Analysis
- user interaction
yes - max time kernel
211s - max time network
248s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 22:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/DxO.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/DxO.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
35 signatures
150 seconds
Behavioral task
behavioral3
Sample
(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/dxo..exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/dxo..exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/dxo..exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/dxo..exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target (DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/DxO.exe
- Size 373.9MB
- Sample260702-13mn7act6p
- SHA256 285930cd7241e1ff2385ff6338e54468d0105254444fe542d637c24212b1e24b
- MD5 ec1aa7c494693df80dd5c88f4328ec58
- SHA1 3c08a7d2581b898240b45eab52da1f7f20882e8b
- SHA512 d23207277bcdedff0b43d0278dafa6562ae05e08bc88eb21f0ccd3c1bee750118e57132180dbaea35922aa8fa3e5bece2af61622b2da473ceccc2fb9e04c132f
- SSDEEP 6291456:KSZuGWLynRDWzcMxbse30+fZut7gLRyTJEcT8eJdmhfroVPclJUySs7xt1znbdv1:v0H8R69bse30+xpteE88eJ52lJVSG31f
- TLSH T18B1933C5E2DCB1F3EC8FB0779F30A10191E0BC431B7E80BA56E5A891159E5F8B696742
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
afra
C2
-
alexisfargo425.myvnc.com:39558
Mutex
-
QSR_MUTEX_dtdSKBHJ4zlrRzcS9c
Attributes
-
encryption_key
MGcPZQ36T3BRZDuPXtu7
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/4604-2577-0x0000000000C20000-0x0000000000C7E000-memory.dmp family_quasar - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 5936 msiexec.exe 10 3340 rundll32.exe 12 3340 rundll32.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 6012 netsh.exe 4552 netsh.exe - Executes dropped EXE 4 IoCs
pid Process 2592 DxO_PhotoLab9_Setup.exe 6084 DxOPhotoLab_9.2.1_Bootstrapper.exe 2740 lightroom-versions.exe 3548 Your file name without extension goes here.exe - Loads dropped DLL 58 IoCs
pid Process 3784 MsiExec.exe 3980 rundll32.exe 3980 rundll32.exe 3980 rundll32.exe 3980 rundll32.exe 3980 rundll32.exe 3784 MsiExec.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 3784 MsiExec.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4100 MsiExec.exe 3784 MsiExec.exe 3488 rundll32.exe 3488 rundll32.exe 3488 rundll32.exe 3488 rundll32.exe 3488 rundll32.exe 1576 MsiExec.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 4348 rundll32.exe 2632 MsiExec.exe 2632 MsiExec.exe 3060 MsiExec.exe 3060 MsiExec.exe 2088 MsiExec.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3340 rundll32.exe 3060 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\ msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcruntime140_1.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3548 set thread context of 4604 3548 Your file name without extension goes here.exe 130 - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DxO\DxO PhotoLab 9\SharpDX.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_CanonG5XMkII.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\10 - DxO FilmPack Time Machine\1856 - Nadar SP.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\7 - DxO FilmPack Designer - Color\Glamour.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\8 - DxO FilmPack Black & White films\Kodak Tri-X.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\9 - DxO FilmPack Color films\Fuji FP 100C.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine8\img\1920-4.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_2911.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_3245.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_3248.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon70D.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\de\DxO.PhotoLab.Correction.CreativeVignetting.resources.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Lut\05-Golden-beauty.cube msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Plug-ins\DxO.PhotoLab.Correction.WhiteBalance.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\img\1800-6.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_3219.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_2189.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\fr\DxO.PhotoLab.BatchRenaming.UI.resources.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Plug-ins\DxO.PhotoLab.Correction.FocalLength.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\9 - DxO FilmPack Color films\Fuji Superia X-Tra 400.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine8\fonts\Montserrat-LightItalic.ttf msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_3253.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Lut\Premium.json msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\DxOHub\fr.html msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Licenses\WpfAnimatedGif license.txt msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\9 - DxO FilmPack Color films\Kodak EIR.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\img\1940-1.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\DxONET.CorrectionEngine.Interfaces.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_3238.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon1100D.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon650D.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\locale\en\en-1990.json msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine8\img\1990-3.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_2043.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon1DMkIIN.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine8\css\layout\nav.css msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\DxO.PhotoLab.Compatibility.V10.