abf388582790661ed70930b04bafc523621206e8b20664fd1f1d9bf1047910d8

Analysis

user interaction
yes
max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AP_SEB_3.10.2.9999_x64.exe
Size 350.7MB
Sample261102-kft7ragt3w
SHA256 abf388582790661ed70930b04bafc523621206e8b20664fd1f1d9bf1047910d8
MD5 251cc8c904db5a689e2f505cfc8251f0
SHA1 b74a90cd2e1a2db3738f3fa01238dd7973965ce2
SHA512 ea7135d8028a61cbd1a12e36cabeec76fd4d28468087e4941fb00858429638f2c86e42a62dc84a605aa2f37062ee7d2219b21d741dda7a856c2420a8ca0fc5ac
SSDEEP 6291456:E8m6/Zca3GjIJ4Z6notioSTdAiI3Prx0wxGFQlXFM91OvlGfopljO0jO48JYet:R1/ZcahA5owimyklXq12pBO0lAT
TLSH
T12809337383F8CB7FF4F068BAE920F538462578390565582AE74ED8A021935CB35B6F61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0aa48568-9268-4f2c-b2f9-19a2ee673702} = "\"C:\\ProgramData\\Package Cache\\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\\SetupBundle.exe\" /burn.runonce"	SetupBundle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
40	3744	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	AP_SEB_3.10.2.9999_x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Drops file in System32 directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\SafeExamBrowser\Logs\2026-11-02_08h35m15s_Service.log	SafeExamBrowser.Service.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\SafeExamBrowser\Application\locales\pt-BR_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lv_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\KGySoft.Drawing.Core.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fil_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\zh-TW_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\es_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Configuration\SEBConfigTool.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fa_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Browser.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ro_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\id_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lt_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\FontAwesome.WPF.xml	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fi_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fi.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Reset\SafeExamBrowser.ResetUtility.exe.config	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\cs_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe.config	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ro_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\en-GB_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fr_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\CefSharp.BrowserSubprocess.Core.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\CefSharp.BrowserSubprocess.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.UserInterface.Shared.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\th_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\sv.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\zh-CN_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Applications.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\pl_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lv_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fa_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Proctoring.dll.config	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\NAudio.Wasapi.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\kn.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\te_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Client.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\bn_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\am.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\sk.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fil_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ur_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fa_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Lockdown.Contracts.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\cs.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.UserInterface.Contracts.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\en-US_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\sr_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Configuration\System.Runtime.CompilerServices.Unsafe.xml	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ja_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.SystemComponents.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ru_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\v8_context_snapshot.bin	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ja_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\en-US_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\en-US_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Server.Contracts.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\Syroot.KnownFolders.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lt.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\he_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ar_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\hr.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\hi_MASCULINE.pak	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592234.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592234.msi	msiexec.exe
File created	C:\Windows\Installer\e592247.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30AE.tmp	msiexec.exe
File created	C:\Windows\Installer\e59225c.msi	msiexec.exe
File created	C:\Windows\Installer\e59225d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ResetUtilityIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI286F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}	msiexec.exe
File created	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ApplicationIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ApplicationIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ConfigurationToolIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59225d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B7A.tmp	msiexec.exe
File created	C:\Windows\Installer\e592261.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2570.tmp	msiexec.exe
File created	C:\Windows\Installer\e592246.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592247.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D81.tmp	msiexec.exe
File created	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ConfigurationToolIcon	msiexec.exe
File created	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ResetUtilityIcon	msiexec.exe

Executes dropped EXE 13 IoCs

pid	Process
1016	AP_SEB_3.10.2.9999_x64.exe
3048	SetupBundle.exe
3196	SetupBundle.exe
4048	SetupBundle.exe
6036	SetupBundle.exe
5580	vc_redist.x64.exe
3748	vc_redist.x64.exe
2408	VC_redist.x64.exe
1424	VC_redist.x64.exe
5332	VC_redist.x64.exe
4364	VC_redist.x64.exe
4756	VC_redist.x64.exe
3564	SafeExamBrowser.Service.exe

