a6611a44c32bc8ba9194298db09c49f1914dffa5ae30a9acb60b2b0641dc802d

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/11/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
saret.msi
Size 10.2MB
Sample261114-e28dlsvw4n
SHA256 a6611a44c32bc8ba9194298db09c49f1914dffa5ae30a9acb60b2b0641dc802d
MD5 28858c557194d7d7d62ed5ffb1206889
SHA1 f98fef150e0e0d720a33a252f2a9fbfbbcb3e95b
SHA512 b1231c81f9146cd81427213ff7fadc841b8099ede7f3cdaa3602cacfe38f070e07b55da20851587ca55b52105a0a0a96c354a86de481e5ada6249951826479ae
SSDEEP 196608:hc5l64Wr2VzZiT+ghw6IMAcnpzDxYqIammTNep:h+64qcmgMAWHxYqQOw
TLSH
T17FB633FA749347F2CB09457A4B13BBC057593C7A629041828ABC7ADE5770EB07871EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4492	MSBuild.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4324	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4492	MSBuild.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e591d62.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E226D84F-221D-4836-82D5-25D98581283A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e591d62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E7B.tmp	msiexec.exe
File created	C:\Windows\Installer\e591d64.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
432	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3208	msiexec.exe
3208	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	432	msiexec.exe
Token: SeSecurityPrivilege	3208	msiexec.exe
Token: SeCreateTokenPrivilege	432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	432	msiexec.exe
Token: SeLockMemoryPrivilege	432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	432	msiexec.exe
Token: SeMachineAccountPrivilege	432	msiexec.exe
Token: SeTcbPrivilege	432	msiexec.exe
Token: SeSecurityPrivilege	432	msiexec.exe
Token: SeTakeOwnershipPrivilege	432	msiexec.exe
Token: SeLoadDriverPrivilege	432	msiexec.exe
Token: SeSystemProfilePrivilege	432	msiexec.exe
Token: SeSystemtimePrivilege	432	msiexec.exe
Token: SeProfSingleProcessPrivilege	432	msiexec.exe
Token: SeIncBasePriorityPrivilege	432	msiexec.exe
Token: SeCreatePagefilePrivilege	432	msiexec.exe
Token: SeCreatePermanentPrivilege	432	msiexec.exe
Token: SeBackupPrivilege	432	msiexec.exe
Token: SeRestorePrivilege	432	msiexec.exe
Token: SeShutdownPrivilege	432	msiexec.exe
Token: SeDebugPrivilege	432	msiexec.exe
Token: SeAuditPrivilege	432	msiexec.exe
Token: SeSystemEnvironmentPrivilege	432	msiexec.exe
Token: SeChangeNotifyPrivilege	432	msiexec.exe
Token: SeRemoteShutdownPrivilege	432	msiexec.exe
Token: SeUndockPrivilege	432	msiexec.exe
Token: SeSyncAgentPrivilege	432	msiexec.exe
Token: SeEnableDelegationPrivilege	432	msiexec.exe
Token: SeManageVolumePrivilege	432	msiexec.exe
Token: SeImpersonatePrivilege	432	msiexec.exe
Token: SeCreateGlobalPrivilege	432	msiexec.exe
Token: SeBackupPrivilege	1736	vssvc.exe
Token: SeRestorePrivilege	1736	vssvc.exe
Token: SeAuditPrivilege	1736	vssvc.exe
Token: SeBackupPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
432	msiexec.exe
432	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3028	3208	msiexec.exe	96
PID 3208 wrote to memory of 4324	3208	msiexec.exe	98
PID 4324 wrote to memory of 4492	4324	wscript.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\saret.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3028
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\OrderProcessor.wsf"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\MSBuild.exe" "C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\OrderProcessor.csproj" /nologo /v:q /nodereuse:false
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Debugger Evasion

