6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SPGlobalRtdServerSetup64.msi
Size 8.5MB
Sample260802-wtyb4sdh52
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4012	adxregistrator.exe

Loads dropped DLL 19 IoCs

pid	Process
3976	MsiExec.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4012	adxregistrator.exe
4208	regsvr32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	adxregistrator.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 49 IoCs

description	ioc	Process
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Markit.ShellHandler.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiClient.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\stdole.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\FTPCom.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\markit_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\extensibility.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Microsoft.Office.Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\log4net.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\RefEdit.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Installer.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\edtFTPnetPRO.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SpreadsheetGear.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DundasWebChart.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_installer_banner.jpg	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGlobal.com.url	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\RegisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\UnregisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRtdShim.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\addin_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\field_config.bin	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader64.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\NSpring.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.VBIDE.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\InternalField.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitRtdServer.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitToolkitDiagnosticTools.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF085.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF085.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File created	C:\Windows\assembly\tmp\2YMW9GAP\Office.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File created	C:\Windows\Installer\e58f029.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f027.msi	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF085.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{192BA6B2-4107-4DE6-862E-FBA06809211C}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\2YMW9GAP\__AssemblyInfo__.ini	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF085.tmp-\MSFToolkitCustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF6D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File created	C:\Windows\Installer\e58f027.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1188	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adxregistrator.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\excel.exe = "11001"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SPGMISFToolkitAdminTool64.exe = "11001"	msiexec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\ProgId\ = "Sfs.DxlComAddin.Controls.ReferenceButton"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4C5EA226-D268-3F1A-A90C-87731DA02CB8}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\ = "Sfs.DxlComAddin.AddinConfig"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.TreeViewState\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.FeedItem	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ActionPane\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\ = "Sfs.DxlComAddin.Controls.ActionPane"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\Implemented Categories	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F204194F-97E3-308A-956B-C92325AC191C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}\Implemented Categories	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\ProgId\ = "Sfs.DxlComAddin.DataModel.RssReaderErrorEventArgs"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.RssReader	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C5EA226-D268-3F1A-A90C-87731DA02CB8}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\Implemented Categories	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.AddinConfig	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A60D964-5C0C-342C-8828-A20B2941FC54}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A60D964-5C0C-342C-8828-A20B2941FC54}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE196C0B-3B7E-3746-9F7D-2983457E0E8C}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C5EA226-D268-3F1A-A90C-87731DA02CB8}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\ = "Sfs.DxlComAddin.DataModel.RssReader"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\ = "Sfs.DxlComAddin.Controls.ReferenceButton"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\SourceList\PackageName = "SPGlobalRtdServerSetup64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE196C0B-3B7E-3746-9F7D-2983457E0E8C}\ProgId\ = "Sfs.DxlComAddin.Wrappers.XLLModule"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Forms.OptionsForm\ = "Sfs.DxlComAddin.Forms.OptionsForm"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\InprocServer32\Class = "Sfs.DxlComAddin.Controls.TreeViewEx"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6A5D03D-D408-3D6F-B5A9-A6ED75797C56}\Implemented Categories	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}\InprocServer32\1.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE196C0B-3B7E-3746-9F7D-2983457E0E8C}\ = "Sfs.DxlComAddin.Wrappers.XLLModule"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\_SPGMISFToolkitComAddin.AddinModule\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.ExcelUtils\ = "Sfs.DxlComAddin.DataModel.ExcelUtils"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.DxlFormulaParams"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\ = "Sfs.DxlComAddin.Controls.ImageComboItem"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.ExcelUtils\CLSID	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4952	rundll32.exe
2984	msiexec.exe
2984	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1188	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1188	msiexec.exe
Token: SeSecurityPrivilege	2984	msiexec.exe
Token: SeCreateTokenPrivilege	1188	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1188	msiexec.exe
Token: SeLockMemoryPrivilege	1188	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1188	msiexec.exe
Token: SeMachineAccountPrivilege	1188	msiexec.exe
Token: SeTcbPrivilege	1188	msiexec.exe
Token: SeSecurityPrivilege	1188	msiexec.exe
Token: SeTakeOwnershipPrivilege	1188	msiexec.exe
Token: SeLoadDriverPrivilege	1188	msiexec.exe
Token: SeSystemProfilePrivilege	1188	msiexec.exe
Token: SeSystemtimePrivilege	1188	msiexec.exe
Token: SeProfSingleProcessPrivilege	1188	msiexec.exe
Token: SeIncBasePriorityPrivilege	1188	msiexec.exe
Token: SeCreatePagefilePrivilege	1188	msiexec.exe
Token: SeCreatePermanentPrivilege	1188	msiexec.exe
Token: SeBackupPrivilege	1188	msiexec.exe
Token: SeRestorePrivilege	1188	msiexec.exe
Token: SeShutdownPrivilege	1188	msiexec.exe
Token: SeDebugPrivilege	1188	msiexec.exe
Token: SeAuditPrivilege	1188	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1188	msiexec.exe
Token: SeChangeNotifyPrivilege	1188	msiexec.exe
Token: SeRemoteShutdownPrivilege	1188	msiexec.exe
Token: SeUndockPrivilege	1188	msiexec.exe
Token: SeSyncAgentPrivilege	1188	msiexec.exe
Token: SeEnableDelegationPrivilege	1188	msiexec.exe
Token: SeManageVolumePrivilege	1188	msiexec.exe
Token: SeImpersonatePrivilege	1188	msiexec.exe
Token: SeCreateGlobalPrivilege	1188	msiexec.exe
Token: SeBackupPrivilege	4636	vssvc.exe
Token: SeRestorePrivilege	4636	vssvc.exe
Token: SeAuditPrivilege	4636	vssvc.exe
Token: SeBackupPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeDebugPrivilege	4952	rundll32.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeDebugPrivilege	4012	adxregistrator.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1188	msiexec.exe
1188	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4512	2984	msiexec.exe	105
PID 2984 wrote to memory of 3976	2984	msiexec.exe	107
PID 3976 wrote to memory of 4952	3976	MsiExec.exe	108
PID 2984 wrote to memory of 4012	2984	msiexec.exe	109
PID 2984 wrote to memory of 4864	2984	msiexec.exe	110
PID 4864 wrote to memory of 4208	4864	MsiExec.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SPGlobalRtdServerSetup64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1188

