floxif | b910a6ffaeeb982bdb88a390c554c327e3eeb65ad2157c66b21f271c6e72818f

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
Size

27.3MB
MD5

b5564521e7f0c7ef8ceefe141469e90f
SHA1

dbb2be0989e75f8d30b6cdd03b4ae1a9db2d7c03
SHA256

b910a6ffaeeb982bdb88a390c554c327e3eeb65ad2157c66b21f271c6e72818f
SHA512

b1b8d40a40890cc4e56d885a2435075c638c48a706bd517b11a1e797a0c57890f4227c56df3b1daf793b7027634f70d5e69b9191929b1dca5c1ac76c581296ca
SSDEEP

393216:dYnK/WGHjJIhMeoUzx3/g/WyUXM0rFfTAtZfeV3qyauJC5PL0IV8PRG/2Zze3qGo:2mHleVx3/2EbAOV3qc05TRVwc/0CfNA

Score

10^/10

floxif backdoor defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000c000000023b29-1.dat	floxif

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ctxusbm.sys	usbinst.exe
File opened for modification	C:\Windows\system32\DRIVERS\ctxusbm.sys	usbinst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETF405.tmp	usbinst.exe
File created	C:\Windows\system32\DRIVERS\SETF405.tmp	usbinst.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b29-1.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	concentr.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
2772	TrolleyExpress.exe
2708	redirector.exe
2776	icaconf.exe
1088	SetIntegrityLevel.exe
3304	concentr.exe
2560	SetIntegrityLevel.exe
4912	Receiver.exe
2716	wfcrun32.exe
2928	concentr.exe
2912	usbinst.exe
2796	usbinst.exe

Loads dropped DLL 64 IoCs

pid	Process
2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2772	TrolleyExpress.exe
2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
3448	MsiExec.exe
3448	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
1728	MsiExec.exe
1728	MsiExec.exe
1728	MsiExec.exe
2708	redirector.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2796	rundll32.exe
2776	icaconf.exe
2776	icaconf.exe
2776	icaconf.exe
2776	icaconf.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
3304	concentr.exe
4912	Receiver.exe
1728	MsiExec.exe
4912	Receiver.exe
1728	MsiExec.exe
4912	Receiver.exe
4912	Receiver.exe
1728	MsiExec.exe
4912	Receiver.exe
4912	Receiver.exe
4912	Receiver.exe
4912	Receiver.exe
4912	Receiver.exe
4912	Receiver.exe
4912	Receiver.exe
4912	Receiver.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConnectionCenter = "\"C:\\Program Files (x86)\\Citrix\\ICA Client\\concentr.exe\" /startup"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	usbinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	usbinst.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
19	1092	msiexec.exe
21	1092	msiexec.exe
25	1092	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	TrolleyExpress.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	TrolleyExpress.exe
File opened (read-only)	\??\E:	TrolleyExpress.exe
File opened (read-only)	\??\H:	TrolleyExpress.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	TrolleyExpress.exe
File opened (read-only)	\??\Y:	TrolleyExpress.exe
File opened (read-only)	\??\Z:	TrolleyExpress.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	TrolleyExpress.exe
File opened (read-only)	\??\T:	TrolleyExpress.exe
File opened (read-only)	\??\K:	TrolleyExpress.exe
File opened (read-only)	\??\O:	TrolleyExpress.exe
File opened (read-only)	\??\U:	TrolleyExpress.exe
File opened (read-only)	\??\V:	TrolleyExpress.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\e:	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
File opened (read-only)	\??\B:	TrolleyExpress.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	TrolleyExpress.exe
File opened (read-only)	\??\S:	TrolleyExpress.exe
File opened (read-only)	\??\R:	TrolleyExpress.exe
File opened (read-only)	\??\X:	TrolleyExpress.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	TrolleyExpress.exe
File opened (read-only)	\??\J:	TrolleyExpress.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	TrolleyExpress.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	TrolleyExpress.exe
File opened (read-only)	\??\L:	TrolleyExpress.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b29-1.dat	upx
behavioral2/memory/2468-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2468-79-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2468-623-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2468-1066-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ko\npicanUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Citrix\WindowsAppRHelper.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\Xerces-c_3_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\ctxlogUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ja\icalogUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\ProgressNotificationCommonUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\en\wfcrunUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\WindowsAppRHelper90.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ja\ctxlogUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\nrhttpUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ko\sslsdkUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\icadlgUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\icalogUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\XPSPrintHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\wficaUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\mfc80u.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\ko\ConfigurationWizard.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\icadlgUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\statuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ja\vdcdm3UI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\concentr.chm	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\statuin.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\concenUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\x64\msvcp80.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ko\icafilesigningUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\en\License.txt	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\MFC80ESP.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\wfcrunUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\CtxDSEndpoints.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\vdzlcnUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\ctxmuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\icadlgn.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-TW\icafilesigningUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\zh-TW\ConfigurationWizard.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\CCMSDK.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\concentr.chm	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\concentr.chm	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\cstUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\neHttpN.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-TW\vdzlcnUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\CPViewUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\MFC80CHS.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\statuiUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\fr\wfcrunUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-TW\concenUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\icalogUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFCLOC.manifest	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\rstnhook.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\ru\vdcdm3UI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\vdgusbn.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\PrefPanel.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\ctxmui.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\MFC80FRA.dll	msiexec.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\en\icafilesigningUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\icavern.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\zh-CN\migratUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\fr\PrefPanel.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\x64\ssonstub.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\de\acrdlgUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\resource\es\statuiUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Citrix\ICA Client\MFC80CHT.dll	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbr\ctxusbr.cat	msiexec.exe
File created	C:\Program Files (x86)\Citrix\ICA Client\Receiver\ConfigurationWizard.exe.config	msiexec.exe