T1622

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591d63.rbs

Path C:\Config.Msi\e591d63.rbs
Size 12KB
SHA256 37b4a209b1adc6dfc4d7614611e000ce868adbae935e3dcb31a80670ff6b37a3
MD5 88e5cb476db3665a629713783c093121
SHA1 a4454bcaf6945813d85134ab79e1567f1bc4e371
SHA512 31589076e7c456ec5f76344979c1d137539c4bb1bb049c882b3a66cba9b1e2c7e6241cc95659ef7061e202ff390eccc4bafb4a58a23977c1a180376d2164c036
SSDEEP 192:akC1Sj7Ut2e8daqHIFaqHxjsSPO1+KspA8:alSj7Uoaq6aqRois+m8
TLSH
T108428601B9504DF2D5180377C657131C33E1F5DCBA0AB64E06CA8E591BE7A8D9E4E3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.gitattributes

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\.gitattributes
Size 52B
SHA256 c0e4f20c88314e4c0ea6f41e977747e07e21a2322e15c81725628b53a14ce77a
MD5 f6cef101900768b28ff9a6332b8afbc9
SHA1 d0125c1e525d7dce793928406258505b4d0f4844
SHA512 3e81c1bfd34e22cb71f5b1a73cbc129876b367f162556a773f97f45953556a67f606068f51a628e41762c4f0a8b1c6fdd8179f486e628ef039ac49c002a705ca
TLSH
T1ED900201B5455755A45020C0D422B5450164179F3262D078095AA980B0901A86D291E5
MD5 SHA1 SHA512 TLSH

Submit Download

.gitignore

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\.gitignore
Size 66B
SHA256 da94df32f9751d635aaaf89c41868815af3d7df3b03e2be9d471db6be3e271cd
MD5 d6e586ea4294851b2b1b5fc443b54c33
SHA1 b384a6c9ec65b063a930348bc5eee60f918e6711
SHA512 bdfabe593d5193c5d46f2e9a35eb2f3110c8cced9e2f5ea08f9fd8487f2c79e018595df2dd15259a927ffd880977c30df2f84b7a3e8e5c4dcee5aceefe2eb3be
TLSH
T138A0220080B023202C8A00C3F2322008E30820BC208BA0B3AE82E332BA08A003300028
MD5 SHA1 SHA512 TLSH

Submit Download

AssemblyInfo.cs

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\AssemblyInfo.cs
Size 455B
SHA256 6ff19abf566a189635d56a2b7b69d7e14d685c09407cc2c888c0b3a90a8c4778
MD5 ca61a0ebedbb338fedb5b850de8b988f
SHA1 6d4708bd1bf5c2088a3070d56c3514ee442afef3
SHA512 a9f178d9eed2746ce60af18b30e688faddf23a2d3becd84dbd908a8cf9dce9ab974abc4aeb9bc795a275868c98c2cf3df0403250bc4e60166869992668a03eec
TLSH
T14CF0ECAC661AA39CDF801183BDA378C846AF333404EE4C12A6FC7C13F94A6B48028526
MD5 SHA1 SHA512 TLSH

Submit Download

Build.targets

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\Build.targets
Size 3KB
SHA256 29a0f73f9af00f400b4785af8bd0c9f835c099c2c825cc18e60b32cd57679f45
MD5 47abde7fddea5a929dc682ebefff7c3f
SHA1 4184c616e27ad311427c0c946c697a9af8f196aa
SHA512 84af5b7b3acdc3e0589caac2521e6415e6c30ea728b73e85a16d60a8bfa32bb06963c661f247a92e7c91cd2b2644da72e49950bada246f4b1174adb06fe43cb1
TLSH
T1F481FF12B3F191EC42D8F6CE7291A6032736ED719AA468F0E571FC04C2630B06E9F52D
MD5 SHA1 SHA512 TLSH

Submit Download

CHANGELOG.md

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\CHANGELOG.md
Size 486B
SHA256 5132f22b3bf047d075f222c23694a16b36605ccbc58b221028aa28fb69df1067
MD5 fd9970d6d07935bd6f2318edd2fa5dde
SHA1 4c04ba98d2ea885aa1b016938efb919263c177bb
SHA512 caf300950db87630ccf1a8c07e83f1a351e575e0fde134a52b1ee2a868a3025c2d97acd9ba9f044c87fc06320ef992c4e86911bdbae97b78a2e3c79367ed6a72
TLSH
T13BF012D663B7D0106A7B849B6D0377E54908F54285C64E88F5182598C3DA9F0CAFD31E
MD5 SHA1 SHA512 TLSH

