2446b07ee36fcc553c911d3bf3e5f0cb9d11bbe9e35e9d5b4f342b8244254509

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee4p_pm (1).msi
Size 124.5MB
Sample260722-stchvstygx
SHA256 2446b07ee36fcc553c911d3bf3e5f0cb9d11bbe9e35e9d5b4f342b8244254509
MD5 57b7f168d837fb940c79a70278d8d5f1
SHA1 d405071ba48c68eeb39f11b87bf20fd9844d22f4
SHA512 17de89038be26d35867b164aa6365d96b35fd0d72d028a08ba6204f3448979e97d85a5e309cfb572264db96a7e6342c97893139163a8bef0d1842db10f05d80f
SSDEEP 3145728:YqHvLmf6MbmIAN5sUgViYIOKpW2DUxAMlSrWAD0VI+0oFu:YqHjdMbHAz3YIOX2ft02aF
TLSH
T12F583362788E8C32E75F02716525FA6A8C693DB10B6200E772FBF5697A357C2433DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4660	MSI615C.tmp
2564	MSI6A7A.tmp

Loads dropped DLL 23 IoCs

pid	Process
4200	MsiExec.exe
4200	MsiExec.exe
4200	MsiExec.exe
4200	MsiExec.exe
4200	MsiExec.exe
4200	MsiExec.exe
4200	MsiExec.exe
4200	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
2984	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
2984	MsiExec.exe
2984	MsiExec.exe
1512	MsiExec.exe

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3380	msiexec.exe
8	3380	msiexec.exe
16	3380	msiexec.exe
17	3380	msiexec.exe
19	3380	msiexec.exe
24	3380	msiexec.exe
25	3380	msiexec.exe
26	4500	msiexec.exe
29	3380	msiexec.exe
42	4500	msiexec.exe
50	4500	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETaggregator.pdb	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNET.dll.config	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\PdfSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ru\ee4pNET.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.NativeInterop.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\NamedPipeWrapper.pdb	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ExCSS.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.ComponentModel.Annotations.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\NamedPipeWrapper.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraWizard.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pMapWizard.xlam	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Numerics.Vectors.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.Broker.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\NamedPipeWrapper.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNET.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4p.ico	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\EPPlus.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETteamsync.pdb	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.Broker.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.IdentityModel.Abstractions.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.Utils.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.Printing.v18.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Runtime.CompilerServices.Unsafe.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\timestamp	MsiExec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\de\ee4pNET.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraEditors.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraTreeList.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.NativeInterop.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETloader64.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\zh-Hans\ee4pNET.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETteamsync.exe	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeConnect.pdb	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.IdentityModel.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\EPPlus.System.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ExCSS.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\fr\ee4pNET.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeFontInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeFontInstaller.pdb	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraBars.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\AlphaFS.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-arm64\native\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeConnect.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETaggregator.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\PdfSharp.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Web.WebView2.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-arm64\native\msalruntime_arm64.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Svg.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETupdater.exe	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-x86\native\msalruntime_x86.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.IO.RecyclableMemoryStream.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Memory.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraRichEdit.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETteamsync.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETupdater.pdb	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\zh-Hant\ee4pNET.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\RSA-MD5.txt	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraGrid.v18.2.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Web.WebView2.WinForms.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-x64\native\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\EPPlus.Interfaces.dll	msiexec.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI20C3.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FB8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}\ee4p_1.exe	msiexec.exe
File created	C:\Windows\Installer\e58ed4b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6911.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ed49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI615C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30D4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AiFilesRemoveNoImpers_FC9F3505_BF4A_4F65_92AD_6B78D0D7B9EF.bak	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI6843.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI322D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2673.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2567.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CD5.tmp	msiexec.exe
File created	C:\Windows\Installer\{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}\ee4p_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A7A.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ed49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F3A.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventcreate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI6A7A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI615C.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fef0c820-0000-0000-0000-d01200000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292076749609256"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fef0c820-0000-0000-0000-d01200000000}\MaxCapacity = "13092"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSI615C.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSI615C.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSI615C.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fef0c820-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSI615C.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSI615C.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\ProductIcon = "C:\\Windows\\Installer\\{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}\\ee4p_1.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ee4pNET.AddIn\CLSID\ = "{EE000000-3421-4932-A0FE-FB95AF9B08AA}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\ProgId\ = "ee4pNET.CheckTaskPane"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\bit64 = "ee4pNET"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\Class = "ee4pNET.TaskPane"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\ee4pNET	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\bit32 = "ee4pNET"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\Version = "67439144"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\ = "ee4pNET.AddIn"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\thumbs = "ee4pNET"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ee4pNET.CheckTaskPane\ = "ee4pNET.CheckTaskPane"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\Class = "ee4pNET.TaskPane"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\ProgID\ = "ee4pNET.AddIn"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\ProgId\ = "ee4pNET.TaskPane"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\lib = "ee4pNET"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\customization = "ee4pNET"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Efficient Elements/Efficient Elements for presentations/Program/ee4pNET.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\ProgId	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Efficient Elements/Efficient Elements for presentations/Program/ee4pNET.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\ = "ee4pNET.CheckTaskPane"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\Assembly = "ee4pNET, Version=4.5.2600.1, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\program = "ee4pNET"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\Class = "ee4pNET.Modules.DesignChecker.CheckTaskPane"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Efficient Elements/Efficient Elements for presentations/Program/ee4pNET.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32\ = "C:\\Program Files (x86)\\Efficient Elements\\Efficient Elements for presentations\\Program\\ee4pNETloader32.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ee4pNET.TaskPane\CLSID\ = "{EE000001-3942-40F3-84CC-9F79304AF198}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\Assembly = "ee4pNET, Version=4.5.2600.1, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ThreadingModel = "Both"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4200	MsiExec.exe
4200	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
1512	MsiExec.exe
4500	msiexec.exe
4500	msiexec.exe
3396	chrome.exe
3396	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3380	msiexec.exe
Token: SeSecurityPrivilege	4500	msiexec.exe
Token: SeCreateTokenPrivilege	3380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3380	msiexec.exe
Token: SeLockMemoryPrivilege	3380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3380	msiexec.exe
Token: SeMachineAccountPrivilege	3380	msiexec.exe
Token: SeTcbPrivilege	3380	msiexec.exe
Token: SeSecurityPrivilege	3380	msiexec.exe
Token: SeTakeOwnershipPrivilege	3380	msiexec.exe
Token: SeLoadDriverPrivilege	3380	msiexec.exe
Token: SeSystemProfilePrivilege	3380	msiexec.exe
Token: SeSystemtimePrivilege	3380	msiexec.exe
Token: SeProfSingleProcessPrivilege	3380	msiexec.exe
Token: SeIncBasePriorityPrivilege	3380	msiexec.exe
Token: SeCreatePagefilePrivilege	3380	msiexec.exe
Token: SeCreatePermanentPrivilege	3380	msiexec.exe
Token: SeBackupPrivilege	3380	msiexec.exe
Token: SeRestorePrivilege	3380	msiexec.exe
Token: SeShutdownPrivilege	3380	msiexec.exe
Token: SeDebugPrivilege	3380	msiexec.exe
Token: SeAuditPrivilege	3380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3380	msiexec.exe
Token: SeChangeNotifyPrivilege	3380	msiexec.exe
Token: SeRemoteShutdownPrivilege	3380	msiexec.exe
Token: SeUndockPrivilege	3380	msiexec.exe
Token: SeSyncAgentPrivilege	3380	msiexec.exe
Token: SeEnableDelegationPrivilege	3380	msiexec.exe
Token: SeManageVolumePrivilege	3380	msiexec.exe
Token: SeImpersonatePrivilege	3380	msiexec.exe
Token: SeCreateGlobalPrivilege	3380	msiexec.exe
Token: SeCreateTokenPrivilege	3380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3380	msiexec.exe
Token: SeLockMemoryPrivilege	3380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3380	msiexec.exe
Token: SeMachineAccountPrivilege	3380	msiexec.exe
Token: SeTcbPrivilege	3380	msiexec.exe
Token: SeSecurityPrivilege	3380	msiexec.exe
Token: SeTakeOwnershipPrivilege	3380	msiexec.exe
Token: SeLoadDriverPrivilege	3380	msiexec.exe
Token: SeSystemProfilePrivilege	3380	msiexec.exe
Token: SeSystemtimePrivilege	3380	msiexec.exe
Token: SeProfSingleProcessPrivilege	3380	msiexec.exe
Token: SeIncBasePriorityPrivilege	3380	msiexec.exe
Token: SeCreatePagefilePrivilege	3380	msiexec.exe
Token: SeCreatePermanentPrivilege	3380	msiexec.exe
Token: SeBackupPrivilege	3380	msiexec.exe
Token: SeRestorePrivilege	3380	msiexec.exe
Token: SeShutdownPrivilege	3380	msiexec.exe
Token: SeDebugPrivilege	3380	msiexec.exe
Token: SeAuditPrivilege	3380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3380	msiexec.exe
Token: SeChangeNotifyPrivilege	3380	msiexec.exe
Token: SeRemoteShutdownPrivilege	3380	msiexec.exe
Token: SeUndockPrivilege	3380	msiexec.exe
Token: SeSyncAgentPrivilege	3380	msiexec.exe
Token: SeEnableDelegationPrivilege	3380	msiexec.exe
Token: SeManageVolumePrivilege	3380	msiexec.exe
Token: SeImpersonatePrivilege	3380	msiexec.exe
Token: SeCreateGlobalPrivilege	3380	msiexec.exe
Token: SeCreateTokenPrivilege	3380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3380	msiexec.exe
Token: SeLockMemoryPrivilege	3380	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3380	msiexec.exe
3380	msiexec.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4200	4500	msiexec.exe	95
PID 4500 wrote to memory of 1512	4500	msiexec.exe	97
PID 4500 wrote to memory of 2984	4500	msiexec.exe	98
PID 4500 wrote to memory of 4660	4500	msiexec.exe	99
PID 4660 wrote to memory of 788	4660	MSI615C.tmp	100
PID 4500 wrote to memory of 2564	4500	msiexec.exe	102
PID 3396 wrote to memory of 1108	3396	chrome.exe	106
PID 3396 wrote to memory of 3068	3396	chrome.exe	107
PID 3396 wrote to memory of 3992	3396	chrome.exe	108
PID 3396 wrote to memory of 3992	3396	chrome.exe	108
PID 3396 wrote to memory of 1416	3396	chrome.exe	109
PID 3396 wrote to memory of 1416	3396	chrome.exe	109
PID 3396 wrote to memory of 3020	3396	chrome.exe	111
PID 3396 wrote to memory of 3244	3396	chrome.exe	112
PID 3396 wrote to memory of 3020	3396	chrome.exe	111
PID 3396 wrote to memory of 3244	3396	chrome.exe	112
PID 3396 wrote to memory of 4368	3396	chrome.exe	113
PID 3396 wrote to memory of 4368	3396	chrome.exe	113
PID 3396 wrote to memory of 2296	3396	chrome.exe	114
PID 3396 wrote to memory of 2296	3396	chrome.exe	114
PID 3396 wrote to memory of 4424	3396	chrome.exe	115

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\ee4p_pm (1).msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3380

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 984474084A413662A8861DC643E042FA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FAD219E01EB43D41F9FC7FAC35FD8F7A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 64C2B5EF7A4DEA8ADF52C70FC97F3B88 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2984
- C:\Windows\Installer\MSI615C.tmp
  "C:\Windows\Installer\MSI615C.tmp" eventcreate /ID 1 /L APPLICATION /T INFORMATION /SO "Efficient Elements for presentations" /D "Event Source Created"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\eventcreate.exe
    "C:\Windows\System32\eventcreate.exe" /ID 1 /L APPLICATION /T INFORMATION /SO "Efficient Elements for presentations" /D "Event Source Created"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:788
- C:\Windows\Installer\MSI6A7A.tmp
  "C:\Windows\Installer\MSI6A7A.tmp" /s /u
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffcfa4c728,0x7fffcfa4c734,0x7fffcfa4c740
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,618605243147269268,6970828904000379900,524288 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,8798216227551644450,15236777160446389243,262144 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,16769641538357817504,12247303437477266339,524288 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,3980541756416993078,15170988749038460909,2097152 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,14793003214305133354,8228629618308359106,2097152 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,17006871052403885980,3448263161116440785,2097152 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4576,i,16319380783294536160,347731292575046719,2097152 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,2885054011435438575,674980218171145807,524288 --field-trial-handle=2068,i,5795406443554811055,16589392775062115655,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ed4a.rbs

Path C:\Config.Msi\e58ed4a.rbs
Size 4.9MB
SHA256 3253d1152b135ce939d7bd99f4b25c7112abe9b77d82e7ca2ca644f35d624b44
MD5 534d21d58b55a15bea13ba61ad110018
SHA1 035206a29ab8bf6bd6a651f475a103bf225f7b65
SHA512 f7263a010a2effb70546d338078e08a48ae4d1c56a5d90212ffe4de6e97cae93434fb0e1843d0df0d80458c9f1cf9ebd44fe0d086baf51045b0da91798ae614b
SSDEEP 49152:F/C9vUR05lS/NVCf/C9vUR05lS/NVCv/C9vUR05lS/NVCD/C9vUR05lS/NVC1/Cq:eU1U9UnUPU80
TLSH
T193367BB035898061F79E0174A66D8BBFB05EED7A1F2408CB63D97A6D5931EC0273DE06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ed4c.rbs

Path C:\Config.Msi\e58ed4c.rbs
Size 491B
SHA256 ee1d5a7e011655997cb73a1912e4e7fa7f151e1a86f03c98b36bdd1631a767a6
MD5 c927c764b727c6d374683c8b833d5d68
SHA1 f6fee8deb995159efe55ee672a62ad77cfdbe05d
SHA512 dd4a1538973ddd86528a4d9bcddf031ea8150e5b3af5150ed47a700971d4615f8a921b1db265ca301f47dc66ba19f35a99ff3245822c755f2e1ee6a3be466717
TLSH
T1DBF0DC9BABC822E0D583813A9A45198320BBD039281457626C07032C3E923C62EFC009
MD5 SHA1 SHA512 TLSH

Submit Download

Program.xml

Path C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Program.xml
Size 655B
SHA256 a9953460fc7770e149d514f2610e30c6b3ac3843815815d2c3380ad3c200ea97
MD5 af0caca67105b6654463500e86b0e814
SHA1 f29dcb329591f9751f672f9f297d4ce3035437c4
SHA512 4041840acd09ce078e35d1aed8bef1f2e09b029cf0598be53e323cbcdb70de238ba14486f44d9e1a281455248dd9bad4294171d108a4ca75bb4decd8f03f00ed
TLSH
T12DF08170A8D4CEE84F219F37ED00A946405FD1B8A3A8ADAC75ED35178563D8401B7194
MD5 SHA1 SHA512 TLSH

Submit Download

Indents.xml

Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\Indents.xml
Size 6KB
SHA256 cf66f9a28a141f22c209ab2bb061d9c925b2aa9137649440ef00f4f4168033c3
MD5 1c8c07040d0d932bb848c27598dd16de
SHA1 16589dd11f6bc6787f269f4f8a3a144b9f235b55
SHA512 557e420ae3f523247eb1922f58fde70b7745a290207447d56b62b598724778a779f4dd1691746ed0d6a5e01fa46b20eabd951b56f8e4fb56fefe441d7d851ab1
SSDEEP 48:uiX9T7qgpGKgX40XTiZQTxvo6U/AqQ147m1VUm9ONhV6hLV5Gi0ITlcw8+IzSb+1:uia3aIxw33Q0mwm92hV6hDiQuV/
TLSH
T1D4D16B1DA3D04A7687F2A61436F414E1FF51D0E38B0617F4F99C63626B628A24ED7172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasterWizard.xml

Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\MasterWizard.xml
Size 2KB
SHA256 4ec4e86e682d85d796d755d37df8c5caa87d129889fee3ba6602b8d2dabcdbc9
MD5 5eafe9eecdd466b87d77fc0bc3981ece
SHA1 198734903a2bd08192e4fae9557c5c6d2cb575a6
SHA512 460e5ed5b8a2adc1846942b032e756a7d85b4e870256c3e2c7f42c908a8f1194b5961e420c1131992e2a38925382889d1bb4b9f056de8fe6118c69915503d905
TLSH
T18E41F93608D88C739B67173CB59AF4DDC9F1816B8A4D608135DC9627ED5A0E048E38DB
MD5 SHA1 SHA512 TLSH

Submit Download

ProjectPlan.xml

Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\ProjectPlan.xml
Size 12KB
SHA256 dcb7005a688ef32e0c07c0309b616905bb3a0717886815d5b5eafe8ccbb4f347
MD5 f7b5f12c6ae3beedc24d2be081788923
SHA1 88abb4fd829c9e6cc15a2c3cf5e28fca68e79797
SHA512 da023bffd9a90fd7385aaaa3f7da6e48e69a877fb09e6f784016071a9ae29fb16e76cd9389b4d54ec14f74e1104ac8ef229465fe9b6277c22045eff89582b5bf
SSDEEP 192:owlztlW6x84ENnRcIN1b1mKUmC3E/rNafTMzevxVW1ow31x16LC8cT:owlbQu0ebW3jILu
TLSH
T10342AE2898C09C758739852E72B24846EF1E66D7070924A0710FAA377FF78F61E175FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmartElements.xml

Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\SmartElements.xml
Size 11KB
SHA256 c5374651d78989de09cc5e1a860c5d1584e1717f03fcc2be288ae5f467374730
MD5 1788187bba2149a03117e14a2eb1425d
SHA1 52909ccfeac1e2c4dd3153f5899087dd49cd9742
SHA512 e0e2bb368c18ed1fc4b28d7307867b6ae67545831690fe867afa33d0e41ada0e4cb2f8f4e2964bc6d98d0aa83fbb3633449473e3a8e9c94e47240a96940d8188
SSDEEP 192:xJGD5f4c9qkjo4uqq59/5UYhkshwp56qr:xJ2F4c9qkM4DqD/CY+syprr
TLSH
T116325914B4D49D3253BF883E7A93649DEF4671E3011A2105718EB5230F3BEB66EA3876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ColorPalette.xml

Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow_AR\ColorPalette.xml
Size 1KB
SHA256 39f853a71b371278df160a743e229a990b15f877e3fa07634e8a00e73611ab0a
MD5 907c628a4d22eb4a7e2c96f302e9a04f
SHA1 d2665ac43e1c4c76d13bc6376b54f7cd20a3aeea
SHA512 f43462c131edd750d9d0807fbcb362c75ebb4314148b784df4ab26b895e42965bf3302c8f11c8807ce08bd4b7c71e1ba555f122b72d77579a0065b2dbf40586e
TLSH
T1EE319E04E4C9AD634273957D480EB8DCAE62B5F3841E338978CDFA52AFB78534953812
MD5 SHA1 SHA512 TLSH

Submit Download

0766DB9AB186806BB9A6B6802D3BA734

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734
Size 2KB
SHA256 810cbb597bed3d10d13974f3d279b150cf95bb0c049d96876a65caf2951afe2f
MD5 eec50f6ce706602294786431066d72df
SHA1 cca684d8e4089acd9f098e05a325ee7cfb211b13
SHA512 5904a02fe9a36209f166e73fd7d554510c22f67cfd6521d4cd34fd8ea4da326fe1df5bff7ec0bf4f1006a81ef0211f42fccbc88cb352ca7c9f1e904586da29a0
TLSH
T1A441DC4C52113563E009BFB2DECABD87CD71BB436ACAD00F8E541E422469EC55F888AA
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_CA7478770B93F17C27E99FDE25DBE092

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_CA7478770B93F17C27E99FDE25DBE092
Size 1KB
SHA256 e60f31a8fc66a5a69bdf879ebbbe6c045653794b60a00fd2cbe0ae2c697ec061
MD5 7d82304c662a474f380123619f6b71e4
SHA1 0292b62af8f65ea83522cee9becbc3a6191391e9
SHA512 28d542f429bb31b92a1bae51594a6c53b5f3852b39fcb84eb5509369f1767fd0fa9ea30a3a444a6acd971ea55aaadc83e3409db88321d82bc76f4f08b5a70018
TLSH
T14831B84B0A1F38456787DE3459C66D16343CE5C009FC7526302FA7413B597A72F95428
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0cf6a9789b98acb45b572a9aa6fa1ee290f241ac3ff75380ccfdfa8c6f270a76
MD5 d1d8d432c22a6a8b37a8cd78e1cf1759
SHA1 18ad3914aa12b87bc711dd978eddc383fa364c8b
SHA512 0802bcd7cb2d75ae859db598019b7c16f0226445e501e24e180b6bf267ea36492e32302b961c6c03b601444d7ab18c693b121e0cff852386f9266cf97b676ead
TLSH
T14E31F8370F2C69208E138CD42ACAE83B9CA09AD45EAD146AB119D61B18C4BB64F1694F
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 5aa64ce7de7e09bf843bd39829483d346d0f4714fd0feb7d308827a7f1586ce7
MD5 9182cc9523e024607d7a8336abbd7500
SHA1 3ba07875ddcb85c15f998200a3fb5ae65625c6e6
SHA512 81c956bda7ed0fd367956a57e0ffb45f1ccab84171bcda4f6f1bfb38e3bbcf0fecb31b3cf2fb4b1abd0c129257a857162687c2c993e7261601f1925ff5520952
TLSH
T1332196978BED4C865E179E8505DCD7727DB285C860CC0809F25BC274540138B6F6623D
MD5 SHA1 SHA512 TLSH

Submit Download

0766DB9AB186806BB9A6B6802D3BA734

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734
Size 192B
SHA256 d5b666f5a8ebf4accaf3ecf72fd5065c64e2d10d0fc5843b520fba2e602d8a7e
MD5 e4348a98b83b090d46a5c4eff9226261
SHA1 63f1d6fdcafed985b2dd92e658c184a267f6ea75
SHA512 b4f91f9f2c66cfdae542518df93d9c99416199c428802c4c6b2f096d46733ee70d07ab93265c4fe9e7edeeee0a01ce3505e4090488df4fd9f04aa515fe8036ba
TLSH
T119C0920063B94318F162497E3E6112B25BF2AE04C893C728072442489879E005931F27
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_CA7478770B93F17C27E99FDE25DBE092

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_CA7478770B93F17C27E99FDE25DBE092
Size 536B
SHA256 dc01ed904da920ae73f8c7d53d20a94785c260317f3dfa3c079399c8bc40cf07
MD5 304c922861eb7c8a61f614d0104c4917
SHA1 fadccb255174033392201de38f446740e5f30412
SHA512 62aa3081eba37d3208d3463ebdace7c00f0502478b2b2b89e5327e432b876d240726c592eba3681de0ea4792c04fc4f495cc19da41fba1c1efd808d0ca27e656
TLSH
T129F0D42428FD012FF032DF7907F155857D65FA1B392597482EDD03056825D80AC0393F
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 c46f16ef328c519d79cdb04b79c7f45e421cbb8c41e6ad4b1af56f53a357d3b1
MD5 e3b3326d2c35dc71bc3315b2ff9ef573
SHA1 5b85de318cac899eba27b8ff30b3e95f7bde170b
SHA512 f049573ab99a86d2d7d170d5f2fa4bb1feb04b71154e75253c8fc113f7501877ab01dc4a09b7a6666e3ad399c214768bdd169680caf9e35390fcad9fc80fb925
TLSH
T1F9F0970445F9413FF0768ABB8EDA505A6EA5FA032C045B280BA10F092C22F019E2792E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 c050f404236b0ff44f78155586d9764a11f823ee70ace111860b20f2e2304413
MD5 9cefcdc5c7fe1c7993205cc1eb8e71df
SHA1 f74dd5a2aa0ec258e827e0dd6290495334b881ee
SHA512 35a5f21ff4d0967fbc9d0492ef73877ef142b3166e43588d839ff7c9356a6c0dd8b65c0ed7f2bcb97d71ba25ad5ebde97f767dba83eb4fae17ff4e8806135ede
TLSH
T144F0AB1425FDD02CF332CF3488D162F6AE1FB913380109BC055A83445B26F053C46A3D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eb2d2ecff6dec3373cfb4f83043f98bf438c6052ef043499275724b08336c53f
MD5 3c434642385114aded363ec19a06f057
SHA1 918f1369eec06ee17749355d2364b680bd91194f
SHA512 9776038d831f18f6859885c7c0367227fd4608ed0ccb45d4b19c403201570fcb28f49229f9b25803448d871b996ef24e14385dcd20c1fb73742108b641779b3b
TLSH
T178E02BBEC930DD2B09FD0718245C074BE75423176B90895B3A3DD7098FBD63A1A8AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bdc553fae9e5844bda0d3ec54d0de3cb939127e7ba83b9d5897c3cd7d6e9745c
MD5 5e1a0347583bff1e1ce7244bd5f2298a
SHA1 80cd60c99da9c289b7c658fe5399cb601ec3f6a9
SHA512 0605674d9e15c46cfe7ee1bdcbdcb8cd75fbb6468cf45d73ecb7d2893330078ae840a3aec0ecc9701cb0d07c317e9f2d4847cb924b02e56cc3e5ba22c5e235ae
SSDEEP 192:/R1WyoMOpIv72ympAPRp2/95Hsb+WNn7Y0+srarPeGVyIsnAUgtaJ:/R1WEaUQUXo7w005aCe8
TLSH
T13742C72EA920647BACDBD329FD217753E7F5106265942E84EAFC9B1C05E75CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b4ba67adf67bdb7956b3c169c78e70c4367df2f37491d13ae30a9bc90c935549
MD5 e0cdd17dd3a3a24c14181d5d17c38bc5
SHA1 268e0ebf6a9356e0b49ec5babef9579f6fa496dc
SHA512 af6496050e33d4a7a33c5167a310bd1168e668946f4e5e9f94ba88d3e943bf6ba1a6b7ae48e90f8d0b3079da76c9cdbb63ab06c3e962fbf594a9042203258b08
SSDEEP 1536:TCQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Dqfd7NtZL8cHQRZEQ6Spsk
TLSH
T18EC30237DBC21F339D96CF60B9530FD697F644A99034D301AA6D77AF6C8389168428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5a2d434fe442ac5c7e177fe3edf7c2491cc54161cd614041e5d401439021a2d0
MD5 374c8ebc8ca0772a37d9de9ce691f1a3
SHA1 6f641c9206e8569f6fc4ac7822ea7ce4aa3c04de
SHA512 3d4e58e2ae4ba641f5bce981f95da36101985e34ba18c8ea050c3b1f5beab2f4a602e792c2c9d2d5b11b8a0d06b03a65fa9befd0c22e0d8f30d0e3ae710e77df
SSDEEP 3072:IvX8V5i0VHn6kAzjNKap9z6I8a4gmbIEXgOy9qfd7NtZL8cHQRZEQ6SpsT:IU/5nAH0aLFPubtQhqZ/ZLW3ExT
TLSH
T122341272AB922FA74A95CBA43D171D5373F818A4D130D147AEE97EEB2D87C612183C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EfficientElementsCleaner_log_260722-162653.txt

Path C:\Users\Admin\AppData\Local\Temp\EfficientElementsCleaner_log_260722-162653.txt
Size 1KB
SHA256 0d99f93c5319385dd43794784a618b1d74761f310357a05c4b2c156efdc07706
MD5 cdce888abcab60c0cf056cf7ca824afe
SHA1 c748575c4e3600eab29c1a8fb583116929fc9cf7
SHA512 6fb92ed5260a83d19bf4ce7f464aebf0c006f9bc8783a2601d1952c2cf7b4064f24e82395f676459f0858d6fd7a0379f48b81441b0232eddf18d34fa57734e4f
TLSH
T1C421798DD6F0304B945582929A651A9DEC87F11DA5EC74F03EB48218035AC5FC9F9305
MD5 SHA1 SHA512 TLSH

Submit Download

EfficientElementsCleaner_log_260722-162653.txt

Path C:\Users\Admin\AppData\Local\Temp\EfficientElementsCleaner_log_260722-162653.txt
Size 2KB
SHA256 c93d8b139675c1870561ab856f6b24b1bfb2136fdfa675df0986ee7d27407efa
MD5 26b7877aec3fb29ffb71d59dd70f5634
SHA1 f1511f58116baf720038d27ec1f23c8e9145c209
SHA512 2ee2ba4b27276286fd5217377187df16e6c4db0fd23fbcfdecee0dc7dcfd67bae75ff271d409c5eb9ee34d6482bc74676b839b6ba71069420a8866a583c3765e
TLSH
T10B418A8DD2B0304BA4A6529397651A9EEC9BF21CE5FC74F53DB482280799C1FC9F9305
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC917.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC917.tmp
Size 738KB
SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
MD5 36cd2870d577ff917ba93c9f50f86374
SHA1 e51baf257f5a3c3cd7b68690e36945fa3284e710
SHA512 426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda
SSDEEP 12288:z0WEPSjIw3my6hFWRZGdTph0lhSMXleaGv5PCcuvk:zxkuf3T6hFWXKh0lhSMXlxG5q7vk
TLSH
T15DF46D2139C9C02AD56D01B12AFDDA6B912EBD7A4B7144CBA3D8AD7B19F14C29334F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICBFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICBFA.tmp
Size 199KB
SHA256 8fdea6b9bf9b87857fc5d5b3d84ce0fb03d4e23daf694db1e08ecba6c35170b2
MD5 22eafd3e76796f0e0725a2ddd91582a6
SHA1 fffe28a43631dc83870dfcb6e10890d8fcc4d1d3
SHA512 51ed363f9aeaaf8bc416279c13ce136c404fcc0e7e219ec2e1375c35fce63f0352513e981e2613c53d3f3a3649f4cfd1e0ca839fea8b5c5c747a992fb4f5e8c8
SSDEEP 3072:oA6eQkUAL3H/v67er6KTdBnms+u80fLWcYx59OHLy3L3Ag0Fuja+8Nt8T6iz:og1UAbK7/K3nHbTWjfbAOA8T6iz
TLSH
T185147C4075D1C176E6BE16380839DBA65A7DB9100E70CEAB73D54EBE4F302C0DA35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICE7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICE7C.tmp
Size 1.1MB
SHA256 34fe948e2b005a424f4e8aff9d9ef847d5623b99196fe5f5e9bff4983770d95a
MD5 7e4ef4bc701a5f46a1fee1a9fdc403f1
SHA1 ab00fc0985d7cae8ccfdae1cd4e687192f079d47
SHA512 7f8013d024142377aad49fc2c5c30376a4b9dd6c732dbbe3d88d2377965ca9e544d7065c7ee5aa1bd9d29b51f19255335c7ac3f85b5079b1cad710dc74bb8748
SSDEEP 24576:Aruj7NEzYyR9j+9lwCItiGS5oWjIPibwd/TyZ5HCbhpP9gY0dB0lAwvI/oD:A6f4dCItiGS5oW8XlT45HqhpP9gY0dB4
TLSH
T179451A11BD7D8572FB2F1E704A169627E86D55D11BF248FBA2E0D8862235AC31333F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI25F5.tmp

Path C:\Windows\Installer\MSI25F5.tmp
Size 868KB
SHA256 f7a548861c26fd64cdd96f03f1e77db9cbe5de139bad5c897444752615c34182
MD5 e498c8ebbdc8e3930f401e26cc4051ea
SHA1 493863d1245182cd5ffdc1507a645352442090ec
SHA512 21fcf147ff3750f935f2b49a3b7c8016a48fe163dd2ac19d1ccd1af222db412b10ecc2e5c357e0a175051db2022d0557ded6566f5d5ec95973c3612360730c0b
SSDEEP 24576:l1J2ReC9EpmCehUvyXh0lhSMXlE5lS/NVCh:l/C9vUR05lS/NVCh
TLSH
T162156C71354EC036F6AE0170262D8BBBA52D7A760FB108CBA3D4ADAA59704C17735F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI615C.tmp

Path C:\Windows\Installer\MSI615C.tmp
Size 419KB
SHA256 2498aca74afe7cd4cae778e635042f84246137a18d43f1b11a27aaae6b4edb4f
MD5 6d3ec55de344d1c6b9bf1cfd673531b3
SHA1 86ad4ffd15209b381ba8a46a9a3982e9a8037cde
SHA512 687c519890d25d8680ff824d2679544145219b00a88e0277f5d157b4a29281675e1c82fa163b662475118fd4bd954b07e53fe78c641d2df07ef41b1044b4b979
SSDEEP 12288:h9x/jGiu4WkT19YwPhHk2D+F8p7cA53BoUviH:h9pjGiHWK9YwPhH9D+iz5xxvQ
TLSH
T187949D217AD5C033D9A211714FA9EAB6677DB9300F6309CBB3D49E2E2A706C15732B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6A7A.tmp

Path C:\Windows\Installer\MSI6A7A.tmp
Size 158KB
SHA256 8de5310615294af0baf6b662b53146be0d39f0ec574b9cfc175ab03f9c5e40de
MD5 6b1902479894417317a8bef1bf3eb719
SHA1 d70903bc37139dd083e52ca8588cedf920270942
SHA512 569d43e244273b234ca5f3718bea69be44f322bbd36a1d6916706097777653d8d994b9b93f750494422da339d5d78f758273fa0086939a869544cfb777dbb7da
SSDEEP 1536:vI+CNu9irZ9C0ZMsX8ZBmyMXzWEL2P4LxAF4oid:mMOfMsXqoda4LxAc
TLSH
T1A6F371569BC50CBCF36E0A398AF0F17108EBBC76180799AA01373052B67ABD5536DF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2564-3340-0x0000000005600000-0x0000000005692000-memory.dmp

Download

memory/2564-3339-0x0000000005BB0000-0x0000000006154000-memory.dmp

Download

memory/2564-3338-0x0000000000D40000-0x0000000000D6A000-memory.dmp

Download