402afb5032caa0b759bba70c5aac558870848b5f4bc0fb82d81069a34f7f6224d3e582c8ea93c9d2fe6ef39dcf47244b5305d7f7f3

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\icaconfs.dll

Filesize
94KB

MD5
6c371186c6cedcafe82d72b3a8515e2e

SHA1
0c3a46b6bf923f1ede73adfcc8f0a987eaf47ac7

SHA256
3a1b4b4a7703a6c5ee19c8219a1c96a2e53b9b5e8ce44a3265783a31d8ebb2ce

SHA512
af1ffb113918af725b10b679112ea08664c19190abf558c3660e9111af406e3a2cab74358e3f0ecea798d9f6017dcd2b9bcc0707adf398c0f1b1d0e1e87810a8

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfc80.dll

Filesize
1.1MB

MD5
1b7524806d0270b81360c63a2fa047cb

SHA1
d688d77f0caa897e6ec2ed2c789e77b48304701f

SHA256
ceef5aa7f9e6504bce15b72b29dbee6430370baa6a52f82cf4f2857568d11709

SHA512
b34539fbda2a2162efa2f6bb5a513d1bb002073fa63b3ff85aa3ade84a6b275e396893df5ab3a0a215cade1f068e2a0a1bbd8895595e31d5a0708b65acec8c73

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfc80u.dll

Filesize
1.0MB

MD5
ccc2e312486ae6b80970211da472268b

SHA1
025b52ff11627760f7006510e9a521b554230fee

SHA256
18be5d3c656236b7e3cd6d619d62496fe3e7f66bf2859e460f8ac3d1a6bdaa9a

SHA512
d6892abb1a85b9cf0fc6abe1c3aca6c46fc47541dffc2b75f311e8d2c9c1d367f265599456bd77be0e2b6d20c6c22ff5f0c46e7d9ba22c847ad1cbedc8ca3eff

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfcm80.dll

Filesize
68KB

MD5
c84e4ece0d210489738b2f0adb2723e8

SHA1
63c1fa652f7f5bd1fccbe3618163b119a79a391c

SHA256
ed1dcdd98dac80716b2246d7760f0608c59e566424ac1a562090a3342c22b0a7

SHA512
3ee1da854e7d615fa4072140e823a3451df5d8bebf8064cc9a399dec1fb35588f2a17c0620389441ca9edd1944c9649002fe4e897c743fe8069b79a5aa079fe2

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfcm80u.dll

Filesize
56KB

MD5
ddad68e160c58d22b49ff039bb9b6751

SHA1
c6c3b3af37f202025ee3b9cc477611c6c5fb47c2

SHA256
f3a65bfc7fce2d93fdf57cf88f083f690bc84b9a7706699d4098d18f79f87aaa

SHA512
47665672627e34ad9ea3fd21814697d083eeeafc873407e07b9697c8ab3c18743d9fcb76e0a08a57652ea5fb4396d891e82c7fde2146fc8b636d202e68843cf4

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\msvcm80.dll

Filesize
468KB

MD5
cae6861b19a2a7e5d42fefc4dfdf5ccf

SHA1
609b81fbd3acda8c56e2663eda80bfafc9480991

SHA256
c4c8c2d251b90d77d1ac75cbd39c3f0b18fc170d5a95d1c13a0266f7260b479d

SHA512
c01d27f5a295b684c44105fcb62fb5f540a69d70a653ac9d14f2e5ef01295ef1df136ae936273101739eb32eff35185098a15f11d6c3293bbdcd9fcb98cb00a9

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\redirector.exe

Filesize
126KB

MD5
ed7fb962f5ea840c27df60ae4346a913

SHA1
ffd119911522da5a0d8b39a9841757aeed72e6cc

SHA256
60fe7fd0d5736011bccae74e41c5df05f993600e140058295eb413512001825e

SHA512
658996cc268768cccbdfbb1ba00f7db788190792e65536ff4f1965b73d61a69d4be7b2a449f068f9e6f3a1e7da9f3ef710c098fa4a077eba1f1d653c0bb61a9a

Download Submit
C:\Users\Admin\AppData\Local\Citrix\Receiver\WindowsAppRHelper_wfcrun32.exe.dll

Filesize
33KB

MD5
51fe311474569e76f99b767aad7b0a4f

SHA1
2c9750aeca960013ac0571220ae26650c9b8e338

SHA256
9eac0362a5751cf962f023c83b4125829280cda28df5e738582dbad16249e754

SHA512
26424f8ca5c2447ca5f3617dfeb819be5af802070db4539d88798aaafec0e6403d2ffb34c502436c92a15c05d5bbe7a9a7506e30bf60021747f59e3e2d22e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE590.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\CitrixHDXMediaStreamForFlash-ClientInstall.msi