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E36AC3F828CCCF97EE1B87A7F432FDF0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF085.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710046 2 MSFToolkitCustomAction!MSFToolkitCustomAction.CustomActions.CloseAppPrompt
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
  "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe" /install=SPGMISFToolkitComAddin.dll /privileges=admin
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7E4808E5312346AE3DF1DEA04556E359 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\regsvr32.exe
    regsvr32 /s "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRTDShim.dll"
    3⤵
    - Loads dropped DLL
    PID:4208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f028.rbs

Path C:\Config.Msi\e58f028.rbs
Size 27KB
SHA256 25d1edd5399d8f8ae8edd11d56b343d58b002535e3b6205686587777b6522ba7
MD5 0c8f5e4d4604a2231fe393496e351acc
SHA1 7d40eb2f0cc3595553da5128403ea493e264e144
SHA512 f536fb0a2ed0b45db1df9ea84f853998ac6b9f1da608c01b8bc705d360fb53165eb0cae3990344ca1b98a1076ac5872b47ec1a8a0126bfecf01b7e185d50b9ee
SSDEEP 768:mzzEB0KQ0k49QRPtQclwsrXlZ/MRSzYqZtH8foIGXdNdciaWMGsn+cUv8HYC2x2M:GEB0KQ0k49QRPtQclwsrXb/MRSzYqZtd
TLSH
T1AAD21240994981D6F84E06B98E5717072F15D298DB0C133B0BBB9635CF9BBC54BE87CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.MSO.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll
Size 4.1MB
SHA256 2488b3a307a297d6f7b349f625eebf8f44a6c2dedcbe3d316ecc87a4d434f35b
MD5 83ca15331b56ec1ea0817c82dc78e6c7
SHA1 1d20a2d47194235ce03c1fcaebbf6836bb35be9c
SHA512 c0ebb6b304ed2e7f3e4c8c500a5c6a178f4d1c1a12ab0074a3ab269fc499c2f81b8b063ae40070fad429652136a737254f9ceb7aeb4ff22bf737510c681c0be1
SSDEEP 24576:9Jqi5VZVORDmP1KZslAUg3YMzPgq/X3zRlNGUvggoDF/nwUbN:dORDmP4jDoqbpRogolbN
TLSH
T10A1650239BEC7CEAC43957B5773783DAC3ADEC4A5111D24E65C4212A24BE613BA037C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.XL.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll
Size 665KB
SHA256 a2a349ddbed4a413cc6e5b83c736febae5db58bbd4c40bef3628605207a59f80
MD5 7153f189b36ba3e26195b7aaf5fb2dbe
SHA1 beec232734a30f3ce5be8da11f5e6d51f6f827f6
SHA512 b9a469c46fa79c938dbdf72150ecc7548f7dd2c82fb13245a4820b242f21e9fe72a9f49e6f274668a929c9262b86286279b31835a458789c6544778f28103d9b
SSDEEP 12288:Bd0+xw8CWALBBuYeNJOtFF4ovgH2sUbY63XqIljQ/:w5BMJOtFF4ovgH2I63acjQ/
TLSH
T19CE4391217E87DA7D07E57BD63B65382C778ED06A202E31F46D460AA1CBA352BE007D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlApiCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll
Size 79KB
SHA256 a21af8a38cba0045b039e4bbae927229161b7dd6e8219dd10abc9d8681d37cae
MD5 659756912fafcbe8b9fc2fa3c3afea57
SHA1 b2d2f15f4c61cc0144e17f3f1e6ecb055fce714a
SHA512 1d6c890cf384e1b47a51e2a69cd22a2e4ed6924d87a18335244041b30f6323923e881b906407da285acbce739d90f6394c28a4526466c75ced0f014f29672173