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicFZ300.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicGH1.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Plug-ins\Export\DxO.PhotoLab.Export.OpenWith.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\7 - DxO FilmPack Designer - Color\Desaturated Green.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\locale\en\en-1920.json msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\CameraBodyTables.dxoJ msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\7 - DxO FilmPack Designer - Color\Fuji Eterna Bleach Bypass.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\LensCalibration\LC_3206.dxoLC msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon80D.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicTZ100.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Licenses\Lua license.txt msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\img\1963-n.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon400D.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\fr\DxO.PhotoLab.Import.Favorites.resources.dll msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\locale\en\en-1930.json msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon5DSR.dxoMN msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\6 - DxO FilmPack Designer - Black & White\Expresso.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\6 - DxO FilmPack Designer - Black & White\Fuji Monochrome + G Filter.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\Presets\7 - DxO FilmPack Designer - Color\Fuji Velvia Vivid.preset msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine6\img\1960-3.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\fonts\DMSans-Italic.ttf msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\CameraBody\CB_CanonR50V.dxoCB msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine6\img\1960-5.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine6\img\2000-1.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine7\img\1995-2.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine6\img\1900-4.jpg msiexec.exe File created C:\Program Files\DxO\DxO PhotoLab 9\de\DxO.PhotoLab.CafManagement.resources.dll msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\System.Text.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.Numerics.Vectors.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Numerics.Vectors.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\Microsoft.Bcl.AsyncInterfaces.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\System.Runtime.CompilerServices.Unsafe.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\{82ADF9A5-4C74-42A1-A418-AEBBAE3B8DCB}\DxOApp.ico msiexec.exe File created C:\Windows\Installer\e5abfd3.msi msiexec.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\System.Memory.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\System.Threading.Tasks.Extensions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\Microsoft.Bcl.AsyncInterfaces.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\System.Threading.Tasks.Extensions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1B2C.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\Microsoft.Bcl.AsyncInterfaces.dll rundll32.exe File created C:\Windows\Installer\e5abfc7.msi msiexec.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Buffers.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Memory.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Text.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Threading.Tasks.Extensions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\System.Text.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\DxO.PhotoLab.Installer.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\CustomAction.config rundll32.exe File created C:\Windows\Installer\{82ADF9A5-4C74-42A1-A418-AEBBAE3B8DCB}\Setup.ico msiexec.exe File created C:\Windows\SystemTemp\~DF42477841B164A68F.TMP msiexec.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\System.Buffers.dll rundll32.exe File created C:\Windows\SystemTemp\~DF63EC01FCA320B87A.TMP msiexec.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\System.Buffers.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\System.Runtime.CompilerServices.Unsafe.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC322.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI1185.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\System.Numerics.Vectors.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\Microsoft.Bcl.AsyncInterfaces.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.Runtime.CompilerServices.Unsafe.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.Threading.Tasks.Extensions.dll rundll32.exe File created C:\Windows\Installer\SourceHash{82ADF9A5-4C74-42A1-A418-AEBBAE3B8DCB} msiexec.exe File opened for modification C:\Windows\Installer\MSI183D.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\System.Text.Encodings.Web.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.Text.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\e5abfc7.msi msiexec.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\DxO.PhotoLab.Installer.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\Microsoft.Bcl.AsyncInterfaces.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\System.Numerics.Vectors.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA75180A3D034A4B296BAE1BAB668D6B16\System.Text.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\System.Memory.