hxxps://drive[.]google[.]com/file/d/1EBVUL8HMKcsI1HWMOrjAFd-bt4Ni4GLr/view

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04/02/2025, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1EBVUL8HMKcsI1HWMOrjAFd-bt4Ni4GLr/view

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
51	4944	rundll32.exe
54	2368	rundll32.exe
55	4488	rundll32.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\socperf3.sys	sepreg.exe
File opened for modification	C:\Windows\System32\Drivers\socperf3.sys	sepreg.exe
File opened for modification	C:\Windows\System32\Drivers\socperf3.sys	sepreg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1484	sepreg.exe
3532	sepreg.exe

Loads dropped DLL 49 IoCs

pid	Process
1308	MsiExec.exe
1308	MsiExec.exe
4956	MsiExec.exe
2384	MsiExec.exe
4152	MsiExec.exe
4944	rundll32.exe
4944	rundll32.exe
4944	rundll32.exe
4944	rundll32.exe
4944	rundll32.exe
4944	rundll32.exe
4944	rundll32.exe
4152	MsiExec.exe
2384	MsiExec.exe
2384	MsiExec.exe
2212	MsiExec.exe
2212	MsiExec.exe
1484	sepreg.exe
1484	sepreg.exe
1484	sepreg.exe
1484	sepreg.exe
4152	MsiExec.exe
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe
1408	MsiExec.exe
1408	MsiExec.exe
252	MsiExec.exe
3108	MsiExec.exe
3940	MsiExec.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
3940	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe
1584	MsiExec.exe
1584	MsiExec.exe
3532	sepreg.exe
3532	sepreg.exe
3532	sepreg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com
5	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\system32\msvcp120.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\encodings\__pycache__\utf_8.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\lib2to3\fixes\fix_isinstance.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\corei7wsp_db.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\broadwell_server_irp_db.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\Styles\Base\images\spinner_small.png	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\sdk\lib\x64\libittnotify64.lib	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtGraphicalEffects\private\DropShadowBase.qmlc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\html\entities.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\asyncore.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\Components64\igm_GCNPublisher.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\lib2to3\btm_matcher.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\gps\source\autocorr\units\tier3\sbe.cp37-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\multiprocessing\popen_spawn_posix.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\urllib\response.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\encodings\iso8859_11.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\atypes\broadwell_server_atype.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\emon_metric_api\emon_metric_api.h	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\x86\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtGraphicalEffects\DirectionalBlur.qml	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\message\en\perfrun1\perfrun1.gpu.xmc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\Styles\Base\GaugeStyle.qml	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\preset\kabylake_pgx	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\Components32\GPUPerfAPIDX12.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\metrics\broadwell_server.xml	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\TableView.qmlc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\Calendar.qmlc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtGraphicalEffects\Displace.qml	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\__pycache__\contextlib.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\cherryview_soc\UNC_SOC_Memory_DDR1_BW.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\Styles\Desktop\ToolBarStyle.qml	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\Styles\Base\DelayButtonStyle.qmlc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\broadwell_de_power_db.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\anniedale_soc\UNC_SOC_Memory_DDR_BW.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\__pycache__\shutil.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\email\__pycache__\charset.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\x86\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\encodings\__pycache__\__init__.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\shimloader64.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\valleyview_power_db.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtGraphicalEffects\ColorOverlay.qml	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\GLESPause.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\GLESTrace.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\trace.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\multiprocessing\popen_spawn_win32.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\keyword.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\atypes\ivybridge_atype.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\qml\QtQuick\Controls\BusyIndicator.qmlc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\message\en\perfrun1\perfrun1.emon.xmc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\lib2to3\fixes\fix_intern.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\xdrlib.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\preset\crystalwell_pgx	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\email\__pycache__\base64mime.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\email\utils.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\media\web2.png	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\Streams\runtime-x86.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\media\web4.png	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\valleyview_soc\UNC_SOC_Module0_1_BW.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\Streams\StreamPlayer.dll	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\urllib\__pycache__\error.cpython-37.pyc	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\python3\Lib\msilib\sequence.py	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\TraceAnalyzer.exe	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\emon\config\sampling\sandybridge_gt_db.txt	msiexec.exe
File created	C:\Program Files\IntelSWTools\GPA\plugins\qmltooling\qmldbg_debugger.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\SA_ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56C8.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\msvcp140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56C8.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\vcruntime140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178	msiexec.exe
File opened for modification	C:\Windows\Installer\e589730.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB313.tmp-\IntelAnalytics.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF1D3661595865780E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\concrt140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA288.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\vccorlib140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File opened for modification	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\GPA_ico	msiexec.exe
File created	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\FD_ico	msiexec.exe
File created	C:\Windows\Installer\e589730.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C1D.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250204154236751.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250204154236751.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcp100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File opened for modification	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\FD_ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10BF1F456DADCB53.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA278.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA940.tmp	msiexec.exe
File created	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\PA_ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEF006177C4EFFDF6.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\AA_ico	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250204154345469.0\msvcm90.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\SA_ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB650.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB670.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250204154345469.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\e58971b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A37.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56C8.tmp-\IntelAnalytics.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\GPA_ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56C8.tmp-\System.Net.Http.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB2B4.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB313.tmp-\ca_IntelAnalytics.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBB93.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250204154236751.0\msvcr90.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\msvcp140.dll.71E1EC1A_562B_3AD1_94CD_84420ED4073F	msiexec.exe