Submit Download

CONTRIBUTORS

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\CONTRIBUTORS
Size 60B
SHA256 b0d93e1305ed05bbb8f59db5aafd719ac0d1af3f52db64bc19817ec3a03c3136
MD5 fe8b221029e332bf4e7d840d984d00d6
SHA1 91db4ebd78cde9d97b48511e29fd5d87415ef52b
SHA512 98b6624b5ba4679c353736e6c1562802fc469763d78857bd99ebc6c2179165239abbe6262c0bd4462f183b6bff20317a9e040d06476edeae7d8667418f6aa598
TLSH
T11BA00255D18926554D9A06216465447571051CD56E2909B72497D58A905C4105328108
MD5 SHA1 SHA512 TLSH

Submit Download

Directory.Build.props

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\Directory.Build.props
Size 274B
SHA256 e2d57d93edf616586052c3d8e02357e0ead041f3a159a450660983ee56902a72
MD5 9499a6acb612504b0df83847192f831d
SHA1 47114dd428304bd615b371ac2c7bd08d0448e863
SHA512 e80ae61cb9279823c1c37efa09009350ad516e2961447d5897b7a7a698aa2e7f376d1e97b34af0e7a0130f2e0c5f19b152ab37607ca1a2784a9d39f864869e91
TLSH
T111D05E16AFC17A355EF0A02846366A68EB9BA26208710834B6CEC84F879680D5933B31
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\LICENSE
Size 1KB
SHA256 1cebffd549b4b1bc7b626cc92eb130af1941dfa512bb0570c1a14858134acb03
MD5 d53f708298c1f2bae141a0ee3e3a97fc
SHA1 cf1601ff3752cb6f3be3ddc5f4253aaf02b1b2aa
SHA512 22dc3eef2a5c6e98517df0a07844699eb3cce8daeb607e6eb8962ed6f18066eef2e9bed15bb73a059e7d05ca00b288fdce30d7bbe44afc91dc1f1dbe28bf7e2d
TLSH
T1EC11B61F725503632882576015A9ECC5F22BB04E7F6B1980347DF2091326018C5FFC64
MD5 SHA1 SHA512 TLSH

Submit Download

MSBuild.exe

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\MSBuild.exe
Size 249KB
SHA256 9db50ddab4741de2d1cc38a3848deb1f398f76bed50cec6e48259420c588e0fb
MD5 cf5fd85adaa17b174e9a28f84881d449
SHA1 ff52bacfa66532d03dd6ef59b9b356253ed2a6e4
SHA512 88244592239881fa90a69d76b2b17b8742afe2e8b89f688fc0ab7995e3328cf55628eeae86fe84fe50c64f7c8734a73fcff42b87d680b7546409f5eeca01a2c5
SSDEEP 3072:+DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:oHK2W0u1tvORstRXfM102bicw4
TLSH
T1B2445A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrderProcessor.csproj

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\OrderProcessor.csproj
Size 3KB
SHA256 7c722b0b4becb65a872acf4c4fd6889f838a7e1e1e0c93a58cf7fce14bd3a10a
MD5 80a7cc3f8c5a29a3414f0f445422c6d7
SHA1 fdcbb149743545ef3769ec6920caf072342a4b9c
SHA512 e0b5e3ccc6eb53a569e71bc1bd1f0a0b876154b1d9aaffe459c8c1271f02738d209c80a3b4775c6d2c8f140afb38ceaab596b9463a59af93c8659a5eca95b555
TLSH
T1C9714030A5C869F483F6047262736A16EB7652E3267808BCF71EE20F1BB3E441567723
MD5 SHA1 SHA512 TLSH

Submit Download

OrderProcessor.csproj.user

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\OrderProcessor.csproj.user
Size 3KB
SHA256 5f1c20ab9ca8f4bddf5addadf14630dac2b84290b755ad53b6678501d8ff4f80
MD5 5bca1fd92fbaded6115efbb248b088ad
SHA1 9c530d58bb09e1984085aa8279ff4247bf15f3df
SHA512 69271ec5bf529889e6ddabe55302595013d290c14983b2391d549d43755eeeb47a57371dcb79eeeb7f057a7f5f85868d38f66342f3830873dbdafd398faf1097
TLSH
T1D76168B421DCAF761973037F80FA7620E87D65E3328B208E398F860D57694251F67265
MD5 SHA1 SHA512 TLSH

Submit Download

OrderProcessor.wsf

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\OrderProcessor.wsf
Size 1011B
SHA256 17b8111c97cc886285d5a2a353f3751f076bf993d8b0b208323672d797affb7e
MD5 bca3be7f74c10094cf5c11bf8892dd56
SHA1 8891139bc3c5f724ba9cd4283f9b2213450990d6
SHA512 c9a79a0846336796252aa2d841c2887cb0c03f79c5f7b0826e29e280486569dd1ee84222300dd3f1e8c456f44a77b7f22e6d9277219fb315f812cf946f72a052
TLSH
T1A411EF466C2ED0ACC046B299A16BDE4C95F151A13530E1E2449CCE8DB72AE38CAF8179
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\README.md
Size 643B
SHA256 2ac98a0b4d8c0d85e2ecdf1127cc5b870208199d0e879fbcdd0a3e0cd330721c
MD5 5aa1c29f360fc7767795ac7a12b6c8f2
SHA1 1cd1bbbc84acfbf78dd2ac543379e45d63138f23
SHA512 83aea6f903f06c049156ae0a93f9145f0753e4df2a13bef6e4b6197d6588de1618aa50f59b2cabf7cdfee2cdbe749ed56bb6d8a38bd9d725c71d556cc442a26b
TLSH
T1DEF0996F32BE53F120330F5866A81AD2C2C846633E368850721C941C77B6E0464AE79C
MD5 SHA1 SHA512 TLSH

Submit Download

Resources.resx

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\Resources.resx
Size 23.3MB
SHA256 60c0df85442134c027a36b236af32b5b8b980b9248ca401c0ee7ef4f06889ebd
MD5 51a4d28d90c8f3c60b800f21beb77565
SHA1 0a92e513412ee90bf4aded2a6638e5d60cb5354d
SHA512 53850949a81f48e916d2c588adc2a742476d89230c0b7ef785dbf31c84adaedf5a3483c0971ec03e48ec49bec99cae6504e355209cba63948cecf1de399168b5
SSDEEP 24576:6xlBQ5C91uM3ogiYi36AUyFCzO5kNuCVTz6fBvAggIAQWaV5nydg7aFf3MRB+bif:7
TLSH
T11637C6F75918CFC7261E0DA3817B21D8C953E6F3ABD45752B439A300DAE9A5290DCBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\Shared.props
Size 3KB
SHA256 3b4b1d6476a6b1b046e58f551ced0637b6a2e86640defef6670ae4051589a158
MD5 47d86e564c8f930d941188161c6cfaa2
SHA1 9c93871013b2180c107a6fcf6467c0305674a4a4
SHA512 20ffdb4382af170ec7f4a054d324937e4348be4532dc25f0b82c49c513554ae527f61a6e0e0f562ce34762fc39e9c76132713177893fe7fc8cf1d7c4f967a288
TLSH
T1D35162A451DD7B3B1C3307BD60FD7624E4BD61E3630114CD7D8F485DA7654642E2B261
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\app.config
Size 691B
SHA256 a29d28138b3b3c927a61778075c9d38600e4399e091c3ca05543c7c1dd6b7465
MD5 0c2d0f59430e979138929cbdaadf91b9
SHA1 d45fc6611b17a9a041a5bd0fde758d8fd89b68d8
SHA512 0ac68e6878f3f66f957e44ef9657f37cef9b434107c5b6ca83eca1075a97a26e0ef017ebda280c4b1e0b8b8169f61e1cec554509821c115196ead3b35dd7b16f
TLSH
T1890126262EC8EE5BDF330C2FA563CB989B38A2DB3190098CF03945970E7349901232C6
MD5 SHA1 SHA512 TLSH

Submit Download

config_68e8e.cfg

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\config_68e8e.cfg
Size 141B
SHA256 8bcfe3291be7a1a3ca628ffd7d81371364b7bee705e1ee44a3b68122038f8f3c
MD5 7be58cc991013829fbce3b3c9f1a2c87
SHA1 1a3321920fe9852123c33c47eade3b67e290fd36
SHA512 e078638c50c801b0083541ad54f36b3149f0d00a8d915f0e4e8855ee124b4f531067aca7faa568c89280e4ae218419ab08e7029d0e1c8ba42f203524dc57118d
TLSH
T177C02BD50C23C7CCD06CE20CBF006B4586786379000081EB985D1CC7021A3460DBC205
MD5 SHA1 SHA512 TLSH

Submit Download

data_bea676a.cache

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\data_bea676a.cache
Size 159B
SHA256 1995293a652a07b5524e2a04f525dfd5bc50057ee596fac55f8fa8fc6ffe6546
MD5 af5deb8a4d4fcff49eb5d22cce72cd0a
SHA1 7c1aaba027c1323274a2ebe315c3d4ff560b24d1
SHA512 9139fd95dcdf3af2b52a87abcb58b1539d96d0001b8477cff948690a652e69eb5845df03c0e81eb10e883889dae9fad3c9ab009f874ac9652a3e940e53734b04
TLSH
T152C08007330529511C851609026495713445D4D510455C29147768D4EC19C8C7674759
MD5 SHA1 SHA512 TLSH

Submit Download

filelist

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\filelist
Size 317B
SHA256 1ff253a6d4225363e8a3648fe0967b0f7008935fefa5e61cefc1f4e07f22df6b
MD5 31a5cf9a478871f09cf78846ece8eafe
SHA1 09d1d6de6631e802f936a5e8249474859aaac095
SHA512 d35d7073364d3c242e49211a1ad0f904486b0c186ba07b42078b2319699c35808b0830196e55014cc2742be345cf47fcff12d818dcf1e919ee3a1f033d70111d
TLSH
T1D1E02672751CB1BE89490F8DE2410D013CC90ED542B310303A52915D0BBDC0956BD468
MD5 SHA1 SHA512 TLSH

Submit Download

packages.config

Path C:\Users\Admin\AppData\Local\Intel\Platform Framework Service\packages.config
Size 285B
SHA256 b7ae581d0f8a6d78837125d5d98eb87965c4a8b632ac0cdebce516e902924119
MD5 f2223be83e81b96160d8d081bfccf8a1
SHA1 50a840cd57d45b76beeee278aacb7e1b8f45b51d
SHA512 0112a7489b6e9f86b2feb9f7dbcab515d29f8a8d7a64eb628f7610e4006447b84722089bd9ae433dd6ec918ae5ac262e811d9b7b9191ec2b04bc67585f752f4a
TLSH
T102D0C20811AA6A3287301FD5FBE945096BBC706AF6220BCCBCA1079A83224058247713
MD5 SHA1 SHA512 TLSH

Submit Download

OrderProcessor.sln

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\OrderProcessor\OrderProcessor.sln
Size 997B
SHA256 f63e7a59adc7120402137857635cb645877c63702cc66fe74feb7a4dac5fde81
MD5 4ac6d07221266172f34d35e74e93af92
SHA1 8ac9a51c536ed69a2a0ee15e935314d8d6fadb25
SHA512 ffb6f2050498d845721cbc00d42d8e2d0cc5edd168e390532331abdac16098bfb5bcc4074bcf2e84d3b274933fa4d1ffe9cac45d73c6d80fd73b0b42cbc40797
TLSH
T149113AF8251D5CE5A98A13DB9BB12CC2AC37814081AA683C114E51589B2FE58907F98F
MD5 SHA1 SHA512 TLSH

Submit Download

data_415a3cd.cfg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\OrderProcessor\data_415a3cd.cfg
Size 199B
SHA256 7703ffacdead491bdf0c92dab0c8c0ba14c33e15a8c87f0350675bcffd7a1cb5
MD5 5f20a10c0b35676f22e1fab726a6e635
SHA1 9c5ce4403d4bae0dd3f6846b9752a1b2eaeeb8e1
SHA512 e43b5d3cdd4afc97b568d9f85ddd6b71e93a6ed0697435d1b7f77b61951fdfbdd418c8e36b8742cacce99038285685bda256c749456bad96eeffe26a24ab6bb7
TLSH
T1EFD022F42801A814B16B0126AA110BBF888919F84FB868D8884C112489A0ABA12A7FA7
MD5 SHA1 SHA512 TLSH

Submit Download

global.json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\OrderProcessor\global.json
Size 86B
SHA256 26fe14a6458f45754d23c671b477326eb65c730397c7eb4823f0b0aa5f66af30
MD5 883611a2d0ab3c91f7d0a75b52d694d8
SHA1 47417633f2115ab447c9acbdf267d9a0990334bc
SHA512 a469d3c962275a48844da5132fb071dd127010a81863dab747b0b2ee72e98b2c4870f85639634509dcd783d99f1bd707450c9267e7ee9193024de553d16ee371
TLSH
T1F1A01205C2600D2360F0076090214540EE06D26F0951000432620D8C87640B51144B40
MD5 SHA1 SHA512 TLSH

Submit Download

e591d64.msi

Path C:\Windows\Installer\e591d64.msi
Size 10.2MB
SHA256 a6611a44c32bc8ba9194298db09c49f1914dffa5ae30a9acb60b2b0641dc802d
MD5 28858c557194d7d7d62ed5ffb1206889
SHA1 f98fef150e0e0d720a33a252f2a9fbfbbcb3e95b
SHA512 b1231c81f9146cd81427213ff7fadc841b8099ede7f3cdaa3602cacfe38f070e07b55da20851587ca55b52105a0a0a96c354a86de481e5ada6249951826479ae
SSDEEP 196608:hc5l64Wr2VzZiT+ghw6IMAcnpzDxYqIammTNep:h+64qcmgMAWHxYqQOw
TLSH
T17FB633FA749347F2CB09457A4B13BBC057593C7A629041828ABC7ADE5770EB07871EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 f3677179f12493e26ddc537e2e9032f63874ef2f35ccdeff65f89f620d7475ce
MD5 af807a8c63b9ac6143b74cbfa11d7726
SHA1 b141f3f2e11679fbfaa7cd30674eb272d03d0b73
SHA512 edcc531e784c2adfe703f137559bc4e065c3257e8c64ad86fff9f6263309d9d44b84ca9719a65c6a0f0c862c8551c9cf1e5eafa2ce3abde10c50fe577eca07c4
SSDEEP 24576:ru8m+1zidoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:i
TLSH
T10247C52437F92240E7F79E3D6CF06A2389397D579C169E8D05421B4E0921BB1E8B2F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{47fa1887-b6ce-4c70-8b73-55a1bca92a52}_OnDiskSnapshotProp

Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{47fa1887-b6ce-4c70-8b73-55a1bca92a52}_OnDiskSnapshotProp
Size 6KB
SHA256 a49b70be1c37c79b9e741bcdeb6671858b8885e6a7cdd0020af2d37ce61ffcc7
MD5 cdce3a50bcf867f2f53b06482292aee8
SHA1 e9c939362cdcc5364dd0e3875c6af4fdab06db60
SHA512 95624c2af26c4967394d409070743437b6459e43eda6aa0411e6da5e2af5e2d35f247dccb126a67651edc8a20ff28cd4cfe278e063e6fcf585c6bc63044488b1
SSDEEP 96:FEodcYvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Co9b++ZVm
TLSH
T13AD189085AF54711E2B3AB7129F14557A877B911EF33CB8E0298638E2670910F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4492-57-0x000000000B4D0000-0x000000000BC80000-memory.dmp

Download

memory/4492-51-0x0000000005290000-0x00000000052B2000-memory.dmp

Download

memory/4492-45-0x0000000005860000-0x0000000005890000-memory.dmp

Download

memory/4492-44-0x0000000005A00000-0x0000000005B5A000-memory.dmp

Download

memory/4492-43-0x0000000005790000-0x00000000057AA000-memory.dmp

Download

memory/4492-42-0x0000000000E50000-0x0000000000E90000-memory.dmp

Download

memory/4492-365-0x0000000006840000-0x0000000006930000-memory.dmp

Download