b754f8b1684418e10e20d6038fdffc479184399c0871efb3490dfd3030bc1425

Analysis

max time kernel
164s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_15ee0ef810ec7a11fc13acd875a307d1_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 17.3MB
Sample260907-jd7vdsfe79
SHA256 b754f8b1684418e10e20d6038fdffc479184399c0871efb3490dfd3030bc1425
MD5 15ee0ef810ec7a11fc13acd875a307d1
SHA1 b350d26f066816264ed8a9817d59996f3d2b47fb
SHA512 837d74462c6678926ae9aec6f72261467f74d9b67b6d3cc7c8bbd0e1940e4d2ae008cd1f325ab726a6bf12dfbf3d3daadd9edd8b71ad7ad54796f138eb1015c9
SSDEEP 393216:nRLQ2DWwiG9CrHq6wqwZkgryt6Hp8eSMg+pYOYhoVTV0:npQKoG9C+Gakgr568g+SOX1O
TLSH
T10D073311BA518471E939207600BAFE62CB25EE6587B1E0D3AFE435898D743D3933279F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5ad-5.dat	UPX
behavioral2/memory/2364-11-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/2364-93-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/2364-94-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/2364-140-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/2364-470-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX
behavioral2/memory/2364-481-0x0000000000400000-0x00000000007CD000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
2364	irsetup.exe
976	dpinst.exe

Loads dropped DLL 32 IoCs

pid	Process
2364	irsetup.exe
6092	MsiExec.exe
6092	MsiExec.exe
6092	MsiExec.exe
6092	MsiExec.exe
6092	MsiExec.exe
6092	MsiExec.exe
6092	MsiExec.exe
6092	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5ad-5.dat	upx
behavioral2/memory/2364-11-0x0000000000400000-0x00000000007CD000-memory.dmp	upx
behavioral2/memory/2364-93-0x0000000000400000-0x00000000007CD000-memory.dmp	upx
behavioral2/memory/2364-94-0x0000000000400000-0x00000000007CD000-memory.dmp	upx
behavioral2/memory/2364-140-0x0000000000400000-0x00000000007CD000-memory.dmp	upx
behavioral2/memory/2364-470-0x0000000000400000-0x00000000007CD000-memory.dmp	upx
behavioral2/memory/2364-481-0x0000000000400000-0x00000000007CD000-memory.dmp	upx

