Edit tour

Windows Analysis Report
WIN_DCA_2.4.0.10717_sursvc_qh.msi

Overview

General Information

Sample name:	WIN_DCA_2.4.0.10717_sursvc_qh.msi
Analysis ID:	1426575
MD5:	71cc51c86999c3630df3ff6169412916
SHA1:	90cd3c54a1b5596c093a7282f0a3db5109094983
SHA256:	1ff9c7139a86d45f92cd939c9f5ffdd5205ddeb87480d21fa753e29fb4370126
Infos:

Detection

Score:	26
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

.NET source code contains very large strings

Sample is not signed and drops a device driver

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

msiexec.exe (PID: 4612 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WIN_DCA_2.4.0.10717_sursvc_qh.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6436 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6580 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 704D2DC67D6894EEBDB1CD33E2207CDD MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3472 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 1630123FD6E99419F490FEE5EE1376B7 MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4428 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 4A304068329E687C086DF1B908D49B47 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 3792 cmdline: "C:\Windows\system32\cmd.exe" /c cd "C:\Program Files\Intel\SUR\QUEENCREEK\" && if exist SurSvc.exe (start /b /wait /d "C:\Program Files\Intel\SUR\QUEENCREEK\" SurSvc.exe /uninstall) MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1100 cmdline: "CMD" /C RMDIR /S /Q "C:\Program Files\Intel\SUR\QUEENCREEK\Updater\" && RMDIR /S /Q "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 1848 cmdline: "C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SurConsent.exe (PID: 2436 cmdline: "C:\Program Files\Intel\SUR\ICIP\SurConsent.exe" -install MD5: 890A5B4F011ED9238885C5A699C6CDC7)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\ICIP	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\base_library.zip	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\cacert.pem	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\ICIP\Config.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config.ini	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config_api.ini	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ctypes.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_decimal.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_elementtree.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_watcher_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\etw_options_config.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\IntelFgndAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_hw_config.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_heartbeat_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\PhatAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\HWPowerStatsTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link_helper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\TextExtractorAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\WifiAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_os_counters.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DttEtlAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\FPSAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_options.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_daq.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\libcrypto-3-x64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_crashlog_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\EntityFramework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\LICENSE.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_thread_monitor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sur_sysprep.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\apptable.csv	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_security.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\HeartBeatAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\analyzer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sqlite3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_fps_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_foreground_window_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\NetworkBandwidthAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_desktop_mapper_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\policy.json	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\HWMetaTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_user_waiting_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SleepStudyAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\FgndBackgrndAppsAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_eqs.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\OSSystemAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_phat_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_csme_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\EventLogCollection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\SQLite.Interop.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_display_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_etw_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\lookup.zip	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\GenericSqlATLSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_audio_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemUsageByFgndAppAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\ProcessAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_extractor.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\UserWaitTimeAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.EF6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\installer.bat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\process_input_options.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_hashlib.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libcrypto-3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libffi-8.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libssl-3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\licenses.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\logging_config.json	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_lzma.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_multiprocessing.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\perfmon.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pyexpat.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\python312.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pythoncom312.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pywintypes312.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_queue.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\ScheduleUpdates.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\select.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\servicemanager.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\shell_executor.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_socket.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ssl.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\unicodedata.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\UpdateServiceProxy64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\VCRUNTIME140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32api.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32event.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32evtlog.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32file.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32inet.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32pipe.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32process.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32profile.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32security.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32service.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\_win32sysloader.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32trace.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32ts.pyd	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Directory created: C:\Program Files\Intel\SUR\ICIP\SURV8_ICIP.log	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\LICENSE.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\licenses.txt			Jump to behavior

Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\wixca.pdb0 source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, MSI8665.tmp.1.dr, MSI790E.tmp.1.dr
Source:	Binary string: D:\a\1\b\bin\win32\_multiprocessing.pdb source: _multiprocessing.pyd.1.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbFF source: libssl-3.dll.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_user_waiting\intel_user_waiting_input.pdb** source: intel_user_waiting_input.dll.1.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: libcrypto-3.dll.1.dr
Source:	Binary string: c:\ium\dev\installer\custom_action\SetPermissions\SetPermissions.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.EF6.2015\Release\System.Data.SQLite.EF6.pdb source: System.Data.SQLite.EF6.dll.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32api.pdb!! source: win32api.pyd.1.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3-x64.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_os\intel_os_input.pdb++ source: intel_os_input.dll.1.dr
Source:	Binary string: C:\src\wix39r2\build\ship\x86\wixca.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, MSI85F7.tmp.1.dr, MSI8356.tmp.1.dr, MSI880C.tmp.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32ts.pdb source: win32ts.pyd.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32security.pdb source: win32security.pyd.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32file.pdb source: win32file.pyd.1.dr
Source:	Binary string: C:\ium\dev\installer\custom_action\SetEulaStatus\SetEulaStatus.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\pywintypes.pdb++ source: pywintypes312.dll.1.dr
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x64\wixca.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: unicodedata.pyd.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_user_waiting\intel_user_waiting_input.pdb source: intel_user_waiting_input.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_hw\intel_hw_input.pdb source: intel_hw_input.dll.1.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:32:59 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files (x86)\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;os-specificC:\Program Files (x86)\Common Files\SSLC:\Program Files (x86)\OpenSSL\lib\ossl-modules.dll..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: libcrypto-3.dll.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32api.pdb source: win32api.pyd.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_os\intel_os_input.pdb source: intel_os_input.dll.1.dr
Source:	Binary string: C:\src\wix39r2\build\ship\x86\uica.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32event.pdb source: win32event.pyd.1.dr
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.EF6.2015\Release\System.Data.SQLite.EF6.pdb$ source: System.Data.SQLite.EF6.dll.1.dr
Source:	Binary string: C:\ium\client\installer\custom_action\UpgradeEvidence\UpgradeEvidence.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\esrv_svc\esrv_svc.pdbNN,NGCTL source: esrv_svc.exe.1.dr
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\wixca.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, MSI8665.tmp.1.dr, MSI790E.tmp.1.dr
Source:	Binary string: c:\VagrantDir\ium-client-mst\installer\custom_action\ScheduleUpdates\ScheduleUpdates.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32profile.pdb source: win32profile.pyd.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\pywintypes.pdb source: pywintypes312.dll.1.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\productivity_link\productivity_link.pdb source: productivity_link.dll.1.dr
Source:	Binary string: e:\build_agent\workspace\laternrock_crashlog-win_main\Src\bin\x64\Release Static\crashlog_extractor.pdb source: crashlog_extractor.exe.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_hw\intel_hw_input.pdb44 source: intel_hw_input.dll.1.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.2.0 23 Nov 20233.2.0built on: Tue Nov 28 17:22:06 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableHMAC-DRBG-KDFentropynoncecrypto\deterministic_nonce.cget_and_lockcrypto\ex_data.cossl_crypto_get_ex_new_index_exCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: crypto\init.cOPENSSL_init_cryptocrypto\initthread.ccrypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFhexstr2buf_sepcrypto\o_str.cossl_hexstr2buf_sepbuf2hexstr_sepcrypto\packet.ccrypto\param_build.cparam_push_numpush_BNNegative big numbers are unsupported for OSSL_PARAM_UNSIGNED_INTEGEROSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_paramossl_param_build_set_bn_padcrypto\param_build_set.ccopy_integercrypto\params.cunsigned_from_signedgeneral_get_in
Source:	Binary string: R:\sqlite\sqlite3.pdb source: sqlite3.dll.1.dr
Source:	Binary string: C:\github\dca\openssl\libcrypto-3-x64.pdb source: libcrypto-3-x64.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\esrv_svc\esrv_svc.pdb source: esrv_svc.exe.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\intel_sur_sysprep\intel_sur_sysprep.pdb source: intel_sur_sysprep.dll.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\perfmon.pdb source: perfmon.pyd.1.dr
Source:	Binary string: e:\build_agent\workspace\laternrock_crashlog-win_main\Src\bin\x64\Release Static\crashlog_extractor.pdb2 source: crashlog_extractor.exe.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32trace.pdb source: win32trace.pyd.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: VCRUNTIME140.dll.1.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: libssl-3.dll.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Code function: 4x nop then jmp 00007FF848A909FFh	13_2_00007FF848A909D1
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Code function: 4x nop then jmp 00007FF848A91162h	13_2_00007FF848A90EAE
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Code function: 4x nop then jmp 00007FF848A91162h	13_2_00007FF848A910CE
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Code function: 4x nop then jmp 00007FF848A91162h	13_2_00007FF848A910B9