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\System.Threading.Tasks.Extensions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\System.Runtime.CompilerServices.Unsafe.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\System.Memory.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5D4CA9A98243A369257688AFBE3E2F39\System.Text.Encodings.Web.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.Buffers.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA32EC6E0B1D4170B95AB11A15867F7A10\System.Text.Encodings.Web.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Text.Encodings.Web.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\DxO.PhotoLab.Installer.CustomActions.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\System.Buffers.dll rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5512 4604 WerFault.exe 130 - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language installutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DxO_PhotoLab9_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DxOPhotoLab_9.2.1_Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4860 PING.EXE - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d87d4b0f84cd93ec0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801d87d4b0f0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101d87d4b0f000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3d87d4b0f00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6d87d4b0f00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.jpe.9 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.jpeg.9\shell\Open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tif\PerceivedType = "Image" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pef\shell\OpenPhotoLab.9\ = "Open in DxO PhotoLab 9" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.jpe.9\shell msiexec.exe Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.rw2.9\shell\Open\command\ = "\"C:\\Program Files\\DxO\\DxO PhotoLab 9\\DxO.PhotoLab.exe\" --mode=openwith \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.raf.9\shell\Open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.tiff\shell\OpenPhotoLab.9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.arw\shell\OpenPhotoLab.9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pef\shell\OpenPhotoLab.9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cr2\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.pef.9 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\DxO.PhotoLab.3fr.9\shell\Open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\OpenPhotoLab.9\Icon = "\"C:\\Program Files\\DxO\\DxO PhotoLab 9\\DxO.PhotoLab.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.arw\shell\OpenPhotoLab.9\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DxO.PhotoLab.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A9FDA2847C41A244A81EABBEAB3D8BC msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\OpenPhotoLab.9 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.iiq.9\shell msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\.dng\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.dng msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.crw\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ori\shell\OpenPhotoLab.9\Position = "Top" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A9FDA2847C41A244A81EABBEAB3D8BC\VC2022Redist = "ProductFeature" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cr2\shell\OpenPhotoLab.9\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.3fr.9 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.nef.9\shell\Open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.arw msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.raf\PerceivedType = "Image" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.rwl\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\DxO.PhotoLab.dxo.9\shell\Open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cr3 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.ori\shell\OpenPhotoLab.9\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.nef msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B0EA428732EFEA4EA6C80CBBCBB3CD9\5A9FDA2847C41A244A81EABBEAB3D8BC msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.srw.9\shell\Open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.arw.9\shell\Open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.nrw\OpenWithProgids msiexec.exe Key created \REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\.mrw\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ori\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\OpenPhotoLab.9\Icon = "\"C:\\Program Files\\DxO\\DxO PhotoLab 9\\DxO.PhotoLab.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cr2\shell\OpenPhotoLab.9 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.dop\shell\OpenPhotoLab.9\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DxO.PhotoLab.exe\SupportedTypes\.dxo msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\OpenPhotoLab.9 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\DxO.PhotoLab.cr3.9\shell\Open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.3fr msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.orf\shell\OpenPhotoLab.9 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.arw\shell\OpenPhotoLab.9\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.rw2.9\shell\Open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.iiq.9\shell\Open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.nrw\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.crw msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mrw\shell\OpenPhotoLab.9\Icon = "\"C:\\Program Files\\DxO\\DxO PhotoLab 9\\DxO.PhotoLab.