Drops file in Program Files directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\cyusb.sys	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\cyusb.pdb	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\cyusb.sys	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\dpinst.exe	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\cyusb.pdb	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\LCDriver-Windows7x64.inf	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\cyusb.pdb	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\dpinst.exe	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\LCDriver-Windows7x86.inf	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\cyusb.cat	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\dpinst.exe	irsetup.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\NationalInstruments.UI.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\ARClc Setup - x86.msi	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\cyusb.sys	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\dpinst.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\LCDriver-Windows7x64.inf	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\cyusb.pdb	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\dpinst.exe	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\LCDriver-WindowsXPx86.inf	irsetup.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\NationalInstruments.UI.WindowsForms.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\LCDriver-WindowsXPx86.inf	irsetup.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\LCDriver.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\cyusb.pdb	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\cyusb.pdb	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\cyusb.cat	irsetup.exe
File created	C:\Program Files\National Instruments\Shared\Mesa\mesa.dll	msiexec.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\CyUSB.dll	msiexec.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\ARCoptix LC Driver.exe	msiexec.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\ARCsoft_48x48.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\LCDriver-Windows7x86.inf	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\cyusb.sys	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\ARClc Setup - x64.msi	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\dpinst.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\cyusb.cat	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\drivers\cyusb.sys	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\cyusb.cat	irsetup.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\ARCoptix LC Driver.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\ARClc Setup - x86.msi	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX86\driversXP\cyusb.sys	irsetup.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\NationalInstruments.UI.Styles3D.dll	msiexec.exe
File created	C:\Program Files\ARCoptix\ARCoptix LC Driver 1.2\NationalInstruments.UI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\ARClc Setup - x64.msi	irsetup.exe
File created	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\cyusb.cat	irsetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\cyusb.cat	irsetup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF558F3A08FD5CD5E5.TMP	msiexec.exe
File created	C:\Windows\assembly\tmp\CPIN85XS\policy.8.7.NationalInstruments.Common.Native.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\YAKUBU5Q\I60VEZRO	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522224.0\mfcm90.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\THY8PQ5T\NationalInstruments.Common.Native.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522191.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.cat	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF0B66851AEDDB16F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1917.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\OD0Q22RZ\policy.9.0.NationalInstruments.Common.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22A2.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\IFFY3OH4\YPZ8RF6Q	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\YAKUBU5Q\I60VEZRO	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB2C296E3ED4B14F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI232F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{4E74F974-ADE0-42AC-9AF6-367AA33F6D61}\_7F1F193CF973770FFA5DE0.exe	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\GTC5OP61\0S4UW35W	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B0C.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\6I182A8P\policy.9.1.NationalInstruments.Common.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\AGWHWENZ\6VIP2MN1	msiexec.exe
File created	C:\Windows\assembly\tmp\7LW4I8F7\policy.9.1.NationalInstruments.Common.Native.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\COJULDCO\policy.9.0.NationalInstruments.Common.Native.dll	msiexec.exe
File created	C:\Windows\Installer\{4E74F974-ADE0-42AC-9AF6-367AA33F6D61}\_7F1F193CF973770FFA5DE0.exe	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\676TDKU4\policy.9.0.NationalInstruments.NiLmClientDLL.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\7Z61Y2LN\NationalInstruments.NiLmClientDLL.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4E74F974-ADE0-42AC-9AF6-367AA33F6D61}	msiexec.exe
File created	C:\Windows\assembly\tmp\OD0Q22RZ\9ERJ8X3X	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\63SH3R4A\NationalInstruments.MStudioCLM.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260907083522170.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522182.0\9.0.30729.1.cat	msiexec.exe
File created	C:\Windows\assembly\tmp\CPIN85XS\37BG7TIC	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522224.0\mfc90.dll	msiexec.exe
File created	C:\Windows\Installer\e5a14d3.msi	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\7LW4I8F7\policy.9.1.NationalInstruments.Common.Native.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\JDZJ5XOR\M0C9UEL9	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3ABFCE56F92C8920.TMP	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\AGWHWENZ\6VIP2MN1	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\6I182A8P\policy.9.1.NationalInstruments.Common.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\assembly\tmp\M933M2GC\V3O8AO9H	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\JDZJ5XOR\policy.8.7.NationalInstruments.Common.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522170.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522170.0\msvcm90.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\HPDKOHTV\FP60KL2D	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\OD0Q22RZ\policy.9.0.NationalInstruments.Common.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B3C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522170.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.manifest	msiexec.exe
File created	C:\Windows\assembly\tmp\65Y8DGCX\policy.8.9.NationalInstruments.Common.Native.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260907083522182.0	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\QZSOWU3O\policy.13.0.NationalInstruments.Common.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\assembly\tmp\COJULDCO\PDINB0EU	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\GTC5OP61\policy.12.0.NationalInstruments.Common.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23BE.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\65Y8DGCX\DMO79E6T	msiexec.exe
File created	C:\Windows\assembly\tmp\7LW4I8F7\3750SLNU	msiexec.exe
File created	C:\Windows\assembly\tmp\AGWHWENZ\policy.13.0.NationalInstruments.MStudioCLM.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\63SH3R4A\NationalInstruments.MStudioCLM.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522224.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_7264ef23.cat	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\65Y8DGCX\DMO79E6T	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\ND9AVFTR\policy.12.0.NationalInstruments.Common.Native.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI244B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522194.0\9.0.30729.1.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260907083522224.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_7264ef23.manifest	msiexec.exe
File created	C:\Windows\assembly\tmp\THY8PQ5T\NationalInstruments.Common.Native.dll	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_15ee0ef810ec7a11fc13acd875a307d1_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e00600050006c00570058006d0065003d006600340027006c004a00790027004500380065004d00480000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.Styles3D.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0030004200400049003f00640071004b007b003700450047004d00380072003f00580064006100620000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|CyUSB.dll\CyUSB,Version="3.4.2.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="01F1D2B6C851AE92" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e004e004a0034006b0079006b0040002c00340033004d0070003400590059004c00400033006000670000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.WindowsForms.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\479F47E40EDACA24A96F63A73AF3D616\NIMUFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\ProductName = "ARCoptix LC Driver 1.2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.13.0.NationalInstruments.Common.Native,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="AMD64",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0034007a003f007e0078005e00650066006b003300290076002d00250044007900710049002d00500000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\NationalInstruments.NiLmClientDLL,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e004a005b006b0055005000360040004a003d0072006a005a0032005a0055006e002e0030005100380000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\Version = "16908288"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.8.7.NationalInstruments.Common.Native,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="AMD64",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e004a007e004f006f0056002a002e0072007e00510041006a0063006d0078005a0061006d005700760000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|ARCoptix LC Driver.exe\ARCoptix LC Driver,Version="2.0.6192.28390",Culture="neutral",ProcessorArchitecture="MSIL" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0054003400440072003f0045006c00770079005d005500390070002800710025006f0066007800670000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.9.1.NationalInstruments.Common.Native,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="AMD64",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e004c00440021007a0062003d0031007b003400370032004a00670065006c00480042006d005e00310000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.9.0.NationalInstruments.Common.Native,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="AMD64",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0072005f002100340059002a002e0036005b005b004a0026007e006500210032002d00210057002b0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|LCDriver.