Drops file in Windows directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICF19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE91E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID50F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b707.msi	msiexec.exe
File created	C:\Windows\Installer\e57b70c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID811.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b702.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID365.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID481.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b6fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF2A.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b702.msi	msiexec.exe
File created	C:\Windows\Installer\e57b707.msi	msiexec.exe
File created	C:\Windows\Installer\e57b70b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{7BD3DC6D-A2BE-4345-B6EE-D146193DB18F}\liteico.exe.827545C6_7013_4DE1_8E6C_DAEE4C57F54A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b6fc.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9D431014-9F90-4335-A58E-8A14B0BD77F1}	msiexec.exe
File created	C:\Windows\Installer\e57b706.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D0992620-D8C1-4C65-ABD7-56E217415791}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC4A.tmp	msiexec.exe
File created	C:\Windows\Installer\{7BD3DC6D-A2BE-4345-B6EE-D146193DB18F}\liteico.exe.827545C6_7013_4DE1_8E6C_DAEE4C57F54A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE92F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b70c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID326.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{9D431014-9F90-4335-A58E-8A14B0BD77F1}\Receiver.5A09B6C6_C238_4B5F_A9E1_AFF142EFAE23.Shortcut	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID54F.tmp	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	usbinst.exe
File opened for modification	C:\Windows\Installer\MSID1CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF132.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID413.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCE5.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7BD3DC6D-A2BE-4345-B6EE-D146193DB18F}	msiexec.exe
File created	C:\Windows\Installer\{9D431014-9F90-4335-A58E-8A14B0BD77F1}\Receiver.5A09B6C6_C238_4B5F_A9E1_AFF142EFAE23.Shortcut	msiexec.exe
File created	C:\Windows\Installer\e57b700.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE41B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEECF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3068513C-3AAC-410B-BAE7-C7837FFF8DEB}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF29A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID21A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3CC.tmp	msiexec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4256	rundll32.exe
2796	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	concentr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	redirector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetIntegrityLevel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetIntegrityLevel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Receiver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfcrun32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	concentr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrolleyExpress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaconf.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}\AppName = "wfcrun32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}\AppPath	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98d6e2ad-7673-4742-8b34-6d327771a66d}\Policy	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy\WpadHost	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveReadAccessG	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathT	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveWriteAccessU	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress8	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Session Sharing\SessionSharingName	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Protocols	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy\ProxyUseDefault = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Multimedia\SpeedScreenMMAAudioEnabled = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Control\CREnabled = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey2Char	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Proxy\ProxyFallback = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DriveWriteAccessF	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathG	icaconf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\Trusted Region\OverrideInvalidICAParameters = "1"	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\HttpBrowserAddress	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathZ	icaconf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\Unknown Region\Version Maximum = "10100"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\LocHttpBrowserAddress2	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Application Launching\LongCommandLine000	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathU	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathW	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort16	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\End User Experience\startSCD	icaconf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runonce.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\LocHttpBrowserAddress8	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\ClientSelectiveTrust	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Client Update\UpdatesAllowed = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\SFRAllowed = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey13Char	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\SSOnDetected = "*"	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort6	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort28	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\BrowserRetry = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Application Launching\LongCommandLine004	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\ICA File\Launcher	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort26	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\Compression\Compress = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Seamless Windows\TopMostonFullScreen = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Control\AllowHotKey = "*"	icaconf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\Untrusted Region\EnableLockdown = "0"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\LocHttpBrowserAddress4	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Session Sharing\SessionSharingKey	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey8Char	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Serial Port\Device\ComPort21	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses\LocHttpBrowserAddress12	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\Ticket\LogonTicket	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Audio\AudioBandwidthLimit = "*"	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\Drives\Device\DrivePathD	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\SSL\SSLCACert5	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Application Browsing\HTTP Addresses	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey15Char	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Network\SSL\SSLCACert4	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\Untrusted Region\Lockdown	icaconf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\GUI\CursorStipple	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Client Engine\Hot Keys\Hotkey14Char	icaconf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Logon\Kerberos	icaconf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Citrix\ICA Client\Engine\Lockdown Profiles\All Regions\Lockdown\Virtual Channels\End User Experience\endIFDCD	icaconf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{238F6F80-B8B4-11CF-8771-00A024541EE3}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24013613-FF51-4B50-9832-37FA561594ED}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ica	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ica; charset=MS936\CLSID = "{238F6F83-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/x-ica; charset=euc-jp\CLSID = "{CFB6322E-CC85-4d1b-82C7-893888A236BC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IcaMimeFilter.IcaMimeFilterPP\CurVer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\410134D909F953345AE8A8410BDB771F\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3D3FCA3F-FA3F-4ACB-A793-DF6FFACC991A}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinFrameICA\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17BFCA0A-C42E-4AC9-A693-29473FF9BA6C}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D6CD3DB7EB2A54346BEE1D6491D31BF8\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{238F6F83-B8B4-11CF-8771-00A024541EE3}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2356A355-6B99-4BA0-9CBF-6C13789A9887}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B371833-5E4F-4B72-A8F6-CB8E762999F4}\ = "IWindows"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1EFF7739-9BDA-4295-BC07-383554CAAC84}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02093274-7B69-4FEB-B7FD-3A010561A5F3}\TypeLib\ = "{238F6F80-B8B4-11CF-8771-00A024541EE3}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/x-ica;charset=MS949\ = "IcaMimeFilter MIME Filter"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4D5D2139-29E2-4CDC-8020-429B35999BE6}\TypeLib\Version = "2.9"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02093274-7B69-4FEB-B7FD-3A010561A5F3}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F2D9E63-D224-47E4-8111-32DBB016A4C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ica; charset=UTF-8\CLSID = "{238F6F83-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D5D2139-29E2-4CDC-8020-429B35999BE6}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{239D08F9-0EC1-43F1-96D9-D11C3FB10A8E}\ProxyStubClsid32\ = "{1EFF7739-9BDA-4295-BC07-383554CAAC84}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1EFF7739-9BDA-4295-BC07-383554CAAC84}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{010A6A8D-FABF-4183-B6B5-381543AE77D5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0262990D1C8D56C4BA7D652E71147519\SourceList\PackageName = "SSONWrapper.