SSDEEP 1536:XnjjKHrxP5q8Bma/iG+wTMl5EXPqF9T8VlIO74e:+88BLiwTM3IPM9Ta
TLSH
T1AD833A6473ECC66DCACE96B9F550866A43B8C3143963F76C4E98F4CE28437468712277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlClientCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll
Size 506KB
SHA256 0152f7ab07acfa451615de423f88c6b8fab6b4d339ca13065dc7765d7ddac67b
MD5 fd91fe911a69ec8dedf3c94812b3afa7
SHA1 2e0d5873fc04383db3c76e972651eb87fe640709
SHA512 39410300cabb94d050432b7f296ab2f1ed5b62f6033eac43fa7ebe849cf0d2177737ea0b33a9de9170d386dcb1720b21eb83f02b80c62da22c4ffd6d8c3071fa
SSDEEP 12288:U0lr7MNfAZQq9gqMEUlpDyH4K54ybc7x7:U+YNfA+q9N3wpDyF54yY1
TLSH
T1D4B4CF1837F94A49EAFB8B38AA70A0404BB7BE47A531FB5D055071CD18B2F618D51B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFRtdShim.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRtdShim.dll
Size 71KB
SHA256 82bc104d863dd07d7bcc54751a2d22bd9dd8de6c811b0f40ba0b89390a8f31fd
MD5 7c608ce33b09698342dbff8303c5b392
SHA1 cd8c5d371b5e75ac469c7bc276904cdbf6bddc04
SHA512 72b5067683cb0986b22570f5fb3befb3f3f82bd2a5a9c3282e12018f7c80abb3745c1738ba8a42ba0659b7d51c96422bc87b67d04c9560c6059408e440e2e8d2
SSDEEP 1536:X1uOaaIh456Lf/DpOcTi6BB4XvDRayKT56jEjnBs:XskyS6LVRTi6ivNayKT56jEjn
TLSH
T1CD632957779950E8E176C27889A34B42E7F7B4000F2297CF12A1836E2F36BE49D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitComAddin.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll
Size 3.6MB
SHA256 b5adfef200ed80a5cf9c7a29c1adf135c37c539862d586c58bb47e84e290bd5e
MD5 2f0c54fd805dffc4a36c7d1ba13e4ed5
SHA1 a3a83f484730f9596fc8624dc8573856e509d10b
SHA512 e121ad0e9abd28bd7b74476a414fa9bf2721b1491ab5dc4ddc86e450ea8f008ea8ecf38026111dd1d254260e4182b8c004e6d3dadb4210d53674c09c3a545c88
SSDEEP 6144:fERXdGSnVRv7mFJMx6uCCtLj5PQO3arUH0SxCTllyRMzavk2LDxsyXA/EEhuTtWl:fWJcuond3znXR5
TLSH
T1660604007160CB1EC266227894EDEAB48A595E077498831D3DF47D9B37B0B42F58BE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utilities.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll
Size 400KB
SHA256 49825f5112592aa040383b36ede469cb9a8f0b99546c9e4da3d14107c64fa0f1
MD5 fe52a7e42a785174dd4165f27b9d18e4
SHA1 615cbc7260b53818aa46e92ffe79eae3bb6466e8
SHA512 ca49e37bf3954d40dbe54f4d0c1aef85aea8b294ac20fc0b3f56d68bae823e3b747cd856211c9ef19e37c78aab9d4f4ec954cc8b58acddd3ae74d5f47cdb4d55
SSDEEP 12288:w5+3wH1PEdgLOck29POd9d1YK3WDtKUtC:mHp5k29P1K3WDtKmC
TLSH
T1C7942A0173F8831FE2EE1B39F430556947B4E506BABED76E4A88A5AD2C537819C017B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest
Size 334B
SHA256 aab5136411289b4d66460d8b12822a940fe2d8a30db5958333611fd199dacbb1
MD5 abb01bf446f1e221b2c8d7dbb0605b30
SHA1 6d5b85ad038530fa7363c524bb5a1c6c6d45247c
SHA512 eef9801b4a8d140baa858a408a29ddbf17dc03940982685bdeaf48bf4da42dd75fb2d9c99cd8926faa435d18deca60060da53e90bea7db53845156a042e11567
TLSH
T109E0200645599F239612D5DBF8F2800956F827AAD4045405B56DB1365606C690BE3263
MD5 SHA1 SHA512 TLSH