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.Design.dll\NationalInstruments.UI.Design,Version="13.0.35.242",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18 = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e004a0069002b004800670043002700400067003800570055007e00470042004a00470049007800640000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.WindowsForms.dll\NationalInstruments.UI.WindowsForms,Version="13.0.35.242",Culture="neutral",ProcessorArchitecture="MSIL",Public = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e003d004b00660074003400740068002d00670038005b00630028002e00640038004c0042004900780000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|LCDriver.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.13.0.NationalInstruments.Common,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0041006d00780059002a00210067006d005400380050005500620031004c00470025007d007a00300000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.Styles3D.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\479F47E40EDACA24A96F63A73AF3D616	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\195767C3CA6F41A4EB5AD0DA3BEEEBE6	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|CyUSB.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.13.0.NationalInstruments.MStudioCLM,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e00610051006a002b004800760021006a006c004900730038005a0046002b003900210069004800240000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\NationalInstruments.MStudioCLM,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e00320065006e00600066002c00400040003f0032004100240036004b0034004f00560041007400550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e005b002b0027003f006b005d005500610035003800350047006d0031007a0024004a0036003700310000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.dll\NationalInstruments.UI,Version="13.0.35.242",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e006b002800410040002a0037004c003f0064003f002d0034006100570076004e00680029007500580000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.dll	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|ARCoptix LC Driver.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.9.1.NationalInstruments.Common,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e006b004000400062005b0035005b0048002e002c00410032004200660043006a004d0062003400570000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0045007b004f00740055004900700068007100330061006c0049005b005e002d0073006b004400410000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\195767C3CA6F41A4EB5AD0DA3BEEEBE6	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.9.1.NationalInstruments.NiLmClientDLL,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0068002e004f0052004a003d00790051004c005700720049003400370043004f007300680070003f0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.Styles3D.dll\NationalInstruments.UI.Styles3D,Version="13.0.35.242",Culture="neutral",ProcessorArchitecture="AMD64",PublicKeyToke = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e003d0037006e005f00650059007d003900690040006b0029003f005a0045007b00600063005700580000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\479F47E40EDACA24A96F63A73AF3D616	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0021004300510050002c0068002a0035007300330026006c006b003f0054006000350064006f00440000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\NationalInstruments.Common,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e00480059004100630048004100290031003500600036005d003f004c007500500072003d007000610000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|CyUSB.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList\Net\1 = "C:\\Program Files (x86)\\Common Files\\ARCoptixInstallers\\ARClcX64\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.8.9.NationalInstruments.Common,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0064007b00590071002b00380053005f00530031004200320031006e00480050004a002e0071002d0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList\PackageName = "ARClc Setup - x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Common Files\\ARCoptixInstallers\\ARClcX64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\479F47E40EDACA24A96F63A73AF3D616	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.12.0.NationalInstruments.MStudioCLM,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e00750025006c00780041005e003d0027006c00730031004900480068005400320064006e004d004a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\479F47E40EDACA24A96F63A73AF3D616\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|ARCoptix\|ARCoptix LC Driver 1.2\|NationalInstruments.UI.WindowsForms.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.12.0.NationalInstruments.Common.Native,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="AMD64",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e0074007a006600490066007e0051002600760025002c006b004c0077007500270028006e0067006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\policy.9.0.NationalInstruments.Common,Version="13.0.35.188",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="18CBAE0F9955702A" = 590042004600360041005000430050004c0039006b0051006a003f004f002a0039005a0042004700440065006600610075006c00740046006500610074007500720065003e004000300061004c002d004000500034006e003600320061006800630064002e00730033007800780000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe
1348	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1292	msiexec.exe
Token: SeSecurityPrivilege	1348	msiexec.exe
Token: SeCreateTokenPrivilege	1292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1292	msiexec.exe
Token: SeLockMemoryPrivilege	1292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1292	msiexec.exe
Token: SeMachineAccountPrivilege	1292	msiexec.exe
Token: SeTcbPrivilege	1292	msiexec.exe
Token: SeSecurityPrivilege	1292	msiexec.exe
Token: SeTakeOwnershipPrivilege	1292	msiexec.exe
Token: SeLoadDriverPrivilege	1292	msiexec.exe
Token: SeSystemProfilePrivilege	1292	msiexec.exe
Token: SeSystemtimePrivilege	1292	msiexec.exe
Token: SeProfSingleProcessPrivilege	1292	msiexec.exe
Token: SeIncBasePriorityPrivilege	1292	msiexec.exe
Token: SeCreatePagefilePrivilege	1292	msiexec.exe
Token: SeCreatePermanentPrivilege	1292	msiexec.exe
Token: SeBackupPrivilege	1292	msiexec.exe
Token: SeRestorePrivilege	1292	msiexec.exe
Token: SeShutdownPrivilege	1292	msiexec.exe
Token: SeDebugPrivilege	1292	msiexec.exe
Token: SeAuditPrivilege	1292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1292	msiexec.exe
Token: SeChangeNotifyPrivilege	1292	msiexec.exe
Token: SeRemoteShutdownPrivilege	1292	msiexec.exe
Token: SeUndockPrivilege	1292	msiexec.exe
Token: SeSyncAgentPrivilege	1292	msiexec.exe
Token: SeEnableDelegationPrivilege	1292	msiexec.exe
Token: SeManageVolumePrivilege	1292	msiexec.exe
Token: SeImpersonatePrivilege	1292	msiexec.exe
Token: SeCreateGlobalPrivilege	1292	msiexec.exe
Token: SeCreateTokenPrivilege	1292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1292	msiexec.exe
Token: SeLockMemoryPrivilege	1292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1292	msiexec.exe
Token: SeMachineAccountPrivilege	1292	msiexec.exe
Token: SeTcbPrivilege	1292	msiexec.exe
Token: SeSecurityPrivilege	1292	msiexec.exe
Token: SeTakeOwnershipPrivilege	1292	msiexec.exe
Token: SeLoadDriverPrivilege	1292	msiexec.exe
Token: SeSystemProfilePrivilege	1292	msiexec.exe
Token: SeSystemtimePrivilege	1292	msiexec.exe
Token: SeProfSingleProcessPrivilege	1292	msiexec.exe
Token: SeIncBasePriorityPrivilege	1292	msiexec.exe
Token: SeCreatePagefilePrivilege	1292	msiexec.exe
Token: SeCreatePermanentPrivilege	1292	msiexec.exe
Token: SeBackupPrivilege	1292	msiexec.exe
Token: SeRestorePrivilege	1292	msiexec.exe
Token: SeShutdownPrivilege	1292	msiexec.exe
Token: SeDebugPrivilege	1292	msiexec.exe
Token: SeAuditPrivilege	1292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1292	msiexec.exe
Token: SeChangeNotifyPrivilege	1292	msiexec.exe
Token: SeRemoteShutdownPrivilege	1292	msiexec.exe
Token: SeUndockPrivilege	1292	msiexec.exe
Token: SeSyncAgentPrivilege	1292	msiexec.exe
Token: SeEnableDelegationPrivilege	1292	msiexec.exe
Token: SeManageVolumePrivilege	1292	msiexec.exe
Token: SeImpersonatePrivilege	1292	msiexec.exe
Token: SeCreateGlobalPrivilege	1292	msiexec.exe
Token: SeCreateTokenPrivilege	1292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1292	msiexec.exe
Token: SeLockMemoryPrivilege	1292	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1292	msiexec.exe
1292	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	irsetup.exe
2364	irsetup.exe
1292	msiexec.exe
1348	msiexec.exe
6092	MsiExec.exe
3304	MsiExec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2364	2948	2026-09-06_15ee0ef810ec7a11fc13acd875a307d1_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2364 wrote to memory of 1292	2364	irsetup.exe	90
PID 1348 wrote to memory of 6092	1348	msiexec.exe	92
PID 1348 wrote to memory of 4944	1348	msiexec.exe	98
PID 1348 wrote to memory of 3304	1348	msiexec.exe	100
PID 2364 wrote to memory of 976	2364	irsetup.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-06_15ee0ef810ec7a11fc13acd875a307d1_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_15ee0ef810ec7a11fc13acd875a307d1_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1743730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-09-06_15ee0ef810ec7a11fc13acd875a307d1_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-552508041-2681165170-3229858294-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\msiexec.exe" /i "C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\ARClc Setup - x64.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1292
- - C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\dpinst.exe
    "C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\dpinst.exe"
    3⤵
    - Executes dropped EXE
    PID:976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 017DC4399012F25D3DB086ADFB66019F C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6092
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EC9E5515A7921B6EBA53149654DF3416
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ARClc Setup - x64.msi