Loads dropped DLL 27 IoCs

pid	Process
1016	AP_SEB_3.10.2.9999_x64.exe
3748	vc_redist.x64.exe
6036	SetupBundle.exe
1516	VC_redist.x64.exe
4364	VC_redist.x64.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe
3564	SafeExamBrowser.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AP_SEB_3.10.2.9999_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AP_SEB_3.10.2.9999_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SafeExamBrowser.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SafeExamBrowser.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupBundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupBundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AP_SEB_3.10.2.9999_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupBundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupBundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AP_SEB_3.10.2.9999_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000069bf6088149b83f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000069bf60880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090069bf6088000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a69bf6088000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d69bf6088000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\DisplayName = "Safe Exam Browser (x64)"	SetupBundle.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\PackageCode = "51FBA0EFEFDB3494A815FAF727EE72D7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Version = "237799819"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\DefaultIcon\ = "\"C:\\Program Files\\SafeExamBrowser\\Application\\ConfigurationFile.ico\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4C75B6C8B27E8349A40BE554ABF2E1F\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\ProductIcon = "C:\\Windows\\Installer\\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\\ApplicationIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.seb\Content Type = "application/seb"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\PackageCode = "54DBE5F4A6701D94F88808552D3738B7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\shell\open\command\ = "\"C:\\Program Files\\SafeExamBrowser\\Application\\SafeExamBrowser.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.44.35211"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\seb\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\seb\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ = "{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}"	SetupBundle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seb	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4C75B6C8B27E8349A40BE554ABF2E1F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\DefaultIcon\ = "C:\\Program Files\\SafeExamBrowser\\Application\\Application.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sebs\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.seb\ = "ConfigurationFileExtension"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Version = "50987010"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\PackageName = "Setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Media\3 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\Dependents\{0aa48568-9268-4f2c-b2f9-19a2ee673702}	SetupBundle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe
3744	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	5244	vssvc.exe
Token: SeRestorePrivilege	5244	vssvc.exe
Token: SeAuditPrivilege	5244	vssvc.exe
Token: SeShutdownPrivilege	2408	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2408	VC_redist.x64.exe
Token: SeSecurityPrivilege	3744	msiexec.exe
Token: SeCreateTokenPrivilege	2408	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2408	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2408	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2408	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2408	VC_redist.x64.exe
Token: SeTcbPrivilege	2408	VC_redist.x64.exe
Token: SeSecurityPrivilege	2408	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2408	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2408	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2408	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2408	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2408	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2408	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2408	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2408	VC_redist.x64.exe
Token: SeBackupPrivilege	2408	VC_redist.x64.exe
Token: SeRestorePrivilege	2408	VC_redist.x64.exe
Token: SeShutdownPrivilege	2408	VC_redist.x64.exe
Token: SeDebugPrivilege	2408	VC_redist.x64.exe
Token: SeAuditPrivilege	2408	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2408	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2408	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2408	VC_redist.x64.exe
Token: SeUndockPrivilege	2408	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2408	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2408	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2408	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2408	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2408	VC_redist.x64.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeBackupPrivilege	3008	srtasks.exe
Token: SeRestorePrivilege	3008	srtasks.exe
Token: SeSecurityPrivilege	3008	srtasks.exe
Token: SeTakeOwnershipPrivilege	3008	srtasks.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe
Token: SeTakeOwnershipPrivilege	3744	msiexec.exe
Token: SeRestorePrivilege	3744	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	AP_SEB_3.10.2.9999_x64.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1016	4340	AP_SEB_3.10.2.9999_x64.exe	86
PID 1016 wrote to memory of 3048	1016	AP_SEB_3.10.2.9999_x64.exe	93
PID 3196 wrote to memory of 4048	3196	SetupBundle.exe	108
PID 4048 wrote to memory of 6036	4048	SetupBundle.exe	109
PID 3048 wrote to memory of 5580	3048	SetupBundle.exe	110
PID 5580 wrote to memory of 3748	5580	vc_redist.x64.exe	111
PID 3748 wrote to memory of 2408	3748	vc_redist.x64.exe	112
PID 1424 wrote to memory of 5332	1424	VC_redist.x64.exe	117
PID 5332 wrote to memory of 4364	5332	VC_redist.x64.exe	118
PID 2408 wrote to memory of 2728	2408	VC_redist.x64.exe	122
PID 2728 wrote to memory of 1516	2728	VC_redist.x64.exe	123
PID 1516 wrote to memory of 4976	1516	VC_redist.x64.exe	124
PID 4364 wrote to memory of 4756	4364	VC_redist.x64.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\AP_SEB_3.10.2.9999_x64.exe
"C:\Users\Admin\AppData\Local\Temp\AP_SEB_3.10.2.9999_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\Temp\{5B5A44EC-79FD-40FE-874D-F79B7459C13C}\.cr\AP_SEB_3.10.2.9999_x64.exe
  "C:\Windows\Temp\{5B5A44EC-79FD-40FE-874D-F79B7459C13C}\.cr\AP_SEB_3.10.2.9999_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\AP_SEB_3.10.2.9999_x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=692
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\Temp\{0F38D322-362A-41C9-A818-EFCCAE544D42}\.be\SetupBundle.exe
    "C:\Windows\Temp\{0F38D322-362A-41C9-A818-EFCCAE544D42}\.be\SetupBundle.exe" -q -burn.elevated BurnPipe.{C43C010C-EF7B-4022-BA92-4A3E5FBDEE6B} {90D72AC2-724D-4DF4-8B54-94F1DFCB52B4} 1016
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\ProgramData\Package Cache\21CE0EE54BFF57F69FAFA741025BF2F15B356405\vc_redist.x64.exe
      "C:\ProgramData\Package Cache\21CE0EE54BFF57F69FAFA741025BF2F15B356405\vc_redist.x64.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5580
    - - C:\Windows\Temp\{B79C42E8-25FB-4532-BC22-DCE670E87EFC}\.cr\vc_redist.x64.exe
        