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dxo\shell msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.pef.9\shell\Open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.nrw.9\shell\Open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.jpg.9\shell\Open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxO.PhotoLab.nef.9\shell\Open\command\ = "\"C:\\Program Files\\DxO\\DxO PhotoLab 9\\DxO.PhotoLab.exe\" --mode=openwith \"%1\"" msiexec.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4860 PING.EXE - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2652 schtasks.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3696 explorer.exe 3696 explorer.exe 6084 DxOPhotoLab_9.2.1_Bootstrapper.exe 6084 DxOPhotoLab_9.2.1_Bootstrapper.exe 5004 msiexec.exe 5004 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3696 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe Token: SeShutdownPrivilege 3696 explorer.exe Token: SeCreatePagefilePrivilege 3696 explorer.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1676 sihost.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 5936 msiexec.exe 3696 explorer.exe 5936 msiexec.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe 3696 explorer.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2852 StartMenuExperienceHost.exe 4832 SearchHost.exe 3696 explorer.exe 6084 DxOPhotoLab_9.2.1_Bootstrapper.exe 6084 DxOPhotoLab_9.2.1_Bootstrapper.exe 5936 msiexec.exe 5004 msiexec.exe 3784 MsiExec.exe 4100 MsiExec.exe 1576 MsiExec.exe 2632 MsiExec.exe 3060 MsiExec.exe 2088 MsiExec.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1676 wrote to memory of 3696 1676 sihost.exe 91 PID 2968 wrote to memory of 2592 2968 DxO.exe 98 PID 2592 wrote to memory of 6084 2592 DxO_PhotoLab9_Setup.exe 99 PID 6084 wrote to memory of 5936 6084 DxOPhotoLab_9.2.1_Bootstrapper.exe 100 PID 5004 wrote to memory of 3784 5004 msiexec.exe 103 PID 3784 wrote to memory of 3980 3784 MsiExec.exe 104 PID 3784 wrote to memory of 2684 3784 MsiExec.exe 105 PID 2684 wrote to memory of 2740 2684 rundll32.exe 106 PID 3784 wrote to memory of 4548 3784 MsiExec.exe 108 PID 5004 wrote to memory of 4100 5004 msiexec.exe 109 PID 3784 wrote to memory of 3488 3784 MsiExec.exe 110 PID 5004 wrote to memory of 4448 5004 msiexec.exe 115 PID 5004 wrote to memory of 1576 5004 msiexec.exe 117 PID 1576 wrote to memory of 4348 1576 MsiExec.exe 118 PID 5004 wrote to memory of 2632 5004 msiexec.exe 119 PID 5004 wrote to memory of 3060 5004 msiexec.exe 120 PID 3060 wrote to memory of 6012 3060 MsiExec.exe 121 PID 5004 wrote to memory of 2088 5004 msiexec.exe 125 PID 2088 wrote to memory of 3340 2088 MsiExec.exe 126 PID 3060 wrote to memory of 4552 3060 MsiExec.exe 127 PID 2968 wrote to memory of 3548 2968 DxO.exe 129 PID 3548 wrote to memory of 4604 3548 Your file name without extension goes here.exe 130 PID 3548 wrote to memory of 4604 3548 Your file name without extension goes here.exe 130 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual\DxO PhotoLab Elite Multilingual\DxO.exe"C:\Users\Admin\AppData\Local\Temp\(DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual\DxO PhotoLab Elite Multilingual\DxO.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DxO_PhotoLab9_Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DxO_PhotoLab9_Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7zS02AB2F89\DxOPhotoLab_9.2.1_Bootstrapper.exe.\DxOPhotoLab_9.2.1_Bootstrapper.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\7zS02AB2F89\DxO.PhotoLab.Installer.WiX.msi" INSTALLERDIRECTORY="C:\Users\Admin\AppData\Local\Temp\RarSFX0" /log "C:\Users\Admin\AppData\Local\Temp\photolab9_install_log.log"4⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5936
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Your file name without extension goes here.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Your file name without extension goes here.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4604 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:2652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uUf7oz6PCd9B.bat" "4⤵PID:1316
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:1872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵PID:5472
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 23284⤵
- Program crash
PID:5512
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3696
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2852
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 42140B5710AEA8CF5BC8FEE1CB845570 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3F9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240780406 1 DxO.PhotoLab.Installer.CustomActions!DxO.PhotoLab.Installer.CustomActions.ProductHelper.ValidateInstalledPhotoLab3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3980
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6E8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240781109 8 DxO.PhotoLab.Installer.CustomActions!DxO.PhotoLab.Installer.CustomActions.ProductHelper.ValidateInstalledLightroom3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\lightroom-versions.exe"C:\Users\Admin\AppData\Local\Temp\lightroom-versions.exe"4⤵
- Executes dropped EXE
PID:2740
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAE0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240782078 21 DxO.PhotoLab.Installer.CustomActions!DxO.PhotoLab.Installer.CustomActions.ProductHelper.ValidateInstalledLightroomPlugin3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4548