Path C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\ARClc Setup - x64.msi
Size 13.4MB
SHA256 23e53e62c69a6c3aeb6efc9247d8ee4a3c557f90cb44189a054221fa599fcf83
MD5 032f16d2ac49d9663c65048cea4ba207
SHA1 0258e771d81eabcd43bd055cae50b9e05095336c
SHA512 7587f52eec8dbd5a5ff90ba99382659eefe699a58fb5c8915c74bc1f629e98bf3116719818d39463ce84a621ff5446797e742ea84011b55706bc99f106f370cc
SSDEEP 393216:qVMOC5lHbj/BvJM2+YqJAe90YV8u9Ggg:5F1Dqmu0o8u9z
TLSH
T109E6331277C6D231E26736311C7BAB2C0F76B8652B3647CB6384968D0E316D0AB3975B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpinst.exe

Path C:\Program Files (x86)\Common Files\ARCoptixInstallers\ARClcX64\drivers\dpinst.exe
Size 663KB
SHA256 fbfaa16b6e1057fd05c30e5b18c455b3c694741ed602a0d98159e7805f496947
MD5 d52047f7c04fd73ca93e9429c3c061ed
SHA1 9432724a1e0ae2f4d5c91a49592b7e501cfa82d4
SHA512 8709d97e0a0aad21392b2706c1e564991a19bea986a7ce726e340179cc8031b318fdd51329313a1c4b0c16afb18d96b3a2ce3d7e4d0f6d3d42c4ad0dee33145e
SSDEEP 6144:5sW7OzpPId26dQcEaUrPvwgwkRVagRoOQTiHaQsVIhVLpHf2mmPiC:fIId79EaUTvwieMowXzZ2tPiC
TLSH
T143E41A18EAA70235ECF1E67F94B15306D87178465B30CACB4242D7AA2EF76D5D432B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LC Driver Setup Log.txt

Path C:\Users\Admin\AppData\Local\Temp\LC Driver Setup Log.txt
Size 4KB
SHA256 88dbeead2faaa9b5a33d99de5243770f1d86fbd4f5ed904128c7e697f8607681
MD5 3a45f3cd14939f9ba403e44724cf0dcb
SHA1 1d4512a772d191aa208f9a6463c2835f61739095
SHA512 14ddd6c8c4923bb69fe5ca8caf539690b2546adbbc5c5b3598f7b19895dcb383b78689bc89738670f7254a94460810cfae97be499ebee15357f2d1e89ab01ea0
SSDEEP 96:etm5q03BCHftp/RFMWnLRN+Ksc+Y/VwON4Vz/klq90Vn/QRS9sVP/oUjARMJ:LqUgU6WX
TLSH
T182913811ADC5F2B2794066C5BF173CE762CC6F69EFB950A0B3414252D3F059F239825A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI961C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI961C.tmp
Size 221KB
SHA256 ba56a2fa13e5dae48b6d74a8fa40f2f44473b386e71ba1e7ec2ded90ad56bb8b
MD5 911aa8d08b7ccab654e897b0e4439354
SHA1 4f4f16048deae47a2ff5b9849042f62ec51794bc
SHA512 8aa11f26093e54a62c5390c64e218a8a57cd3374bbce8ecc243042dd8a2214ede1f3befa699837698c0bd42b9b4e011f95c62588b8bdd4da9aae12dabe4b46e4
SSDEEP 3072:oCwtulBs61sjBGyhrhirKFalevt64totKL7BCSj086gbTv075x2K1kv398G8Haf1:3o9hEcaGt5PBCSnR/c/LSP9tRzSQ
TLSH
T122245B2136D0D131E5E321B846ACA6711ABEF5B15B70C5C7B38407EE9AB17D0AB3874B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI96B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI96B9.tmp
Size 506KB
SHA256 60d68dba51598aada8ca4a593829f00dc2a704444de72dffe79a7b9b6ac51964
MD5 0733a117f06c436663769808e425d653
SHA1 5d3ea3da3e6aa60676bc985bfebe6a133653d9dc
SHA512 f3730fe47c32b0fddcbe538d5ab7c9f3fd81b3f120cc962fa0bf0a88d13281e9f8455d7fccc9321b39a9de6924b5fe6c4a2b2c621ae93e9dcfeff82c1a3fc4c9
SSDEEP 12288:hG+Wx5DTnMlMHdCmxB94pkPfwuWxmi34g+X1rfSzkZMpah:hGbMl8asfwuWxmA+X1rfSzkeM
TLSH
T13CB44B10B7EA8035F9BF2A746875865D0A3B7C915B34C6CFA3489A1E1E717C0DA3532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 c63e64cba7e219316c729c80257a4fc0d53a8db611c7ccd5644e383a494341de
MD5 da0f98f2f852d078fa260e9a5f8f2218
SHA1 9bcb3d5c9d74352c94892375b9fab780da1683a8
SHA512 685d0328ce7637d9e2587af74dfe30fc8066ea6776c3730ff2bc4bcd7ac375e0d8d08dca08b239173aa07a66714d7fec290b3675e890738e09520b41d4706413
SSDEEP 24576:b3BrELwtW5a1bTFQE+m/OHe72CmAD/XWsQRs9fTSO7OwHmPWce6Ns:TR2X6pymME2HAD/W5Rsleo+PWcea
TLSH
T18C553385BA65ABBAE4582C3024739A27CBEBEC18DE0B43035FD4B95BD1376108F77905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 318KB
SHA256 f537713bbe56322189b5ca120537b25d380da267bac4b6a3fcafa62c1c8a0777
MD5 8c0b6838878f3dd76135f999ddb1c900
SHA1 903371c45acc9afd86911a417938954963904442
SHA512 460bf428ebe57b2b018fdf0316028f80ac6921847c0600c1d9c7f3c8fe78c172ccfd4f1baa33ebc391040f9efd302523050bc0e239de85ed77dc205da87cadd4
SSDEEP 6144:Ckn2LG5bwf92+0HiDhAqUS0aMkvAvBtAOj+JzOghK:n2x2cdUhZuIBt8xc
TLSH
T14D64AE03B283C472D5A500B90569D7BA4E7A79715776C4F7EBD01AAD8E203E0A73738E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.12.0.NationalInstruments.NiLmClientDLL.dll

Path C:\Windows\assembly\tmp\57OYN3MI\policy.12.0.NationalInstruments.NiLmClientDLL.dll
Size 3KB
SHA256 43c0b349d0a62d80be45fcc4b0a737f971a503a44072c4edfe1f898bf81fb68f
MD5 129f8eb6bb4df6bc928dde6493f1fb7d
SHA1 d85915a7ee0f4892680751e5b3d1f81d82f2d0aa
SHA512 7aa0e7d1f7238f5f159271c707fb5c3b18f0ee850a63eea34838c7821e968f123a617336d065b6fcf7cc454a6421172745505a80a0e6b11ab5e5155b1244758c
TLSH
T1E3710E47B3FC232EE4B34770AAA747167A75FC10DEA2476E1991111C2C22A649E20FB2
MD5 SHA1 SHA512 TLSH

Submit Download

NationalInstruments.MStudioCLM.dll

Path C:\Windows\assembly\tmp\63SH3R4A\NationalInstruments.MStudioCLM.dll
Size 4KB
SHA256 e767cc2171e076d1b976672162abf5004489711895999c43e979126d50ac1b2a
MD5 fa721fd65a73414840f5d4e665900321
SHA1 26a69eb3a0b8ab2be83174bc32199b43209e1815
SHA512 96a2f9f01eb707280a06d88ec1fe6ca3bbdda9e207ba7b36f9cc0dd0887212c25ddf2dc9532d96833ea771ff4af67a31072a293c0d0c56ff143a624275796145
SSDEEP 48:6YVRvmbMD8qLrKrRvckNff79eUX4ADR2D9UrWZOPUg0TaDEx+:nRSm8trXNbo5+0Tt
TLSH
T1BD9165633B9C4166E4F74370AEB247661AB2FC075F13CB2F0594724C9D276D09A66B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.8.9.NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\65Y8DGCX\policy.8.9.NationalInstruments.Common.Native.dll
Size 2KB
SHA256 7f2c3c6cf4532c367f0101214355181360bc8060dd60e448c084b1feff2e0bd0
MD5 e6c6dceffffd06c82adafaa0368f4dcf
SHA1 9a5cb3f0091d016bd6ca4c30105508e68d179f94
SHA512 0bddf92414289b75fd8e4d7f521518cdc805b82665058a1196930d912470cb77bff74a32f66b89f315e5b4092b435a939da9a9ecacde73daad13c11f85f7a6f4
TLSH
T15651215773FC4356F0B30770ADAB47056AB9FC14EB624B6E0945012D5C22A508E22FB6
MD5 SHA1 SHA512 TLSH

Submit Download

policy.9.0.NationalInstruments.NiLmClientDLL.dll

Path C:\Windows\assembly\tmp\676TDKU4\policy.9.0.NationalInstruments.NiLmClientDLL.dll
Size 3KB
SHA256 34e303bc06db62d4238d3f5c1a39bf22a070a96d11a2a849e9c35c4372aa577f
MD5 3a3daeae9d8f3a456a64a5d46c531fd2
SHA1 934cb05dc49123e749c6170d33b7963fe933af34
SHA512 d6ba473a9e00c8daadeba3002ae02d82c95c58e47cb94b38fbf308cc3bcee5cb960c2dbf8648151489348a271e0ac3744c8d3723e12e8b4cfbd6659f748facac
TLSH
T13371004773B8132AE0B34770AEA747166B75BC10DEA28B6E0945025D5C22A248E35FB5
MD5 SHA1 SHA512 TLSH

Submit Download

XFNNFHXI

Path C:\Windows\assembly\tmp\6I182A8P\XFNNFHXI
Size 1KB
SHA256 6a189a54493070866038db82129c0aeb4fc6ad6e7b45291921e093f869087d23
MD5 67e11be5f0618385054fcd7902f05285
SHA1 f6eae66ab2c08b805a0945cb9f6efb4b8bc42f98
SHA512 efa0754d0087cf31b5ddfce91cffcafe9ff15987a355d422a0a439ff7a27624923f5002874484654841843f05a863953f02f9ae24c0324a75ffd51e1b4b75b15
TLSH
T176319F9271A8A7E285A04A7F3756281D97B103A7FA4C404DF4CE9182CF760CEB1032BB
MD5 SHA1 SHA512 TLSH

Submit Download

policy.9.1.NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\6I182A8P\policy.9.1.NationalInstruments.Common.dll
Size 3KB
SHA256 a39cdb632f6e2668765aa96f9feab5b7be1e4ca5c6789e235e1a5c507e33569a
MD5 bd363a8a16c4eec02641abd96d9e48ea
SHA1 eb9a9f979063dead68a497fbc44d634228f6850d
SHA512 68b7b4b1c4a4f06eb68dca03710faac041a5ac64fb1540fb4e68033ba3d5779344a7f256bd42ba2af7e91c385869c68ef4a106b99174ad8a9cc0008917e0b0a7
TLSH
T1DE71434773F8432AF4B34B70ADE747126AB9BC14DA9247AE0D56014C6C156248E31FBA
MD5 SHA1 SHA512 TLSH

Submit Download

policy.9.1.NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\7LW4I8F7\policy.9.1.NationalInstruments.Common.Native.dll
Size 2KB
SHA256 379c368a767397fad12de8b83c17f3d7f65bda26891f5a2e27aedf5774455aa9
MD5 104280043c4846dc7425f71c85dd583f
SHA1 1e5a38f45812e3f02ae90403583b822867b69f45
SHA512 fd6b0e5deaa99b507e2a9f7b14293fc39ce28da9053161be0c316a7532b72be20822ece73dea3d4f98443626bb8469e27873364bd1a23190ff50bcf6d5eb47fe
TLSH
T1F851214773FC431AF0B30770AEB747056AB9FC14EE614B5E0949025D1C16A54CE62FB5
MD5 SHA1 SHA512 TLSH

Submit Download

NationalInstruments.NiLmClientDLL.dll

Path C:\Windows\assembly\tmp\7Z61Y2LN\NationalInstruments.NiLmClientDLL.dll
Size 29KB
SHA256 306870dcddfd7ae159c208f786a377fdef1a35f81a542a93a82c38595c4862d2
MD5 10c8fc42f15d2c07577e0f65825f2861
SHA1 86ddcc463b2589407decd9b1b9c5e4fa4cddb34e
SHA512 976b72883eac6d12739457f214c9e981319f6ee3e58639898d39b45c707dc25c3b5549c7601c5fbda3f4864de7272e120c2d3c0a6fcb4369736eb93e35e57984
SSDEEP 384:tXhRMUixSt6IzUnerrq44grumVJ3IH3/KttDNNuB8myasqPH1k:tXhdbpzU944gr3tDNNGyaVV
TLSH
T104D29642ABF07361C77E8736D44ED706D9B9B9720BCB07DA35B6C4EA06E315B3289142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.13.0.NationalInstruments.MStudioCLM.dll

Path C:\Windows\assembly\tmp\AGWHWENZ\policy.13.0.NationalInstruments.MStudioCLM.dll
Size 3KB
SHA256 e3c9fab6ab2251f5aca4a403b3b2725957e8584404546802f14fc5b1c1df350c
MD5 97359c39a90c53609dacbe0ba7cebc0f
SHA1 bd3abb7a77cfdbb3e4874a1b06ad10f5c754684c
SHA512 6aacda4540cbad09f929d50aeab0a5ef678e0d3cb02ce04d436c896750fa7025a2b60b41fee5e3eda38d8e6b0717228de17b2a452cc9762bebecb8cce1e92a04
TLSH
T13B710E4773F84326F4B74B70BEE343126676BC11DB624BAE0955018D6D267548E20FA9
MD5 SHA1 SHA512 TLSH

Submit Download

PDINB0EU

Path C:\Windows\assembly\tmp\COJULDCO\PDINB0EU
Size 1KB
SHA256 bd1fbb7006fc44cdd64c0544f9e385e6d84e3eb695e763888fddbbbc80656686
MD5 f4621821c02fafec23f6787ef3064156
SHA1 b56560484fad44bcc4213af0e81b3815c7db3a25
SHA512 957875b25ed895f0e4666c80617149f95a3c0539c90960687f293c88eadfe258563f1b7923adc33d8f4d92e77d2699994e0416a23f6c94424d4310e59c03aad3
TLSH
T15C31A19271E8A7E285A04A3F3756281D97B103A7FA4C404DF4CE9182CF760CEB5032BB
MD5 SHA1 SHA512 TLSH

Submit Download

policy.9.0.NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\COJULDCO\policy.9.0.NationalInstruments.Common.Native.dll
Size 2KB
SHA256 47147c8763368d29facfc7b5dc0e99beee8cfb83359a8df25105368196b8f410
MD5 1ad09cb234a1a7a1552e4b69a5d755fb
SHA1 519c873409e22f21fe016cf31c319e0029680878
SHA512 582e543c323000fa25e0613fad641e7dbeaeeb6e1800df0f7d78b09be911d3c5f7d55c2515a7f5593f2a6baf638d5b666563631bd8d0de3fed3733912cab9d50
TLSH
T16051128773FC4356F0B34770AEB747166BB9FC25DA624B9E0885025D1C12A408E22FB9
MD5 SHA1 SHA512 TLSH

Submit Download

policy.8.7.NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\CPIN85XS\policy.8.7.NationalInstruments.Common.Native.dll
Size 2KB
SHA256 8157e75a0e8d7699c4fe1e9cbbc4b1e563f86a860b49cce76bf0be417bd2fbb9
MD5 4895102079e4897a597b5e9b5d6989c5
SHA1 91ac6479cdcdf5e59ce82e50b44e44b3578accb4
SHA512 03f7859382c59741b8d9e4d92ee0411048d86411e84405fc0de2f79dc728d18b21be6f173d16f745298879b3f1b69ac5f4c3572e70acc14a4d6e68d273a3efc6
TLSH
T19D51424773FC4356F4B30770AEB747056AB9FC15DA610B6E0885011D5C22A01CE62FBA
MD5 SHA1 SHA512 TLSH

Submit Download

policy.8.9.NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\E3HCYXQ0\policy.8.9.NationalInstruments.Common.dll
Size 3KB
SHA256 f7de745df7f5d10de833d865d625cca70ad5e56e5ee963c39460f9688efb64a2
MD5 4a3552e455b4fcbb544e91f13f7578cf
SHA1 b392523f2b1dd335318b239db17ed448d7a01c3d
SHA512 1901a2bf8e7969b978ec65a98cc43511c2a9c052dfd5b358b441ba6442a56b5a0493aaae95892d1e4d3382a260b606bf8d6538ee40183bd89e79139e2607ddd0
TLSH
T17C71238773F84326F4B34770ADA747122BB9FC24DA6287AE0E56014C6C227148D21FB6
MD5 SHA1 SHA512 TLSH

Submit Download

policy.12.0.NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\GTC5OP61\policy.12.0.NationalInstruments.Common.dll
Size 3KB
SHA256 b53b14e3fe51dc2267f2ad39ae46079e23c88b98f81d41a046603bf9b48f9f1c
MD5 31223eb9015ca048dbf3d794309313ac
SHA1 aaf4e1c0c420c9fe81a83d2ecfa2bdb23f53d943
SHA512 c058f754f9c8a97fc3270c7b4ca053560a4f52ad8a87d11e8d4860260a49b0b67976e75c26c71b3a83d4fec7b348e577767a4e4249b6783d3e3d9c0894ec8708
TLSH
T1CE71314A73BC0326F4B34B30ADE347166BB9B910DE9207AE0D55014C6C226549D61F79
MD5 SHA1 SHA512 TLSH

Submit Download

FP60KL2D

Path C:\Windows\assembly\tmp\HPDKOHTV\FP60KL2D
Size 817B
SHA256 ee7b70e21799ae5bb36a998bb87cad24eaeec0624774c1b68e50010c2ba57654
MD5 5f0d55189d181794212a42d466c82a82
SHA1 906687d9f185ae6850efeb600bcd17bf33649f5b
SHA512 15da75bd27220d939b108c0446227f42dd50d10260c0ac54dd235f3c88f315ecfacf3c987184d8acf5bb1b07a779a2a7806fdb6068def450e8fbbfa980ce75af
TLSH
T12C01F25371C8ABA28AB14A7B7652281887B503A7F94C004DF0CE9583CF3658A720326B
MD5 SHA1 SHA512 TLSH

Submit Download

policy.13.0.NationalInstruments.NiLmClientDLL.dll

Path C:\Windows\assembly\tmp\HPDKOHTV\policy.13.0.NationalInstruments.NiLmClientDLL.dll
Size 3KB
SHA256 ac8e890f141800fc60b89c26eaf8b3e38abaabbecbcbf07ce6aadb714279e673
MD5 1c2ddc4b999b378dc193c3667c672a0c
SHA1 b68f90644961d0e6a6c12ac25652934077f8aa0b
SHA512 9ba6d28a1305c44f93a73d0492c83c4867948464db8742b14141530c15c097e659a6dfb6a6245eb7bd0bf367956993f1785f81fb09ab6bc701b21ad415fda01e
TLSH
T1CA71225773FC232AE0F34770BAA7471666B5BC10EA63476E0955015C7C61A648E20FB6
MD5 SHA1 SHA512 TLSH

Submit Download

policy.9.1.NationalInstruments.NiLmClientDLL.dll

Path C:\Windows\assembly\tmp\IFFY3OH4\policy.9.1.NationalInstruments.NiLmClientDLL.dll
Size 3KB
SHA256 28c2e3cbedf6acb2174bf33cdf3c68f7a423bb558b588822e86f8454e06b9751
MD5 2b8bbf211a358338d99a9036a93adaf5
SHA1 79ba948d2c6caa285a9664309434508b5af6fc1d
SHA512 d8daaf05a30a63eb8d29c8f97548c8feec440e0332ff8dbee7e1d52dababae9d6c29dd01a4f236b64574c928f8c23a2346cc17c3ad9973fee3039fa9a6876a56
TLSH
T18971200773BC233AF4B30770AAA347162776BC10DAA24B1E0A4541AD2C216258E35FB5
MD5 SHA1 SHA512 TLSH

Submit Download

policy.8.7.NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\JDZJ5XOR\policy.8.7.NationalInstruments.Common.dll
Size 3KB
SHA256 f55a26fed13a598fa1f7c13bb1637fd4c5523c7d5de266fbab92f495ea9b9c7b
MD5 9af3d7c88d5ff60ffc93c9f26714acc2
SHA1 a5937677b897816962105f2668adcc4bf30b59ba
SHA512 95d8d48a48e6a6dce63cebbfa6c7333ea25669f94f80397850c8090481d81215678559e010b758800b46e735539fde49d704da7b274c4f33e2afa8e4af52877f
TLSH
T1AD71654773F84326F4F34770FEA787122AB6FC14DA92879E0D56015C6C12A118E21F76
MD5 SHA1 SHA512 TLSH

Submit Download

policy.12.0.NationalInstruments.MStudioCLM.dll

Path C:\Windows\assembly\tmp\M933M2GC\policy.12.0.NationalInstruments.MStudioCLM.dll
Size 3KB
SHA256 dbaa91f04098c6206e3411fd4698785bc4fb67d2c237cb01f31a8cebd6e546c3
MD5 d0838e3eca2abaa0a21ac0455e7fbecb
SHA1 fb888752ad965f75b753e013e22f0e54ace5bd76
SHA512 3d4d800a8185e149610f5ba25f12255d8a9f9ec9a4d551707a6a4607282722c38711ca794f6da520f50efc00a038773e21d91710a57e86576643e6106f5fe66e
TLSH
T1C771424773B4032AF4B74770BEA7430266B2FC15DE614BAF0985014CBC217505E21FA9
MD5 SHA1 SHA512 TLSH

Submit Download

policy.12.0.NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\ND9AVFTR\policy.12.0.NationalInstruments.Common.Native.dll
Size 2KB
SHA256 eb2f9822e4a0c14123318a84c7bc411a4112a76b685fc208770a05e52d7ea583
MD5 ee4804230a552cb8ae9128a409a7607f
SHA1 9854795d8e3c767d427f60051ddb16507dde4378
SHA512 c1ca021e2ff4e2cbc66c2f0105ef66f6d025fcd608efe586d717e02bba49c77833ce6d9f6dd9efe04a70f573e62fbeb5242785c5dd1e2cae9ff777e48813c9b4
TLSH
T1D8510E07B3F80315F4B30770BEB74B0676B9FC25DA528BAE0889015D6C26B549E21FB6
MD5 SHA1 SHA512 TLSH

Submit Download

policy.9.0.NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\OD0Q22RZ\policy.9.0.NationalInstruments.Common.dll
Size 3KB
SHA256 de132625f6455e6ce87d3eb5a021224f36522cd6f3dc7238f0971a468f8b72da
MD5 a0fa2a61fba8d2eb962390b3948cc2ea
SHA1 5db827d66a2da317d1616de036b3216ab972bd8f
SHA512 ad508fa64241e0a033f23b1ca0b11ec004762008bd92aadcd4d4b4fde2fe20ba2873390157a9082a62de2ebacceb43321e4ee674c480bed5553e02e48ffeaf1b
TLSH
T17C71234763F80326F4F34730ADA3871366B9FC24DAA2876E0D56015C6C22A548E21FB6
MD5 SHA1 SHA512 TLSH

Submit Download

policy.13.0.NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\QZSOWU3O\policy.13.0.NationalInstruments.Common.dll
Size 3KB
SHA256 cf7e4354eb42310b07d23f14eff7b9966992c3a21e4f2e22e208b0ed94105e05
MD5 a4df36389248dd8d0ebe2db198312166
SHA1 3964707767e19182aa3d21e7ca051ce03284e1f8
SHA512 c0911405bff3e749c2108db0cb19369336c9ad088f51f3464e9c8a8b5ceb86c4b64deaad4985b57cde3630dcb948107204b10f6c343ee2ca00ecaf435f30b7bf
TLSH
T17E71EE4763FC0326F4B34730BDE747126BB9B910DAA247AE0D49015C6C216548D21FB9
MD5 SHA1 SHA512 TLSH

Submit Download

NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\THY8PQ5T\NationalInstruments.Common.Native.dll
Size 77KB
SHA256 6497b14ca4cadde292766b6587c686c6714681a47134ef33c3a2bd43c31f9b0a
MD5 0f3bdbdea3a7ebcc553e5e516db8f8b8
SHA1 43e5ccb871292c2d1f62c1a92ffafb91b2bb9bca
SHA512 bcc4922e87c803f9575593a7ae23032e13a93e3a7e4eff7765f427444dbe46b150f02f10d6cd90e9e3df71682be638838624d56c977dee0b66e566a2c3c76dcc
SSDEEP 1536:lX3I5hvXPPEpW7un0cu+vn24bhY9vjgawBtCjvPpUSF5:lX3I/PPPA0cu+vn24bhY9vjgawBtCjv9
TLSH
T19D731B0657540B3FE7A7063781A7E3D90733A86656326302648863FA3837B94EF6B7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NationalInstruments.Common.dll

Path C:\Windows\assembly\tmp\XW5L4ZQ3\NationalInstruments.Common.dll
Size 278KB
SHA256 bd91a16f8b9d4afb6a7e60d4c143c5c3ad4b90509e4e8e5ae9246300e0d70ce6
MD5 115af5e0d4ce0536bd1475f14bc8fb68
SHA1 3265a799ed4bdec3a87115353ce045607c93be96
SHA512 9eb4a4a4be95c835a842b4cd6a715362d082f37d816031d5324963798531298f911e7502ff0aba8f7f70cecca3d98f96e8619e05d8ed32659317b404f17a01f0
SSDEEP 3072:eut9JrANVU69KN8VfY3hLi9fROYeDraZ6F5thUmmIZBiNFNxLNn:eulrANVwN8NY3c9fRzMaZ6X7mx
TLSH
T15D54395423DC8616E7FFAB71E020411587F4E957A5E7E78E1981A2F91C623E0C9A23F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policy.13.0.NationalInstruments.Common.Native.dll

Path C:\Windows\assembly\tmp\YAKUBU5Q\policy.13.0.NationalInstruments.Common.Native.dll
Size 2KB
SHA256 bcc658ab0236d8f68e6ea462a01654950d0b8e156b35bba893494ad7d2655651
MD5 4509eb1d3eccd7d18d44c0f830353ba2
SHA1 7e9b92cfef7013490d9874db21e0050a7c1ace7f
SHA512 06de59325e04fef966cefbf3d8b5c2657abd75af18326f1f33528c6458ac8ad9def6ca5b07ab903d2cc211c075c4b8ecdba478ddb372c8dd1ba15971547e8130
TLSH
T10E515447B3FC035AF4B30730BEB707156AB5FC25EA524B9E0989015D6C22A849E21F76
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 88c808cd44bbe471d2776e07c2496b8db951b7cb500c2759e930fadeb17f5ce6
MD5 31eccc0e8664115f9770bb2a0c49c7a2
SHA1 5b900de00bf64e0dea1d6d16cd0561038cf53798
SHA512 280338b878c09eed23a2e52c63c24f6855aef4c240fed6211f0960eb51ee282fba4bc120ed1b4a2a96b3b14204630ebc5ad7a2abf15dc02f775b8a2973839452
SSDEEP 24576:9Fo3DMPDdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:bH4
TLSH
T1FB57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b5aa8ed7-99dd-4320-b8fc-e13d2f37b07c}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b5aa8ed7-99dd-4320-b8fc-e13d2f37b07c}_OnDiskSnapshotProp
Size 6KB
SHA256 48f3a7b2b406e58aa3f5412cd64d2fa1eb7470bab526a98343aa7db8d9ae3975
MD5 516088d1ceef2eeb3cd8ca504e735e2c
SHA1 c84be56975e5460360414f4f8f4d30ad9c748da6
SHA512 fabeff5b2c8af83e456fbcd7870cd5c0c3dfc26f680dab708878e6f08bb876830b07ab979ebf50ef6898e348edfc1f205e5f893629ee74836a296577cf1fe136
SSDEEP 96:FnA0bW5mftvlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:lA0yUvl/b++uVm
TLSH
T17ED198085AE54311E2F3AB3229F14557A837B911EF33CB8E0298238E2631911F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1348-258-0x0000020ADE540000-0x0000020ADE546000-memory.dmp

Download

memory/1348-144-0x0000020ADE0B0000-0x0000020ADE0B8000-memory.dmp

Download

memory/1348-208-0x0000020ADE180000-0x0000020ADE188000-memory.dmp

Download

memory/1348-241-0x0000020ADE520000-0x0000020ADE526000-memory.dmp

Download

memory/1348-248-0x0000020ADE530000-0x0000020ADE538000-memory.dmp

Download

memory/1348-202-0x0000020ADE5F0000-0x0000020ADE63C000-memory.dmp

Download

memory/1348-219-0x0000020ADE4B0000-0x0000020ADE4B6000-memory.dmp

Download

memory/1348-265-0x0000020ADE560000-0x0000020ADE568000-memory.dmp

Download

memory/1348-198-0x0000020ADE170000-0x0000020ADE178000-memory.dmp

Download

memory/1348-194-0x0000020ADE160000-0x0000020ADE168000-memory.dmp

Download

memory/1348-190-0x0000020ADE150000-0x0000020ADE158000-memory.dmp

Download

memory/1348-186-0x0000020ADE140000-0x0000020ADE148000-memory.dmp

Download

memory/1348-183-0x0000020ADE130000-0x0000020ADE136000-memory.dmp

Download

memory/1348-178-0x0000020ADE120000-0x0000020ADE128000-memory.dmp

Download

memory/1348-236-0x0000020ADE510000-0x0000020ADE51E000-memory.dmp

Download

memory/1348-175-0x0000020ADE110000-0x0000020ADE118000-memory.dmp

Download

memory/1348-214-0x0000000000A50000-0x0000000000A69000-memory.dmp

Download

memory/1348-168-0x0000020ADE0E0000-0x0000020ADE0E8000-memory.dmp

Download

memory/1348-158-0x0000020ADE0D0000-0x0000020ADE0D8000-memory.dmp

Download

memory/1348-150-0x0000020ADE0C0000-0x0000020ADE0C6000-memory.dmp

Download

memory/1348-358-0x0000020ADD4F0000-0x0000020ADDE94000-memory.dmp

Download

memory/1348-477-0x0000020ADD4F0000-0x0000020ADDE94000-memory.dmp

Download

memory/1348-172-0x0000020ADE100000-0x0000020ADE108000-memory.dmp

Download

memory/1348-231-0x0000020ADE4D0000-0x0000020ADE4D6000-memory.dmp

Download

memory/2364-94-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/2364-470-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/2364-93-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/2364-11-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/2364-140-0x0000000000400000-0x00000000007CD000-memory.dmp

Download

memory/2364-481-0x0000000000400000-0x00000000007CD000-memory.dmp

Download