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24FD31DB-3560-4C78-8950-30F03352D830}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\410134D909F953345AE8A8410BDB771F\ProductName = "Citrix Receiver Inside"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PROTOCOLS\Filter\application/x-ica	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C45B7921-9578-4E38-92B1-18346DA5B84B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{238F6F81-B8B4-11CF-8771-00A024541EE3}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49813E6D-17FF-41A1-9A7B-95C3D5B44185}\ = "_IWindowEvents"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.9\CLSID\ = "{238F6F83-B8B4-11CF-8771-00A024541EE3}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.3\ = "Citrix ICA Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/x-ica;charset=euc-jp\ = "IcaMimeFilter MIME Filter"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.8\ = "Citrix ICA Client"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{ABCAD60C-D071-4683-AC98-50AEB736B2A2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{238F6F83-B8B4-11CF-8771-00A024541EE3}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C43C22AF-CC33-43c0-9E0E-E843087AE46C}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}\ProxyStubClsid32\ = "{1EFF7739-9BDA-4295-BC07-383554CAAC84}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F2D9E63-D224-47E4-8111-32DBB016A4C6}\TypeLib\ = "{238F6F80-B8B4-11CF-8771-00A024541EE3}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A502C16-CFAE-4BB0-B1F9-93ACADDA57BB}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Citrix.ICAClient.2.6\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABCAD60C-D071-4683-AC98-50AEB736B2A2}\ = "IEvents_PrivateICO"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{785A16E9-4E42-4C87-84AD-BFB4A60570A3}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3B51AEAB9772D194785CD20C5CC1F35F\0262990D1C8D56C4BA7D652E71147519	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{238F6F85-B8B4-11CF-8771-00A024541EE3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Citrix.ICAClient.2.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAE32A9F-DC07-4EE1-8EB1-944E060694F4}\ = "IConnectionCtrl_PrivateICO"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{238F6F81-B8B4-11CF-8771-00A024541EE3}\ = "IICAClient"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B371833-5E4F-4B72-A8F6-CB8E762999F4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\CDViewer.exe\IsHostApp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91602FD4-080E-44E5-BC6C-7AEBB7C36F2D}\ = "IEvents_VirtualChannel"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBACA88C-FA22-4B27-9F2A-7A0517227FE3}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17BFCA0A-C42E-4AC9-A693-29473FF9BA6C}\ = "IKeyboard"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC}\TypeLib\ = "{C43C22AF-CC33-43c0-9E0E-E843087AE46C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{ABCAD60C-D071-4683-AC98-50AEB736B2A2}\ProxyStubClsid32	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E63F16AA-7C16-4697-826C-98B7A5092299}\AccessPermission = 010004803000000040000000000000001400000002001c000100000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PROTOCOLS\Filter\application/x-ica; charset=MS936	msiexec.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2772	TrolleyExpress.exe
2772	TrolleyExpress.exe
2772	TrolleyExpress.exe
2772	TrolleyExpress.exe
2772	TrolleyExpress.exe
2772	TrolleyExpress.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
1092	msiexec.exe
228	MsiExec.exe
228	MsiExec.exe
1092	msiexec.exe
1092	msiexec.exe
2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
Token: SeSecurityPrivilege	1092	msiexec.exe
Token: SeCreateTokenPrivilege	2772	TrolleyExpress.exe
Token: SeAssignPrimaryTokenPrivilege	2772	TrolleyExpress.exe
Token: SeLockMemoryPrivilege	2772	TrolleyExpress.exe
Token: SeIncreaseQuotaPrivilege	2772	TrolleyExpress.exe
Token: SeMachineAccountPrivilege	2772	TrolleyExpress.exe
Token: SeTcbPrivilege	2772	TrolleyExpress.exe
Token: SeSecurityPrivilege	2772	TrolleyExpress.exe
Token: SeTakeOwnershipPrivilege	2772	TrolleyExpress.exe
Token: SeLoadDriverPrivilege	2772	TrolleyExpress.exe
Token: SeSystemProfilePrivilege	2772	TrolleyExpress.exe
Token: SeSystemtimePrivilege	2772	TrolleyExpress.exe
Token: SeProfSingleProcessPrivilege	2772	TrolleyExpress.exe
Token: SeIncBasePriorityPrivilege	2772	TrolleyExpress.exe
Token: SeCreatePagefilePrivilege	2772	TrolleyExpress.exe
Token: SeCreatePermanentPrivilege	2772	TrolleyExpress.exe
Token: SeBackupPrivilege	2772	TrolleyExpress.exe
Token: SeRestorePrivilege	2772	TrolleyExpress.exe
Token: SeShutdownPrivilege	2772	TrolleyExpress.exe
Token: SeDebugPrivilege	2772	TrolleyExpress.exe
Token: SeAuditPrivilege	2772	TrolleyExpress.exe
Token: SeSystemEnvironmentPrivilege	2772	TrolleyExpress.exe
Token: SeChangeNotifyPrivilege	2772	TrolleyExpress.exe
Token: SeRemoteShutdownPrivilege	2772	TrolleyExpress.exe
Token: SeUndockPrivilege	2772	TrolleyExpress.exe
Token: SeSyncAgentPrivilege	2772	TrolleyExpress.exe
Token: SeEnableDelegationPrivilege	2772	TrolleyExpress.exe
Token: SeManageVolumePrivilege	2772	TrolleyExpress.exe
Token: SeImpersonatePrivilege	2772	TrolleyExpress.exe
Token: SeCreateGlobalPrivilege	2772	TrolleyExpress.exe
Token: SeCreateTokenPrivilege	2772	TrolleyExpress.exe
Token: SeAssignPrimaryTokenPrivilege	2772	TrolleyExpress.exe
Token: SeLockMemoryPrivilege	2772	TrolleyExpress.exe
Token: SeIncreaseQuotaPrivilege	2772	TrolleyExpress.exe
Token: SeMachineAccountPrivilege	2772	TrolleyExpress.exe
Token: SeTcbPrivilege	2772	TrolleyExpress.exe
Token: SeSecurityPrivilege	2772	TrolleyExpress.exe
Token: SeTakeOwnershipPrivilege	2772	TrolleyExpress.exe
Token: SeLoadDriverPrivilege	2772	TrolleyExpress.exe
Token: SeSystemProfilePrivilege	2772	TrolleyExpress.exe
Token: SeSystemtimePrivilege	2772	TrolleyExpress.exe
Token: SeProfSingleProcessPrivilege	2772	TrolleyExpress.exe
Token: SeIncBasePriorityPrivilege	2772	TrolleyExpress.exe
Token: SeCreatePagefilePrivilege	2772	TrolleyExpress.exe
Token: SeCreatePermanentPrivilege	2772	TrolleyExpress.exe
Token: SeBackupPrivilege	2772	TrolleyExpress.exe
Token: SeRestorePrivilege	2772	TrolleyExpress.exe
Token: SeShutdownPrivilege	2772	TrolleyExpress.exe
Token: SeDebugPrivilege	2772	TrolleyExpress.exe
Token: SeAuditPrivilege	2772	TrolleyExpress.exe
Token: SeSystemEnvironmentPrivilege	2772	TrolleyExpress.exe
Token: SeChangeNotifyPrivilege	2772	TrolleyExpress.exe
Token: SeRemoteShutdownPrivilege	2772	TrolleyExpress.exe
Token: SeUndockPrivilege	2772	TrolleyExpress.exe
Token: SeSyncAgentPrivilege	2772	TrolleyExpress.exe
Token: SeEnableDelegationPrivilege	2772	TrolleyExpress.exe
Token: SeManageVolumePrivilege	2772	TrolleyExpress.exe
Token: SeImpersonatePrivilege	2772	TrolleyExpress.exe
Token: SeCreateGlobalPrivilege	2772	TrolleyExpress.exe
Token: SeCreateTokenPrivilege	2772	TrolleyExpress.exe
Token: SeAssignPrimaryTokenPrivilege	2772	TrolleyExpress.exe
Token: SeLockMemoryPrivilege	2772	TrolleyExpress.exe
Token: SeIncreaseQuotaPrivilege	2772	TrolleyExpress.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4912	Receiver.exe
4912	Receiver.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4912	Receiver.exe
4912	Receiver.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	TrolleyExpress.exe
2772	TrolleyExpress.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe
2716	wfcrun32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2772	2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	83
PID 2468 wrote to memory of 2772	2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	83
PID 2468 wrote to memory of 2772	2468	2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe	83
PID 1092 wrote to memory of 3448	1092	msiexec.exe	89
PID 1092 wrote to memory of 3448	1092	msiexec.exe	89
PID 1092 wrote to memory of 3448	1092	msiexec.exe	89
PID 1092 wrote to memory of 4652	1092	msiexec.exe	94
PID 1092 wrote to memory of 4652	1092	msiexec.exe	94
PID 1092 wrote to memory of 4652	1092	msiexec.exe	94
PID 1092 wrote to memory of 1728	1092	msiexec.exe	97
PID 1092 wrote to memory of 1728	1092	msiexec.exe	97
PID 1092 wrote to memory of 1728	1092	msiexec.exe	97
PID 1092 wrote to memory of 536	1092	msiexec.exe	98
PID 1092 wrote to memory of 536	1092	msiexec.exe	98
PID 1092 wrote to memory of 536	1092	msiexec.exe	98
PID 1092 wrote to memory of 2708	1092	msiexec.exe	99
PID 1092 wrote to memory of 2708	1092	msiexec.exe	99
PID 1092 wrote to memory of 2708	1092	msiexec.exe	99
PID 1092 wrote to memory of 4256	1092	msiexec.exe	100
PID 1092 wrote to memory of 4256	1092	msiexec.exe	100
PID 4256 wrote to memory of 2796	4256	rundll32.exe	101
PID 4256 wrote to memory of 2796	4256	rundll32.exe	101
PID 4256 wrote to memory of 2796	4256	rundll32.exe	101
PID 2796 wrote to memory of 2776	2796	rundll32.exe	105
PID 2796 wrote to memory of 2776	2796	rundll32.exe	105
PID 2796 wrote to memory of 2776	2796	rundll32.exe	105
PID 1092 wrote to memory of 1088	1092	msiexec.exe	107
PID 1092 wrote to memory of 1088	1092	msiexec.exe	107
PID 1092 wrote to memory of 1088	1092	msiexec.exe	107
PID 1088 wrote to memory of 3304	1088	SetIntegrityLevel.exe	108
PID 1088 wrote to memory of 3304	1088	SetIntegrityLevel.exe	108
PID 1088 wrote to memory of 3304	1088	SetIntegrityLevel.exe	108
PID 1092 wrote to memory of 2560	1092	msiexec.exe	109
PID 1092 wrote to memory of 2560	1092	msiexec.exe	109
PID 1092 wrote to memory of 2560	1092	msiexec.exe	109
PID 3304 wrote to memory of 4912	3304	concentr.exe	110
PID 3304 wrote to memory of 4912	3304	concentr.exe	110
PID 3304 wrote to memory of 4912	3304	concentr.exe	110
PID 1092 wrote to memory of 228	1092	msiexec.exe	112
PID 1092 wrote to memory of 228	1092	msiexec.exe	112
PID 1092 wrote to memory of 228	1092	msiexec.exe	112
PID 2716 wrote to memory of 2928	2716	wfcrun32.exe	114
PID 2716 wrote to memory of 2928	2716	wfcrun32.exe	114
PID 2716 wrote to memory of 2928	2716	wfcrun32.exe	114
PID 1092 wrote to memory of 4344	1092	msiexec.exe	115
PID 1092 wrote to memory of 4344	1092	msiexec.exe	115
PID 1092 wrote to memory of 4948	1092	msiexec.exe	116
PID 1092 wrote to memory of 4948	1092	msiexec.exe	116
PID 1092 wrote to memory of 4948	1092	msiexec.exe	116
PID 1092 wrote to memory of 4564	1092	msiexec.exe	117
PID 1092 wrote to memory of 4564	1092	msiexec.exe	117
PID 1092 wrote to memory of 4564	1092	msiexec.exe	117
PID 4564 wrote to memory of 2912	4564	MsiExec.exe	118
PID 4564 wrote to memory of 2912	4564	MsiExec.exe	118
PID 2912 wrote to memory of 384	2912	usbinst.exe	120
PID 2912 wrote to memory of 384	2912	usbinst.exe	120
PID 384 wrote to memory of 1900	384	runonce.exe	121
PID 384 wrote to memory of 1900	384	runonce.exe	121
PID 4564 wrote to memory of 2796	4564	MsiExec.exe	122
PID 4564 wrote to memory of 2796	4564	MsiExec.exe	122
PID 2796 wrote to memory of 4400	2796	usbinst.exe	124
PID 2796 wrote to memory of 4400	2796	usbinst.exe	124
PID 4400 wrote to memory of 3584	4400	runonce.exe	125
PID 4400 wrote to memory of 3584	4400	runonce.exe	125