Submit Download

adxregistrator.exe

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
Size 167KB
SHA256 80e99c9bd8ebf68900d62e076e683b09098c9be4ecbca90e1eb43251046f202f
MD5 1d6be4e749fef9bf18a0082ee05e5344
SHA1 5b89cc6788c741627b1bb1a8326301169ae65ac9
SHA512 685ac60f731e32d64c9b38f57a1ae9c200a38d826651f698874afceef35b2476c17c1230d6777109439df1c2125854b317520980f117b653feb797b89303dc8e
SSDEEP 3072:qJDLZbxrdIYMldkxLn+9bRUjTxfJs2DDg2:qJv5fIYMlmxLnAUjvs2D7
TLSH
T17DF37C607BD6C472E1A2193265F587626A28BB325B33D0CB775C4AA85F307D1BA3D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtdlocal_config.xml

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml
Size 912B
SHA256 fb63c862bab8ab22be01309c6404288e7d38661137c461541799b92e7c067981
MD5 349645d9cc73a7e7daec1a41fedfc46c
SHA1 798c9a55aefd9dd588bb4203b0f30d5ca2ebeb54
SHA512 1514de8a604372c326e3a20036d030f89fcd22cc46516abca3e6027493f83ac6efe3c50c01b31087893b63c61a77580cef517100bae9a7779e3293d51d55ed15
TLSH
T13411DC256A5332338824C3F2C23760CA1B712FAA163C047C6E8DB22F26D059C3851E77
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF085.tmp