Source: licenses.txt.1.dr	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: licenses.txt.1.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: http://ocsp.sectigo.com0#
Source: licenses.txt.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	String found in binary or memory: http://www.intel.com/privacy
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	String found in binary or memory: http://www.opensource.org).
Source: sqlite3.dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: licenses.txt.1.dr	String found in binary or memory: https://github.com/jquery/globalize
Source: licenses.txt.1.dr	String found in binary or memory: https://github.com/jquery/jquery
Source: win32security.pyd.1.dr, win32trace.pyd.1.dr, perfmon.pyd.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, win32profile.pyd.1.dr, win32api.pyd.1.dr, win32file.pyd.1.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://intel.com/pr
Source: SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://intel.com/privacy
Source: SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://intel.com/privacy.
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://intel.fr/privacy.
Source: licenses.txt.1.dr	String found in binary or memory: https://jquery.org/
Source: licenses.txt.1.dr	String found in binary or memory: https://js.foundation/
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policy.system-usage-rep
Source: SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://policy.system-usage-report.intel.com/faq/
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: System.Data.SQLite.EF6.dll.1.dr	String found in binary or memory: https://system.data.sqlite.org/
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.co.jp/content/www/jp/ja/priv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.co.jp/content/www/jp/ja/privacy/intel-privacy-notice.html)
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.co.jp/content/www/jp/ja/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.co.kr/content/www/kr/ko/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com.br/conte
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com.br/content/www/br/pt/privacy/intel-privacy-notice.html.
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com.br/content/www/br/pt/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com.tr/content/www/tr/tr/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/cn/zh/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/id/id/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/it/it/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com/content/www/it/it/support/topics/idsa-cip.htmlPv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/pl/pl/support/topics/idsa-cip.html.
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/ru/ru/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com/content/www/ru/ru/support/topics/idsa-cip.htmlPv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/th/th/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com/content/www/th/th/support/topics/idsa-cip.htmlPv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com/content/www/tw/zh/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/tw/zh/support/topics/idsa-cip.htmlH
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	String found in binary or memory: https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp, WIN_DCA_2.4.0.10717_sursvc_qh.msi	String found in binary or memory: https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html.
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html8
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.com/content/www/us/en/support/topics/idsa-cip.htmlPv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/vn/vi/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.de/content/www/de/de/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.de/content/www/de/de/support/topics/idsa-cip.htmlPv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.es/content/www/es/es/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.eu/content/www/eu/en/privacy/intel-privacy-notice.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.fr/content/www/fr/fr/support/topics/idsa-cip.html
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.intel.fr/content/www/fr/fr/support/topics/idsa-cip.htmlPv
Source: SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.it/content/www/it/it/privacy/intel-privacy-notice.html.
Source: libssl-3.dll.1.dr, libcrypto-3.dll.1.dr, libcrypto-3-x64.dll.1.dr	String found in binary or memory: https://www.openssl.org/H
Source: System.Data.SQLite.EF6.dll.1.dr	String found in binary or memory: https://www.sqlite.org/lang_aggfunc.html
Source: System.Data.SQLite.EF6.dll.1.dr	String found in binary or memory: https://www.sqlite.org/lang_corefunc.html

System Summary

.NET source code contains very large strings

Source: ProcessAnalyzerTask.dll.1.dr, ProcessAnalyzerTask.cs

Long String: Length: 10957

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\447489.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77D5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI790E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI796D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7BFE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7C3E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7C5E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI81CD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI822C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8356.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI85F7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8665.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI880C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\Registry	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\downloads	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\history	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\update_events	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\persisted_updates	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\captured_logs	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97EC.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI77D5.tmp

Jump to behavior

Source: DSADcaIntegration.dll.1.dr

Static PE information: No import functions for PE file found

Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	Binary or memory string: OriginalFilenameuica.dll\ vs WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	Binary or memory string: OriginalFilenamewixca.dll\ vs WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	Binary or memory string: OriginalFilenameServiceO.dll\ vs WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	Binary or memory string: OriginalFilenameScheduleUpdates.dll` vs WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi	Binary or memory string: OriginalFilenamewixca.dllL vs WIN_DCA_2.4.0.10717_sursvc_qh.msi

Source: GenericSqlATLSupport.dll.1.dr, GenericSQLAnalyzerTask.cs

Task registration methods: 'CreateValidSessionTableAndAnalysisInterval'

Source: DSADcaIntegration.dll.1.dr, FileSystemController.cs	Security API names: System.IO.FileInfo.GetAccessControl()
Source: DSADcaIntegration.dll.1.dr, FileSystemController.cs	Security API names: System.IO.DirectoryInfo.GetAccessControl()
Source: DSADcaIntegration.dll.1.dr, FileSystemController.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.GetAccessRules(bool, bool, System.Type)
Source: DSADcaIntegration.dll.1.dr, FileSystemController.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.SecurityIdentifier)
Source: DSADcaIntegration.dll.1.dr, FileSystemSafetyController.cs	Security API names: Directory.GetAccessControl
Source: DSADcaIntegration.dll.1.dr, FileSystemSafetyController.cs	Security API names: Directory.GetAccessControl(directory).GetAccessRules
Source: DSADcaIntegration.dll.1.dr, FileSystemSafetyController.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: sus26.evad.winMSI@19/177@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Intel

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_03
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF91EC66383DD0AB80.TMP