Filesize
1.6MB

MD5
6ee2f92781a08761a03b2c9b8108ad5b

SHA1
193e8fbaa803b8d61dcbfc47ff59cbe2883115c2

SHA256
3abe4dedd5a3baf35e2b50177ac384e4ad3dec00c9c052a1f036f2ff4a06c78f

SHA512
ed2d4bc361fc94bd2109d703ace4988af035df1831c1785708ec620fb8119e1d16ce39b00b1bff98d3754a290400df1d49e88469052f860cbd23061b1f211597

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\DesktopViewer.msi

Filesize
1.2MB

MD5
ee20facd94bbb3295ca904213b82fd92

SHA1
901c3b3b8584c633926c2d418cb90abc18263323

SHA256
c1e4a6c9c27fcf43839f9d6b4ddaf5efa395dbb5027893491ac032d2816ee362

SHA512
8199caff272b6a72f3cb496ea58f7dbd1882cb8de09d00a1cc2e5a6c5b19391bb10cfb7f4f0bdeb086186930e62fcc84f003c98ab184446839cc55268797a90e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\GenericUSB.msi

Filesize
3.2MB

MD5
7c48d43b4230c794a065f2669a03c891

SHA1
89a713f8a0f2095d148bb9fcdc01ba1debf7f946

SHA256
fb3f75d9c2d2c502f9019f7c27ba6463d9aea27aafbccc55887fbf285819eb68

SHA512
7ea5fcc54c74385f0a69c58770a8fcee2908e1f8838fadea83c65ef4c8e0e87b764e076aa0319451074343883e7b546cfa2aeaef6e5daca4150ef7ced892a42c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\Global.xml

Filesize
3KB

MD5
952bdda83b498c4b35fc8317ec8692aa

SHA1
d9028679e6a81670991840cb3e965ca3811edaa3

SHA256
2a499a1376687f746d86b0fbd048f9b8a662c7beef6b5021dcfb51da461edb2e

SHA512
487f54bb28279e4259c7b75279aa3f1c08b519190bad84ec448153ead3fc8675def07e773b3a94f8bae8de397208052e7ed0b8deb43036509385ed5327c31879

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\HeaderLogo.bmp

Filesize
9KB

MD5
d5caff779c4d478676750e9936d4b8c6

SHA1
9c70fa0f942156dee25e2c47fb7aae7b1613eb4e

SHA256
5af6f987391efcc8204689735be40ec53b6a655c702a4bf0226c484b2afdabb2

SHA512
b0e463dad79b2a76ef5003470a7076c335c97dbe063373bba9d416fd7b7be5ca35e271ae0f472000c515e71080a0e0f3dd957a01f379809217716e3867a784f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\ICAWebWrapper.msi

Filesize
10.4MB

MD5
28bb0696352c4dd1d76c2523ddc7ac58

SHA1
ae67b2e04084d4dac455a11b7f981df9e9fac596

SHA256
bd9b6b9f9dc6cf3a254ed33693c2a8aec4bca1dfe82f3f3639fd7dbffdca49ac

SHA512
1d7d83af9cade45fff88c3d427fe0156923a550fea1d4329780859b9349251cba1ae9badd5d657ab1aec7328ed5bc0f637853be18884198db664b0e0b0d989a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\Localized_en.xml

Filesize
4KB

MD5
d297aa58b7abaec3529a88ced5ef14e9

SHA1
811dde73f4f0ad8ae2baf94e768d836359068e73

SHA256
102043a8272134e0584d705857e6f3d24349dc673c17932e09eb737bc38fc3aa

SHA512
abdc5d66cb3aeb5072d3eb15907109cd8b66cf37c75301e6934d4020ae626ad3c5f1a55ba22cf6a756b859e87ac6cbe2e5813c045b7189b12f89b46b4beca33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\PNAWrapper.msi

Filesize
2.1MB

MD5
dd44e1bdd6c4420459cd3206eb025647

SHA1
aa8b503f5a2a98b5bb467e90ab975911729914cc

SHA256
e2ab5100648198e7308eb71596addc023723caab5ed415d8602da64bd81f9604

SHA512
fa6a791601864c6e70b10a6649c984bcd728a84e545eddd21cbcc1859470236d1841e7692bcc9e13cd3e8d019c1e3751be4dc7b3083bf185163fe28242a35c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\RIInstaller.msi