Path C:\Windows\Installer\MSIF085.tmp
Size 248KB
SHA256 365b97da5bb15b785f3932db392b01fc551872147497fd31d11ee6aa8d8eef3f
MD5 203dc2f058f4b9d4f4e47668ad6fc412
SHA1 8927e78968410714edd3c71335ff23fc6283289f
SHA512 446f731072990153c04868342f95d25c260692e317c115479ba1ad2ea8540aa3403c3804927497d5e23f30a0bf205aa7a9e179c0f370f833f2673177dfd1258b
SSDEEP 3072:5Arbg5BxgracGnEnRQOl9WGPotlx9uYGi+GtvkW2dWdhYElg5P16vqDyS:5ArbtraBqLlAGCHtvkW2DElMP1AqDf
TLSH
T17644BE01B6D48471F1BF2E380D34A66549BEBE604F71CA9F6748862E4EB46C0DA35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFToolkitCustomAction.dll

Path C:\Windows\Installer\MSIF085.tmp-\MSFToolkitCustomAction.dll
Size 283KB
SHA256 eb2f5d7ea77c39131179cdfada4dbe7a2407cbfc89562eae1e190b9a72543a55
MD5 b278d0d3559b0ff0380f007c41e6dffc
SHA1 891193511d6382a669c414ad9338fa3ebb04c7b6
SHA512 d0697d6426d0340e96a9c1ea67c81985296e083d6ba3e5a8207c1d73f07bbfcf591d64fba0ff640ab95c262e9691bb2b7fd0086044880590774d9e9f0916d06e
SSDEEP 192:ypLrzRqw8/z7B47xPIeBqFPuvkvwKwq6k9grbbbbbbbbbbbbo/1jl:wYw8r7K7xAk0GkvwKwq6uNtjl
TLSH
T1A3549604B120CA1FC763223895EDEA7198595E1674A4832D39F83D8377B1B82F59AF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIF085.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f029.msi

Path C:\Windows\Installer\e58f029.msi
Size 8.5MB
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MSF_ICN_200

Path C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200
Size 273KB
SHA256 d9f90faaa32abb8dbb3d4ed113ad25edad67a84de39dbeaa84b83e268f22bd7e
MD5 222e93becec18f646e306e6ad60c7a07
SHA1 97816b343566048bf36b20c6af3f37a9f377f169
SHA512 0115c1eeb7fc41e03ca014945825dd8877f0f79aba1eebfbe77734391e868a7f836637166717fb202b89bd44f006eac9b1e160616f83cee6ef90e44f1c91dba1
SSDEEP 48:mZrWUWUWUWUWUWUWUWUWUWUWUWUSPrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb:2rbbbbbbbbbbbb
TLSH
T1A6548744B121CB1FC763213895EDEA7198495E1674A8832D39F87D8337B4B82F58AE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Office.dll