C:\Users\Admin\AppData\Local\Temp\2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\TrolleyExpress.exe
  C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\TrolleyExpress.exe "C:\Users\Admin\AppData\Local\Temp\2024-12-23_b5564521e7f0c7ef8ceefe141469e90f_floxif_magniber.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E47216B638674DFBD464758C18E362C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1D7CA3DABF1F45CCA18AFC0FC071C4C9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68BC561BF0B5B3A1FC973B999A2F53CF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8F0A95CB62A2E04B0461A4E90CA7F184 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:536
- C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
  "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /regserver
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\Windows\system32\rundll32.exe
  rundll32.exe icaconfs.dll, ApplyConfigurationA import --replace -f -all "C:\Program Files (x86)\Citrix\ICA Client\Configuration" --RunAsAdmin
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe icaconfs.dll, ApplyConfigurationA import --replace -f -all "C:\Program Files (x86)\Citrix\ICA Client\Configuration" --RunAsAdmin
    3⤵
    - Loads dropped DLL
    - Access Token Manipulation: Create Process with Token
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Program Files (x86)\Citrix\ICA Client\icaconf.exe
      "C:\Program Files (x86)\Citrix\ICA Client\icaconf.exe" import --replace -f -all "C:\Program Files (x86)\Citrix\ICA Client\Configuration"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:2776
- C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe
  "C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe" $concentr.exe /startup$M$2772
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
    concentr.exe /startup
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
      "C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe" -autoupdate -startplugins
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4912
- C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe
  "C:\Program Files (x86)\Citrix\ICA Client\SetIntegrityLevel.exe" $redirector.exe /startup$M
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0ECA7F463FA31A3E289218A733C1927B
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\Citrix\ICA Client\x64\ssonstub.dll"
  2⤵
  PID:4344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F73ECEE2BEEE1D423F0BEAA0899ECF30 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E195E5BAEBBD5C56705EAED6597DD20B E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe
    "C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe" InstallHinfSection "DefaultInstall 128 C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbm\ctxusbm.inf"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:384
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:1900
- - C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe
    "C:\Program Files (x86)\Citrix\ICA Client\Drivers64\usbinst.exe" InstallHinfSection "DefaultUninstall 128 C:\Program Files (x86)\Citrix\ICA Client\Drivers64\ctxusbm\ctxusbm.inf"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:3584