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6D84.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807328 28 DxO.PhotoLab.Installer.CustomActions!DxO.PhotoLab.Installer.CustomActions.CheckInstallationFolder.CheckInstallationFolderCustomAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3488
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 24D9B8724C1EACFAC60FD85759140267 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4100
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4448
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 199864F8FDD41173622B701BF8FABA852⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC322.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240829640 2 DxO.PhotoLab.Installer.CustomActions!DxO.PhotoLab.Installer.CustomActions.ProductHelper.ValidateInstalledPhotoLab3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4348
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D0D30359784DB91917D02966EDE24F9A2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 866C5206C9D4BCB3DD629C77BA01C63D E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" advfirewall firewall add rule name="DxO PhotoLab Installer" dir=out action=allow program="%SystemRoot%\SysWOW64\rundll32.exe" protocol=tcp remoteport=443 profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:6012
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" advfirewall firewall delete rule name="DxO PhotoLab Installer"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4552
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9820460C88215BEBBC44E221AEAE5974 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI1B2C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240851843 28 DxO.PhotoLab.Installer.CustomActions!DxO.PhotoLab.Installer.CustomActions.DependenciesHelper.InstallDependencies3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3340
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4604 -ip 46041⤵PID:1996
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_Canon5DMkIV.dxoMN
- Size 576B
- SHA256 502c6d8e223962741b2f25445dc08043e237733ff912f8f3b4d16f8364b8b2a6
- MD5 a8b7c1794248dd423c0615736d8275f4
- SHA1 8c1974c06f00e09804aa96e277f9f1229d213c69
- SHA512 6c32fceac9bd34dada5fe55d9803167ae2c658fa46f996a3d2ba75d711d1c64655eedf400ce7aded8f4fb8af3eaec59a5653f5c7a24d210c0565bfd093de795b
- TLSH T153F096D0BF22D42C1689D8E2E24E3C083BF2896403377E9139D54EB1C9A215EC02D566
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_CanonM100.dxoMN
- Size 560B
- SHA256 e399a5900a73ab703d3111d6ec80a4ef1a94e6ea222bfdded91a021de598ccd1
- MD5 4f8082597c0758865bdffc2c2ede2e70
- SHA1 36a806af99956dbdc25f4a33169ac9ca437f412f
- SHA512 80f5dba41185e77f0890439bc4c4475288662f60689685283e0fe9b679c22f45dc7b281c5986d4eda11a551e6499b893e39f78512dc6e34eaeade5f6a41af8ff
- TLSH T16BF026B8A715C170009D21FA298267E2413A7A1F337D91376DC01D7E53EB859C39F008
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_CanonR50V.dxoMN
- Size 560B
- SHA256 5aedb8c3cfba6da6ee0d88e132708d9fb771862cb4320227a8b1d1a994c8b671
- MD5 4260b4631e5df486b3218fd6124ede93
- SHA1 b03b83e233f65b2414cac0b8d5a8cf24f56b7f88
- SHA512 4ef2bef8926baf4ad67d8bac2b58055b19c070e2a588d351259739a5d1bb245067f98aa7720bead1d4ccdd16a92ffd5b25d0c726d517a3e724433e10572f37d3
- TLSH T118F0E1185F56C9E064948D7E6C78E5770F7329F0480636253D787571FA7818A0B19091
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_CanonS110.dxoMN
- Size 512B
- SHA256 195cf6c60257b1710dc97fa78346defdfdcdd7e09400db7f3a2a3f0fd614097f
- MD5 b1ef614978a20793331a7d2bf97ab516
- SHA1 cd403ca7806b1064946f108c8e868627fc8b4b62
- SHA512 525f5b472dac51a41594d942e07677dca6ded42573609f981665dd45dc3ec4600c587d802aa3b9e713eb77fd2faaf9a61d65e1c1dd4df191281dafb4a792decb
- TLSH T16CF07E24314C012C2928CAD4E090252A96F4EB42408E0E00538EBAEA81973FBB884889
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicG80.dxoMN
- Size 272B
- SHA256 6af7ad52e49eafb55dc2b3e7f5edd778e5738948299da0a0ea1bc302dff04c6c
- MD5 c4ce4a755ac7984f46def7c9258c6350
- SHA1 14c351bdf94ad02c1e7e13eef17137611ed4ff1a
- SHA512 c26d640200e7a4f8c255085dd69a2bcd84556ddbcdcb6b83dae5c6146e5d7dee19a3cbd94adb489c8339481842b6bac708116abf25577d6cf9e162dc1879de35
- TLSH T187D02BBA14311D016B06D1E14478AA6EDA15AD8186685D4DB133604F8082E9F588F917
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicGF1.dxoMN
- Size 272B
- SHA256 518d1145679bbac8ac65a7a21888f275ef33508d46c9fe62a2613fcfe8a309f6
- MD5 8722437e4e7d248446c8ec42a526c5d6
- SHA1 ec187e5a93e189385031fb43606436862a3ea344
- SHA512 b78cd401531aaffe44f6702970b9cf42e12085f5f24067e3e8b514a433e1535b8f0378e59dcd788fd84d0995f762ababe68c7a0257a3a212b1f222aaba0a3f01
- TLSH T1FED02B6456045B941239A0444F0DE8A87201C2B59E63914459CCAE4BA4E0E67A83B6F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicLF1.dxoMN
- Size 272B
- SHA256 40c0b886971537d4c4428e6454021add2f68c4843934c0d64c6b1520e61a4a4e
- MD5 b8cc382f0131fe3a3f30ae9e2a5bbac6
- SHA1 ccf5fd943b6016a0e55e56d91eb9d2889f41195f
- SHA512 a7e78534d1065011a9f902d739be14097efd13ac0fe416fcc1f4d1547593f40cf77149fea6b28e64006c5aee232bf69b67b4e3fc905729d118d973730c90f4e1
- TLSH T159D0EBE10BFE4E9A00754152421B48E2FC49C2A0F80BCC782B11284FB51364A34DF236
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\CameraModules\MakerNote\MN_PanasonicS5IIX.dxoMN
- Size 288B
- SHA256 a0db74404ba0bf524f4bbce95ec3ec1cf58c48d022f447e878eca87b0d0632f6
- MD5 317cdaac559bff4057980637e45a2cc6
- SHA1 62e229fb30d2a56f6843e3a38b33b4630341d8aa
- SHA512 738a4dcc2546c44179c0984f183e5ea49d226826a4debaee5f264ae6a19ea9f128dfb492bd94afcf12d12366609d976329d6443468728851b95fa40a3df646c8
- TLSH T155D0EB86EC688AEA43D08C3E31AD1C6A09978EF26BD0CC518720FC89304622692033C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\DxO.PhotoLab.exe
- Size 17.2MB
- SHA256 dfa47c0f8623a9f453c67c7e1877dd11e44de202d1f08c322f4773364e22661e