Path C:\Windows\assembly\tmp\2YMW9GAP\Office.dll
Size 413KB
SHA256 c4519e50471fd5b0d495a1eb010ccf9b34a7af97df4e0d409a9f5147aee9f912
MD5 df7cbcd2db89880a8a92ea134611b038
SHA1 9940cedfb3526e12744c6f358ff90fcbf2cd5bba
SHA512 3bbb3b3ee3189e8699acf4ca01f14535725ed844133c9b5a8494e017c1c283c9c9b4626906ff617bfff014e474e02320183cb61ebdbe95ae792a6f22fcc0d072
SSDEEP 12288:e3LuxZNel6lWlCkZOaU2foNM98c3n/YvmcyjlSonPo:e3LuxZNel6lWljsSjn/Yvv
TLSH
T18F94C446BA1E9013EAC5C73E1577BB5453B9F2410FD2EF4A651D822CAF83688DE036B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 e87feb4232bb8873d5998819f95226d199798f5d07f00fc27baefe01d6a3a88d
MD5 e6ef3d6f5b1b932bd69ea44a25d24cc2
SHA1 c1109aa250361eb5f60fc59820df0af067eb0d36
SHA512 d11f8ca47e2eabf23f5acf636bb9143fd1a8dded88a45de3cd9db05ed7414bd72eafda589b7fc5a3f499e6395849105a0013f5468649d3b6e87ce6d32a56f15d
SSDEEP 24576:xu8m+1zOdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:8
TLSH
T1BE47D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7735962e-ed6f-43a2-af57-8834be96a68e}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7735962e-ed6f-43a2-af57-8834be96a68e}_OnDiskSnapshotProp
Size 6KB
SHA256 b03a2dbc04191809a7c7035c24992e6ce2a9f8accb31e2181ad10f1e35858de8
MD5 f8035c59a3e86d78010b72074039c4b1
SHA1 6ffdd69b6915c4199e067c66f6e50d8f01e61d25
SHA512 f03143a872692915899f1a266014a4f645add1aaccc7a76ab94150c097597fa186ec8ef5cf37097b7f0795e4b04fae870fe2677e7c41364d4a5b132aebe9c277
SSDEEP 96:FrjCgeVZvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Vhcb++ZVmN
TLSH
T11CD179185AE54311E2B3AB7128F14557A477B911EF33CB8E0198238F6670A11F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitAdminTool64.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitAdminTool64.exe.config
Size 283B
SHA256 888e7829792bb583192468acc472f16ac972e47f6305e81750880146818a12f5
MD5 b940a7ae8967f2016c6fa2a1835f36ad
SHA1 14513ca0bfa631f4f31af5cf1b3e81967a73cf07
SHA512 bf477d15f1f8f8b3e556f36f0285e498c07f659d877007f48e808baa22c4e1c0fc49a78093d69216493568e77dce4946b67c518c7c9cb26456086645156f2e44
TLSH
T1FBD02B063298FE3748E74F63E0324550A7B15E29A264701DF0FE7B73460104B3643335
MD5 SHA1 SHA512 TLSH

Submit Download

SPGMISFToolkitUninstaller.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitUninstaller.exe.config
Size 146B
SHA256 fe29ce4150e251a4fc4ca5db321cd0bdc6dbacd34846735ced5113df056ec3b6
MD5 99ca66a5df246c217028be8caf20c154
SHA1 ff0768ce405c2d8c3b9a100c850de4add6fa9e64
SHA512 15abd3756f4bf31ea63c79d1378517f19c2b16a2fe60ca2b6a7a77c15a79e6b0baf3b0beb40b2ca835d0eb56655ef0d9fac0d82b3316a9f21296e313e9d0a721
TLSH
T19BC09B5945787D3BDC234F6355504952FBF54361F464512CE46FA756061015E8306356
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2984-36-0x000001F25FF40000-0x000001F25FFAA000-memory.dmp

Download

memory/4012-125-0x0000000005FC0000-0x0000000006044000-memory.dmp

Download

memory/4012-133-0x0000000005F50000-0x0000000005F6A000-memory.dmp

Download

memory/4012-129-0x0000000006710000-0x00000000067B8000-memory.dmp

Download

memory/4012-137-0x00000000067C0000-0x0000000006828000-memory.dmp

Download

memory/4012-121-0x0000000006A00000-0x0000000006D9A000-memory.dmp

Download

memory/4012-118-0x0000000005B60000-0x0000000005B6A000-memory.dmp

Download

memory/4012-117-0x00000000056D0000-0x0000000005AF4000-memory.dmp

Download

memory/4952-24-0x00000000056C0000-0x0000000005752000-memory.dmp

Download

memory/4952-23-0x0000000005C70000-0x0000000006214000-memory.dmp

Download

memory/4952-22-0x00000000055B0000-0x00000000055FE000-memory.dmp

Download

memory/4952-18-0x0000000005530000-0x000000000555E000-memory.dmp

Download