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
"C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
  "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b6ff.rbs

Filesize
23KB

MD5
35a5478e6d9cbb928f9dadb062759d92

SHA1
45196923c5dbc57e6f82e7d61e1d84f539a5d80e

SHA256
f736187e5b5dd1903497a4d919ee8d8ea59c809f2014e83e7e310f4f109fe0ab

SHA512
059cd268cb9db401dc047b8606cf800101793f57a27e8c53e507c5d0fe1d4fd34a38cdfee7a32500a4a43fd96c04143dcaabc49d0aedc649fef2ec6b7f994205

Download Submit
C:\Config.Msi\e57b701.rbs

Filesize
454B

MD5
7c00da950d044777e6d636bf250fd0da

SHA1
660f5ec8847a508af175b38ba05a984557ce434b

SHA256
0fa18204a6a41e6560b94267adc27f160a614d40acb71abe634c0b322c1110b8

SHA512
df7be2726b58999e213896321027131778c0ec6337bdc7dca8db4ecf43951429d4204240e7796772a2c64d17a290d217d6672ae094313d28f0d0e75a66561da8

Download Submit
C:\Config.Msi\e57b705.rbs

Filesize
794KB

MD5
1720985c31506e6f9b3023ba96f739b6

SHA1
b37acaece7139d29071b6b63a41f638c153289b3

SHA256
b5115b183832d2fa6c3678db35a9a3dfc04f891188a28fcb86aa1babba0b4cd5

SHA512
36d847a2c2e9bef95e3670af6bbfdc03e4ba874d792be57aa6427e0c7c2d2a1efeeb7b1e86d3e96dfab51cc2af21f840df1ef43cb104a35a3d036464d5761644

Download Submit
C:\Config.Msi\e57b70a.rbs

Filesize
93KB

MD5
8b7e95c842a24e6cf7fa365457f0aca2

SHA1
b2984ad0813b40cd4592fd20f0c07ee92d942fda

SHA256
80a44b4b4c4a078309720da4f36ed4e9c7d7145fcf983fcc0ffd0d115973ca0f

SHA512
fbcaf1eedb209ac476e0bc2b700bcee6767f2218b0bc6c0c8fdf6d839e34aa5af2ac8f9e0da708e770cf5d9d1abdc668a3b011a5a0448b21f32571dc7baf57b7

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\CCMSDK.dll

Filesize
126KB

MD5
87f20c71e9a429f7e5d1abe486025f0e

SHA1
0d2388d5ddaefaea8da4bc5dd5aa6f3f7f2327b2

SHA256
838873292ca958b2c05ca85ed228538cf46b21ccd83d241458a562bf1f445efe

SHA512
6be8a97c10489c92c36c12159e00365ca981748f9d52fbca634a17f8a44ad8dd979e169ccc7d8522350a2980b04a840b6999015bf2cc4324125b984a28df917a

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Configuration\usertemplate\All_Regions.ini

Filesize
21KB

MD5
f701cccbbe12fad3992f2cfb8cf21000

SHA1
a1f273788f08890ace99e34faba1aa861cda34c4

SHA256
f8b519e0b27c559277a9d417a4b3d16c9758f2f416b97e18e9c987aa2711d22c

SHA512
ba6e21582048837a92b3a8009dc721b27e1c47d05d1c0132dc49e545d6d07cea2b14a59f973ef9a35a06a284c22610ffaef502b7350dafb3f005ff00388c9034

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80CHS.dll

Filesize
40KB

MD5
afa7e91c8c9566e03fb1620f95230b93

SHA1
75057a0e936032ec9cbc77559241720f58bfab84

SHA256
4eaf1750a573bab5c853e7714efcc84ff2fcf992ad935fd01af9e2a5bd01a93a

SHA512
b9c34166555f42d4a4e754131fd2868b4fc2965ac8519a6eeed8a32f6c67e1e6e5b4daa93175967f5f687d8333ca53c4d183a2177191a81bc01e89b7cbdc9bb3

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80CHT.dll

Filesize
44KB

MD5
2dca32742f80bb37e159b651f8eef44b

SHA1
dcd0265fbe8efd63c235ed4611aecc4b935c057c

SHA256
a7eaf2b5df991654500ffed95d3950a46dd0fe05cddcccd77490f125e22b80d6

SHA512
40e1533f6989955f537d556ab28ff0be44658309eef5d40093bf3fcec39ad85ea14bb2b880ff5c067ccfc257a35361c25aac087e0463bafe39fb265b8a0825ee

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80DEU.dll

Filesize
64KB

MD5
1e6719ebeb1d368e09899a9d0ddfad70

SHA1
fc510a6dbe0d9180f203af651e186979b628675f

SHA256
734eb909c54a0a1c53aa5177727660b1c64f3d261b222feaec76fc5853300661

SHA512
c5753b79d97204c130a2c0a46d7717e74c140d207a446918df113a6c460f538afe0a48af52360d8a501104283311667ce8dd23b4d3e65b7ee99939a791c25ad6

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80ENU.dll

Filesize
56KB

MD5
9090454e6772f7cfbce240bf4dc5f7e8

SHA1
3afd27af1fbb5d2efde463869a1e6465affbcdd8

SHA256
a532044dfd1fa6463516125ea74c250762de4dacbe613f8ad2ff72d50c0b9585

SHA512
4691138b2e32447a6300a17967c1221153b5b514ee0edcd25a135dce2a6eefea9cc7f3fc516a9b3482feb62dc190a7f4192bcf15d9793832f828078557e24cdf

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80ESP.dll

Filesize
60KB

MD5
d47599748b3ecf645c47caa0bc24a7cd

SHA1
2f47846b9308fe4b444363f0863f394a1b13c938

SHA256
10fd5eebe39acd996309da073b247b365cbc0f48f43da3062463ea9f712319ca

SHA512
30b0f056123657eaca8f97138e1ca5c2981575420938ee7ed645e4d62f2a159c011eff08c2ee20ac68504bd59d890dbc030718a9ba185871b07dee9851cf2608

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80FRA.dll

Filesize
60KB

MD5
eec2f9e4d790bccdbc542715ab613579

SHA1
8993e9f0cc4657e40866efba0cab7e077060cea8

SHA256
e283b055a0b9f522ff415b78f100542255aa07cb17c1eeb3885e75326d9dbc66

SHA512
89c083c820798872f3feecffccc1a5ccef9a367c8af2170ec06b04a64a234dd03cdfe250b31b5969f87caa8e7ea8393fbcbbcbf16d83c35105814501b6be08e8

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80ITA.dll

Filesize
60KB

MD5
cb23b162ac655f24c6711a5f5df348c6

SHA1
e4e0e803b9297b0937824c53f227598998229463

SHA256
6498ee1449b61b40e2dab46f0b3dfa15f17590d7aa87919580748ec9d4bc2c55

SHA512
460d235818cd83d9020a13f47b24aadc777e4bdc81a6387d8bb59daf37eaf930c70ace5e238fe2fa34491a03b3972f11a4bdb8d30ff98801acff82630b6d24a2

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80JPN.dll

Filesize
48KB

MD5
012031b19f0a9f6431997c79e1893822

SHA1
2265c92b3ed9ec169e2c362e448b0e3f449528a3

SHA256
ed296b3dd004c8845a7015a3a5ef3a92331e30535204a02995323681cbd342ab

SHA512
b4cca371481b349546ad09c40461258a99e5ad6cf7b66fe040a37f90071c420cc41e74f495141a490b4848b66da876ad8b91ac7c14a328cf5c4ccaadfd3e226e

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\MFC80KOR.dll

Filesize
48KB

MD5
fec4610f1174136b1d3db2ae37924ce8

SHA1
ba94e77bb29b9b74ea8e2a8fd005dc3083166f3c

SHA256
a6d0b3d20e67c26f7c247f2eeb8dba723b396b118a1b9eaa4568c474826ea740

SHA512
9144a0243e41ec17628a740913a745261346efa2dff3f61d48ccf186f30a1527f6a4f5cb3f7f7727d7bfd4103e9fc90cae1e0cefbc1d8d042218d9d2ea869a36