Filesize
9.5MB

MD5
358b2d433986a553cf7d92b29c20aa59

SHA1
7c87f4a3bca822c7790fe9b97a062099096481de

SHA256
eb2fbc6eb9850d41b711065f44a1329d630ee69bd2017ceeac305f0c0f8bb5ed

SHA512
a1bcac69c40c80a4f026bcaafbf246c105aaf24571aca017c9c7941cc88037b5c6dcd0c7f057b6d19d324136b1a04d0ff7c3db9ec357bd30a75fd60d20b9e3fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\SSONWrapper.msi

Filesize
1.9MB

MD5
e7f487520e5bb8ec30723c027ee1fa4a

SHA1
e2d11add3a4e1aa32e5bc35b0b46887eb1fa8f2c

SHA256
9333d6af4f6c5519674ee636178e8dfd91aa9eba55b960abc3b3e0ee1ed1c421

SHA512
49555e9a5b52e8c0a2b0690b22e40f1931b858cbf8f7b2d7738befc94620e62629d3ebc5b0160caf211f4e09bd9118466886127d0cbd8ecf7c647efe88da681a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\SideBarBackground.bmp

Filesize
53KB

MD5
12066b3231497c8a718fbd935c6ce73c

SHA1
289a97128c559a95b1a2ce5a5bbe6d9535653fff

SHA256
d6b627a2f446f5cd0765c82b1fd2e417e36e1f82c1a57bcb3ca61a82f8bcf74c

SHA512
3f721bf423574a48a820fcaa66545169b6dd648b32557750cd0cf99185d6871f84bdc2350a0901fda9b1322a36aaf560eab4f41aec9d3ee3251da949de9293ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\Vd3dClient.msi

Filesize
887KB

MD5
854703d051674c8f9bac2475e229229f

SHA1
8e78b578f511405d8a710283207b205552cbbc4f

SHA256
fa808d409f5c0ead5b19cd6b328e1b15f66ae9282e91ae7dedb75331f197c773

SHA512
bc11b645bf3177f058f31d7978f49923eff2040e1db9b74ddc63bd1abe82c5ac1fa2d2b21d70ef8d146609af3e0095f8c1d82ce0375c55b703ffb35bdc34a5a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CtxInstall-ICAWebWrapper.log

Filesize
2KB

MD5
db211310d522b5f93220a4e375e81941

SHA1
4c5e81fb313dff2b6cf127e943565a42b9590053

SHA256
8a84c0dd9cfdb6c82b099a6547d0c74a79b7d65921421b8022f53a1fc2444774

SHA512
7c3f8bb81000d63a1956b110a7af9b933cdee66db2f8a65b22981d5ad275b5bfe8d3190f7032ef9f1f2a5dba0460bd61fd2850bf7bab8c5a59d388e7c7b82a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CtxInstall-RIInstaller.log

Filesize
2KB

MD5
e3ad922917f52301889819d0b9fba00c

SHA1
79aa94d59898c341c51a278e159dd4c53ee32bb4

SHA256
5539e3c0d9796a27ccb79dea9bfabe07367fea34b5ea7a218f875dab7b9f909e

SHA512
f26b55981875dd5f581bc38becd14379c8b0d182b01dc8e761f1ca43b2797276ef402096ef5b7403b18fa3e35c2b9c84a2484375d266e937162ffa5c751c0b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5B3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\ICAClient\APPSRV.INI

Filesize
1KB

MD5
1fbbe898b846a85ae01e5b3b4c354c08

SHA1
b92715d8ff8e42b948b71faeb58af6d083c09006

SHA256
2112139e080dd5c0a818db7c591187772ef3ebe3d13c821d60a42de6cf17bebf

SHA512
a2caba2e930c700a55eadc09168603f33289fbda14c732c5bccaf2e1b49b73ce9b41d52bbdc412b67680c793d11904104fbe83cf4dc7819b8fdd5c7c89996f98

Download Submit
C:\Windows\Installer\MSI1D25.tmp

Filesize
230KB

MD5
343fbdef61350969469a5e71c511c37a

SHA1
a28ecd20c5aca00e9cb693613ef6c2d0c788f4b5

SHA256
7e4c9d20275338014f9827ea5ebdc374c02bb43d71c5ec2c265b6be3d4113710

SHA512
c7fd20042858ae4e9ea139f2f09c3113f3105025b88072aea32b1222cc187f12d98111f5f1a01f1dc1be5d9a318aee11b62ab787f62d2ee7ad249741c13a22fd

Download Submit
C:\Windows\Installer\MSI20F2.tmp

Filesize
326KB

MD5
0ef8fede1958b73e964186f1b10a5b47

SHA1
68c11c80b6c2d1e4ff15b02719b6d2bbd938f014

SHA256
0d19ea5aa7e0bc5d3e1ea1668ea10ea2446750fd05fe0ee58f6674a0f38202fc

SHA512
a06208b1ae726a24ff37c3271ec83c79551172d573bc53fdf8d6ac1c3cf793426704179a8376c6842841ed55da1807fb0085895324bb7a0e14574703b7a08952