- MD5 641fc5ba6f15322a3a09e950f6ca9c49
- SHA1 2b7a84820cc6dbc75a821a4ec46cb4916058d998
- SHA512 0f0c4ac6a951b08d60031ca07ec4abd6d9206a5c5a94e604904f4ebc769b97ceb88bacd9cd412106191e02735bfcee23bb34f796966c232b4a97fdb0370b36a1
- SSDEEP 393216:Zyy9fwUwXWO+gPrLsyFoGCnI0gmnaEVQ5s8RiNffQ:Z7JyXd+mLsyeGCqmna4Q5s8Ifo
- TLSH T15107121073EC8E25D57B0B35542100BB46B1E8669B12937F387C785A1EB2BC07F57AAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\DxO.PhotoLab.exe.config
- Size 27KB
- SHA256 4f888799907341dc38525a2e50cd1042727c5a6cfa7b433181a7e6ca4a29d609
- MD5 675210885f2d6b12a5a90bb5d89a09ac
- SHA1 51367336996873d0b2e4ca7db7cb103802a576a0
- SHA512 b1957e4003fb44c921a1ed6977604abc2d5a664f5b9bee35863b366d1c763519c7b9c739165d17104cf5c885a5130746fcf54f109966ee828156e0ada16bb3dc
- SSDEEP 384:yyXwK7l757A7fMwK7n7/7S7l7q7L7b7L717P7r9n8Z2EFkUCl+1GyaqUQv5IBV:s369nICAEZ5Qvg
- TLSH T11DC2061CB1C1AFAA12726631EA3152D5EEB006231176B0F478ED31675F71CDA0AE37B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine6\zh.html
- Size 83KB
- SHA256 db43e86b40fc0b697cbc7c693457b01539e0f3a74f1c11b58aff76fdafbb7995
- MD5 2a8c9d1feb2febb28efa727c727fdabe
- SHA1 09e6d4f280fabfe4de114fbce230a0a852499b67
- SHA512 09e0411881fd69f4e5bd96d0d06ba9bf03c850ae7d886feab36c285eca3a7e14afca9eed1dc50c1928bdb7feed4cbec18b1596f143559d83184417580ff533c7
- SSDEEP 1536:FJY+Z2TEG/sC9fBcNBePCVMUeQ3g8BVeMNF79Wrk/I7MgP5:FTZYsC9w0PCV7XSMmj4i
- TLSH T1C9835C25736E0ECF0591A3CE8304919A745C7B6F666BC658BF9FEBA967D4F280304603
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\DxO\DxO PhotoLab 9\TimeMachine8\zh.html
- Size 149KB
- SHA256 cc99bd372f7ff8c3fe8026caba6e44bc049e8467d53612ff1b9cb3577c1b9638
- MD5 ca02d21b0e86e910d45fe4be4b6228a5
- SHA1 6610a917262903d1b3b274bbc6a431c804964454
- SHA512 593aed6a7e8199843bac77625444a9487b243c37b22f76180322066aeeeeb5d0100dce3fa3e7fb4852eda0e383e3a1ea646b44691eec0778ff4e463ace1d0dd6
- SSDEEP 3072:8JZasnYpXfi2PCfs/O9KRg3gsRkGI5AXmj:8/asYZ6iCfsm9KR2nGAX0
- TLSH T1D5E33A19E3690ED9044111EE87048196308C6B8F5E7BEA1C7FDE965E5F9CB1F03B4A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS02AB2F89\Data6.cab
- Size 27.0MB
- SHA256 d2f02cba6031128f1f24b2a9009e37261d571fd7b2a2fbc5a3571070569075b6
- MD5 d7d8d6ddfdc898d4e40182222b75130f
- SHA1 9c45b8a683297405f7a92f09123061b50178d7fe
- SHA512 d9116138f1c0712a1488b5916e01be110de4868651ec4f0a937a518e95968674b691a045a2867b259c3fe2cdad648ee182e705b7ea8ed229394a3785b9d603d1
- SSDEEP 393216:W10U0BCDID3D3D3DDD3D3D3D3DD/4x1zTeFp9Y:W10P21m2
- TLSH T1445711EAC24458D5FC0D9CBCE83E7A99240AF4BFBDC0E18435EDD92ED2539DA4610E85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS02AB2F89\DxO.PhotoLab.Installer.WiX.msi
- Size 4.1MB
- SHA256 5218902b67e892872fcd4591dc476b0658c559db0bf6553e9a4cd434fdc3a85e
- MD5 825c69c7a5b9c97d867afce0097dd8e3
- SHA1 1bc8ec0b0d0f1e3747160882d96020796a22895b
- SHA512 44f376adc7674adaa3b46b83afbe1a41cd82ddf77a8dda9a5531e57a02c5c00e366a6680b75c6f9321edfc39cd2b22076dac7c2438021c4d12373244dd732c78
- SSDEEP 49152:5mQXNWcfwwx+KV+KREYw2BKbMWvupPgMFuW11xPD5yvgxc4JpMrWja5/Tdt:EQAcfHYKVTFKxvMMR
- TLSH T15D165A697E08E921C55147B8C902E0FE6D796C00F2758527A27ABC2F383E9F8B377549
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS02AB2F89\DxOPhotoLab_9.2.1_Bootstrapper.exe
- Size 2.1MB
- SHA256 48e938a9170cf4328b4f3699808b5e9c9fffbc7ced80595312a95aefe30ff237
- MD5 f5754806297d9253b24fe3506e8c1fd2
- SHA1 8f1267a82bd97b0091bc623f4a041655a9ea8c12
- SHA512 3d41997943ce73327d787a4edf529ff2206814b3894fb479402d298b95439e112df6ac4eb60cddd6ce7a1a83717bd4c21fd6bd91b26c041e9a4274da3b8488b9
- SSDEEP 49152:J36nfyDDj8QAdmS4RjcWgjs4dOEHt6R/EUeZd5uBp4q7f6N/:J32fEkQA49dcWgjs4dOEHt6R/NeZd5uQ
- TLSH T172A55D313644C067C53313305E5CF37BB2ADA77887B94DC76694BB1D2A36C82892A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3F9.tmp
- Size 638KB
- SHA256 186f0f56647abfa6aef90a754e9f42bb0b5b761783530294c0e9ff9ecea36b40
- MD5 431d910149ea1aceeae394cef9c57c1a
- SHA1 8a01c3a15e167dc495f73334ff61621396d53eaf
- SHA512 48fd99fe3d1669865b15e55938d798969ce3301fc49784152557fec941a2a8c02106ec4fe42ddfc8e7514aac93c9af9968ce2c68df7cf1fde08765d984f90b2d
- SSDEEP 12288:WqEahS/QQqdUKlLvYcZf8m/RWtIbRtT+lQe0nf/lHe+iH+OKREnn:WQXdflAcZ5QtiRx+lQ3nV3iHnKREn
- TLSH T100D4014079D48135F4FF183469788A651A7FBAA09B608ECF67484E6E4E307C1CB35B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6CE7.tmp
- Size 175KB
- SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
- MD5 543072c649a87e1880784b7f0effaeeb
- SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
- SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
- SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
- TLSH T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Your file name without extension goes here.exe
- Size 7.1MB
- SHA256 87647a9777f37ac7aa45535fc5b3be3685c1f64b35bc1ace25bb8c6a4dcdcb14
- MD5 0b747858d671c100a7b92dc16133c071
- SHA1 e720e8969c798854373a16b649a2ac8a4a001d87
- SHA512 28d5863f209dd00fc0857983be7bc4922f1232dc94c7d1afb411a7f50dbc3283877b3199002af39e0d83463f001e7c6bed3d2bde6b7621f47939723c9113bfdf
- SSDEEP 98304:qQ3sHMama56vaievWe0rTVTejgLTlbG1wfiKr:q2ssama56vMO31ejgta1w
- TLSH T19976BE1993A804B5D82BD738CA65C733CAB0BDA24635D50F099DF6461F33A628F2F725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lightroom-versions.exe
- Size 313KB
- SHA256 d5fadea75ab8669a01499d53c2c6e3ed8577a7169e89d38216efefcac30aa8f4
- MD5 afc28cbe8f2619375d74d7e1026418d3
- SHA1 164f8714a66eb5e5286e8991f2b1fe8fdee3fb50
- SHA512 5de32baf21033787bcc224b7367369cdc2ce166f19f7393b21226cfc11297db52b423abdf50d5303810b9587f45c28bcb6d45c2a9459481c879dee5be8223665
- SSDEEP 6144:UIIEo1sdeKVeInQT1SDL3wn/TotalEZBKmiAnK3Q:UMveKVebZSP3WotkmJnKg