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.CRT.manifest

Filesize
1KB

MD5
541423a06efdcd4e4554c719061f82cf

SHA1
2e12c6df7352c3ed3c61a45baf68eace1cc9546e

SHA256
17ad1a64ba1c382abf89341b40950f9b31f95015c6b0d3e25925bfebc1b53eb5

SHA512
11cf735dcddba72babb9de8f59e0c180a9fec8268cbfca09d17d8535f1b92c17bf32acda86499e420cbe7763a96d6067feb67fa1ed745067ab326fd5b84188c6

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFC.manifest

Filesize
2KB

MD5
97b859f11538bbe20f17dfb9c0979a1c

SHA1
2593ad721d7be3821fd0b40611a467db97be8547

SHA256
4ed3ba814de7fd08b4e4c6143d144e603536c343602e1071803b86e58391be36

SHA512
905c7879df47559ad271dc052ef8ae38555eac49e8ac516bc011624bf9a622eb10ee5c6a06fbd3e5c0fa956a0d38f03f6808c1c58ee57813818fe8b8319a3541

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Microsoft.VC80.MFCLOC.manifest

Filesize
1KB

MD5
1d77377f1e874be0fb362e06a39d5167

SHA1
8088aec7cadc8396613b208a94338269dd6b25a8

SHA256
b072669158d28f4ae2db5feba220712f9fefc79b555be848534416b5b9a4e698

SHA512
8ad30ad3501d93a8979eea89b52ac8c9319e78deffa6bde3602e1be10d81b91af83cfc40a919a960e51263258599e495cf8ed09b074d29f541781f52f986461a

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\Wfica.ocx

Filesize
574KB

MD5
754d77bb79f53e77b69968e29fd9b44e

SHA1
1faf2e1f2ec00195c817338d6d274b6487483e7d

SHA256
3665325e356946de061ec035ce2c26239be467bd47c9007a8b0bf03f9df3da44

SHA512
183422f9df49fc0d30f571402afb5032caa0b759bba70c5aac558870848b5f4bc0fb82d81069a34f7f6224d3e582c8ea93c9d2fe6ef39dcf47244b5305d7f7f3

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\ctxlogging.dll

Filesize
23KB

MD5
2f8939a8cac217017790845d5d3e3060

SHA1
8510f91ed04d98c91920614044766aee82d9c88c

SHA256
e9baa0cc7275558d81bafb4392c96bff2972475e124d6ce91f76e7959f27a600

SHA512
f0a40707d4e86bc97c157144c5ec4809aa4c52fe97585be3f45e64a15a5d251c62acb8ad933b8c63d6074aeb02741673312142d9a7377783fe53f428d18418be

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\icaconfs.dll

Filesize
94KB

MD5
6c371186c6cedcafe82d72b3a8515e2e

SHA1
0c3a46b6bf923f1ede73adfcc8f0a987eaf47ac7

SHA256
3a1b4b4a7703a6c5ee19c8219a1c96a2e53b9b5e8ce44a3265783a31d8ebb2ce

SHA512
af1ffb113918af725b10b679112ea08664c19190abf558c3660e9111af406e3a2cab74358e3f0ecea798d9f6017dcd2b9bcc0707adf398c0f1b1d0e1e87810a8

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfc80.dll

Filesize
1.1MB

MD5
1b7524806d0270b81360c63a2fa047cb

SHA1
d688d77f0caa897e6ec2ed2c789e77b48304701f

SHA256
ceef5aa7f9e6504bce15b72b29dbee6430370baa6a52f82cf4f2857568d11709

SHA512
b34539fbda2a2162efa2f6bb5a513d1bb002073fa63b3ff85aa3ade84a6b275e396893df5ab3a0a215cade1f068e2a0a1bbd8895595e31d5a0708b65acec8c73

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfc80u.dll

Filesize
1.0MB

MD5
ccc2e312486ae6b80970211da472268b

SHA1
025b52ff11627760f7006510e9a521b554230fee

SHA256
18be5d3c656236b7e3cd6d619d62496fe3e7f66bf2859e460f8ac3d1a6bdaa9a

SHA512
d6892abb1a85b9cf0fc6abe1c3aca6c46fc47541dffc2b75f311e8d2c9c1d367f265599456bd77be0e2b6d20c6c22ff5f0c46e7d9ba22c847ad1cbedc8ca3eff

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfcm80.dll

Filesize
68KB

MD5
c84e4ece0d210489738b2f0adb2723e8

SHA1
63c1fa652f7f5bd1fccbe3618163b119a79a391c

SHA256
ed1dcdd98dac80716b2246d7760f0608c59e566424ac1a562090a3342c22b0a7

SHA512
3ee1da854e7d615fa4072140e823a3451df5d8bebf8064cc9a399dec1fb35588f2a17c0620389441ca9edd1944c9649002fe4e897c743fe8069b79a5aa079fe2

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\mfcm80u.dll

Filesize
56KB

MD5
ddad68e160c58d22b49ff039bb9b6751

SHA1
c6c3b3af37f202025ee3b9cc477611c6c5fb47c2

SHA256
f3a65bfc7fce2d93fdf57cf88f083f690bc84b9a7706699d4098d18f79f87aaa

SHA512
47665672627e34ad9ea3fd21814697d083eeeafc873407e07b9697c8ab3c18743d9fcb76e0a08a57652ea5fb4396d891e82c7fde2146fc8b636d202e68843cf4

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\msvcm80.dll

Filesize
468KB

MD5
cae6861b19a2a7e5d42fefc4dfdf5ccf

SHA1
609b81fbd3acda8c56e2663eda80bfafc9480991

SHA256
c4c8c2d251b90d77d1ac75cbd39c3f0b18fc170d5a95d1c13a0266f7260b479d

SHA512
c01d27f5a295b684c44105fcb62fb5f540a69d70a653ac9d14f2e5ef01295ef1df136ae936273101739eb32eff35185098a15f11d6c3293bbdcd9fcb98cb00a9

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\msvcp80.dll

Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\msvcr80.dll

Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
C:\Program Files (x86)\Citrix\ICA Client\redirector.exe

Filesize
126KB

MD5
ed7fb962f5ea840c27df60ae4346a913

SHA1
ffd119911522da5a0d8b39a9841757aeed72e6cc

SHA256
60fe7fd0d5736011bccae74e41c5df05f993600e140058295eb413512001825e

SHA512
658996cc268768cccbdfbb1ba00f7db788190792e65536ff4f1965b73d61a69d4be7b2a449f068f9e6f3a1e7da9f3ef710c098fa4a077eba1f1d653c0bb61a9a

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLMF.DLL.tmp

Filesize
139KB

MD5
3cae78b45147f81454e1d9d3489f6fc2

SHA1
d87b67d9115b621023544039746a0274ee1c15da

SHA256
119d24e7cb0dcd0e566f66bc402c3c26a7b6fd324752b77a5dec033f6f337bfe

SHA512
f1de12f5fc2dcafc55e7106e061cffedb18f6ea25aaf05d10230b5788d5750c41bef7094c8d36ce4c7f3b37a99622d87cd9e379aaa00bdc805ed87ebd8d85e39