File created	C:\Windows\SystemTemp\~DF78B124221304E24C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C1D.tmp-\ca_IntelAnalytics.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C1D.tmp-\IntelAnalytics.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{FB09BE27-23F9-479B-B5CE-A08C39054214}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\72EB90BF9F32B9745BEC0AC893502441\20.1.178\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007daebf27fdc62d460000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007daebf270000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007daebf27000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7daebf27000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007daebf2700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133831572911548960"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F1956AED-8B22-3DEE-B4E4-6A714FB40116}\InprocServer32\1.0.96.0\CodeBase = "file:///C:\\Program Files\\IntelSWTools\\GPA\\ActiproSoftware.Shared.Net20.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F54232E7-3E8E-3A89-B295-30683B9E650C}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4CE083AB-54A0-3E01-BF53-B0873972B363}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F81E99C-2F9E-351D-806F-2818DD1FB1A2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{249E9D1D-B200-3D2C-8703-39465A5DC212}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F210830C-BA20-3CD3-A829-1091813ED148}\ = "ActiproSoftware.SyntaxEditor.Commands.SelectRightCommand"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ActiproSoftware.WinUICore.ColorPalettePicker	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{777D2213-0475-3EEE-81CC-C1C5F97E04B8}\InprocServer32\CodeBase = "file:///C:\\Program Files\\IntelSWTools\\GPA\\ActiproSoftware.SyntaxEditor.Net20.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FAD6BDC-FB30-380F-9938-E84E3344DA87}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{318E9A54-FF8C-3537-88FE-C6FE59648366}\ProgId\ = "ActiproSoftware.MarkupLabel.MarkupLabelAnchorElement"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9FC18B8B-D663-3EE3-B7B9-8607513E772C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.Drawing.Design.ImageEditor\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2AE1C4EE-2350-3BE6-ACCB-0616F0F6D1D8}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.FontDropDownList\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.Commands.MoveToLineStartAfterIndentationCommand\ = "ActiproSoftware.SyntaxEditor.Commands.MoveToLineStartAfterIndentationCommand"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{857F0EC3-B885-3BF5-B764-B035787ACF97}\InprocServer32\4.0.277.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{16ED1B45-A591-30CE-A28F-2DBDD9CCA02A}\4.0.277.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F105D3C4-CBAA-39C5-A637-50E41EA7E7C8}\InprocServer32\4.0.277.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{44ACEA3B-6C93-3767-9A0B-60B8937B8523}\ = "ActiproSoftware.SyntaxEditor.Commands.OpenLineAboveCommand"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{70395E9E-AFB2-38D4-9203-FEC2C015C9C2}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FAD6BDC-FB30-380F-9938-E84E3344DA87}\InprocServer32\CodeBase = "file:///C:\\Program Files\\IntelSWTools\\GPA\\ActiproSoftware.SyntaxEditor.Net20.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A73C497E-1131-3629-92C8-74BF7D5A5BE3}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{318E9A54-FF8C-3537-88FE-C6FE59648366}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B6AA1B1B-F0D2-36C0-BE69-36BA36341157}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A230A002-B973-318B-83A1-21C9D77F4DFD}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.Commands.SelectDownCommand	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.Commands.RunMacroCommand\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{44ACEA3B-6C93-3767-9A0B-60B8937B8523}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FAD6BDC-FB30-380F-9938-E84E3344DA87}\InprocServer32\4.0.277.0\Class = "ActiproSoftware.SyntaxEditor.Commands.ScrollUpCommand"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFB90A52-15C1-33A7-9BC3-F81AED4FE819}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E375C22D-2B46-3B52-9A01-993D6EB8546E}\InprocServer32\1.0.96.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24FBDCF3-5B25-3E02-925E-B8DE15294897}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{825B1423-339B-3126-85A4-8DA3836158A0}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8E0824C7-6132-326B-9FB4-76A5949E19FB}\InprocServer32\1.0.96.0\Class = "ActiproSoftware.MarkupLabel.MarkupLabelTextElement"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{585AD23A-77D6-3574-A50F-A7DC3CEF9036}\InprocServer32\4.0.277.0\Class = "ActiproSoftware.SyntaxEditor.CodeSnippetImportCollection"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E45D108-14B1-3899-8C56-BBA18BB67C86}\InprocServer32\4.0.277.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{777D2213-0475-3EEE-81CC-C1C5F97E04B8}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.Commands.SelectToNextWordCommand	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.Drawing.Range	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ActiproSoftware.SyntaxEditor.Commands.SelectPageUpCommand	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2DEAB4C5-7968-3868-95C6-EB4C21571C84}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8E7CD6F1-9B0B-3BF9-9596-899CEEDBDC78}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.FindReplaceResultSet\CLSID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20110CEE-CBFE-3771-933D-38B1DC9D70A0}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07FDA5D9-956E-3A5A-8FF9-E58C290085E9}\InprocServer32\1.0.96.0\CodeBase = "file:///C:\\Program Files\\IntelSWTools\\GPA\\ActiproSoftware.Shared.Net20.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{161A6232-4553-3D47-B748-63ACE7D32EC7}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{67F1BEB6-D4F4-3334-8EC9-7C3140337C5F}\4.0.277.0\Class = "ActiproSoftware.SyntaxEditor.CaretStyle"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BFFBEF30-761F-3C8A-9196-539731C7B6A1}\InprocServer32\1.0.96.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{43346F1D-20B3-3021-9D18-F3EE678D40DB}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8102D194-5526-3867-BA14-2DDD2F8551FA}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C284700B-BD84-337E-9795-A4789D986057}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8CD712C0-75F8-3CAA-9E8F-8C20EC8D92F3}\ProgId	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2DB23F33-2C39-3038-B6AD-F00D1C9526C2}\InprocServer32\1.0.96.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C5D1B247-9E68-3C67-B656-63BF72C069FE}\InprocServer32\4.0.277.0\Assembly = "ActiproSoftware.SyntaxEditor.Net20, Version=4.0.277.0, Culture=neutral, PublicKeyToken=21a821480e210563"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B446DC0A-A51D-339A-9FE8-7F81AF803098}\4.0.277.0\CodeBase = "file:///C:\\Program Files\\IntelSWTools\\GPA\\ActiproSoftware.SyntaxEditor.Net20.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9FC18B8B-D663-3EE3-B7B9-8607513E772C}\InprocServer32\1.0.96.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF56045C-79D9-38A4-8B89-D77BDDE4CED8}\InprocServer32\1.0.96.0\Assembly = "ActiproSoftware.WinUICore.Net20, Version=1.0.96.0, Culture=neutral, PublicKeyToken=1eba893a2bc55de5"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{43346F1D-20B3-3021-9D18-F3EE678D40DB}\ProgId	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0869E777-D93B-356D-9DCF-F4917BEE41E1}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.Commands.MoveUpCommand\CLSID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13923F68-AD24-313C-A4EC-251CE116FDA7}\ProgId	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7BC53792-F565-36A4-9DC9-66234711E532}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A8834CB-0FB2-396E-A900-17BC2E06D06B}\ProgId\ = "ActiproSoftware.WinUICore.Design.ImageIndexEditor"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiproSoftware.SyntaxEditor.Commands.ScrollLineToVisibleBottomCommand\CLSID	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\gpa_20.1.1585397060_release_x64_standalone.msi:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
2384	MsiExec.exe
2384	MsiExec.exe
2384	MsiExec.exe
2384	MsiExec.exe
2384	MsiExec.exe
2384	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4404	msiexec.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeSecurityPrivilege	1352	msiexec.exe
Token: SeCreateTokenPrivilege	4404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4404	msiexec.exe
Token: SeLockMemoryPrivilege	4404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4404	msiexec.exe
Token: SeMachineAccountPrivilege	4404	msiexec.exe
Token: SeTcbPrivilege	4404	msiexec.exe
Token: SeSecurityPrivilege	4404	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4404	msiexec.exe
4612	chrome.exe
4404	msiexec.exe
8	msiexec.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 400	4612	chrome.exe	77
PID 4612 wrote to memory of 400	4612	chrome.exe	77
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 856	4612	chrome.exe	78
PID 4612 wrote to memory of 5052	4612	chrome.exe	79
PID 4612 wrote to memory of 5052	4612	chrome.exe	79
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80
PID 4612 wrote to memory of 3032	4612	chrome.exe	80