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: sqlite3.dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: BrowserHistoryAnalyzerTask.dll.1.dr	Binary or memory string: create table if not exists visits(id INT, url INT, visit_time INT, from_visit INT, transition INT, segment_id INT, visit_duration INT, incremented_omnibox_typed_score NUM, user_key_idc_session_id INT); oError occured while merging browser history databases:

Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WIN_DCA_2.4.0.10717_sursvc_qh.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 704D2DC67D6894EEBDB1CD33E2207CDD
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 1630123FD6E99419F490FEE5EE1376B7
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 4A304068329E687C086DF1B908D49B47 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c cd "C:\Program Files\Intel\SUR\QUEENCREEK\" && if exist SurSvc.exe (start /b /wait /d "C:\Program Files\Intel\SUR\QUEENCREEK\" SurSvc.exe /uninstall)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "CMD" /C RMDIR /S /Q "C:\Program Files\Intel\SUR\QUEENCREEK\Updater\" && RMDIR /S /Q "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\icacls.exe "C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe "C:\Program Files\Intel\SUR\ICIP\SurConsent.exe" -install
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 704D2DC67D6894EEBDB1CD33E2207CDD	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 1630123FD6E99419F490FEE5EE1376B7	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 4A304068329E687C086DF1B908D49B47 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe "C:\Program Files\Intel\SUR\ICIP\SurConsent.exe" -install	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c cd "C:\Program Files\Intel\SUR\QUEENCREEK\" && if exist SurSvc.exe (start /b /wait /d "C:\Program Files\Intel\SUR\QUEENCREEK\" SurSvc.exe /uninstall)	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "CMD" /C RMDIR /S /Q "C:\Program Files\Intel\SUR\QUEENCREEK\Updater\" && RMDIR /S /Q "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\icacls.exe "C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Automated click: Next
Source: C:\Windows\System32\msiexec.exe	Automated click: I accept the terms in the License Agreement
Source: C:\Windows\System32\msiexec.exe	Automated click: Next
Source: C:\Windows\System32\msiexec.exe	Automated click: Install
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Automated click: Accept

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\ICIP	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\base_library.zip	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\cacert.pem	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\ICIP\Config.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config.ini	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config_api.ini	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ctypes.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_decimal.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_elementtree.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_watcher_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\etw_options_config.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\IntelFgndAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_hw_config.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_heartbeat_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\PhatAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\HWPowerStatsTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link_helper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\TextExtractorAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\WifiAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_os_counters.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DttEtlAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\FPSAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_options.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_daq.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\libcrypto-3-x64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_crashlog_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\EntityFramework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\LICENSE.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_thread_monitor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sur_sysprep.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\apptable.csv	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_security.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\HeartBeatAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\analyzer.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sqlite3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_fps_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_foreground_window_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\NetworkBandwidthAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_desktop_mapper_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\policy.json	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\HWMetaTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_user_waiting_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SleepStudyAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\FgndBackgrndAppsAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_eqs.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\OSSystemAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_phat_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_csme_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\EventLogCollection.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\SQLite.Interop.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_display_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_etw_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\lookup.zip	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\GenericSqlATLSupport.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_audio_input.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemUsageByFgndAppAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\ProcessAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll.config	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_extractor.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\UserWaitTimeAnalyzerTask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.EF6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\installer.bat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\process_input_options.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_hashlib.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libcrypto-3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libffi-8.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libssl-3.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\licenses.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\logging_config.json	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_lzma.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_multiprocessing.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\perfmon.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pyexpat.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\python312.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pythoncom312.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pywintypes312.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_queue.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\ScheduleUpdates.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\select.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\servicemanager.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\shell_executor.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_socket.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ssl.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\unicodedata.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\UpdateServiceProxy64.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\VCRUNTIME140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32api.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32event.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32evtlog.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32file.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32inet.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32pipe.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32process.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32profile.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32security.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32service.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\_win32sysloader.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32trace.pyd	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32ts.pyd	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Directory created: C:\Program Files\Intel\SUR\ICIP\SURV8_ICIP.log	Jump to behavior

Source: WIN_DCA_2.4.0.10717_sursvc_qh.msi

Static file information: File size 24121344 > 1048576

Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\wixca.pdb0 source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, MSI8665.tmp.1.dr, MSI790E.tmp.1.dr
Source:	Binary string: D:\a\1\b\bin\win32\_multiprocessing.pdb source: _multiprocessing.pyd.1.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbFF source: libssl-3.dll.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_user_waiting\intel_user_waiting_input.pdb** source: intel_user_waiting_input.dll.1.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: libcrypto-3.dll.1.dr
Source:	Binary string: c:\ium\dev\installer\custom_action\SetPermissions\SetPermissions.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.EF6.2015\Release\System.Data.SQLite.EF6.pdb source: System.Data.SQLite.EF6.dll.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32api.pdb!! source: win32api.pyd.1.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3-x64.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_os\intel_os_input.pdb++ source: intel_os_input.dll.1.dr
Source:	Binary string: C:\src\wix39r2\build\ship\x86\wixca.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, MSI85F7.tmp.1.dr, MSI8356.tmp.1.dr, MSI880C.tmp.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32ts.pdb source: win32ts.pyd.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32security.pdb source: win32security.pyd.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32file.pdb source: win32file.pyd.1.dr
Source:	Binary string: C:\ium\dev\installer\custom_action\SetEulaStatus\SetEulaStatus.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\pywintypes.pdb++ source: pywintypes312.dll.1.dr
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x64\wixca.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: unicodedata.pyd.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_user_waiting\intel_user_waiting_input.pdb source: intel_user_waiting_input.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_hw\intel_hw_input.pdb source: intel_hw_input.dll.1.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:32:59 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files (x86)\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;os-specificC:\Program Files (x86)\Common Files\SSLC:\Program Files (x86)\OpenSSL\lib\ossl-modules.dll..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: libcrypto-3.dll.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32api.pdb source: win32api.pyd.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_os\intel_os_input.pdb source: intel_os_input.dll.1.dr
Source:	Binary string: C:\src\wix39r2\build\ship\x86\uica.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32event.pdb source: win32event.pyd.1.dr
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.EF6.2015\Release\System.Data.SQLite.EF6.pdb$ source: System.Data.SQLite.EF6.dll.1.dr
Source:	Binary string: C:\ium\client\installer\custom_action\UpgradeEvidence\UpgradeEvidence.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\esrv_svc\esrv_svc.pdbNN,NGCTL source: esrv_svc.exe.1.dr
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\wixca.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi, MSI8665.tmp.1.dr, MSI790E.tmp.1.dr
Source:	Binary string: c:\VagrantDir\ium-client-mst\installer\custom_action\ScheduleUpdates\ScheduleUpdates.pdb source: WIN_DCA_2.4.0.10717_sursvc_qh.msi
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32profile.pdb source: win32profile.pyd.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\pywintypes.pdb source: pywintypes312.dll.1.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\productivity_link\productivity_link.pdb source: productivity_link.dll.1.dr
Source:	Binary string: e:\build_agent\workspace\laternrock_crashlog-win_main\Src\bin\x64\Release Static\crashlog_extractor.pdb source: crashlog_extractor.exe.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\il_intel_hw\intel_hw_input.pdb44 source: intel_hw_input.dll.1.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.2.0 23 Nov 20233.2.0built on: Tue Nov 28 17:22:06 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableHMAC-DRBG-KDFentropynoncecrypto\deterministic_nonce.cget_and_lockcrypto\ex_data.cossl_crypto_get_ex_new_index_exCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: crypto\init.cOPENSSL_init_cryptocrypto\initthread.ccrypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFhexstr2buf_sepcrypto\o_str.cossl_hexstr2buf_sepbuf2hexstr_sepcrypto\packet.ccrypto\param_build.cparam_push_numpush_BNNegative big numbers are unsupported for OSSL_PARAM_UNSIGNED_INTEGEROSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_paramossl_param_build_set_bn_padcrypto\param_build_set.ccopy_integercrypto\params.cunsigned_from_signedgeneral_get_in
Source:	Binary string: R:\sqlite\sqlite3.pdb source: sqlite3.dll.1.dr
Source:	Binary string: C:\github\dca\openssl\libcrypto-3-x64.pdb source: libcrypto-3-x64.dll.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\esrv_svc\esrv_svc.pdb source: esrv_svc.exe.1.dr
Source:	Binary string: C:\jenkins\Workspace\BUILD\GitRepos\dca-infra\build_windows_mainline\intel_sur_sysprep\intel_sur_sysprep.pdb source: intel_sur_sysprep.dll.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\perfmon.pdb source: perfmon.pyd.1.dr
Source:	Binary string: e:\build_agent\workspace\laternrock_crashlog-win_main\Src\bin\x64\Release Static\crashlog_extractor.pdb2 source: crashlog_extractor.exe.1.dr
Source:	Binary string: C:\src\pywin32\build\temp.win32-cpython-312\Release\win32trace.pdb source: win32trace.pyd.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: VCRUNTIME140.dll.1.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: libssl-3.dll.1.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3.1.dr

Source: DSADcaIntegration.dll.1.dr

Static PE information: 0xB9BEFE61 [Mon Oct 1 07:25:21 2068 UTC]

Source: IntelSoftwareAssetManagerService.exe.1.dr

Static PE information: real checksum: 0x4b4715 should be: 0x4bab14

Source: crashlog_extractor.exe.1.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.1.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.1.dr	Static PE information: section name: .00cfg
Source: python312.dll.1.dr	Static PE information: section name: PyRuntim

Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe

Code function: 13_2_00007FF848A98CB5 push eax; iretd

13_2_00007FF848A98CCD

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\EntityFramework.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\shell_executor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\PhatAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\TextExtractorAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32service.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI790E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemUsageByFgndAppAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link_helper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_fps_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7C5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\EventLogCollection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI81CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\OSSystemAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\analyzer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8665.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\HeartBeatAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\HWMetaTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI880C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\WifiAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7C3E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\ScheduleUpdates.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_desktop_mapper_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\IntelFgndAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_daq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_user_waiting_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_foreground_window_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_phat_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pythoncom312.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\FPSAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI796D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\SleepStudyAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_security.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_extractor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\python312.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DttEtlAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\UserWaitTimeAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI822C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\ProcessAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_heartbeat_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI85F7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_watcher_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77D5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_csme_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\ICIP\Config.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sur_sysprep.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\select.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_audio_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_etw_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8356.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_thread_monitor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\FgndBackgrndAppsAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_display_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.EF6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\UpdateServiceProxy64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\GenericSqlATLSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_crashlog_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\HWPowerStatsTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97EC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\NetworkBandwidthAnalyzerTask.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8665.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI880C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7C5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI822C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI81CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97EC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8356.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI85F7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI796D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7C3E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77D5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI790E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\LICENSE.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\licenses.txt			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\System32\icacls.exe "C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: esrv_svc.exe.1.dr

Binary or memory string: WINE_GET_UNIX_FILE_NAME

Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Memory allocated: 20B65E10000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Memory allocated: 20B7F880000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\EntityFramework.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\shell_executor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\PhatAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\TextExtractorAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32service.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI790E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\SystemUsageByFgndAppAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link_helper.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_fps_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7C5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\EventLogCollection.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI81CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\OSSystemAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\analyzer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8665.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\HeartBeatAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\HWMetaTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI880C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\WifiAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32inet.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7C3E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\ScheduleUpdates.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_desktop_mapper_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\IntelFgndAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_daq.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_user_waiting_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_foreground_window_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_phat_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32security.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32process.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pythoncom312.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\FPSAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI796D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\SleepStudyAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32event.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_security.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_extractor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\python312.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DttEtlAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\UserWaitTimeAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI822C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\ProcessAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_heartbeat_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI85F7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_watcher_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI77D5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_csme_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32file.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32profile.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\ICIP\Config.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sur_sysprep.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\select.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_audio_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_etw_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8356.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\FgndBackgrndAppsAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_thread_monitor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_display_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.EF6.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32ts.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\UpdateServiceProxy64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\GenericSqlATLSupport.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_crashlog_input.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\HWPowerStatsTask.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI97EC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32trace.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\perfmon.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32pipe.pyd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Intel\SUR\QUEENCREEK\NetworkBandwidthAnalyzerTask.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: esrv_svc.exe.1.dr	Binary or memory string: VMware-
Source: esrv_svc.exe.1.dr	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys

Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe "C:\Program Files\Intel\SUR\ICIP\SurConsent.exe" -install	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c cd "C:\Program Files\Intel\SUR\QUEENCREEK\" && if exist SurSvc.exe (start /b /wait /d "C:\Program Files\Intel\SUR\QUEENCREEK\" SurSvc.exe /uninstall)	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "CMD" /C RMDIR /S /Q "C:\Program Files\Intel\SUR\QUEENCREEK\Updater\" && RMDIR /S /Q "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\icacls.exe "C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Queries volume information: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Queries volume information: C:\Program Files\Intel\SUR\ICIP\Config.dll VolumeInformation	Jump to behavior
Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Program Files\Intel\SUR\ICIP\SurConsent.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Scheduled Task/Job	1 Windows Service	1 Windows Service	32 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	1 Scheduled Task/Job	11 Disable or Modify Tools	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Services File Permissions Weakness	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	2 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WIN_DCA_2.4.0.10717_sursvc_qh.msi	0%	ReversingLabs
WIN_DCA_2.4.0.10717_sursvc_qh.msi	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files\Intel\SUR\ICIP\Config.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\ICIP\Config.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	0%	ReversingLabs
C:\Program Files\Intel\SUR\ICIP\SurConsent.exe	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll	0%	Virustotal	Browse
C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll	0%	ReversingLabs
C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://js.foundation/	0%	URL Reputation	safe
https://www.intel.co.jp/content/www/jp/ja/privacy/intel-privacy-notice.html)	0%	Virustotal		Browse
https://www.intel.com.br/content/www/br/pt/support/topics/idsa-cip.html	0%	Virustotal		Browse
https://www.intel.eu/content/www/eu/en/privacy/intel-privacy-notice.html	0%	Virustotal		Browse
https://www.intel.com.br/content/www/br/pt/privacy/intel-privacy-notice.html.	0%	Virustotal		Browse
https://www.intel.com.tr/content/www/tr/tr/support/topics/idsa-cip.html	0%	Virustotal		Browse
https://www.intel.co.jp/content/www/jp/ja/support/topics/idsa-cip.html	0%	Virustotal		Browse
https://www.intel.co.kr/content/www/kr/ko/support/topics/idsa-cip.html	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html	WIN_DCA_2.4.0.10717_sursvc_qh.msi	false		high
https://intel.fr/privacy.	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/jquery/jquery	licenses.txt.1.dr	false		high
https://www.intel.fr/content/www/fr/fr/support/topics/idsa-cip.htmlPv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.intel.com.br/content/www/br/pt/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.sectigo.com0	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.htmlPv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policy.system-usage-rep	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.intel.eu/content/www/eu/en/privacy/intel-privacy-notice.html	SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/mhammond/pywin32	win32security.pyd.1.dr, win32trace.pyd.1.dr, perfmon.pyd.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, win32profile.pyd.1.dr, win32api.pyd.1.dr, win32file.pyd.1.dr	false		high
https://www.intel.com/content/www/ru/ru/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://policy.system-usage-report.intel.com/faq/	SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
http://creativecommons.org/publicdomain/zero/1.0/	licenses.txt.1.dr	false		high
http://mozilla.org/MPL/2.0/.	licenses.txt.1.dr	false		high
https://www.intel.fr/content/www/fr/fr/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.intel.co.jp/content/www/jp/ja/privacy/intel-privacy-notice.html)	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
http://www.opensource.org).	WIN_DCA_2.4.0.10717_sursvc_qh.msi	false		low
https://www.intel.com.br/conte	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.intel.com/content/www/vn/vi/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.sqlite.org/lang_corefunc.html	System.Data.SQLite.EF6.dll.1.dr	false		high
https://www.intel.co.jp/content/www/jp/ja/priv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.intel.com/content/www/tw/zh/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.intel.it/content/www/it/it/privacy/intel-privacy-notice.html.	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.intel.com.br/content/www/br/pt/privacy/intel-privacy-notice.html.	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
https://www.intel.es/content/www/es/es/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.sqlite.org/copyright.html.	sqlite3.dll.1.dr	false		high
https://www.intel.com/content/www/it/it/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	licenses.txt.1.dr	false		high
https://sectigo.com/CPS0	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
https://www.intel.com/content/www/th/th/support/topics/idsa-cip.htmlPv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.intel.com/content/www/tw/zh/support/topics/idsa-cip.htmlH	SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.intel.com/content/www/th/th/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.sqlite.org/lang_aggfunc.html	System.Data.SQLite.EF6.dll.1.dr	false		high
https://intel.com/privacy	SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.intel.com/content/www/cn/zh/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
https://intel.com/pr	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.intel.com/content/www/it/it/support/topics/idsa-cip.htmlPv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html.	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp, WIN_DCA_2.4.0.10717_sursvc_qh.msi	false		high
http://ocsp.sectigo.com0#	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false		unknown
https://www.intel.co.kr/content/www/kr/ko/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
https://www.intel.com.tr/content/www/tr/tr/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
https://intel.com/privacy.	SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
https://github.com/jquery/globalize	licenses.txt.1.dr	false		high
https://www.intel.de/content/www/de/de/support/topics/idsa-cip.htmlPv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jquery.org/	licenses.txt.1.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	WIN_DCA_2.4.0.10717_sursvc_qh.msi, intel_hw_input.dll.1.dr, win32security.pyd.1.dr, libssl-3.dll.1.dr, crashlog_extractor.exe.1.dr, BatteryAnalyzerTask.dll.1.dr, win32trace.pyd.1.dr, DevUseAnalyzerTask.dll.1.dr, perfmon.pyd.1.dr, _multiprocessing.pyd.1.dr, CSMEAnalyzerTask.dll.1.dr, intel_os_input.dll.1.dr, libcrypto-3.dll.1.dr, pywintypes312.dll.1.dr, win32ts.pyd.1.dr, win32event.pyd.1.dr, Config.dll0.1.dr, ProcessAnalyzerTask.dll.1.dr, HeartBeatAnalyzerTask.dll.1.dr, win32profile.pyd.1.dr, HWMetaTask.dll.1.dr	false	URL Reputation: safe	unknown
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html8	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	libssl-3.dll.1.dr, libcrypto-3.dll.1.dr, libcrypto-3-x64.dll.1.dr	false		high
https://www.intel.co.jp/content/www/jp/ja/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse	unknown
https://system.data.sqlite.org/	System.Data.SQLite.EF6.dll.1.dr	false		high
https://www.intel.com/content/www/pl/pl/support/topics/idsa-cip.html.	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.intel.com/privacy	WIN_DCA_2.4.0.10717_sursvc_qh.msi	false		high
https://js.foundation/	licenses.txt.1.dr	false	URL Reputation: safe	unknown
https://www.intel.com/content/www/id/id/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.intel.de/content/www/de/de/support/topics/idsa-cip.html	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp, SurConsent.exe, 0000000D.00000000.2272592397.0000020B65AB5000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.intel.com/content/www/ru/ru/support/topics/idsa-cip.htmlPv	SurConsent.exe, 0000000D.00000002.3308758924.0000020B6789C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426575
Start date and time:	2024-04-16 10:41:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WIN_DCA_2.4.0.10717_sursvc_qh.msi
Detection:	SUS
Classification:	sus26.evad.winMSI@19/177@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 10 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	39377
Entropy (8bit):	5.6842726971423145
Encrypted:	false
SSDEEP:	768:FMvwt7di5Lh6duOcxKo/MsaJjIUvS45GNNVwUVyEvhyV7IiiJYq2AfhpJx4AGOPt:Gvwt7di5Lh6duOcxKo/MpJjIUvS45GN1
MD5:	11E7577FDE3728ED9363629E2454812E
SHA1:	E98AE67B91D3B04DA5D1B2E4A1E35BEF4AB05238
SHA-256:	9C3B7F182984BBA1F14F47B3462E7AE79EB3380884D81AF81BED9E09087630DB
SHA-512:	B8BAEC673ABF4EB3F0038C6A431BDE740891A5551E81C40861044674586500B1A998A8922E286624C35272BFE8D89FE1F74AC39F2AED8F07B4B335DA9CB45FE4
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@KU.X.@.....@.....@.....@.....@.....@......&.{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}&.Intel(R) Computing Improvement Program!.WIN_DCA_2.4.0.10717_sursvc_qh.msi.@.....@.)...@.....@......vmp..&.{BBF8B85D-F894-44F2-9844-AEC4CA522F8F}.....@.....@.....@.....@.......@.....@.....@.......@....&.Intel(R) Computing Improvement Program......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....uninstall.4FFF4AAB_22AE_4C10_B00D_4F1423082A83....clear_ids.4FFF4AAB_22AE_4C10_B00D_4F1423082A83....ProcessComponents..Updating component registration..&.{E2ABED4C-AB56-4586-BBD7-364421DB14E2}&.{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}.@......&.{83CFBACE-BB58-4BEA-95BD-7612425AA7B3}&.{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}.@......&.{B33258FD-750C-3B42-8BE4-535B48E97DB4}&.{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}.@......&.{2427B123-F132-4F0B-A958-50F7CDFCAA56}&.{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}.@......&.{22824972-0C4A-31B4-AEEF-9FC7596F1305}&.{15E71D2B-4046-4B9