Download Submit
C:\Users\Admin\AppData\Local\Citrix\Receiver\WindowsAppRHelper_concentr.exe.dll

Filesize
33KB

MD5
51fe311474569e76f99b767aad7b0a4f

SHA1
2c9750aeca960013ac0571220ae26650c9b8e338

SHA256
9eac0362a5751cf962f023c83b4125829280cda28df5e738582dbad16249e754

SHA512
26424f8ca5c2447ca5f3617dfeb819be5af802070db4539d88798aaafec0e6403d2ffb34c502436c92a15c05d5bbe7a9a7506e30bf60021747f59e3e2d22e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\CitrixHDXMediaStreamForFlash-ClientInstall.msi

Filesize
1.6MB

MD5
6ee2f92781a08761a03b2c9b8108ad5b

SHA1
193e8fbaa803b8d61dcbfc47ff59cbe2883115c2

SHA256
3abe4dedd5a3baf35e2b50177ac384e4ad3dec00c9c052a1f036f2ff4a06c78f

SHA512
ed2d4bc361fc94bd2109d703ace4988af035df1831c1785708ec620fb8119e1d16ce39b00b1bff98d3754a290400df1d49e88469052f860cbd23061b1f211597

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\DesktopViewer.msi

Filesize
1.2MB

MD5
ee20facd94bbb3295ca904213b82fd92

SHA1
901c3b3b8584c633926c2d418cb90abc18263323

SHA256
c1e4a6c9c27fcf43839f9d6b4ddaf5efa395dbb5027893491ac032d2816ee362

SHA512
8199caff272b6a72f3cb496ea58f7dbd1882cb8de09d00a1cc2e5a6c5b19391bb10cfb7f4f0bdeb086186930e62fcc84f003c98ab184446839cc55268797a90e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\GenericUSB.msi

Filesize
3.2MB

MD5
7c48d43b4230c794a065f2669a03c891

SHA1
89a713f8a0f2095d148bb9fcdc01ba1debf7f946

SHA256
fb3f75d9c2d2c502f9019f7c27ba6463d9aea27aafbccc55887fbf285819eb68

SHA512
7ea5fcc54c74385f0a69c58770a8fcee2908e1f8838fadea83c65ef4c8e0e87b764e076aa0319451074343883e7b546cfa2aeaef6e5daca4150ef7ced892a42c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\Global.xml

Filesize
3KB

MD5
952bdda83b498c4b35fc8317ec8692aa

SHA1
d9028679e6a81670991840cb3e965ca3811edaa3

SHA256
2a499a1376687f746d86b0fbd048f9b8a662c7beef6b5021dcfb51da461edb2e

SHA512
487f54bb28279e4259c7b75279aa3f1c08b519190bad84ec448153ead3fc8675def07e773b3a94f8bae8de397208052e7ed0b8deb43036509385ed5327c31879

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\HeaderLogo.bmp

Filesize
9KB

MD5
d5caff779c4d478676750e9936d4b8c6

SHA1
9c70fa0f942156dee25e2c47fb7aae7b1613eb4e

SHA256
5af6f987391efcc8204689735be40ec53b6a655c702a4bf0226c484b2afdabb2

SHA512
b0e463dad79b2a76ef5003470a7076c335c97dbe063373bba9d416fd7b7be5ca35e271ae0f472000c515e71080a0e0f3dd957a01f379809217716e3867a784f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\ICAWebWrapper.msi

Filesize
10.4MB

MD5
28bb0696352c4dd1d76c2523ddc7ac58

SHA1
ae67b2e04084d4dac455a11b7f981df9e9fac596

SHA256
bd9b6b9f9dc6cf3a254ed33693c2a8aec4bca1dfe82f3f3639fd7dbffdca49ac

SHA512
1d7d83af9cade45fff88c3d427fe0156923a550fea1d4329780859b9349251cba1ae9badd5d657ab1aec7328ed5bc0f637853be18884198db664b0e0b0d989a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\Localized_en.xml

Filesize
4KB

MD5
d297aa58b7abaec3529a88ced5ef14e9

SHA1
811dde73f4f0ad8ae2baf94e768d836359068e73

SHA256
102043a8272134e0584d705857e6f3d24349dc673c17932e09eb737bc38fc3aa

SHA512
abdc5d66cb3aeb5072d3eb15907109cd8b66cf37c75301e6934d4020ae626ad3c5f1a55ba22cf6a756b859e87ac6cbe2e5813c045b7189b12f89b46b4beca33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\PNAWrapper.msi

Filesize
2.1MB

MD5
dd44e1bdd6c4420459cd3206eb025647

SHA1
aa8b503f5a2a98b5bb467e90ab975911729914cc

SHA256
e2ab5100648198e7308eb71596addc023723caab5ed415d8602da64bd81f9604

SHA512
fa6a791601864c6e70b10a6649c984bcd728a84e545eddd21cbcc1859470236d1841e7692bcc9e13cd3e8d019c1e3751be4dc7b3083bf185163fe28242a35c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\RIInstaller.msi

Filesize
9.5MB

MD5
358b2d433986a553cf7d92b29c20aa59

SHA1
7c87f4a3bca822c7790fe9b97a062099096481de

SHA256
eb2fbc6eb9850d41b711065f44a1329d630ee69bd2017ceeac305f0c0f8bb5ed

SHA512
a1bcac69c40c80a4f026bcaafbf246c105aaf24571aca017c9c7941cc88037b5c6dcd0c7f057b6d19d324136b1a04d0ff7c3db9ec357bd30a75fd60d20b9e3fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\SSONWrapper.msi

Filesize
1.9MB

MD5
e7f487520e5bb8ec30723c027ee1fa4a

SHA1
e2d11add3a4e1aa32e5bc35b0b46887eb1fa8f2c

SHA256
9333d6af4f6c5519674ee636178e8dfd91aa9eba55b960abc3b3e0ee1ed1c421

SHA512
49555e9a5b52e8c0a2b0690b22e40f1931b858cbf8f7b2d7738befc94620e62629d3ebc5b0160caf211f4e09bd9118466886127d0cbd8ecf7c647efe88da681a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\SideBarBackground.bmp

Filesize
53KB

MD5
12066b3231497c8a718fbd935c6ce73c

SHA1
289a97128c559a95b1a2ce5a5bbe6d9535653fff

SHA256
d6b627a2f446f5cd0765c82b1fd2e417e36e1f82c1a57bcb3ca61a82f8bcf74c

SHA512
3f721bf423574a48a820fcaa66545169b6dd648b32557750cd0cf99185d6871f84bdc2350a0901fda9b1322a36aaf560eab4f41aec9d3ee3251da949de9293ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\TrolleyExpress.exe

Filesize
1.4MB

MD5
d3e06d69718c97ac5014457d2a80e07c

SHA1
de5f72caca6aec8643ee0245a2a01acebe269481

SHA256
7dcef0bf72093f42e0e3bb49d77939254fa77a742798bc0f7dafb819678b6898

SHA512
01cb5f57159d7eb9b6e1beac2340835d99f3cd3eefdf605ca548a1805a138aab9a14c5928fdf23f0466f714f4efae2116f2c1b3316b5d6f46ecb8feb9e75fe76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\TrolleyExpressUI_en.dll