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1EBVUL8HMKcsI1HWMOrjAFd-bt4Ni4GLr/view
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd6fcc40,0x7ff8fd6fcc4c,0x7ff8fd6fcc58
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4368,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3760,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5396,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4276,i,10970838535984910839,930257395027752759,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  - NTFS ADS
  PID:252
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\gpa_20.1.1585397060_release_x64_standalone.msi"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4404

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1316

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1352
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2F54FD8A82216C1330A3FC55158C803B C
  2⤵
  - Loads dropped DLL
  PID:1308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3DC5926FBFE5C51C1BCFDC04FD125003 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4932
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7BB5F6B22DB55CACD4D336431CE01BD4
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2659BCDD5DAA420C15568B614C135F43
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4152
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9C1D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688234 5 ca_IntelAnalytics!ca_IntelAnalytics.CustomActions.SetupTrackEvent
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI56C8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240735953 31 ca_IntelAnalytics!ca_IntelAnalytics.CustomActions.SetupTrackEventError
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2368
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 44C0AF8803ED4A351CD32645EDA50361 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2212
- - C:\Program Files\IntelSWTools\GPA\emon\bin64\sepreg.exe
    "C:\Program Files\IntelSWTools\GPA\emon\bin64\sepreg.exe" -i
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1484
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 94037278CDF8755BD7707A3A6B236711 C
  2⤵
  - Loads dropped DLL
  PID:1408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1C48108A3261620C0DD6472C8994935 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:252
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7F48A4E195EC5DD8ED2E286E31CB9FF7
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6C76B26184BE9C6E3BFB0B855B3A6F57
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3940
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB313.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759593 42 ca_IntelAnalytics!ca_IntelAnalytics.CustomActions.SetupTrackEvent
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4488
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9122BD23F28E15DA39B94768BF7B9520 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1584
- - C:\Program Files\IntelSWTools\GPA\emon\bin64\sepreg.exe
    "C:\Program Files\IntelSWTools\GPA\emon\bin64\sepreg.exe" -i
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1200

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\gpa_20.1.1585397060_release_x64_standalone.msi"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:8

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\IntelSWTools\GPA\emon\bin64\MSVCP120.dll

Filesize
644KB

MD5
edef53778eaafe476ee523be5c2ab67f

SHA1
58c416508913045f99cdf559f31e71f88626f6de

SHA256
92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

SHA512
7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\bin64\MSVCR120.dll

Filesize
940KB

MD5
aeb29ccc27e16c4fd223a00189b44524

SHA1
45a6671c64f353c79c0060bdafea0ceb5ad889be

SHA256
d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

SHA512
2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\bin64\amplxe_sampling_utils_3.16.dll

Filesize
191KB

MD5
d5aa6f7063724b9ad2b5f7a922188f51

SHA1
d9539f559216161a0b190dce48ef6a15b4249901

SHA256
0d4d999fa8b52b8a19a4fe178fde93eba43c4494d27786196bd128f7b4182755

SHA512
b1274c638285b0fead4d499cf7b6b09669a4da858e53d9752c4f4fbcb218b986a022a5fad3c19cce7a7fee4d0ea9590bc9b50a902a741c27fe28e7b03d19b3dc

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\bin64\sepdrv\win7\socperf3.sys

Filesize
60KB

MD5
c679dceb794d0ac8a339ebe56cbb83b1

SHA1
8b101332f3ad839470b8839fd46007086aa48c14

SHA256
d51bada5fac7d9ff466a780ec00dff4365f8dbb83e01b98903dbbd6d92ce4cbe

SHA512
57304902f1133d14cf96ad5ba741706eebc76769032ec2193e80014d66b81ece9f28693b4160d100f083a67f20be3ccd5b7dba5bcbe70f1cdc45fe8ebd1944eb