Download Submit
C:\Windows\Installer\MSI22B9.tmp

Filesize
214KB

MD5
ff1f2350af2e48970db5c98cfb646094

SHA1
00b77ef5975bfb418176310e5424840b7da4a38e

SHA256
a981bcea8a9c91acb2373746accb03e4a910843d687460420073b9fef8ee84bd

SHA512
868368ae94355ccddc51f358c78af9699177bacf360c09f94e21342b188a376912cb4003ee7578031f035308123580c8161a22a21b2c23990e649c7f1d93ca3a

Download Submit
C:\Windows\Temp\OLD3572.tmp

Filesize
96KB

MD5
c20e2a7a29f06a69c40e949255257b01

SHA1
cd4dc057a52c52d0911d28be0c121882953d0def

SHA256
309044604363e563a32086770aeccd99c6bf20925e4eb404604e88e5393f5f6b

SHA512
b6be25b215bbf88d51016531a8f3e8368b2f4253c2b8f0468e05723619715fbb9b539f4c59be885a9e4b5d804b9b34485897ddc0bc7215682cc25b6127a3034f

Download Submit
\Program Files (x86)\Citrix\ICA Client\CCMSDK.dll

Filesize
126KB

MD5
87f20c71e9a429f7e5d1abe486025f0e

SHA1
0d2388d5ddaefaea8da4bc5dd5aa6f3f7f2327b2

SHA256
838873292ca958b2c05ca85ed228538cf46b21ccd83d241458a562bf1f445efe

SHA512
6be8a97c10489c92c36c12159e00365ca981748f9d52fbca634a17f8a44ad8dd979e169ccc7d8522350a2980b04a840b6999015bf2cc4324125b984a28df917a

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL.tmp

Filesize
124KB

MD5
b9080505b5cf07796e60e1f4d833138e

SHA1
18a223545e6c2af954f16eac8d4918c2b882b480

SHA256
04a57242c809df6cd3b363d6b4c6bbd94b5bd76d00e68388c4055a57f3c9037b

SHA512
7834879071bbddc0c934f32061b26559cba9ffccdb89a53b1ec203cf3ea924061f52bf08a1116e6b0b4602351aefcdf8119a2d336f9d19459d71599daa8cf700

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\TrolleyExpress.exe

Filesize
1.4MB

MD5
d3e06d69718c97ac5014457d2a80e07c

SHA1
de5f72caca6aec8643ee0245a2a01acebe269481

SHA256
7dcef0bf72093f42e0e3bb49d77939254fa77a742798bc0f7dafb819678b6898

SHA512
01cb5f57159d7eb9b6e1beac2340835d99f3cd3eefdf605ca548a1805a138aab9a14c5928fdf23f0466f714f4efae2116f2c1b3316b5d6f46ecb8feb9e75fe76

Download Submit
\Users\Admin\AppData\Local\Temp\Ctx-A3760150-08ED-47FE-808D-9F1B816CB3D0\Extract\TrolleyExpressUI_en.dll

Filesize
342KB

MD5
68beb883a565b203a7653a1e65ef26fe

SHA1
2c0a61c51b885c20259f32e1b2d6b8eeb0f87c22

SHA256
ffc0dfe7ee859a3665d7692633044ef89788be3145d43f3e4dd6868d0ed3e452

SHA512
a29044bf91b34015a25ce6ab673992537e2f1f2a17b09c861cac50cb72e887be3f8eda2612a3463749526cc9374e6fd6ce100096f9b646b6cebd6f1921262ebc

Download Submit
memory/564-708-0x00000000002E0000-0x000000000031B000-memory.dmp

Filesize
236KB

Download
memory/1988-732-0x0000000002120000-0x0000000002134000-memory.dmp

Filesize
80KB

Download
memory/1988-730-0x00000000020F0000-0x0000000002108000-memory.dmp

Filesize
96KB

Download
memory/1988-734-0x0000000003520000-0x000000000355B000-memory.dmp

Filesize
236KB

Download
memory/1988-727-0x0000000002D80000-0x0000000002E51000-memory.dmp

Filesize
836KB

Download
memory/1988-726-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/2104-122-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2104-111-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2104-109-0x00000000009D0000-0x000000000250D000-memory.dmp

Filesize
27.2MB

Download
memory/2104-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2104-1151-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2104-1156-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2104-1154-0x00000000009D0000-0x000000000250D000-memory.dmp

Filesize
27.2MB

Download
memory/2384-1040-0x0000000000570000-0x00000000005AB000-memory.dmp

Filesize
236KB

Download