- TLSH T1BA648D56B3A404F8E9B7823CC9934906EBB27C164761E7CF03A0865A3F276D09D7E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\photolab9_install_log.log
- Size 10KB
- SHA256 6ba2d6c51558b1207572ceb5690fe32f8c6f71436c106c01096cf24d17d9053a
- MD5 759e0d8536e340c34a4d2ee214f847a6
- SHA1 4537a1bbf3fce8fe8b073653d40c0073cbc6c1fb
- SHA512 3abc10495f8df70c208d5af8f80210e82b06a54f1585c43495391a52d2a610ed036a27a2fe6246fce5c57408b8ec9be2ad7669ecd9f8d16480c9ac8d56bcc711
- SSDEEP 192:b6T8Of9Vebl/9gbMgK+CZd8yU9Lb67Tt2wIBGJG/wQ0:cKUM0iJOM
- TLSH T191327F299BF8525CF1F3DB43AF3B14644E73BC9E9936EA1C2281414D04B5A05F9A0BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\uUf7oz6PCd9B.bat
- Size 220B
- SHA256 0665360bc2dcc8647c9a5e425791686acb720671d50cd55238ff4ca5d55d0786
- MD5 b5762ca762e40e52e50c543291af9ae7
- SHA1 949fcf300185faa686d6c13d0f3599ae9f921466
- SHA512 4776873c4c7a95c39a00f9ac3d53909c547ce3b069998ebebe902180f59d0838d612011334450ffdfd9cd6ae9f28aa594a3a98b26b192448f3b6bbec473b5fba
- TLSH T175D023C11351CE69D7346D4538562654718A54D73905BD62C00A48694787CDCA9577C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIC6CD.tmp
- Size 390KB
- SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
- MD5 e8dc682f2c486075c6aba658971a62cc
- SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
- SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
- SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
- TLSH T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\DxO.PhotoLab.Installer.CustomActions.dll
- Size 44KB
- SHA256 0dd82f4bca1b5904c901b8cb8de6fa13de127b1f34ca9363dfd56eb572722d48
- MD5 c8aa6c9c866f2a54fefe9d6cec04d519
- SHA1 56fce74af291523b50c711f8c965992008450792
- SHA512 116a4950226bd25b47f0da89239c5e06e5a2c92a0da31dfb3eb30e0863fdb6ee10bbb433ccbe431ca8481030e8e47633c5ff64fa5cb529a90ba66c9c1bda3266
- SSDEEP 768:7/vuyon0U/5F+6ThJ/xr5ZwbR5YiLdGp5ALD:7zFyThJ/xNKbf7LdGA
- TLSH T177237B9187F81926D8BB3BB8B5B65671D771F70B5930C60E38A4904F8FB131269D03BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA65DD57BCD94C3DDBF9583B0CFABA9816\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
- MD5 ef8d5785ac8669f5fd54e22f52770e6b
- SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
- SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
- SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
- TLSH T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
- MD5 ff34978b62d5e0be84a895d9c30f99ae
- SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
- SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
- SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
- TLSH T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Runtime.CompilerServices.Unsafe.dll
- Size 17KB
- SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
- MD5 c610e828b54001574d86dd2ed730e392
- SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
- SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
- SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
- TLSH T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
- MD5 fa9d0d182c63c49a4c567f7c1652b6e6
- SHA1 55ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc
- SHA512 58f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7
- SSDEEP 1536:AOOgOOOc2yQDmBkKQh39thfavqcdUIUdu4OzfocSWnO73TT+zo:KyEmXQh39HfavqEUTjOzfo5WnMO0
- TLSH T198735E12A748C75AC75E153256A085619BF0DF6F2313F782585CB81E2B733C9EA0E2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Text.Json.dll
- Size 629KB
- SHA256 86c3f263ae9b4469ab1266c80471087082447eb4a38e6b97bf5e84de15c07a1d
- MD5 d7e1e8629da31f3482045f243edd50be
- SHA1 d3ad7f529c0b9232206348842e31566ad7347135
- SHA512 0ebfcae7cf17ca0c4299f6d1cd850f0f8959b49e6bbc05079fa6679838abff9eca3a09ad8158f7b0395dabb20a0b9a25efe1d8f645ca9ef69bedce45606a23d3
- SSDEEP 6144:oQ4zRvmmBhTxZOnAHqBfFgICCSToJkR4mUfimb7MVM8iHtoqurICVLeV+kctqWan:BmhZBAXM3eVcTQKiyfVtQ1RCHe
- TLSH T1E4D43A0467E49F3BEADF5370B07941249BB5F81A6329E78B520844E93C937D29D837A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.Threading.Tasks.Extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9F1552521A4B32DA8B75C56A95A94250\System.ValueTuple.dll
- Size 24KB
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAFC9F3812AF42FFAB4879F3398443FC57\CustomAction.config
- Size 1KB
- SHA256 61e7c0e34748682b96cd1c31276746bcae22ab4872afcf97e51475e55208a338
- MD5 56bfe4f513ee7e8c75f47ea6a41cddeb
- SHA1 d706efdace8c27c6ff8a41c68c34f6d936d4c022
- SHA512 44924f6193b5db1f4553390db40933a1efe26b306b8fd4b97e65c51504be8af9c8e8729b09f491b6f75b97f024903d8c9366820291d0f30b37767bb1727edc79
- TLSH T1C3314F1589C86BB61A3126A33E6AA0D8CB6943B73C8C415C70DFBD074F35D6912232BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\concrt140.dll
- Size 309KB
- SHA256 2dc2276ce389e3ca2240984d83ab869fbf4a99ba14af375fee28709063e654a7
- MD5 e06841a13c3c808609af88fd2a36d74f
- SHA1 ae06e4445fa455db9b40bd46f179d0918452b5b4
- SHA512 40e4c46c15aa3afd2fb9c5b8bcba62a2aedb33100f92a932937e9f88426a44146511ec25af387257e152b376d380e7e3ba0b448c6d709968f5d7d0deba6a9812
- SSDEEP 6144:EVvUj+bd59STgnNtVsUxPZAVHwtUbPdRs8Ew5VnWzgBoSDiBLp:evNbz9DtmUxPe3+zm09
- TLSH T13264179A76540CE6F96790398653890BE6F3BC016326D3CB0274839F6F537D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp140.dll
- Size 558KB
- SHA256 4176d8cab80e035b165eb1769047daeddc4f31f965d28578f45ae0d99e7e7c40
- MD5 34d7f648ce9550ff11f8aca24a5da769
- SHA1 b544b0d7c1cba2c97ee2775f855d0b68ab6663d8
- SHA512 8d9c8edbec0b45596f7a680341daa7873df2bbce2c7eba7ad0873c35f70e633fd7ee3b277562546d7cd13e0a71a351f17f9e43c6a1993a1e179329f64d7e9739
- SSDEEP 12288:Q1emQJb7Knk8pZJ/77kd0AbhgzKeUzTz1Y3iRInxVek2ha0tQEKZm+jWodEEVJxc:Q1Mm4Isa0tQEKZm+jWodEEbq