        "C:\Windows\Temp\{B79C42E8-25FB-4532-BC22-DCE670E87EFC}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\21CE0EE54BFF57F69FAFA741025BF2F15B356405\vc_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=692 /install /quiet /norestart
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5B73FEBD-ACEA-402C-BD01-D40978F9C599} {38563CB0-CA70-4FB9-92D9-62B7362F1BA1} 3748
        6⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{59CBF506-68E9-46DA-83B5-779BD80714C0} {28F25577-FEA7-42BA-B7AC-43EAC4A5A487} 2408
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{59CBF506-68E9-46DA-83B5-779BD80714C0} {28F25577-FEA7-42BA-B7AC-43EAC4A5A487} 2408
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{08D515CF-1EB4-4C3B-8449-E8147F25A8B8} {A70C85FB-20D2-461C-AA0C-50203C67194F} 1516
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe
"C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196
- C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe
  "C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Safe_Exam_Browser_20261102083428.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe
    "C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\SetupBundle.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Safe_Exam_Browser_20261102083428.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102083453.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102083453.log" /install
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{EA7885EB-BF5C-4CAF-965A-35876C6ABFC8} {2FD590B6-1325-4078-ADA3-DB1CB1E85F36} 4364
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4756

C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe
"C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592239.rbs

Path C:\Config.Msi\e592239.rbs
Size 19KB
SHA256 693cd3747097ab884a644d42ae40244de55f7da7bf5a43898429af37a1db529b
MD5 34d4ad5ee0593881fdbe3bb1c995cf6b
SHA1 5d4e998fa026067b43af0bfdc57c897ded4fc0d3
SHA512 49219138d293961327aa76190b8cb2f4471848f4e4cdb9610cc72fdcd39142da0011316f0ec3a7c68ca7e65ab1609300fff46f9757310465307d95012976907c
SSDEEP 192:cMhRH1kRa15dXcFUADIc1L+W+y4+agPuCv7:cMhRH6RaTeC81L/cuv7
TLSH
T11092FB427680C9D2D8766B30CD671BA53B76DBD9A350438B50DC90308F93BCA2F9D69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592245.rbs

Path C:\Config.Msi\e592245.rbs
Size 19KB
SHA256 850540b68e9a7fecaed23198d3f5409dac196290bc17e1b5f50772e2a3e663ea
MD5 ae1de358ff6e7424b7f097d6e9cb61da
SHA1 19231afc21f0d7a5d33fb8c8f48c060e05bf3e9f
SHA512 760484053dd6b292686b5bbb1b69bcea5bff0c4bfab7a6a6c716ea254e45a0f33313f7804e950ab66ce6e5b927309080a0c163e085297259d3e17e4c04550ef1
SSDEEP 384:yvOGnJXMjZ7Up+BFqiO6FggJA0uJA0Goa2D8Lfv/8c3zMZxq+nNwzQ6R:yvOGnJXMjZ7Up+BFIkAFAR
TLSH
T18292CB026640C5E3D8A62B70DD4B67203BB5D7CAA355A38B41DCC1708FA77CA7F8D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59224c.rbs

Path C:\Config.Msi\e59224c.rbs
Size 21KB
SHA256 1165f4cb07518940184b20e9bd53616256a3da4f1f67ffded1bd32cfccd0a193
MD5 f6d0b577e18dfbe5f92122ae88304b00
SHA1 0cd578a48db3184c9ca6195cd708f27ac1cbc99e
SHA512 4b633b6b1dc46f4484fd2dd97e93a3183a2f6b6e5639dcc5b740912c9facae7f4bafc4970e603853c8bcbc6205e643db7e555ac6603cd7498656cb45f4da0ae4
SSDEEP 384:yPRIGRrnAKxNAUhUC7xJjrMNYPVIbS/aMw7ymRWX45hkP:ypRTAKhCsV
TLSH
T104A20D03768099E3C86227B1DD671BA93B72D7D99350434B50ECD1388F633C72F5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59225b.rbs

Path C:\Config.Msi\e59225b.rbs
Size 21KB
SHA256 2de2db8fdd624886120c908b77a1860fdc6cc6b69115d3a8380f1b20f5500a9c
MD5 180b64f6f5dd5dd7a49fa8d004f06e07
SHA1 d778c2594e2c48ba6d0da5f7beaa82f22044f492
SHA512 edc97a9a07938e00842ceedca4368486da60e79056e1770602fc8e715a3491779a489c0bf84717fb1b8572d639ff266bbec835f30a7f4987b6b485aa979a989b
SSDEEP 384:hrNvDIAZxEth/phSYjK4WbJGwaZsalckU72eC67JkE5KLJDUJDsrr6c+0dWg:hdDIAZxEth/phSYujbJBToGArr6/0dP
TLSH
T16FA20E42BA40D2D3D8A62B70CD975B2437B5D3DA9755474B00CC90348F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592260.rbs