Filesize
342KB

MD5
68beb883a565b203a7653a1e65ef26fe

SHA1
2c0a61c51b885c20259f32e1b2d6b8eeb0f87c22

SHA256
ffc0dfe7ee859a3665d7692633044ef89788be3145d43f3e4dd6868d0ed3e452

SHA512
a29044bf91b34015a25ce6ab673992537e2f1f2a17b09c861cac50cb72e887be3f8eda2612a3463749526cc9374e6fd6ce100096f9b646b6cebd6f1921262ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ctx-1F2343BB-E6F6-44EC-B42A-BC9A57DC1627\Extract\Vd3dClient.msi

Filesize
887KB

MD5
854703d051674c8f9bac2475e229229f

SHA1
8e78b578f511405d8a710283207b205552cbbc4f

SHA256
fa808d409f5c0ead5b19cd6b328e1b15f66ae9282e91ae7dedb75331f197c773

SHA512
bc11b645bf3177f058f31d7978f49923eff2040e1db9b74ddc63bd1abe82c5ac1fa2d2b21d70ef8d146609af3e0095f8c1d82ce0375c55b703ffb35bdc34a5a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CtxInstall-ICAWebWrapper.log

Filesize
3KB

MD5
6ca5a20751278b1cbd57afe56251074d

SHA1
60deb4a068146467b7e9a0122937e92f24990604

SHA256
794d00d11a538cae2338a7c0695ca902b8fb91c22db7ee86bc00f936fd38cacc

SHA512
b084e664f577237e82d11c45930172e8deaebc1f944f49b8911492152cc9b148060761c8d3a7fdb52c1976a5bebb001ee16e2b87a5a9259b192f961b5ed5e19b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CtxInstall-RIInstaller.log

Filesize
2KB

MD5
7c1b50d151cd15d52ea1fd0a2b66a5d0

SHA1
8cf4eb76bcfc55ae1af78b3ac60c439168d8b99c

SHA256
d7395b9ca90a9566d3fe03dcd019f7a2750db206a25d7a47a4b5bb3d9b7e77b8

SHA512
36a4e86b1687a3d03ed78b0340b5f0db24597476b0babce2e748b0c77449777f79fe9516f6aa4e0ee38386f6ff7df0b54d3ac6cb9daed24631eea121eb9ac5eb

Download Submit
C:\Users\Admin\AppData\Roaming\ICAClient\APPSRV.INI

Filesize
1KB

MD5
81f9781f8b14ab3088dc5d88fab23272

SHA1
2c40badda9832e64f2c3370e056846600f289a62

SHA256
a8ecdcc96c1fda3084cce8f4dc017f1d1e18b4f8b03967741a4a36c49e730ab0

SHA512
7af94e7944c903fed4f8f216eeb78e46d34a260357074e8a9eac2a8b164462ddf5c298855b6598b26da6e9b21761d159832fb9d2e7249a172dfe2f3597f30d35

Download Submit
C:\Windows\Installer\MSICC4A.tmp

Filesize
230KB

MD5
343fbdef61350969469a5e71c511c37a

SHA1
a28ecd20c5aca00e9cb693613ef6c2d0c788f4b5

SHA256
7e4c9d20275338014f9827ea5ebdc374c02bb43d71c5ec2c265b6be3d4113710

SHA512
c7fd20042858ae4e9ea139f2f09c3113f3105025b88072aea32b1222cc187f12d98111f5f1a01f1dc1be5d9a318aee11b62ab787f62d2ee7ad249741c13a22fd

Download Submit
C:\Windows\Installer\MSID1CB.tmp

Filesize
326KB

MD5
0ef8fede1958b73e964186f1b10a5b47

SHA1
68c11c80b6c2d1e4ff15b02719b6d2bbd938f014

SHA256
0d19ea5aa7e0bc5d3e1ea1668ea10ea2446750fd05fe0ee58f6674a0f38202fc

SHA512
a06208b1ae726a24ff37c3271ec83c79551172d573bc53fdf8d6ac1c3cf793426704179a8376c6842841ed55da1807fb0085895324bb7a0e14574703b7a08952

Download Submit
C:\Windows\Installer\MSID2F6.tmp

Filesize
214KB

MD5
ff1f2350af2e48970db5c98cfb646094

SHA1
00b77ef5975bfb418176310e5424840b7da4a38e

SHA256
a981bcea8a9c91acb2373746accb03e4a910843d687460420073b9fef8ee84bd

SHA512
868368ae94355ccddc51f358c78af9699177bacf360c09f94e21342b188a376912cb4003ee7578031f035308123580c8161a22a21b2c23990e649c7f1d93ca3a

Download Submit
C:\Windows\Temp\OLDF721.tmp

Filesize
96KB

MD5
c20e2a7a29f06a69c40e949255257b01

SHA1
cd4dc057a52c52d0911d28be0c121882953d0def

SHA256
309044604363e563a32086770aeccd99c6bf20925e4eb404604e88e5393f5f6b

SHA512
b6be25b215bbf88d51016531a8f3e8368b2f4253c2b8f0468e05723619715fbb9b539f4c59be885a9e4b5d804b9b34485897ddc0bc7215682cc25b6127a3034f

Download Submit
memory/2468-85-0x0000000000450000-0x0000000001F8D000-memory.dmp

Filesize
27.2MB

Download
memory/2468-1064-0x0000000000450000-0x0000000001F8D000-memory.dmp

Filesize
27.2MB

Download
memory/2468-623-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2468-1066-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2468-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2468-6-0x0000000000451000-0x0000000000452000-memory.dmp

Filesize
4KB

Download
memory/2468-79-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2716-831-0x0000000001460000-0x000000000149B000-memory.dmp

Filesize
236KB

Download
memory/2716-1069-0x0000000072BE0000-0x0000000072C41000-memory.dmp

Filesize
388KB

Download
memory/2716-1100-0x0000000072BE0000-0x0000000072C41000-memory.dmp

Filesize
388KB

Download
memory/3304-620-0x0000000001360000-0x000000000139B000-memory.dmp

Filesize
236KB

Download
memory/3304-1067-0x0000000072BE0000-0x0000000072C41000-memory.dmp

Filesize
388KB

Download
memory/3304-1073-0x0000000072BE0000-0x0000000072C41000-memory.dmp

Filesize
388KB

Download
memory/4912-633-0x0000000002F30000-0x0000000003001000-memory.dmp

Filesize
836KB

Download
memory/4912-636-0x0000000002EF0000-0x0000000002F08000-memory.dmp

Filesize
96KB

Download
memory/4912-638-0x0000000003150000-0x0000000003164000-memory.dmp

Filesize
80KB

Download
memory/4912-642-0x0000000003490000-0x00000000034CB000-memory.dmp

Filesize
236KB

Download
memory/4912-630-0x00000000023F0000-0x00000000023FC000-memory.dmp

Filesize
48KB

Download
memory/4912-1068-0x0000000012000000-0x0000000012230000-memory.dmp

Filesize
2.2MB

Download