- TLSH T11EC40927774906A0E195A3B8A1C78305D7F1BC4A8312A3C752FBD66E2F5B3D1673B290
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp140_1.dll
- Size 24KB
- SHA256 fa42a1199801ed2832662fb681087542d59d685b5f0fd5a9d8d03b51d74d9670
- MD5 5bf0057ad6d77144dbdd22974fc6795f
- SHA1 e8f7bdce679061597e01d10e6fb9d03e27f45d1a
- SHA512 621c4b9f2b122e7ffa75cdee6c4c7d8cd586e819fc553942f075dbe2d94cca1d8bb265fa6c62de72389b1733b1fc1c13734d9e4515f9d52e04bf81db97c1acc8
- SSDEEP 384:IK1vZLUtUPmOoKFYFWci5gWLdKLHRN7M1x85zR9zZ7:IKpCtcmOj6QnAM109zh
- TLSH T163B25B86FF188941E9A74830C5A7DE46BD3DB7C29B21A7CB1391A71D0CE33C1E935629
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp140_2.dll
- Size 182KB
- SHA256 cd893712ebfcfd9667819baff6e63586ea4e90c1a8af6bfb33f6f0efdc656512
- MD5 3beb8d7129336669ba3ce1a6a2bdfcea
- SHA1 12fb11de279c2c17a68d284b8ae296feb0aca1fb
- SHA512 77a65756e2b5caf98733f842e0ee818e53c4b7e9151b943ee7f5f125069f567c081976b31477e8a461b643df59ab7a58c9412887d28de3b8c240cd490b2d53c5
- SSDEEP 3072:8p7IsDQtnEzmvmebbqU0KGGYU0ZnEsInNgo82lfRrU/9a7dQtf8eHB:8VrDAEGjbqUXJEnEuCA4etf9h
- TLSH T1BA04494AB95D01BEC4A7B4B8843A312AF533351457B4C98B1BD30E2D4F1B7927EB3A25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp140_atomic_wait.dll
- Size 55KB
- SHA256 dd95d6a47502784e96fa8c5a86910fa353472be15474982bd601d6f5a9c81cad
- MD5 3eb2d46162a7d71d0713cfa0e1b8df5a
- SHA1 a0eb37716b3f63c43564ad7bbefe158f800c02d2
- SHA512 c27ff12faac6f8c045a3c59c5ec36deb7cca79183dd794ebeba6b6d80a2398b726682e833ab716c283f1d1666e9f9ef3c318fec3bca120fbdbc58207e5d6cad6
- SSDEEP 384:qH2XoV523kjgDHxgj2+FkYCKGrFrtXKN/HdS9ysHRsa2WDDgmEIreAFz9XodwaTl:qHL4+YhCv6jHeIreA3X2QLczvAMJm9z2
- TLSH T12543292996140847F43ED674C06BBEAFEBB6F6A5071087DF9210918D0F923C2BB71A47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp140_codecvt_ids.dll
- Size 20KB
- SHA256 ab15e442ae46cc9b00507d24172927046683dc50f099417c246d1389922d2836
- MD5 9ae3fdae63f973e98fb82548ab39d617
- SHA1 8dcf83d3b11b34f73c65e78fe2c9a168e8e20c7b
- SHA512 b91d193061cf717a9bbd0a9c4c35ec19fe07226bfbb716198c1542448f9833178c01956314910b7fab965313c6e511c9a1b5c6b08ae0ce579323dba78ec94fe8
- SSDEEP 192:f04q+UocFUXa5wx+xSxMxoU6rmGHaWiYEWcWMPUvFu8kcHnhWgN7awWYXIfK2Ydw:fvNXaWUhJWiYEWsKLHRN7nuwR9zNmLF
- TLSH T153A25DDAEA78088AED675870C2A5CE47BC3DB7D25710528B0790F1292DA37C6EA3435D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vccorlib140.dll
- Size 328KB
- SHA256 e2170f13c4691374d5fac7186ee68edf7fc963247a503a1bb31555ba679d76d7
- MD5 196b82ec7cfb9e9017047a1899977115
- SHA1 0746f9ad5916993fde754a47d3d6e29c4b5f7d7f
- SHA512 272e5d62662308fb414ae6c288499eddb95dd12f4c94b709c781315a3eeb4baa7f41dd94994ae8b9e36e83aff05a1035db303e96caf04c35f85d82b3dee5a131
- SSDEEP 3072:J//RM+FuBsAVqS+kH1gV47uvdpEC5u2RpLpwLjMMS53srEnhgzfZgVYZAFI95d2v:NRMHDVvupkMHsrEnhgjZWYH95dciatB
- TLSH T10064E5677B9C0CD3C932A1794A978309E372784147A0D7CF1596470E4F3B7E8AC3A6A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcomp140.dll
- Size 177KB
- SHA256 e94dce32639f2463b2a07d3136de442548349aafdbdc75cb6ceba645b6b7f67d
- MD5 5c28edd460f4a3496e1c9455a2969a39
- SHA1 811b24ac3ef5fe52c1b7370e4026173219714dcc
- SHA512 8c5a10e76ca5cbf1f0b088219ea427f92d81e17edcea565746b4b96550160764dcba140c699a68635cf8173eaeb192e983410da05a8b0587b4d119e852bd7c9c
- SSDEEP 3072:dBFGPDq8izphpuxRCrg0G+0mVxTFaHlIOdPWetKoQ6Up/Pab:vIG8izpixRyZ009gHvw56w/P8
- TLSH T1A3047D4673A9007BF97B9238CA674916E773784107609BDF03A043BA5F277C1AD3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcruntime140.dll
- Size 96KB
- SHA256 80f06c0740f31019f76fb1398a1112b3e02d1b80aee7d3a738d475408d7b4c60
- MD5 a3fad57d5a6e0a0d0a0f2378888f1415
- SHA1 77771d8419fc20f5e351f8c612694dd8fbba974c
- SHA512 fe347df7e12cd1bc188c87f72c4a89fb2860fe79fffea5ab85baedd994f5e1b31243c22e00bff22b2b9c76c2ac74aca986c76c52a1e4c7275e767425b6c5709f
- SSDEEP 1536:7BhIEPWom56j9BVxI2mKpmzUzWG92XPl2ycecb8Ds6HzuZ:7/jrg2JEozWG29yecb8DzH6
- TLSH T1B5A36C4676A442B7D0AED278C1A35A06F7B0F845877053CF03B546AA4F23BE19E3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcruntime140_1.dll
- Size 37KB
- SHA256 2992687b6e8bea2efa2abaa77bf3ab89b81f84de8bc4940472cd179ffd3584ff
- MD5 de489da8f234a9dc92bd91f5de346659
- SHA1 2aa85ed032679330aedb295985fdf4be26f9acab
- SHA512 73317c80284ab061d6a9fa8956e668bee790e304109cb9dbc57c590f10ad9ac38e8384f5e33bdb2e330a77ed7a4e7df37d85fce6411bf62daba4ff8243ea2f95
- SSDEEP 768:shh4pTUUtmUwqiu8oSRjez6SE79+AObn6K9zu3:MJ9x7l9/gnXzu3
- TLSH T10B034A9467B88485D5AB96B0C4D35E17FA3CF9A14B50538F0BA0C25D1F63BD0AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 8e0c83170eec96c54ab86f99b6eaa1c2f128f2d61d05f5a186a88be9af5b5c8d
- MD5 65dc6c3705ebb82dd460b5e2119d40e7
- SHA1 bddf2c855a84cce6d7850d507e93c74b971cf3e7
- SHA512 184b681cafa1e43bd9d27e84e666397a5e5c9e54bbc2fbd17adb5141eef55680dd9bfd9fc93ff6dcccbae8961e5b66078d93a19acd835b90d1cbac09535e9a5c
- SSDEEP 24576:6Fo3DMPEdoO/vvTL/CAd9SlgPre3Wrae0A7PtwzlLIz6ZKMN84h29E3cZup:DHs
- TLSH T12557B12436F92250E7B79E3CA8F06A234D3A7D5B9C15DE8D45411B8E0C22F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0f4b7dd8-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0458b2da-ea2e-4b91-8408-9105818682e4}_OnDiskSnapshotProp
- Size 6KB
- SHA256 12946fb026f009727f375f5cee023007b67e1305388871e1e70917771b1a568b
- MD5 699f3a56e5e20c51c01367fba98c2889
- SHA1 a0068187baf37dec8c2e084fe31cba76fd9d247f
- SHA512 e9ad14b712dfa2a1b6b8fcbefb6e63abc66eb6310e0e498ea9f26033f092cc125b88445dfaf20fb77e2097904b534473d357d152b61f4f59409534f209f27aaa
- SSDEEP 96:FassmLtvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Ywdb++uVm
- TLSH T1BBD198181AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E2671A10F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH