108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc

Analysis

max time kernel
87s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
Size 17.1MB
Sample260709-pf9dwsa19x
SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc
MD5 386529af136fe96a23da6aaa39711e2b
SHA1 f34330d4c6e0aa978dc3af40360c14b31ad51127
SHA512 7ee28ca0e2798fa47023858f27e5d98da5a0057d0783cdf2a4e61c1dc6c9ea27be9feda5ae8d1c3e3bcf7848d425712589f5538a36e5947128658206890d41ce
SSDEEP 393216:Sz0LnfhNw32VNelklzfhSecSpv5JwuFUvmB8leDOgwtEI0ppjagOibnaE4qX5y:SzMnsA88tSxe5JhUvmO0DOgXOgOijacQ
TLSH
T1E30733907CA4F70EDCA8D438C97053F041EB0EEDF6769017A4A27E6237B7293D69A845
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5544	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
4984	nsk9C3A.tmp
4768	nsk9C3A.tmp
3256	windowsdesktop-runtime-8.0.22-win-x64.exe

Loads dropped DLL 22 IoCs

pid	Process
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
4768	nsk9C3A.tmp
4236	MsiExec.exe
4236	MsiExec.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{a3899eef-6164-4d42-b8c3-95ae6a844821} = "\"C:\\ProgramData\\Package Cache\\{a3899eef-6164-4d42-b8c3-95ae6a844821}\\windowsdesktop-runtime-8.0.22-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.22-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Threading.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Private.DataContractSerialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.22\System.Collections.Concurrent.dll	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a619f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD697B119620EB52B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA6C8DB347CDD1ED.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a619a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7719B10DC407A01D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9FA0835A96F405A9.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a619f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70DC.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C43A1A89-0CA5-43FD-BDC4-3B85DAD06A41}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI731F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a619e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E3C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a619a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4824	sc.exe
1412	sc.exe
4904	sc.exe
1132	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nsk9C3A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.22-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EVENTCREATE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nsk9C3A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1360	CMD.EXE
4132	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C43A1A89-0CA5-43FD-BDC4-3B85DAD06A41}v64.88.42551\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.88.42551_x64\DisplayName = "Microsoft .NET Runtime - 8.0.22 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.88.42551_x64\Dependents\{a3899eef-6164-4d42-b8c3-95ae6a844821}	windowsdesktop-runtime-8.0.22-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.88.42551_x64\Version = "64.88.42551"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.88.42551_x64\ = "{C43A1A89-0CA5-43FD-BDC4-3B85DAD06A41}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\PackageCode = "9F713B724ECE7AD4AA76DD7C188BB2CC"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3899eef-6164-4d42-b8c3-95ae6a844821}\Version = "8.0.22.35428"	windowsdesktop-runtime-8.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98A1A34C5AC0DF34DB4CB358AD0DA614\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_64.88.42551_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\Version = "1079551543"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\ProductName = "Microsoft .NET Runtime - 8.0.22 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98A1A34C5AC0DF34DB4CB358AD0DA614	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{3D6C75ED-F3A3-4E8D-BC29-2D208A25D78F}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98A1A34C5AC0DF34DB4CB358AD0DA614\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C34A480CA45BD847FA5C798686CE42C\98A1A34C5AC0DF34DB4CB358AD0DA614	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\SourceList\PackageName = "dotnet-runtime-8.0.22-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C43A1A89-0CA5-43FD-BDC4-3B85DAD06A41}v64.88.42551\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3899eef-6164-4d42-b8c3-95ae6a844821}\Dependents	windowsdesktop-runtime-8.0.22-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7C34A480CA45BD847FA5C798686CE42C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98A1A34C5AC0DF34DB4CB358AD0DA614\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_64.88.42551_x64	windowsdesktop-runtime-8.0.22-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{a3899eef-6164-4d42-b8c3-95ae6a844821}	windowsdesktop-runtime-8.0.22-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{a3899eef-6164-4d42-b8c3-95ae6a844821}\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.22 (x64)"	windowsdesktop-runtime-8.0.22-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
5508	explorer.exe
5508	explorer.exe
5400	msiexec.exe
5400	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	5508	explorer.exe
Token: SeCreatePagefilePrivilege	5508	explorer.exe
Token: SeShutdownPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeSecurityPrivilege	5400	msiexec.exe
Token: SeCreateTokenPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeLockMemoryPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeMachineAccountPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeTcbPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeSecurityPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeTakeOwnershipPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeLoadDriverPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeSystemProfilePrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeSystemtimePrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeProfSingleProcessPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe
Token: SeIncBasePriorityPrivilege	3256	windowsdesktop-runtime-8.0.22-win-x64.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1204	sihost.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
4768	nsk9C3A.tmp

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe
5508	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4780	StartMenuExperienceHost.exe
3252	SearchHost.exe
5508	explorer.exe
5400	msiexec.exe
4236	MsiExec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 4872	2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe	87
PID 2436 wrote to memory of 964	2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe	89
PID 2436 wrote to memory of 1360	2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe	91
PID 1360 wrote to memory of 4132	1360	CMD.EXE	93
PID 2436 wrote to memory of 3624	2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe	94
PID 1204 wrote to memory of 5508	1204	sihost.exe	101
PID 2436 wrote to memory of 4984	2436	pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe	107
PID 4984 wrote to memory of 4768	4984	nsk9C3A.tmp	108
PID 4768 wrote to memory of 3256	4768	nsk9C3A.tmp	109
PID 5400 wrote to memory of 4236	5400	msiexec.exe	111

C:\Users\Admin\AppData\Local\Temp\pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe
"C:\Users\Admin\AppData\Local\Temp\pjschaeferllc_rmm_v2.5.0.67_oidb3a82b54-9ece-4495-83e4-b6d807b47f86_bidExPdI4eoAEaXh-Fax2O4!A.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\EVENTCREATE.EXE
  "C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\CMD.EXE
  "C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log" "C:\Program Files\RMM Agent\"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:964
- C:\Windows\SysWOW64\CMD.EXE
  "C:\Windows\system32\CMD.EXE" /C dotnet --list-runtimes 1> C:\Users\Admin\AppData\Local\Temp\nsp82A5.tmp 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files\dotnet\dotnet.exe
    dotnet --list-runtimes
    3⤵
    - System Time Discovery
    PID:4132
- C:\Windows\SysWOW64\CMD.EXE
  "C:\Windows\system32\CMD.EXE" /C copy "C:\Program Files\RMM Agent\install.log"+C:\Users\Admin\AppData\Local\Temp\nsp82A5.tmp "C:\Program Files\RMM Agent\install.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\nsk9C3A.tmp
  C:\Users\Admin\AppData\Local\Temp\nsk9C3A.tmp /passive /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\Temp\{1BE8E1B9-5F2E-4718-8D94-956562FBA6D5}\.cr\nsk9C3A.tmp
    "C:\Windows\Temp\{1BE8E1B9-5F2E-4718-8D94-956562FBA6D5}\.cr\nsk9C3A.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsk9C3A.tmp" -burn.filehandle.attached=760 -burn.filehandle.self=764 /passive /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe
      "C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{33C09CAD-F45C-46C8-A3EC-0CCCADFDD424} {BC93AEB9-FE43-4024-BE4F-3D9A3FDFC720} 4768
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3256
    - - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={a3899eef-6164-4d42-b8c3-95ae6a844821} -burn.filehandle.self=1204 -burn.embedded BurnPipe.{3A77393C-0D44-4030-BC08-0C431DBDD869} {FECEA0C0-67ED-4A2B-967E-FA087100A287} 3256
        5⤵
        
        PID:5504
      - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={a3899eef-6164-4d42-b8c3-95ae6a844821} -burn.filehandle.self=1204 -burn.embedded BurnPipe.{3A77393C-0D44-4030-BC08-0C431DBDD869} {FECEA0C0-67ED-4A2B-967E-FA087100A287} 3256
        6⤵
        
        PID:3660
        
        C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{1647C8E0-AD1E-4463-BD4D-FF4F490D165E} {0FDC8062-6257-4766-8587-E50027EBB8AB} 3660
        7⤵
        
        PID:4460
- C:\Windows\SysWOW64\sc.exe
  sc stop "RMM.Agent.exe"
  2⤵
  - Launches sc.exe
  PID:1132
- C:\Windows\SysWOW64\sc.exe
  sc stop "RMM.Agent.Launcher.exe"
  2⤵
  - Launches sc.exe
  PID:4824
- C:\Windows\SysWOW64\sc.exe
  sc delete RMM.Agent.exe
  2⤵
  - Launches sc.exe
  PID:1412
- C:\Program Files\RMM Agent\RMM.Agent.exe
  "C:\Program Files\RMM Agent\RMM.Agent.exe" -ch -csqd -ps
  2⤵
  PID:2232
- C:\Windows\SysWOW64\sc.exe
  sc delete RMM.Agent.Launcher.exe
  2⤵
  - Launches sc.exe
  PID:4904
- C:\Program Files\RMM Agent\RMM.Agent.exe
  "C:\Program Files\RMM Agent\RMM.Agent.exe" install
  2⤵
  PID:3756
- C:\Program Files\RMM Agent\RMM.Agent.exe
  "C:\Program Files\RMM Agent\RMM.Agent.exe" start
  2⤵
  PID:4336
- C:\Program Files\RMM Agent\RMM.Agent.Launcher.exe
  "C:\Program Files\RMM Agent\RMM.Agent.Launcher.exe" install
  2⤵
  PID:948
- C:\Program Files\RMM Agent\RMM.Agent.Launcher.exe
  "C:\Program Files\RMM Agent\RMM.Agent.Launcher.exe" start
  2⤵
  PID:2832
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="RMM.Agent.exe" protocol=UDP localport=48678 dir=in action=allow program="C:\Program Files\RMM Agent\RMM.Agent.exe" enable=yes profile=domain,private
  2⤵
  - Modifies Windows Firewall
  PID:5544
- C:\Windows\SysWOW64\CMD.EXE
  "C:\Windows\system32\CMD.EXE" /C ren "C:\Program Files\RMM Agent\install.log" "install_2.5.0.67_20260709132026.log"
  2⤵
  PID:3868
- C:\Program Files\RMM Agent\RMM.TrayApp.exe
  "C:\Program Files\RMM Agent\RMM.TrayApp.exe"
  2⤵
  PID:1076
- C:\Program Files\RMM Agent\RMM.TrayAppLauncher.exe
  "C:\Program Files\RMM Agent\RMM.TrayAppLauncher.exe"
  2⤵
  PID:6100
- - C:\Windows\system32\eventcreate.exe
    "C:\Windows\system32\eventcreate.exe" /T ERROR /L Application /ID 100 /SO "RMMTrayAppLauncher" /D "RMMTrayAppLauncher> [Program] Error during application launch: Specified argument was out of the range of valid values. (Parameter 'length')"
    3⤵
    PID:2168

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5508

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3252

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91650636E338C0A392B4FB9BBACDBF44
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9AD8CF983E592B300158F38A3F6D7A7
  2⤵
  PID:2460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A6129DA0DE2565CEDD7D8E7B8CA30981
  2⤵
  PID:2532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2574ECDD77ED4D7C6F608C7E8EF11FEF
  2⤵
  PID:4872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A35122C7EE4C4D5D603AD03C4AF97945
  2⤵
  PID:3384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0368AB686114673E1DFE0C7F421727F4
  2⤵
  PID:2488
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24E0B9BAEF5275000C86C0A46352B037
  2⤵
  PID:3000

C:\Program Files\RMM Agent\RMM.Agent.exe
"C:\Program Files\RMM Agent\RMM.Agent.exe" -displayname "Online Remote Monitoring and Management Service" -servicename "RMM.Agent.exe"
1⤵
PID:4544

C:\Program Files\RMM Agent\RMM.Agent.Launcher.exe
"C:\Program Files\RMM Agent\RMM.Agent.Launcher.exe" serve
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2872

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e5a619d.rbs

Path C:\Config.Msi\e5a619d.rbs
Size 48KB
SHA256 9e013721b648e2dd7af503f58fbc1090745c7993674b211f969c4baaea8d84fa
MD5 4847c03c9633e1dfc4712e79e096378e
SHA1 095dbb456145dccc08f3863bc6cb52ea8a3770b0
SHA512 f0ae2dedb99cfffdd0bb364f737b39e379b525dd5ecd374c87c30befd42a812835ba28de3adbe910dfd227543e555b6a64d3841b8bf255cc6e5db01eeee4df01
SSDEEP 1536:ponoRQeqK/lY/9Kx536Xt3PIAlEQp3xj+lB5toZAsTxWBhheb6c7P7m+Nk8n2DMN:oVn
TLSH
T12B230235DF00C1E2F63739A02B21DB2563395D857F248C9D61CA2229E9C6E9CAFFC585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a61a2.rbs

Path C:\Config.Msi\e5a61a2.rbs
Size 9KB
SHA256 975bd493013c54d357283b6dd20a2f74d1aae423ce3a80175d77f0b6fdae39e3
MD5 457ab48ea74498e87520657cf2aa6f2f
SHA1 e0d14559ed2ff7b7f57e11298fdde5195150b05a
SHA512 f5bf6ea9dff4563b5069410a8fb04e5970f32cb210f10ddeab971bcbb4f0e6e39f162f64a177e401ac44d021bc0d3d27468e39faadd0fc4e7b8d541b54c1406c
SSDEEP 96:lmLTlALv4LtNrz+7CzZdRUpeD2XPOCsTl0UpeD2XPOC6jWJk4YKTlWY+rE5V7T0r:oqvorEC/KJtIhJtRyE3TEU89pr
TLSH
T181121F41660592D2EE9B3B34C70B2B213BB7D3A99340678B08DD55B01F677891FD82EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a61a7.rbs

Path C:\Config.Msi\e5a61a7.rbs
Size 11KB
SHA256 afe43a46850c9aaf8bbc90de21c3ccdeed97507d9e6fca0d28258bba4485d503
MD5 db22de01dd5ac573682ecf3c3369f0f0
SHA1 7f5eea8b268faf42789669061b982f4338fd9bbc
SHA512 3f527683a3160168e91b676e386f19bb3629fe85552884788a95b4419a6e94f61b1f4ca476f21603c8dfe34f3adfe1bb0ffa79f199a41744809a026cbd8c01d1
SSDEEP 192:frUwMTM/SkMgMj5HqAs59CXK+tIzg+ttyEWMXy9pc:frE46vrj5HWd+Kg+V9
TLSH
T121325542BA00C9E3E8922F70C707572237B3DB95D711436F05DD92B99E433858EB96AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a61ac.rbs

Path C:\Config.Msi\e5a61ac.rbs
Size 8KB
SHA256 02ade439314cc41fc45fc0cc7885c14750b6b5591e405ef8444b23df494af511
MD5 79ebc6872942c2ba086801ea4db3def5
SHA1 4d7a1872b78152bfdb734f612849874018e195b6
SHA512 bf4d5ab249df158c6d5e3796e946a8538977a0126be05c8958b8dc3e4b259d0d2946c2558d6f6be963c28e6e2b9fc3422e86515fab301985c8a69713a139e3dd
SSDEEP 192:f8q3xRvxERCxP/nlkhVSczdrCFgTD8e0W1co0RVo0X3Qw/ii6s:f8q3xRv+RC5/nlkhVSczQFAD8ezczXzB
TLSH
T16F124007B60081F3EA512735E72327B13BABD79E8304435F10ECB4695B46BC61EE95EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a61ad.rbf

Path C:\Config.Msi\e5a61ad.rbf
Size 143KB
SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
MD5 7d4ea76b6e0659fdd36b34499f964aea
SHA1 6b7700ed5632d176fc0efbc5611192644bc391d4
SHA512 41ecf5f0a70828d114056bacd8fde364e2685e3c2f58a785540af7056e3698b027cd3bcce64ab840814ad3d2c5a0eac0a3528cdd88b737eb02671e816eff27cf
SSDEEP 1536:8vJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:8vJ9psmeIBcV8pQFq4XKF3QP6
TLSH
T1FBE3C31AD29802E8C06E6179C7568A41B7337C6687E1D3CB53D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a61ae.rbf

Path C:\Config.Msi\e5a61ae.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5a61b2.rbs

Path C:\Config.Msi\e5a61b2.rbs
Size 87KB
SHA256 611667ac5364fa55a1ebac54406cdddcb7ec43a7bb108f3fc8a3d0e554ce21ce
MD5 ed119cc691ec42b31a0383a7f1522dc1
SHA1 c48110130113189220ffbce89a1cdd0280d0383a
SHA512 882d89513644715185d327c72951cbd651d1c093b5c4523fb03f9db394f8b17988be6e7f82676a7162b6c1ec2f47a0efd6d3f411817b9fd480f8a4ddbc066fa8
SSDEEP 1536:xyut0tAj4Q2LhGx3A7pHotDn9/MVknYNSnT3oml+20XY9EJaL97yoF7R9XBm6K5P:pNQGCOqxL8tqYOWwXou/wy
TLSH
T10093069ED710C2D6D8732D450B7BEB086E344D6BA745A92D03C60236DAA16EFCBBC4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a61b6.rbs

Path C:\Config.Msi\e5a61b6.rbs
Size 132KB
SHA256 ce7270b5e37299b4071d7d5e8d68634a861922ea6962ca9952d8bb83540295c5
MD5 f62bc6658c1bea5d00e0edcd417bce3a
SHA1 bfadf36a8a625501ea643b0b6ea7dba2fe3f76e4
SHA512 17f53375944670e83b40c874edd84235444de5456df1784c581462a6906fe4e4c9e0aa4700a7e349a2c67ccd47954d2cbd54609a4a1df049dc545513ed5f5e04
SSDEEP 3072:2MrS6moQnqroUOVa377XMcUlPoG0SToOGJRez1Y:jKiz
TLSH
T1A4D3DD5B6348D0E2C53236349B3BAA4CAD134E764351806B9AE9923EDF777C72F648C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a62d3.rbs

Path C:\Config.Msi\e5a62d3.rbs
Size 8KB
SHA256 0947c412838ca8152c737c86c00eabca7465e2cee41e09445df6d1e15aef8221
MD5 739692791ad84449e73f8b697b32e744
SHA1 491a5f098da516475bbdda3080b8341555e44d40
SHA512 95187dadc40901670a80633189db2286158e1fb85fd5b7407e347b04fc1db10255386a0aab832ae3d81c666c6ff9ac480fb5f15c90197dbee063058d4e54195b
SSDEEP 192:lzMHRPx+R/xqkHHhYPR6a2OrI9mT2kcOgiHK+L8K+RXKo6mi:liRPsR/8BTP
TLSH
T15F020F26B649C1E3FAA62A31D7032B70BFA7D2D98314438B10DD75609F17788AE583DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a62d7.rbs

Path C:\Config.Msi\e5a62d7.rbs
Size 86KB
SHA256 f24650627469ee5533951fc11e6c161ddcd1505d9c0356d0f8993ab090e69902
MD5 f9030733b99b33b0137d66ef552b2a08
SHA1 77004c9852d3002638e169b25e372e5854df93b0
SHA512 b73d047d21a55eaa6c67d74c8f8c846b58332396a081852df82181dbebd1a717a0b90974f32b1a74edc5d3f49c03dd8a5eeed3b4020defcc89aab33d062918fa
SSDEEP 384:0rHRcvR6IOJif+YIp4eafmC/0QAXjB8tbIURpcAhdO/qAlFIHafTC9v7ahhFEDuM:0NYkEz1tmyOFc6H/7rNKN
TLSH
T17483CE276F88C0F3D231B97067725A4D7F128E664310C09A56F9825FCB3B7E96F98486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Commands.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\RMM.Plugins.Commands.dll
Size 65KB
SHA256 1c73cde35414fe24735925b456127211102895753c849f8a613999bc821605a7
MD5 d013edde105dd86e41042033e4efe570
SHA1 235af31019df85dc527fd52be84ed8f3e7564377
SHA512 beef10839cadfa2e282b67b731577d15f66e7f329cb8d281c7711d4b0972a4f796f093513d0b24b13802363d9e65c7378c100a05c5ce9f6cbc43466ccb889114
SSDEEP 1536:3v8XgyGuRlHI1rM+LZdbPHAg6KfMfIgkuS1x:/JyjeM+/HAg62MAgkuS1x
TLSH
T1CE631B3EA3859D63C9FC077CF137443055E54B9A2232A70F1A7A2858C50368EADBD6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.CommonDefines.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\RMM.Plugins.CommonDefines.dll
Size 24KB
SHA256 ab03ecadea74bccf12386e20024c8b9793abc63c8b079c903eebba973bdb6bed
MD5 c52957cf4ba1e325734ff2add5a758c3
SHA1 908c3df46254b21b8cfac6ee9af0118bc93fad39
SHA512 bce1cab8641ba273ccc0dc13cb5637b0a9cd13fc88565bb1739fb5c7f81c285d138a4e39bfa962d8c2960f34c36c94b361ce121c5ae5e11a8318790829b2d0cc
SSDEEP 384:hUxr4vV9RNPoBmd3KRvsckfYA8ETwZGSDgaczApP6pVkTpE5hPABEIfZ:KFOgId6v33A07cEp5TpoP6
TLSH
T1FCB2E615F3ECC25DEBBE1AB868B692049671F71B9811DA4F4D9500DF0D236C89A12BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.DataProvider.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\RMM.Plugins.DataProvider.dll
Size 94KB
SHA256 1644bbe9bcfcf063d44f809e649ad3d586dcf645de5fe4b5f9cfed9690df94c8
MD5 25af63d699e644579ef46254a67e7bfc
SHA1 459fd931ea40fc40b5efb4e94df70299109125fa
SHA512 af6fe86f5dbc77275ef9f14f43e90f869b1661c019d425f4f1b46e87f2c40e1e7829e899c0dfe3651791d5077c65e00957c789f9d37a4fa2864d6ee33baeb340
SSDEEP 1536:2oFGlfimaxuQAfF2ob9aUZhkGWH1DXCEsV1XWYcXb5wrr:KlfpQAfF2w9aAD47rofctwv
TLSH
T1ED934B36F304CA37CA9E4A7DE422441147F34E0B9465FF176B9D68E61A837187C8A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Models.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\RMM.Plugins.Models.dll
Size 10KB
SHA256 0937cad675225275766b9eea54f17537d7d6fea6a6e69cc35bf2816b70e7fae5
MD5 964ddce217d7102d21a0de0e3fcd3335
SHA1 8cab5031f7b5a495e690071dc7cba98456075e9f
SHA512 4e8df1cf5385302a9e93918edae2fa6c3fa4fa81c24de15f033efe636f071f3a11c5f327e607b92e43a1b7d04ab80b2b6684de9c6e71f8497625922a73449ddb
SSDEEP 192:Ai5+6ftR43DzBgZv1sOPC+PcfHQFYBTf6GIYqdODkF6H:Z4msDzBm1LqDWYBUjdODu6H
TLSH
T1AF22D8219A7CC3BEF5990B36B973039511FA93457211DE7E8B21F81F3E01B5B9221978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Root.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\RMM.Plugins.Root.dll
Size 18KB
SHA256 026905745dc2acf6df9eaee691a4d126574dc84ad805c8f55e87453eb161a484
MD5 fd20aed9995198f156e2b67df1599743
SHA1 ec1e50ef1346e2f096b81330621758818eb96d99
SHA512 1a2c0fc8a6fc80988c0809d31b77711bbf7e80031ef8712feb40454918f9f1a09eeea5968cc9bc8f07ebda162f72db36dc4e51006ae0ad302c60130993ea9a70
SSDEEP 384:Ryil+brbBTDuN34Cyq7LUpt6P9eaVvGl5AUrmHEA:Ryil+bvFDuN3aq7IOGlaUr4EA
TLSH
T1ED82F809BFA4D21DEFAD47BDD4E30B2097B1C60B3632E76B658C04611E033C61D892DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.AccessControl.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\System.Threading.AccessControl.dll
Size 31KB
SHA256 7b5756c389708289c8b7439607a729878d7f35b2667dcff7b13c61b498f5e5ed
MD5 7c032a3caf701378c6dd116ea8abdf28
SHA1 55013b9d64877b6d32c663371a1d41767df4ca57
SHA512 0bf1a091fa382a5634f52fd9e0ee5f58ae76d985bb9597ec1faef6aa31a73e3e0f84ccd15b0f0255bf3c88effdab541b1353ed7fcf84b54758ac5ddc4c7709f1
SSDEEP 768:ShFdElflmlElHlEl3lEld1qObZTfiH7ODWnuK9z/z:SZObZJDWLz7
TLSH
T18EE2E912B3F8022AEDB74A70B6B487755A31B5E54D02C25E359AB01D199BFC0CF6273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.AccessControl.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Hdd\runtimes\win\lib\net8.0\System.Threading.AccessControl.dll
Size 52KB
SHA256 1715d83ad69ccc4920b53fe2bbaf00095482f603795976bfe7d461f0d6cbb925
MD5 1a000b614bad9e066dac5fbdc030461d
SHA1 05e6075e2f63319b9c8445d759ebc0857da4ee8b
SHA512 04b2a6a65122a4ef5b8ef88d54742f46dd2336fb13f24e6dcf13d9a86bbd9571cd52c9b6e4f44bca47ddd062cadd7d20900924fcafe9e32a4decce63c0965ec5
SSDEEP 768:eyCo43wgxJ46O/tttEKvd9abMK/9cTW8DjTfu7OjyFCl2F9zr:R/1RNCM//PPiiQzr
TLSH
T157334C19B3E8033EEEAF0A31F97190095932B6CA5E03F77F5595E01A1547B808FA2767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Extensions.NetworkMonitor.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Host\RMM.Plugins.Extensions.NetworkMonitor.dll
Size 6KB
SHA256 c0e8725c1829a9f7b3eca1e0b1ed6a13260647b36ac5abcbef3e4bc909ea34a5
MD5 cbfdfa8a1ada09e7810efee49fab605b
SHA1 38f3b8d5b015dbc1b761b04c6438a2ee3f1ad610
SHA512 bd1bc9540a4b7dbadf3d82621438c0a0f9accd08b2a2235e620b6ce46357a5d3d4661714fcaa566aaf972dc9f74b12fcacda053bcdbd4746f56cb770daf2db36
SSDEEP 96:bAJ1UPhxqJWAofmv8EyNlFlZL4JKMNgzw0:bll+v8EUL
TLSH
T125C1941293E9426BE5FD4B72AEF753805676FA11BA53E7FF0C8802079C625A04A71B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Extensions.ProcessAsyncExecutor.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Host\RMM.Plugins.Extensions.ProcessAsyncExecutor.dll
Size 11KB
SHA256 7d0d6a22070ba2d4ab28a449f74a68ca5a0de159e74d51e18a450fdd3e4d2077
MD5 a238f786000cca470d87b15dd1bd8794
SHA1 2804f1d3d8acf104df6a3aa5e08bce092be77800
SHA512 696be0727c3da9796f1e75ab2305af6cb320039d176c373c8fd928a08eebd227dd89d24201c566629c7f3b5bcaa5d6117746099d1d880f43291376123b56bc8d
SSDEEP 192:vR3b9XoU8O4IuUy1Rw/h6WyCoQothg37EMxZcTpYWlK+5k555cDJ1EiLLq:vRrdBKIuUy1qpdKiLEgcTpVjDPEiLLq
TLSH
T124321A05EBAC8217D87F7FFEE6F646524AB2BA005E11D72E2C8C60D818927511870B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Extensions.WmiHelper.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Host\RMM.Plugins.Extensions.WmiHelper.dll
Size 11KB
SHA256 cbc311f937bda9292a7fbc59e41469586a788c185702ad53dd1f53b990877e35
MD5 40151e3aa9fa4c039c91bcb4994efa77
SHA1 f52d119c17b315453414649b3a0502eb840e2fd9
SHA512 6d7a3bebb2175063d0429cbd8aef6335a3b1a5dcd633f2ca42b62be7def0b7413324cd3e7421b2d10c486509d5b142078330d17a1d24351d4c3dff39a706d366
SSDEEP 192:L8OzOxEgW9kAP6MzKsXy6gRUezMMUWMjn/AGfbl2jO+TN:LkxEgM7P6MzfXyBzMMUWMjnzMO+T
TLSH
T15932D821E74C4335C8FD4F7EACE2929052B1DAB5A8319F5F36DC40E3AC266241762776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.Plugins.Extensions.ServicesExplorer.dll

Path C:\Program Files\RMM Agent\Plugins\RMM.Plugin.Update\RMM.Plugins.Extensions.ServicesExplorer.dll
Size 10KB
SHA256 914578e769efbeb0268805cd0862f530c513aa4a58db7aa6aca68e90eb6d8048
MD5 3a1bd6477d29b02da9932818c2d2b1e7
SHA1 b8d283e322ffbe08afa90b2e38378350b220dfa0
SHA512 a1659c13e16d58794e3ebe9ff90aeb8963adda1cdebc6e23bbdc15d724ae17ac2908ec7897947af823ce10839dd8986f8368173dd9077c0be48ffc0feda17d1d
SSDEEP 192:97D1zs4uNm2YVKhVLUbKkFabDvLCZ6aA8g1MgLpyyUWf:bspm2YVKhVLU2JbDvLCZ658g7LpyJWf
TLSH
T1C622D600FBE54369E5FE4E75A87307000173B9A5AA27EB5F0ED8A01D6CB27409A67B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.TrayApp.exe

Path C:\Program Files\RMM Agent\RMM.TrayApp.exe
Size 145KB
SHA256 7f27d43a661e456d7f5dc59de885a5f702dbd7a3e374108e4da0bd80291cfdae
MD5 b2f5a8575b76f5b83da2b5082ec56b73
SHA1 14d40d637fd5cb638894cb591f137bbf9e98d343
SHA512 974b2efc93d84ace6e897a8b45edc12791b99d0edc464749c84c308f0a723b98d6210b192effbf1967f6f74fd591cc73b07eaedd16b66314ca5248fd0181cb57
SSDEEP 3072:V+f4nYTC3LwjBzaQhlG4a7qWdCXcXxuZjwxkBnh4:V+f4nKvaQhcF7qIBxuZjwCBh4
TLSH
T190E33A13B2A810FDE1BBA37C89A21901F3B6B8554B7197CF0390C56A1F67BD09E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RMM.TrayAppLauncher.exe

Path C:\Program Files\RMM Agent\RMM.TrayAppLauncher.exe
Size 146KB
SHA256 9f8cf01174a620beac6ca76d3e4682b4dc06eff873c53e00b71bd86d67dc7ec1
MD5 ae9aa7d9b93659e435b853c4499576d0
SHA1 311bc6b1748ba882a09b4f42286a777d957459b8
SHA512 4d65df53efda295eebc824d76b50905a3d8d93743b62f32f4e98006c96da05f165befd25d0400c803c8539be6c1d57f34f35432f5065e7f643e1275476400918
SSDEEP 3072:V+f4nYTC3LwjBzaQhlG4a7qWdCXcXxuZjwx4B6VRA:V+f4nKvaQhcF7qIBxuZjwKBERA
TLSH
T1EFE33A03B2A810FDE1BBA37C89A21901F7B678554B7297CF0390C56A1F67BD09E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Program Files\RMM Agent\install.log
Size 9KB
SHA256 95fd87faca8094a870027ae52fd126b023f1b5bde2b9326da687689a8aa1984d
MD5 70de0a93c8d1a92735930b036af08cf5
SHA1 54897e6dc21ffc2813149a91f549cbdf04c2ef47
SHA512 d517a48a2bfa9de3c324f14638a6a59b4906116267d64a9cdc82ec1beb327cfe035688d4b1b24e9b4f2572fdaac60b0b7b706eccdba23558b5657fa96a7c6f3f
SSDEEP 192:/Pu/u/Aju/AjuBARuwDuBAju/Aju/AjuBAncu/Aju/AENudui7juc7YujVkdiRVw:/mW/d/dBzrBd/d/dBeJ/d/UkiOcxadiA
TLSH
T170128C448AC7CBA8341232BB4DE3D7ECD6B54E1CB785F73056B5B909318261EEED1162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Program Files\RMM Agent\install.log
Size 9KB
SHA256 a7de99c32826f6a2f92de01449f47829cba2d7a3968cd8e7ae64544cccd4d5b1
MD5 3ccfde7f85a94bc11b106c43b905570c
SHA1 273747ed91a46589fa9e32152882e6d989581ff0
SHA512 41f772f702e322d1895ba87273d1c2e96138e0f088f3f11b99250614b78847d2b069401eb4eff127ec5f1db6db0a188a9811c110e161e361df620c82ff55ec0d
SSDEEP 192:/Pu/u/Aju/AjuBARuwDuBAju/Aju/AjuBAncu/Aju/AENudui7juc7YujVkdiRVo:/mW/d/dBzrBd/d/dBeJ/d/UkiOcxadi4
TLSH
T165129D458AC7CBA8341232BB4DE3D7ECD6B54E1CB785F73056B5B908318261EEED1162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmm.agent.launcher.log

Path C:\ProgramData\RMM Agent\logs\rmm.agent.launcher.log
Size 367B
SHA256 ff9e1c2abe6c2b7ee527f43721750f1c970b506d12b3d29b23032b35806a572f
MD5 3286939a7afd46145362afaf5381cb39
SHA1 cdfb300b41feba3a3d3768d938ebc837892cc79f
SHA512 484547f63a0b3e40a9aaac0dd15ac0bf0a6261d327d8ba3c10b84b0a042aaafff2390510cfe2b5f115f8587cd04ce53cba3fd37105e4f71b5a5360e6d1326809
TLSH
T1F3E0D84200FC257A0FA305019E0E4AF1A3B4F969032FAA74217BC49020EC81F11EDAD4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709131956_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709131956_000_windowsdesktop_runtime_8.0.15_win_x64.msi.log
Size 3KB
SHA256 5ef13f2eba38fb65320c12f1181ebe9d4488552708d41546610a157f33122916
MD5 af7a774d21630ce2e906802f655cf8cc
SHA1 cf64138979dddd1e33c170f7610783d338b7ec00
SHA512 ca049bde4de34fbe73074b282646c904b735499ae207ee3c9b8cea5caecbad9d18a5c6ee63d9ef073b0d444a009cdc2b086659c664fff2081fe94aad20df346f
TLSH
T1A651F8261EE80C5AA5B76A479FF3C4525B33FCD66834CF4C6349831902AFC0658AC76E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_000_dotnet_runtime_8.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_000_dotnet_runtime_8.0.22_win_x64.msi.log
Size 4KB
SHA256 34f61247f725f8e16c5e1645a47af9d6083f700c77806dec486400419cfce454
MD5 29fa675be579a995bd3bfac72b21b7d4
SHA1 fc0afea2a6e6bf139f5216a86ed9a5ef118840c3
SHA512 4b9a5e1e44ca867ec375d4cacfcd91e1759425e644047eccca601cf443be8a0811f258dfca3a49a0819d39d8d85e33b6353fe5fc7109a16a96333627577d3753
SSDEEP 96:YZ+bluZQPjOq0fvQxiQP6QmOxSBOx2xOxRQPLOx3fOxlWOx2cKFMjOx7:8I3jOqx3bPDXSsA9pKF/7
TLSH
T14A8116251FED0D15B2B35A47DAF7C4615A33FCD35830DF4C2284821946AB90798ACBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_001_dotnet_hostfxr_8.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_001_dotnet_hostfxr_8.0.22_win_x64.msi.log
Size 2KB
SHA256 e11d2d6fce0fc5c5b106f7fd428ada9b0b0ceeefc4df0ce5910c2bf1b21c3fce
MD5 0c5f51ad740088074779ed4085fb464e
SHA1 b241b926a3f67fd9c4fa36be71ce193c9cb7cc93
SHA512 0d23e45e0ebb6e8c2b3ee44a3d5c0e1e47905b41f8edd416de52a4c72366c2f4096ef4fe19ee3b60022c219993cc4baca656b4fc8232f0138d4e8a002768eb6f
TLSH
T1794107651EED0D06B1B35B479EF3C4616B33FCD27834DB8D22444219076BD05A96CBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_002_dotnet_host_8.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_002_dotnet_host_8.0.22_win_x64.msi.log
Size 2KB
SHA256 e88b74dce67b03519b09210a1c101f174c496cfb8e24c293f3753e018d9bc5da
MD5 27e6f8733f64334fc0069f6b97bf37db
SHA1 878543dde2ca5792664ceb55ac6a4c7c4e85bad3
SHA512 01ecae7360c45ef31cb2079973c2473309915560098c1198436684413d43e562a86c94dd748da249cf4b3f51513bf4738f754c43686fdb067fa3058d4606e4dd
TLSH
T15F4106351FD90809B1B79A47DEF3C4621B33FCD2A934DF5C23448219066BD0698ACB7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_003_windowsdesktop_runtime_8.0.22_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260709131937_003_windowsdesktop_runtime_8.0.22_win_x64.msi.log
Size 2KB
SHA256 db2416727cd0806e44316f755789e007b0bb6e1a20048a51ef55e4295afba27e
MD5 24edb166b0a8de531922bc2fce1681f2
SHA1 b4769130f6b2699e4d420d934ede0c639a4c2df7
SHA512 7333991ff6539ecd1d3e22249d29b588e7ffeaca96934f4e78f0bef142c46de60f99874140f80571700deb96cf9bba8506a9d499a000a2baed10245d1b02fc79
TLSH
T1A34101501EF90916F1B39B8B9AF3C4625F33FC92A930CB4C2244831947ABD05996DB7E
MD5 SHA1 SHA512 TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log
Size 8KB
SHA256 4afd64191f680997b67ec0052c29affd3dd0e5b346d2fd04699ad106284b5e8c
MD5 ec86fee28961213189626381ceb7163c
SHA1 127fcefd8a8902459b8fa8f76f6e188508596742
SHA512 00ad279adb8a42c55714d04c7e12a52886daf6de80731fec89a7f73efa9019b2d3ae8249b5e6c37dc3b0ad3667f478730aace304cbc02a079b5344dad112aab1
SSDEEP 192:/Pu/u/Aju/AjuBARuwDuBAju/Aju/AjuBAncu/Aju/AENudui7juc7YujVkdiRVj:/mW/d/dBzrBd/d/dBeJ/d/UkiOcxadiz
TLSH
T1B0024A458ACBCBA8341122BB4CE2D7ECD6F54E1CB695B7305A75BD08318211EFEE2162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\INetC.dll
Size 21KB
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
TLSH
T158A22B5353A01FFEF3E7153878B27B3745A99A6450938A9F07B32D8D2566282BD32342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\System.dll
Size 10KB
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\UAC.dll
Size 17KB
SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
MD5 88ad3fd90fc52ac3ee0441a38400a384
SHA1 08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
SHA512 359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
SSDEEP 384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
TLSH
T16F724B25ABA083FFC5500571A6E1672217FA98301979586F8E73EEC62FB59436C3E703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\modern-wizard.bmp
Size 150KB
SHA256 bfb254c0cbb17a4350a312e79dcccda1beef44701b03e014841d367557840509
MD5 410d38983076a71136e9a9ad63cb72cf
SHA1 ec5b8fea719265f0c3af4adcbb98b2f8cb546450
SHA512 07bda5e35dc1ab40ce0657d96046c0603d638a6122e8eb01fedc8580b9da47164765c7b1452ad0501d5fa1fc2add316e205e729cddcc0f3c5545e732ead9cabc
SSDEEP 1536:chLDYndaa8vavzHYeRaOJm9a0HJHtjo8zORXCbugRqzqYFSf1cffgXSF:cxYUu
TLSH
T1BCE350F3C05E81C351EC3CA726CC1909AA527FE9845CE57437C7B788EA66D8E542E6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\nsArray.dll
Size 12KB
SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
MD5 0917ee492308b691326e6581e8c793c9
SHA1 ff689c8051ffca7657461ac828bc46e303ab8e59
SHA512 2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5
SSDEEP 192:L+QMtjhIz23Tv7QpAXXcxwtXexpnGOO81h2xXP:SQ6nDv70AXXcWtXexpnGIhW
TLSH
T1C642090A1F6082F5F8F201BA557A2B355A1D7E19971E1EEB07A314142E209C73F39BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\nsDialogs.dll
Size 9KB
SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
MD5 f832e4279c8ff9029b94027803e10e1b
SHA1 134ff09f9c70999da35e73f57b70522dc817e681
SHA512 bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d
SSDEEP 96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420
TLSH
T19212F9675A0011B3E9A3223D306A2E3F977C9325D0527C03C677AE562BF031A7D3A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\nsExec.dll
Size 6KB
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
TLSH
T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processwork.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3129.tmp\processwork.dll
Size 231KB
SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
MD5 0a4fa7a9ba969a805eb0603c7cfe3378
SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
TLSH
T1F2343B36E1C0CC76D5672B7CDC49E3D8556EBA302E2898866BE91E8C9B3D391351C287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsp82A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp82A5.tmp
Size 552B
SHA256 3a540187aba2047118a389c22152a488c215f21766cd75e59c187f7c414bddb1
MD5 bb1ccb3c24a94cf904ce4144c1253352
SHA1 0f8bdf7add3f3d408fadfa1902f5436a4cd725e2
SHA512 8893124fefb3effca66bd4b783b46f8f3adf0ddd4fd5146d879f1cc10303b1e5bef2903a87c5b8d5a1c85432ac83c6e201a5b8998b0e8af671cb2d6048308f9f
TLSH
T1E3F01249EB10D14366733944572F7A407F0A5EAF87C59E6203C74153D5C5F6B855C4D0
MD5 SHA1 SHA512 TLSH

Submit Download

MSI70DC.tmp

Path C:\Windows\Installer\MSI70DC.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsk9C3A.tmp

Path C:\Windows\Temp\{1BE8E1B9-5F2E-4718-8D94-956562FBA6D5}\.cr\nsk9C3A.tmp
Size 608KB
SHA256 daa2e35615ad3b138003d150096c27dd03bd754c434657031e64c33376eddb40
MD5 414d47c7a38936c615c79f9502e9f843
SHA1 53626433410e6d8ddbd7b3b41c8b842490c411f2
SHA512 a19c816a90651bd25667e264fff0f2b8cb2d362d088467d048ca49328face03d07f3aa123454c68a08a286f667f165a53a4fa55f60a6e8dc5e92824db6ada3f3
SSDEEP 12288:emEsd9PZfePv3xl7ft7V+6uC+zd5qLlCp3wXDiy7nlEM0Dnmge:em39PZfePv3r7fm6t+jqps3kNzCM06
TLSH
T11BD48D32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{2DBA9E04-91E6-4CAE-ACFA-265E57B71895}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_8.0.22_win_x64.msi

Path C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\dotnet_host_8.0.22_win_x64.msi
Size 708KB
SHA256 41bee98f21575992e7a5ae1e0e499881117e62f46d722fe183016338c025ee32
MD5 e72f8d52bd0f11645e4cba00bebe6147
SHA1 f88024f18b78b21b9525e9d9a5d1ddec1ec2a82f
SHA512 40264b1d5dbbe63529935c2a1187b8edc3436b32eca2562a2deb42032643360663d11db3ed2abb77076b31a626c67ac686b7c6596e0c8ba49ff9804045e76cb7
SSDEEP 12288:Qmj+OsNV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqr:nj+3Xdc3/7Rin+s
TLSH
T130F48C237D80803AD9BA0D318539D7B16F3DBD204A64989BA380791DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_8.0.22_win_x64.msi

Path C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\dotnet_hostfxr_8.0.22_win_x64.msi
Size 776KB
SHA256 5348ead3f40fbede2047d43c8303e20b12bfc2e0bdf5ebf5020ebc3b311b28d4
MD5 c1237fb95ba5981b4f76f87f862c52c2
SHA1 1135afc4ff887a84b24e45685e33c251313357f0
SHA512 4f724c5d97c313189cd1989732331660bd03cab9c10c2efc0a9919ba8de532f1a78ecadbce57387a1be185c5286925f0994a081a5a090aa24adf85308f5b15f0
SSDEEP 12288:S+jYfCoTzLmTU+4Im4c5DZV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:S+jWTzLYU+PmT5lXdc3/7Rin+s
TLSH
T120F4AD237D80803AD8BA1D71953AD7B16F3DBD204A64899B5380B91DDDF11C0AF76BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_8.0.22_win_x64.msi

Path C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\dotnet_runtime_8.0.22_win_x64.msi
Size 26.3MB
SHA256 efab95895aa3d5dee85b686cef9a81c613cd8bdc1cadcc9ecfe248804e96b4fc
MD5 739eefcd7adbc7c056d8cbfa9a9c331c
SHA1 268ca7fe923fe12e3be1471954e10ce6a0821b2b
SHA512 8e633d264f60b3893ca57127fcb14895bf5cda036769fbfe1ad4e184b23bf87b31f152cac11d9b52bc3efac788c2ac2e157a4e93d69d1608c05aef9a7dfa1735
SSDEEP 786432:rMmQKUEkA1iN9dpRxbbQcnZ/SMTc13Gtx615Sa00:rB5UfA1ivRSsjQw
TLSH
T18257331B3C01C478D5B91E3289B69378573FBF006E2588966694770CDEF92E06B729F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_8.0.22_win_x64.msi

Path C:\Windows\Temp\{B061CB4F-CF7C-4A5C-AD27-D4CBDB7ECB24}\windowsdesktop_runtime_8.0.22_win_x64.msi
Size 29.1MB
SHA256 4605b47ecf5e0512c595e2ea514985f0187765b4d80eca72c95bba40c61c38a2
MD5 ff86fa3f941327d6db7ba482307453a3
SHA1 8e5c8dfe0a345d198cff810e416f7dd696fc7eda
SHA512 304e5f6959a07b08049eb2ca36b40ef94da5a025b5b9a48a93da614d0acc8839114a62f5784b63f0ae99d210798ef34625fd218eeaff78b402d5e97e9d4b3168
SSDEEP 786432:iBv5X1yF4EiZIrJ202TfW5kTQLobxjJQNstg:i5d1yFriAJE+mQLsJmGg
TLSH
T13F673313BD81847DCAB60C3085FFCB295B3E6E3043614D8B6221395EDDF62D19A7A9C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2436-34-0x0000000002300000-0x0000000002341000-memory.dmp

Download

memory/2436-1508-0x00000000009A0000-0x00000000009E1000-memory.dmp

Download

memory/3252-84-0x000001DA02D20000-0x000001DA02E20000-memory.dmp

Download

memory/3252-90-0x000001DA06400000-0x000001DA06420000-memory.dmp

Download

memory/3252-91-0x000001DA16960000-0x000001DA16A60000-memory.dmp

Download

memory/3252-93-0x000001DA06760000-0x000001DA06780000-memory.dmp

Download

memory/3252-116-0x000001DA171C0000-0x000001DA171E0000-memory.dmp

Download

memory/3660-1061-0x00000000002E0000-0x0000000000356000-memory.dmp

Download

memory/4460-1059-0x00000000002E0000-0x0000000000356000-memory.dmp

Download

memory/5504-1062-0x00000000002E0000-0x0000000000356000-memory.dmp

Download