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\bin64\sepreg.exe

Filesize
216KB

MD5
ec1cfcad92c004cb5f8da0aae6c957b4

SHA1
f9232b07430e444099fa1a2ff25409ca8a18ca1b

SHA256
02873f4c0d4d6ac1be99110dbc6a783acb2ec784280dd2e592605dc62f2a55a8

SHA512
84393a50861bb5110061ee7263aa0d9cee79ef92ce274cb1f7d783f363240b41510d82738085ca313ddad96452b2a8949a4e201f93981d4306bd50818923d831

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\metrics\skylake.xml

Filesize
19KB

MD5
0d57a97292bb2016e11e918c90d808fa

SHA1
5e70b315b18e4ed3f40c806212a03fb0faf591a6

SHA256
7f49e78825f1d9d3d68d159639d4c14207665edd50a09585e85f86b1d25e8919

SHA512
12f070d0023ea0834842742692a528cc6ada49581c7cd7bf8691fc58532f415577eec1154e97f12586ca2114e99929dda2bb9d757840a72d760c68a9c91cd3b2

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\pgx\kabylake_ulx.xml

Filesize
44KB

MD5
67f529d45f3e7c48e09b21b61f57f179

SHA1
43083c6d20137288a564f26830d104db2b972f8e

SHA256
76f52ce004e38e39a0a1b85f3347223fcd1f71e1604a80b888c85400bc2ca316

SHA512
802c6acc4a1b6c1722d401aa5cae5dc6fc41758e2141a93954aa79611b92bfa8c638b794bc9d9c5aac4b64659d113e4a66fcebf495f2fa3469f568727896ab5f

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\preset\skylake_ult_pgx

Filesize
6KB

MD5
60b19cfaed7fa55ad289e737ab6245e7

SHA1
d23fb989a481df0e1eb48e8b23bdf2b22d72fe15

SHA256
f63cd1f4ffef554c3883be295578b21cdf725013fb15d513f8c5b4e7162cd5d2

SHA512
d600b01b3805028ef3f22620fbbbb5d99e760aa838111fcfc4bec9bbfaa7003bccaf845885d2c204a9023378844ab1c5a6b9366c9b1d848fb5aa1b9a930d37c6

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\sampling\broxton_power_db.txt

Filesize
663B

MD5
c55b31922b88012d6a5d5ddd25640fb5

SHA1
a80a4021583df7a6b721a7c21726a4c1ac4441f9

SHA256
3cd3200dbcd3ef76184abff3198af73f7f0247f226023bf2686b8e91c2fc44ef

SHA512
1979b32827b7c050a88d367aa538da0a241daead15572a0f191ec138a70de72d39f3df42880b5d7f42abb23eafc85479a26d1ba9481349d81465abd16b581450

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\sampling\denverton_power_db.txt

Filesize
1KB

MD5
70b094b1e7b541a8cb14d8adf77217b4

SHA1
c44109f94b7249d13c831db76ad4c239750aeb32

SHA256
fa738397af443e0da41fdfdf3433224eb5cfd6463698a3fcbbb48cd4d782c7b9

SHA512
d275f1d5e0460e9fc1f8c8e1c9dd9aaf2532466f80169b68b585c9038a1de2ea9d995c8956e78ce07c5b88f35af7807f86f7a6ab611f290c812b9808c03c6d0c

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\sampling\haswell_imc_db.txt

Filesize
491B

MD5
d301271517a4055ee219492990745880

SHA1
9e09db0446245c2e85f2d049b79d8ced2cb162ec

SHA256
47819222e62911645949b80afbe1206801349eda004cf7b16c7b463b2873dc5b

SHA512
e410a0dcd7f759cba380ab98930a443bcd1b622067735c7f62e9437603c97eba536c0f943fca5981d740858978536f961563e3c2954e6f023be84b15cc704bac

Download Submit
C:\Program Files\IntelSWTools\GPA\emon\config\sampling\haswell_server_power_db.txt

Filesize
1KB

MD5
a61c1b01f61978315e552bcea617cbdb

SHA1
4995de289a0bf36066c16d1933804b320aa2ff23

SHA256
b43fc05727ea9b34410e1729611f332195fdf26e2632808dd236b208e90bc38a

SHA512
64c199aca3f5c6aa5026516a0dfdaa9123a0ea4b39c4b7bc865003e4b80a2c99181016e7051761571fbe793ff298fd9bc4807b46a42b048870696c18c5f5d41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\95A7979A07314DCE9A6C0B392A677717

Filesize
827B

MD5
10bd186af36808180b7f1997acafb519

SHA1
ce5e9a38fff703726bfb472648947500e1c14445

SHA256
2d368d0234f71def20bf2596a6d39a56aa43ebc48eafa3e4076bc3e90ebd7e91

SHA512
10e15dbd1d165f004fa34d48cb55844355fa2c8983ebdf1253ff1f2fa74e264dc09add43931a2fe928110691c01f6856252b976bac0fa214e8f26fe9f813054b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\991F383F0AD298067B7400BAFF5D2AF4_00D084FE81512F630C7D0D8E96C65D9C

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\991F383F0AD298067B7400BAFF5D2AF4_A21E89781AA27664772E601B3BD86EB9

Filesize
5B

MD5
4842e206e4cfff2954901467ad54169e

SHA1
80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

SHA256
2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

SHA512
ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
1KB

MD5
fff7b9faa65fca2c616f94b838fbf4ee

SHA1
723ddee19f3a60c265901f93797d7d8315fbe239

SHA256
5b4c123b074e12ad2eda0050128b627bbb4efa4f188edf1dc887776a0c441f4f

SHA512
5629261711e6ae184757b85cfc31500b9871a232a61c7411790dafa7aeb9c84fdae2a25016b7c9d68c3b5389b46105c530d64ef7a3f9bec9e6d37e0276522ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D

Filesize
826B

MD5
e7b4ee8af5533712e16cc0be2da7ed15

SHA1
9bc15b2f768a2185c6c2f0593fc5965394142a96

SHA256
91ff05e96acb22e7043fa77256c3d36e70f47cd431051571df754fb5d894735d

SHA512
6299759f91660112d43af80b3770ba86a0162fd12658012ba960f7d33e17666d20811ad9acd2d4814ec1bdc7aab4f66b7e3edd6534717e305dad354309665731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_DA0AC6C3213D3F67EDAAEA42522AAD0D