Path C:\Config.Msi\e592260.rbs
Size 96KB
SHA256 a3e47f460a42f973ce1b8203ffa349bc8a3364beea4e23961e4a00ab14a29896
MD5 8bdec8f3951af06d19f0812dfdfbc5c0
SHA1 f3a0a59d7389f7b64e88a1993d6e8e102ff9a996
SHA512 17bf848f1ac9a76b5bea2098fb99a01b37204f155fbf74898fdbff26f30b2a97a51e86382554eb7b69328549d1ad8c3b901006918bb6b1feccec75001cc983ec
SSDEEP 1536:9hrvFzkBiYgTYPjU2osVYsSTMff1MXNbm1r8xEqhYEiuxAQqV6qVkzVBSray7Y+q:qMMbIrcytGqEa
TLSH
T15EA3C396D81DE1D4BEE379D11B41B888212ECC1877AF841F43EE8A9B6D806D7067D8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta_MASCULINE.pak

Path C:\Program Files\SafeExamBrowser\Application\locales\ta_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

SafeExamBrowser.Communication.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Communication.Contracts.dll
Size 35KB
SHA256 40e788ab60b810f007f348bb7e48ba84421df9b9d6b2bc07c4db6baa33d41275
MD5 23827dd8b333c0a85a06d416aae6051e
SHA1 7abe88734fb43bece8afead1a7cd7533653c6583
SHA512 143e9d5976ea8bc757886460e159f3197874503bf7bf1f9b830837e4a0d8e8ecd7a36f6b124613a9726d45ce9d7373b1247a4160095d2a059b3bc791def26b49
SSDEEP 384:CQhkz9Kt9H3amR+lKgYaesZfwI+1rFGc8kYiaVjNAqZwVuIYiyH2JFWWiy8RbmLT:CwyCamoAavZfV+GiSNUjYiyWqWi5ALT
TLSH
T184F22BC6C74C8F3DCE6F0A71FCC252912BB0D24A3526E6A55758E8872F13BE112536AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Communication.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Communication.dll
Size 37KB
SHA256 e2a71dca19937e2c1bf5ce0e2d8563aa9ecbb983e617b5c1dd9ad7b2d21d2e0a
MD5 4d915ee3ce80233f344cfbed51e4e927
SHA1 c7afcb23ef28f55c07992f42869849542b80b19b
SHA512 7c24707f6e1953bfdd60127e16ae5a4f38a1d077d5bc921815a153ef797046e1f23e6dfc09883cf60a4275756fba14c50fd2f8f89c43deb1865daa1f16914784
SSDEEP 384:s1Vh9B75rYh/8JpscTQ4Tz+QIpY0eSD9Cgq4lRJwflnusIYiyH2zGoy8RbmL4nNy:sFHkXiE4SD0wf9YiyWKo5ALD
TLSH
T1E303E76653FC8E05F5FF5F7068B822215EB7FC466CB1E28E1598508E9861BD09EA0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Core.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Core.Contracts.dll
Size 18KB
SHA256 80f4f66cee400de42cd3f315f870434506beb62c75856e43cab79ab02abf58e3
MD5 055a9a78fb6f50da7a7697f2a853082c
SHA1 c04d93cdf76a20be3d3c24998cddecaf2d1e094b
SHA512 958228f56bd4a08599328a7e4d17eec6bdeed4bb28292d7dba0f500eaebdccfe2ea82970e629d774a5ffcc1c32186d4257de43ec47fd6f487ce306c1f623e53b
SSDEEP 192:jACnTUbBLwpbWOh84QsiHlrIYiYF8mpPJj++w8V2eAFULc8pq8RuwdmL4pUQrNyQ:UczpJKnNZIYiyH2eXy8RbmL4nNywrN
TLSH
T1C6825D53CAE88C25DC378F30B9920A212F76F5C53DA2C3D71359D046AF963406AE92F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Core.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Core.dll
Size 21KB
SHA256 d782b6e7a498cc08704ab0e4fbddc670f5feb46c4ede8cdd6043655c2f9176b5
MD5 2c9f861247038d135b6d32f9f31e3cd3
SHA1 04ba569d9d80adcfb293e57640c02611a37fd21e
SHA512 ceb8cf255ebbf0be644d129be08f1161a04b5d3aeff8e352c097e6c765001c62f1ae899de80123a63650a87bbf1029963e069dfc026e5120f031de657a9df0df
SSDEEP 384:M2qe9Jg5ons3P2wqHm+0k4dIYiyH22ooy8RbmL4nNyKrNS:McQons35P+EKYiyWW5ALYo
TLSH
T1ADA24B51CBEC8D12EDBB9B70B4B152201F71FD4125A3D2CE2149C2D5AF923405E9A3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Lockdown.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Lockdown.Contracts.dll
Size 16KB
SHA256 7056eeba4ad5374f626214183ec0082a185f2e2bf87c65393022217592207d59
MD5 5c18a8f228485f38c3c51f300ab66968
SHA1 021b6bee5ab3daf7c3c3817e63b7f50fced9906d
SHA512 911bedb9154744ca53bc060b64d16a31f1f3051e276ac2dffe374acee6a979bd192ac1e376efc02715a08d83e1139085ab33501cc92608f6a6f32b6c6c859a28
SSDEEP 192:NSwFtIwWHc3+si2uZiIYiYF8mpPJj++w8V20B9g2ULc8pq8RuwdmL4pUQrNy2nC:NhWHc3+58IYiyH20B94y8RbmL4nNy2C
TLSH
T12E725A53CBD08D22DC2B4E71FCD05A216FB2B65569D1C3D7201ED41A9F463801BEA7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Lockdown.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Lockdown.dll
Size 40KB
SHA256 68af7fed47dbbb790adf0a487d674345fbeb0397e38fae7c544bb6f7d7fbdd98
MD5 80b448a87136505c78a52d5845c2b798
SHA1 3425cedd642c14ae46e1129633b9323e18ac589e
SHA512 2f70635a11b27a296c9069a28fe8cb58a744d8d8ce79f5451cb85bbaa78cef39ad6846f0fcb2ffae19a98c6df2ac478d12f84d187aaacdf36077d9ea5827f34a
SSDEEP 768:DKdh1ZDMCCXnaZi05y8hcJmKw2B7QYiyWZeu5ALIr:DK/1uCCXaZF5bswgQ7yWZes
TLSH
T1C113084657E80B19FAFF9FB479F115010FB2FC527872D39D1988908E09633A19AA133B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Logging.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Logging.Contracts.dll
Size 15KB
SHA256 59bbc2f35a43365de946dc18d5cad6cf730f1601cea13a9ecccfd12aaa5a4d9e
MD5 a4343ee1c94a7ee8c744ccdd9a7d7aae
SHA1 d2dcbcd05e64ca7497a637e7e19d72b04bbd4fbb
SHA512 b9cb3cb2e952763b8add1727dfe5756385893986d0352b425783517dc62dc5dfc457b80777c2380836e83084771a1fdf2aad142c81daa173696936467771945d
SSDEEP 384:9RXNsuH4bNJv4gIYiyH2mSP3ky8RbmL4nNy4T:9JNHANJv4pYiyWlk5AL2
TLSH
T172626C638BD48819EC7B4E30BCE856223F71F5555EE2C3CB2109D1569F823412FE9679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Logging.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Logging.dll
Size 21KB
SHA256 afeab7c442eec21dceb5d509f5d3a2e579caa1c0c1df47205f022f12fee2dd09
MD5 61ca5614001d4e266cc966fce79b3869
SHA1 77bb0100f53268f80a28908916154159d848ad8f
SHA512 f1a92f5e7fb3a1be984670679e0c2f7b573619efe6b6def4059f8aa9387ac90123fdbfdd56995dbc9db0baa2ee153d1d446e3b290b187539f74141fd9daaf5b2
SSDEEP 384:ncBXG2s4TdPWsl5x8VZClHp3rDxIYiyH2q1y8RbmL4nNyvPc:cjs4g6bmYiyWY5ALRc
TLSH
T16DA26D138BDC4915ED6F4E30B8F066212F72F9566C62C6D72288E0699F533852FD13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Service.exe

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe
Size 395KB
SHA256 05e0f06ada206028e5597c58f5305b36ceb095417c8387d2cc2088fc452577d5
MD5 4ca9bfc8741a76a4b15d009c3b1e0ddc
SHA1 269aa5b216bfb5a157750f826bdeab9ed45bb5fa
SHA512 a1cc97bb65609cba4cc7dcf14ca9c39ae2cb204d9f28dcc53dceb021bb10b6c1469933c5c4c4a1287acfbc70c0e7a228e64d159a7128c1c4743f776d56116e8e
SSDEEP 3072:GFOet4snQt+OLsocBvEUodZRBiBIHmSwIu6wbEqBRnkud:pemsQt+OLsocREnY4w/qgH
TLSH
T16E847351DBEA448CE8F0B8FACC35F07063226D2A097545CF8A5879585535FCE18EBF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Service.exe.config

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe.config
Size 184B
SHA256 16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a
MD5 13ff21470b63470978e08e4933eb8e56
SHA1 3fa7077272c55e85141236d90d302975e3d14b2e
SHA512 56d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8
TLSH
T123C0124940A8BD269D338A279250C922FFB022A2A024140CF02FAA6A0B311AD464736A
MD5 SHA1 SHA512 TLSH

Submit Download

SafeExamBrowser.Settings.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Settings.dll
Size 56KB
SHA256 3ba7d4ea5edd7a6937f3ac4eeabe91af67d98b3c2eb55b6d3933fec01965b883
MD5 a877cf2a5a5842a683aa3d288d54b3f7
SHA1 7dbdd0edea5d3171c1e837dfd0b933246204f7f3
SHA512 9a41b756fd6708b011fae054289c7045d2796150a3725ef31001115224c86f520fea35ae142dfe9d914f9b936a4998c9c89c416dba87a5793e05bee710d5413d
SSDEEP 768:q/2SbrCp1KWWezF5li327NBWaMccJeSy9pSaLz58NxFIF9YiyWI5ALy:q3CTKWWYwWga4eSy9pSaLz58CF97yWu
TLSH
T1D54394E24239D2AECA290671F475527A16B39DCA3161EEF39B30F84F7B1274753084E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0aa48568-9268-4f2c-b2f9-19a2ee673702}\state.rsm
Size 856B
SHA256 e49756eba6ced18f36b27572454921418dd8b00c28713455b34b63462c023a6c
MD5 e05ded9cdf493880c72c5d19a12667d9
SHA1 1c23a192e21641f00ea918d6ca7d7cece9c43c78
SHA512 09ade6843ecb6eb3fd95a8d7a109261aeb057454862206ddf19a7a57abe04d3630df82381cb4a02efd05801d64b4f0936cd1cc46cd908e21fe09d6c194306006
TLSH
T11A11A761AFF75028F3BBBB747DF6172015BEF8114D26912C0101714A4F32B908E24B22
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 1KB
SHA256 f3cfc3db2c2715e625f94ec6763b8b4c6d694519bf82322a9abc0028c4541d64
MD5 de13f1bfd8e338ab9fd8d87fe5c7ff3e
SHA1 cad6bbb9306776cdd117fbebf548ecd181a2c10c
SHA512 e45d128b7a7a44f884e064cd21a23ae9548c3430b8255419a9004aa85c520694cad8fac680266545372963dda691c48d976aef024fde629a1ed7e5ae6319d257
TLSH
T1C411A7240FF6016BF3BBE1B02DF50622EA2AF4171531812D408332478F36A90AD93B7E
MD5 SHA1 SHA512 TLSH

Submit Download

Safe_Exam_Browser_20261102083428_001_SetupX64.log

Path C:\Users\Admin\AppData\Local\Temp\Safe_Exam_Browser_20261102083428_001_SetupX64.log
Size 1KB
SHA256 c45df13d0e168552074a7c696bda084cbccdd33e86405b2392f1c776e4607c5d
MD5 684ab4b03b55d9b55a2e583d9d40e0ea
SHA1 95e7d6d345848497f099a48b03777d6d260bb676
SHA512 3c2f07ecf980f9f8f19f6997e17a1c5caeba73427925f66e9369b9f08a7df9f306df65bdc5a4e1723121bb0ad48c7d944092baf763abc310f6a8b6b68a175289
TLSH
T15F41D5591BE50806B1B29747EEF3C1535A33BCDB68748B0C63C5831A466BD03795CBBA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20261102083453.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102083453.log
Size 19KB
SHA256 ec859fa9e9f2cc297e143100f1f0641f6cc3049f63c226d7801d2984fd86c23e
MD5 b2dc0f90728e0f741d42d0d634f4a930
SHA1 6b7e26cac0e8278013007b1c6fab973477e30ff7
SHA512 aa23322a8ec0bbafca1ed6c2fb5c237751446a60c2d82605fa53f62db1369a95ca95d25a0c69680944d84bf883ea455ef2261b53621536a9ac8505157b9e6fd5
SSDEEP 192:i8rJfknT1G1U1b1L1o121l1Gr/q+1O1XHAjNjPKRE5atip32+dAlXHP6C:i8rJ0wr/q+1AAhDcadAlXP6C
TLSH
T1E09231625794E17029EAC2D484AE7AB18A1CBBB43F0060EC6796C78C1958C7F87DDD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20261102083453_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102083453_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 7ac332d1e5e6c4760641963e84c25d02440723e309b7e1c3b3930a75c928ff12
MD5 1bc4cc9831be0ea6ba29c54f643b2bc2
SHA1 551628671dfae45402680f0afd04384c3b90e000
SHA512 4ea7efbe5a5a53e548cf07230d09eafe12116c1aef89e912ddbf54ada38df26c0880c4a7c430e9be9f23ae0bce24dbbd860e12b698891186087909a71faeb30b
TLSH
T1EE41E5601BD8494BF2F71647DEF3C062BA33FCC3B8748B0C6345825A466BD06986C76A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20261102083453_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102083453_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 3d8480e0df3f25c69dbcdc73d7d1f1788afbfd5675d747ec84e4f2ed679df437
MD5 653fa80e5c2316e03ab6a6a1e3399a31
SHA1 dd7596c7d5ac657480d891183a66293bda73536e
SHA512 69d52dad4982f32f81175840aa5dc22913a18d9dd44a33b83e95e8a7f726d5c54c3547613da79419e2ddcd1b5f238456ff399272989845d7e930f5ad63aea45e
TLSH
T1EF41F2701BE80805F1F76657EAF3C0A26A33FCC3A8749F0C2385835D4667D06699C76A
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{00A231D1-D18C-4D5B-AC60-7F3D80B35E6B}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{0F38D322-362A-41C9-A818-EFCCAE544D42}\.ba\logo.png
Size 8KB
SHA256 199faee2605c599338d55d581e9dbc328c7a4f6048ca54ae960125e552059221
MD5 3dabf4904fdec2b21819207bb034d4d5
SHA1 2878e699a679b20e705f18461a25ad7401d239d1
SHA512 c109de337d4614de429f95025c6fabd8221e02d4182a3b8e98b22f21474e40d74dedf99a07b105d04195f5e4cb814009969889c70c03fbcf4bd43d87bf3c4f89
SSDEEP 192:DSCvknNvx1GJhJnx7py/rO0lDjl3T4Gj0J0EBfPX7Yz:2CcnNv7GLtppy/7jT480iEhPsz
TLSH
T15402AFC8FBEAEAA4D04EED5CA7E9A542047743C08DD2F8857D8E8802B4045F6F27C596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0F38D322-362A-41C9-A818-EFCCAE544D42}\.ba\wixstdba.dll
Size 205KB
SHA256 b7de0a0ca3a94738747abd708e30ba1f9638a8c8b7d8173c76d4f39fae3d9346
MD5 87c8a7ea44e8ee0d9358e25b7dcd397d
SHA1 0e2021be823fee499175d2c0d68346d15c02a376
SHA512 98b5bbe5bb3ec331a0025e3da209296050b2f695be5a4b90b5c939f8fbbaada6dd93483eba779c10151546c2798aab5282fa619a55ec0cf04f56a03795a0a3f5
SSDEEP 3072:tEIwsGi6eTe5uBR3SupIu+ieZpKamkOLCaQuEsSyhssS2KPjbfkd4qhgTrm9b3EJ:tEZdi6e93SuDeTKZxQfsRy26BqbUHF
TLSH
T18524AE12F5D0907AEBFB1930593AA6206DBDB9200FA0C9CE53486D2B6E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{0F38D322-362A-41C9-A818-EFCCAE544D42}\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{33B3A3E8-31C8-4A58-9051-F6DB8921197E}\.ba\BootstrapperApplicationData.xml
Size 8KB
SHA256 9b2fe3cbf9ca4b571a77bd8053fa8de8fc4d2673946147726ba2b0519718bd84
MD5 66c6b72962f789f51e3f1b42d2e603ee
SHA1 77b153f8068b75d4caab0e02541e945643a4b6b6
SHA512 593707ffadbca0e5709e940434d1898e938bbdb2fef86301e0a8da69b77e9839f81bc98f15f0196f263185aecf213fa1e96a35b474514a947254d82dd9c805b0
SSDEEP 96:XiUn6tF1UYycin61esiFUQycJVhn65eI79UUyclV6n6I10wCycw1xGlVPn6I20wi:X9m0V2bqhq026YGh1ePtaPxYgrzpv0
TLSH
T189024B252BFD0225F1F39E88FEB845565E75BC526E38CD1D00A11E0E4973E419862FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{33B3A3E8-31C8-4A58-9051-F6DB8921197E}\.ba\license.rtf
Size 64KB
SHA256 f70ac6d997de40a936c46155879226e75de71233451e6515c37e1628db05f77a
MD5 67d9c8e08e0a9c02d4ff9153f61d4c7d
SHA1 0594e9809817eaeec15b87ce6fe28f43bbd8f921
SHA512 2c5244b5b0dc70692f9d519a3d738c207a237e1da8d3f55b3cf94117fdd9558765860e3327090e64447ddc638435185efcc2f7d993e4fb92cdbd11cc7f3650ae
SSDEEP 768:l91v32daAn/33rPW+bnX3Jx+YOQSBgQLRFkDKEN/L0ManrZNLoJ0R:l9MdVzeaXP3KB7VqmcOr3HR
TLSH
T1485342EC004593DDE36253C4AF56F088AD2BF91414F9A494B1AFC1FDB0BFAA8D526522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{33B3A3E8-31C8-4A58-9051-F6DB8921197E}\.ba\thm.wxl
Size 4KB
SHA256 b71ac74fef26d0fd724e490d9e196d316a984b4fcba5d944232188a38cb9bb51
MD5 ddeb88decef9ac16dc4521c29b0ea5fb
SHA1 cfb6ae4de4bd8c2a3f5f4f6ca3d9ae69ab702b15
SHA512 0b5ee93e23bc3d869b5a55383b697ffe9ba9b526d8e4f86b4f07546de8cbd07e24b1c4063fa0312a3312630fb99a2f7a79900ed48907db3efece64e3fa28e241
SSDEEP 96:9+eTNabTxm5k22Fup/vrxKqNpCIT19ZgoVOBq9LRO:2zZCVNpZDzO
TLSH
T1D7A19AA779CF63D028732265EA8255AA1910C09C933B1DF5FC47854B838D927A3B3F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{33B3A3E8-31C8-4A58-9051-F6DB8921197E}\.ba\thm.xml
Size 8KB
SHA256 016dffcd3b10f72364971143d02e8ca41adc5ce83fe0ad31991f840e8408b764
MD5 3ede594a29ecf65357401960e52382ee
SHA1 422a8b18f7d9e7a24d11b63856e0b72d17134c26
SHA512 df8ff54c5c8ed471c5efaedbd558563b18c7f7303745a70e4418955bf013ba05c82a9aaa0d84dd68830e4034e93a934381035465c3d641cc13a91b34a9fbd2ab
SSDEEP 96:9+XMyoR9sOVAM9rJiADTHf8BczEFGiA6aXdZRgu/mNqFQDhBu2Ux47hhpZ82rRO1:Zm/D9AWR6
TLSH
T1011267B546DDB801D232FB1267F221D27F126972C4C46A68F90D3ABB5FE214068772BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AP_SEB_3.10.2.9999_x64.exe

Path C:\Windows\Temp\{5B5A44EC-79FD-40FE-874D-F79B7459C13C}\.cr\AP_SEB_3.10.2.9999_x64.exe
Size 976KB
SHA256 2e61f1be504d7c01cbaec0e8640321735aa27dcc7987e713119dbd6da0049d08
MD5 33a72a6a6d3f1306d1de701866273df4
SHA1 9de9e262577a38444c5120bdd9d2c6944b7d63eb
SHA512 208f535e083f0e2d24725f143542fc66af53c23c52f05f25a7056490a63e4dd0d31dcde9f6c66389f164204b0d8e9def5910ff711816276385809e4cc9f6a11c
SSDEEP 24576:I3WnIZuMCxezot7xHt+ysobEAk1TemRKwk:ILZ5zot7GQ2jk
TLSH
T130254B31D7E5405DE9F034F6D834F0306B29AA290A7148DFD6D8B9186934ECA16FBF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{B79C42E8-25FB-4532-BC22-DCE670E87EFC}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{F6A3DCDA-75AE-424D-8CEE-778697BC59D3}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{F6A3DCDA-75AE-424D-8CEE-778697BC59D3}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{F6A3DCDA-75AE-424D-8CEE-778697BC59D3}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{F6A3DCDA-75AE-424D-8CEE-778697BC59D3}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{FF2EA6C3-1465-4AFF-9592-E5900ADD9BC9}\.ba\BootstrapperApplicationData.xml
Size 14KB
SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
MD5 7f35d3c6ef5189d916dce7f974f2e5b8
SHA1 37f9ed9a2ed80fdafd187ce9a38ce5b0c952f3a2
SHA512 ccaafb8ef675e2625561a244f80a4d5e05c590211055e76afe4a317b2220bab2e9baf8fe968a46b226e3ad4e2d064f1551d88e47da798d24ed365331840d4c03
SSDEEP 192:X0sveDnH5zHqQHG0Hd8Hz7HE06HA0rH3pJp+tHxLUrnDzLG0LY1ftHJr5e0II0B4:X0s6dLbmnoNwtR03J+ftcItVEp+Eo
TLSH
T1DD62D5142AFD0159F1F34F88EAB945566B76FC963E38C81D01611E0E4873E819972FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-330-0x00000000000B0000-0x0000000000127000-memory.dmp

Download

memory/2728-331-0x00000000000B0000-0x0000000000127000-memory.dmp

Download

memory/3564-793-0x00000282144D0000-0x00000282144DC000-memory.dmp

Download

memory/3564-789-0x0000028213C40000-0x0000028213CA4000-memory.dmp

Download

memory/3564-855-0x000002822CD80000-0x000002822CECE000-memory.dmp

Download

memory/3564-805-0x0000028214500000-0x000002821450A000-memory.dmp

Download

memory/3564-817-0x0000028214650000-0x0000028214656000-memory.dmp

Download

memory/3564-801-0x00000282144F0000-0x00000282144FC000-memory.dmp

Download

memory/3564-821-0x0000028214660000-0x0000028214670000-memory.dmp

Download

memory/3564-797-0x00000282144E0000-0x00000282144E6000-memory.dmp

Download

memory/3564-809-0x0000028214510000-0x0000028214516000-memory.dmp

Download

memory/3564-830-0x000002822CF30000-0x000002822CF38000-memory.dmp

Download

memory/3564-813-0x0000028214520000-0x0000028214528000-memory.dmp

Download

memory/3564-834-0x000002822D0A0000-0x000002822D0DC000-memory.dmp

Download

memory/3564-835-0x000002822D080000-0x000002822D092000-memory.dmp

Download

memory/3564-836-0x000002822CF20000-0x000002822CF28000-memory.dmp

Download

memory/3564-838-0x000002822D1F0000-0x000002822D2FA000-memory.dmp

Download

memory/3564-824-0x0000028214670000-0x0000028214678000-memory.dmp

Download

memory/4976-328-0x00000000000B0000-0x0000000000127000-memory.dmp

Download