Filesize
400B

MD5
bce1e89193a584af4ef0f204f94a57fd

SHA1
4a300bad1cbbf942aa151beb082bfc596fba8046

SHA256
aadc05455313b27d2073883ffe781cd1d272b4953fe3a9e8f3e5695612400591

SHA512
38147fa87e14b706185363eac477eda2a44217e19847bcfff30a1ca3e513b3793c2ccb36e0ae857480a04c2fd2877df6a534a30a2b7571338006e64df8fbfeb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\95A7979A07314DCE9A6C0B392A677717

Filesize
264B

MD5
8bffc08c868138276780b7cce2f657f5

SHA1
ba957c63f30b572755fb7b7adf4c8e72c3883dd4

SHA256
f13e2c22bfb09bf06198e483427be1ce06f8baeb44ff00e4dc43f5bc97df1d5b

SHA512
bdf9b4026976b28c03c0e56f6245232d5db448743dce6a719e20077567a9fbdafb81e22d61eb23acd4dc23559f38fed1da04a8e707076c10069e848622b7c493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\991F383F0AD298067B7400BAFF5D2AF4_00D084FE81512F630C7D0D8E96C65D9C

Filesize
478B

MD5
f44260b5ebc95e8aa03597c8fa94c1e8

SHA1
05d466af14e151fc8e68c08d15d7c904eb5ab22f

SHA256
76870f720b0ce5d5578fc047669a738cb2457d4395759c5bd92a93b7c188f727

SHA512
bd766614d3b27601e9dfc3a531d6b3b9379f822fc446f9c4923abb5279330bb8a1dcb06cbc490adb4a8f85d3b34842673f394279428a24a4ae6514aa8f2d262f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\991F383F0AD298067B7400BAFF5D2AF4_A21E89781AA27664772E601B3BD86EB9

Filesize
400B

MD5
2a67113c77c4db231e6659366463f47b

SHA1
954e71ee31323485e6280722ec54f7d26db1aaef

SHA256
47ed560572781aee02b8ee39704b3e881bb70853a9efcb605f4efabc220add90

SHA512
923989f942edae8050d8437049972a93608ca1f09e6dc9fa6a2ad87190a21c2e2dc43424a8c49ddabbefc0926357a6d18c26671f3523f29bfb11f8a6e07def31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
486B

MD5
b981d4b6ad35e6e1495419b1f3c1befc

SHA1
d831a3531c607fedf77b937b67a3629a9d28ba0b

SHA256
55788b6e42122cbbed45c578ee68c46908d3044aeca4dd6298fdaa657a4f9f50

SHA512
b4590435717c36f3df965e87004d52c17d6f985510f1334e74abe82410a465030817c38c1a1fa3ee5e815a5b6e8dec44430197494ac527e185c89e6a16b91391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D

Filesize
322B

MD5
80630de2d4a47656aa4ffd7840a67cf1

SHA1
75f6931cd4c7de3f422eb6fb28153bcd8ab76eda

SHA256
0f8c9502395cbf361f074f01ea41143a5f132b6cea2020dbc3629afab629457c

SHA512
a070cfe73e0a9c8d5946b8898ad04144a4569c4c9e253ee2044ec1a678062349f085e4983636fb51525e7c54067f5633cb6931c03280e358464fdb7d06b19296

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
67ce6597835206900101852c92d09b98

SHA1
235d7f084760e146deda53d34ec53ae843be43ab

SHA256
e447b2dc79ee25ac5c597f74c575bb7f768b4a9decb8fd85c37608b376439469

SHA512
a22194827ee064b87274a3809af4e6472c7b0e688d7f6ebf68228c52fdd0147f38fb80c8c9514c442272a913f7156c0fa263f610223a6f0c95e1a46b077d0014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
2648e023bd575ed151e0b94f35aef112

SHA1
ecc7b3963714934e4cc168453f08d2fb3d17fc52

SHA256
cf218a04c338df2f1ecdf2d4576e8d8197e08cbb24826995e6953284210d5dfb

SHA512
2fb5c9d59deb440037594ac41c0fa48fd2a0ae9d53fb59133bac57f6b5b7724eab43688f9b1c4a88064182fdabbf1f140ec7f92a63dc29b4b85417986fbcf38f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
b9be7682d9b23e01018823d6fcf54918

SHA1
ce0f5c9849daf6306f5e81844cad635981ba2c7d

SHA256
564eeab450ac715bb7f76183f1c039fb2c68cfcbaab6f598765d932062111fc2

SHA512
1939f23ead7ef5841f23b2744805b62bd70c42731a254e34b59d36251bb2368c3d4c2845a8f0ec303af0448acae0eb744d88a627a4d2ac06c6eef592c7ca247c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
7d32b69954cb2ea3e6fc390c5d005082

SHA1
0352bb4513da008e4414604734d0a280ffb24dca

SHA256
4338950f26632d9bca1e625638557b8112746bb33dcbf58280823a117e901027

SHA512
55af5153338c877594b3f0008788d83617a59f656fd8b5b99910000e028e16fce1b9784d5d3a8ba2686a88add2fe5f30aac427bd2e98310647664e9332366b7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
27bc5cc1fd292501e44c3b03bdb6d6c6

SHA1
daec0439f62297dd8b57e9b30806a06cce278384

SHA256
a882848205641d905cecccbc8c3f92d3d0ef8468f43c503d6ae27437a8e2f875

SHA512
d6c25951b83e94cde65f8daaadb4f6114af5af41e7668c0f668d424a92376862a2ad7da29c754fba8161c4d8bc458682267ccef4042fb703d7ee7f8e99e592ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
215661ebdc0051e8589c9fca78906703

SHA1
341c35b0bb4a3f9e326ce986d815505415a05a68

SHA256
ca76247b45a1f8492a88f0d609fb295670d41295657dde274eacc0bdb1231415

SHA512
d71712e2b61afb04c048798a8e4239fd6a400b234146c88269662c2a9550355f9fc5bdcf715eadd8245508562e28b932cbeb0940a74fb6f7f786f5766e427bff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
215b7b7457d9a768f84ab5b2bb79fbad

SHA1
84f900c8b498372d97ed6f9f31af38482e8cf5d3

SHA256
480a6b21b7119f647f1574b04da409be3fba6c629fda8f75291cae35514e682a

SHA512
b04311d401af880489fe72942b1e3c7562b23cba25810473d9f088c22a5dbd19c5f13fb377a0434f031fab1d0825562ac44c4f8833e7bf6a3e5100e839cd3401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d3468d90de19c6aa9caec40e503a11d5

SHA1
fd08ddbaa2a976720ab7c7cf613a7d3771ec5435

SHA256
7f41f54588fd808c5402bfd0387fca8d680d2285f367eec59d31dcce13190151

SHA512
b84f998b43ee4f0384be8fa93b02e90ba3d7bd11efc7b03db2050252a7d344e3588fdd690003078989f86a0c646c1eaba928a742445f60d72d3409097956d328

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
9e46938bd6096f1550666a35e04da7f4

SHA1
d830231cfc25c5deb3f1e316671246c924c3ecc7

SHA256
e6035ca790c9de9cfc6c2bcfe47ca1fb7301fa6be01a69f00dcedca7e2362ba8

SHA512
9a4ef8121bb843cbaad1567e0224531c8dcbc3ae7de5580ea5af1bb6990f852cd8bb7ee41f24ea050b62e3aed33c52a90227b193f54341db8ef0e4d29aaae612

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
15057cc30a8a05f6292532cf708a6c69

SHA1
794055c814ebff9a0dcddc3cd7bfa57ff25ff18b

SHA256
2efe586e3586cbb41aaabc50cc8d6b6218783e5c001e4563a24ff320d0bba8d0

SHA512
b9a7c1cfa593a87e43a4571a5a5719bc0468596e5f09115430b3e8103e4343d117d5412e555d459b64a40ad6df1efb87dfb05edf645104bf59833de2f9c3908b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
551d5cbc76e2c0b306323a9f65d8213d

SHA1
c1592a6c77d6348f792baa1e3a3fc14f4b82fec4

SHA256
dbe2e0f2b394de720bcb50cd01212d74bc01b07b0a6cab94187ffb6ed0cc1047

SHA512
41e512c60c462095b4386288f7c1803f75d1a4c030c6e59e11976b52885f2cb2b959ab3af63ad6f0759fd7593e7b2b18e9c46f01819e34e8fee36fe6783a54a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
b9cf69b320f24dcfbee83d2d23cffc74

SHA1
e3cbf5412add1c00c099afeca532ff5bf525949a

SHA256
34420d778c7a17b247237f416cd6fab269a9b3e1802e3f9335d427e6b14112f9

SHA512
b40b89eebe423a737df420190528e2605334b46e80a0816c11752994ce5549aa98796bfe0fcbfafb6b70dbbfba7c8c8b4e3b0f62e4fe12a73e293e404e8f22e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\69edd4a4-33d6-4838-99b8-a7fca203c418.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3832.tmp

Filesize
2.7MB

MD5
c3238e65f7a5c72d0ac8bc7b02de1326

SHA1
121243fc1e3a3206b777605092e673c24204b2db

SHA256
cddfda8e5e31dd70a63e531754fdf6758c98533fc1f83f5a96cd40ba64036530

SHA512
569a1b226dc9f4266bf15795a9fe115212847a5cfa1bc4aef5378661a9af795c27574123415a7b0b1ea8f1b4af4bbc10503402f64c84cdbf778421157f253f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5A91.tmp

Filesize
104KB

MD5
fab4aa95c57f441b701be7c2e81ee370

SHA1
fad06bb4bedbf22bccb2ab105a630f2c4435bbd4

SHA256
8ad1084de9a734b2d5c86f472f671cc324632b3a6ca5aaa0c360d93d4d08e148

SHA512
7ab85940f9c6144864fc5b5221eae30cb5800ee5fa270957109e8f182551806965fe1dfeffbe655d805aa2bb33b0896725236b4422d3a540d90fd55ce174ef48

Download Submit
C:\Users\Admin\Downloads\gpa_20.1.1585397060_release_x64_standalone.msi:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Installer\MSI9C1D.tmp

Filesize
334KB

MD5
1a9342d7e352dde5467e4cb90740e593

SHA1
04ffc2f7a0583e0610a98b8b50677254aac54bc4

SHA256
23ad225fadd143b99ea98a9037dfb2575ed6e65deafcf2b0888277de2909f4b6

SHA512
28767fb5fa2c16b3965c6922475065817c1bf224fc2032097bafa7ad29d86d057c8cd62132afc18b3a16beef783b438778de00bf9b4e0dbbd2770757ec2f4806

Download Submit
C:\Windows\Installer\MSI9C1D.tmp-\CustomAction.config

Filesize
1KB

MD5
4933c1e1be5973187e991ea2ed9e6451

SHA1
b16b52ba34a835b5bb8665f502e7e37985b6776e

SHA256
dc44fb3a0ce9cb88926b2d91ec3cc5a5c5d694b02415c4b2459090f08f08ed58

SHA512
766ed216354a9d0f681607577e586e89dc82729ced58c328676771178ba547cd87878a1f5955cd46b197672753bc693d08246a7a11ceb8a7f255e1321403e805

Download Submit
C:\Windows\Installer\MSI9C1D.tmp-\IntelAnalytics.dll

Filesize
48KB

MD5
851b0a081c3b4048378c775da30f1992

SHA1
5a470b3b1f045d0b9d7696b27d3566f8fa40c7de

SHA256
366cd5ff9390acfa9287f026175b496cc3fb5d6e2b2faa0711095a1ab06a7038

SHA512
5f7b0739de1a24aa1e4db5dcd1e828041279784e74174824e5e0c14ac926634386bfed7c902e21e3cb89adf590a7ec52f78f5f02305fa7c1a7813b0c66151eda

Download Submit
C:\Windows\Installer\MSI9C1D.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
4e04a4cb2cf220aecc23ea1884c74693

SHA1
a828c986d737f89ee1d9b50e63c540d48096957f

SHA256
cfed1841c76c9731035ebb61d5dc5656babf1beff6ed395e1c6b85bb9c74f85a

SHA512
c0b850fbc24efad8207a3fcca11217cb52f1d08b14deb16b8e813903fecd90714eb1a4b91b329cf779afff3d90963380f7cfd1555ffc27bd4ac6598c709443c4

Download Submit
C:\Windows\Installer\MSI9C1D.tmp-\ca_IntelAnalytics.dll

Filesize
13KB

MD5
e619f747bf445963c653a8056b960f6f

SHA1
7a416f428e41e6c40cead82cf3ecfdb7d3b0d1e5

SHA256
2e8e19018a0cf90fa28989259d6ffd6c1dbd796c0917bf1e79bedc7205b5173f

SHA512
338211af39c3442b420f5e1ebce2309f965f6d793140b68a654d61ad60ee64580d595a2c6424947f3207d375a769a9ae56d6b1383058f4c196fb23f40b0b1b2a

Download Submit
C:\Windows\Installer\MSIA229.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\MSID7E3.tmp

Filesize
19KB

MD5
a5cb0697e42470462cddb91c14c5957a

SHA1
1805e5606b62094a026eeb121350b4ff1cf94f06

SHA256
5b752aa9a408df84a7192df5568b4c0aa0a48d6af20d70796ed1a26459520832

SHA512
156b0c73b86eb4a025c8b6a11d04400885c11eb800446bf2319a0b7ea890c56298e7c720281cd1342b7937eac15e52d22cec9b26219e5d6c52894f7270839d51

Download Submit
C:\Windows\Installer\{FB09BE27-23F9-479B-B5CE-A08C39054214}\monitor_ico

Filesize
163KB

MD5
9f978bd41b671df0dfe42d97e094d238

SHA1
9807e61727c2d2a3f029f911ba89313acaad6397

SHA256
5bf783077eb3c4840f990af1a9c667b9e3d807b008d3102fe4ac2bb93461c314

SHA512
db9ebff3fdd8dd69645ef63ac661c10c74afb480dcdb5da696737252469f95800d22666321bf42aa464bee8c261377e32e176a26c7c8bf0f18822baee8b4ebf5

Download Submit
C:\Windows\SysWOW64\concrt140.dll

Filesize
238KB

MD5
48db05391b6405f67f65d67095cbfdd9

SHA1
17b78dfe4051aa5e363fd2a5a73e5786f5785be4

SHA256
c1e5d240bc3a1c5b36770110ae35a10fbf7438a5c617e8c751b00bec10fce063

SHA512
a3c9ef1ed24d30af0cc46f0474b5e264e065c758f30fc252ce53bc369bec40f2dfb4c165f634bbf737d284b7a25fe10323d65ef0b805b01de6783ef0cc58ae1e

Download Submit
C:\Windows\SysWOW64\msvcp100.dll

Filesize
411KB

MD5
e3c817f7fe44cc870ecdbcbc3ea36132

SHA1
2ada702a0c143a7ae39b7de16a4b5cc994d2548b

SHA256
d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

SHA512
4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

Download Submit
C:\Windows\SysWOW64\msvcp120.dll

Filesize
444KB

MD5
fd5cabbe52272bd76007b68186ebaf00

SHA1
efd1e306c1092c17f6944cc6bf9a1bfad4d14613

SHA256
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

SHA512
1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

Download Submit
C:\Windows\SysWOW64\msvcp140.dll

Filesize
433KB

MD5
a84a8a708751e2cb1f2bb117e9b7f390

SHA1
a9378bae50093465e2ea1567958a1bb656d42149

SHA256
f656f0f98cf2510f4e0fe5d5666643028a6b8bac50bf553c0a464456c0e82934

SHA512
609850f700a3147bbd1947c26ece31aeb0ca70249ec4dcd22f1bdc922fb24b0a20f569de827d4818f32983b65456bc9a9a0e9c23ba1e8eebe8520581a814bc49

Download Submit
C:\Windows\SysWOW64\msvcr100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
C:\Windows\SysWOW64\msvcr120.dll

Filesize
948KB

MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
C:\Windows\SysWOW64\vccorlib120.dll

Filesize
242KB

MD5
69837e50c50561a083a72a5f8ea1f6a2

SHA1
1a4b4c6c3cb6a5164cc1018ac72d0300455b3d8f

SHA256
9c9d4e421c55f7ef4e455e75b58a6639428ccd75c76e5717f448afe4c21c52bc

SHA512
fd20c6b4eec972c775681ad7322769d5074108d730727051ef77d779a277d77b12419e1fee1e2ec0cf376a235573a85ad37975245dbf078de467953afd02164a

Download Submit
C:\Windows\SysWOW64\vccorlib140.dll

Filesize
264KB

MD5
af530e084fc969b552db842d3de5f285

SHA1
7d0bccad63d6b0f5f4b144ade34afb7fb342d22a

SHA256
92cd13772dd046e9e8a36343c96e6c145ce9072dc51de05aeae4a770cf4b1c33

SHA512
c89cb972067f7971c8ead078a89ebed0d4625a46370c11ddffbdd3f0e56619b55403d19cbf89ad001dbb9c302501bd3ea0331dbbb2a587b6ef79a5f709562792

Download Submit
C:\Windows\SysWOW64\vcruntime140.dll

Filesize
83KB

MD5
b7ebc19a5b23d0d32ff014e30be26061

SHA1
efb3b58b31a27407402a2be0d41aee120519c282

SHA256
5695560a50ed9746696c0d647e55d77459f5981907c177d086df36656a978b19

SHA512
922d94e80cdffeb51a1818c52b5c568597307225eed33c7c07e193322c2e9b0c7a5f17f3f4b57f2e22b8ad7f9509cb893bfc6d07d19af83360da6c0d807aa93a

Download Submit
C:\Windows\System32\VCRUNTIME140.dll

Filesize
87KB

MD5
419cbc91b0847e3d1457aa5af6847b8c

SHA1
131b37e549e1a6af0bf889a303f24f95669edcdc

SHA256
60f0bfe9dafcd8e678864337e0563a9ad359ef66169890f2f0af76eafa9e113e

SHA512
0122eb4b3a0b396cfc9f3556ed0b7358dfb0ed9c8c7dedd0d80e0f6bf8cd44ed9f6683df1d2fc249238d80d03777ba67fe96c402acad681f8e7246bb856b1277

Download Submit
C:\Windows\System32\concrt140.dll

Filesize
326KB

MD5
c29b4fda897ca97ed7688968483e0ca5

SHA1
577226990967406561d2a3309b2ba5a6f9017c16

SHA256
e8fead0f66a0979b68d6e97c8f802cac45848ec2c304d4c0b8cafd758499cfe5

SHA512
67ded99678cbd146399f1738b2be24868fea3cd03cb4cad8fb33c3372c16b51ad7e105927334b1f1c2dc957f30dcd5db24c10084e9a9830066aab1dc3be7973e

Download Submit
C:\Windows\System32\msvcp100.dll

Filesize
593KB

MD5
4f096d96285e06cd51aef7d2d3de04da

SHA1
c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb

SHA256
5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8

SHA512
80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c

Download Submit
C:\Windows\System32\msvcp120.dll

Filesize
644KB

MD5
46060c35f697281bc5e7337aee3722b1

SHA1
d0164c041707f297a73abb9ea854111953e99cf1

SHA256
2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848

SHA512
2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a

Download Submit
C:\Windows\System32\msvcp140.dll

Filesize
624KB

MD5
c754fa2eb5badc2c841133b30dd004e3

SHA1
d5ecc6acdac2412db16cef50e80661e4760c1415

SHA256
eb51ce24ca7651b66be304308d96f12cd21a967ddcfb4f258ea32762a0fef8d1

SHA512
1f29da4456b28395dc0b57bf87880cfdbe42ae5a3b4ca110e7bde6619b9602d4afa8291a7e86f26bd7af2082e8ba2f2ecaf9b64828e74456ad317d005fcac03b

Download Submit
C:\Windows\System32\msvcr100.dll

Filesize
809KB

MD5
df3ca8d16bded6a54977b30e66864d33

SHA1
b7b9349b33230c5b80886f5c1f0a42848661c883

SHA256
1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

SHA512
951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

Download Submit
C:\Windows\System32\msvcr120.dll

Filesize
940KB

MD5
9c861c079dd81762b6c54e37597b7712

SHA1
62cb65a1d79e2c5ada0c7bfc04c18693567c90d0

SHA256
ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c

SHA512
3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7

Download Submit
C:\Windows\System32\vccorlib120.dll

Filesize
348KB

MD5
bdd8ae768dbf3e6c65d741cb3880b8a7

SHA1
91b01fd48a586822c1d81ca80b950f8639cce78c

SHA256
602add77cbd807d02306de1d0179cb71a908eecb11677116fc206a7e714ab6d6

SHA512
7840554a66f033e556cf02772b8b3749c593657ca254e0f2dbd93b05f4600e11ba821eba8fc038115c038b5e5af2f8d2cf0a5ae1f1362e813cf0b5041bbbff94

Download Submit
C:\Windows\System32\vccorlib140.dll

Filesize
385KB

MD5
eb1490c37200b232762a403b73cdc154

SHA1
f20ff1df4a9bab766a67f6101c27344d4c72fce6

SHA256
ae8790c615bd8d342c82a3979ecfe8eab21cf4e8a3f1ba88e969ce6449ea54a5

SHA512
c1ff04324f2fa658c98a6f3d46136e6a019bb776410f6e1e09d023ce64f92f20882d59d3faec950e9a4fd58a9f24adf1e6b5f0744e5adea46619135e9b29d84f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
5182c682898cc84f4f77c9a2598a7bc8

SHA1
996f4b27f25e0356893b90f0645f28c46d59fccc

SHA256
7c80f304e0c9db6d63fb4ccbcdc2e9754419e60e98cc7acffbb0021f6b650183

SHA512
15b19a3cef813f737dfac68e20426286c25933a9005db1ffab4d648c3575f689abfb0585a579c6a403cab5b9229beb0760408035a657419bbba9f7da24f4ecbd

Download Submit
\??\Volume{27bfae7d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d677b1cb-a383-43fa-9c6b-b1238b784294}_OnDiskSnapshotProp

Filesize
6KB

MD5
a370e4b9e3205aa612c8c6875c2a4de9

SHA1
009be26a4f303184d3298dbf0525b7b08b87c396

SHA256
7a7ec19139007eee1bbd23d76a57f4ae290f28cc9ed8b4e86c86394ebbe3b324

SHA512
6dfdb4e5bdddf76a784b35ccae2aa1a087724fd85cacd4862032a4293b8a9c3b8ce338f5972f836b191d49442900ae54cd254f66374e07464b04fd8aa10b7fa0

Download Submit
memory/4944-324-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/4944-320-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Filesize
40KB

Download
memory/4944-316-0x0000000004D90000-0x0000000004DBE000-memory.dmp

Filesize
184KB

Download
memory/4944-325-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/4944-326-0x0000000005530000-0x0000000005AD6000-memory.dmp

Filesize
5.6MB

Download