C:\Program Files\Intel\SUR\ICIP\Config.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16648
Entropy (8bit):	6.751174656233439
Encrypted:	false
SSDEEP:	384:DTcfqN/nX/ClpwKNsehdD1ZGoGCJEF8ZpHOsac:fgqxa6ehdDHEFiRYc
MD5:	14F8AE20F254CB4C8849E6318F2CF6B8
SHA1:	EA81019FF98018D4220142D2C6E2D1485B85F09F
SHA-256:	C71BDA9A817E81712B4EF460CCB39D2D3C53627F6762B8F7A3ED1036395B1023
SHA-512:	EA5229B4AED3BF7B8BC993CF4ED9B5CD88BE062796281FFBD886506EC2CF31950F58A0630543E6DE0EDE162F7FD8E04FBA14B1B7C595A57EED0FE963EE1D2111
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.................. ...@....... ....................................`.................................h...O....@...................)...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H.......,"..<...........................................................".(......r...p.....~....r'..p(.........r3..p.......0...........rC..p(......((......(....-..(....-...o.......+....,;..~....(......(...........,..rC..p.(.....r[..p.(........+..r[..p(......+.......0..........ru..p.....r...p.....(.........r...p(.........r...p.....~....~....~....(.........~....r...p(.........~....r...p~....r#..p(.........r'..p.....~....~....(.............0..[.......rI..p.....r_..p.....r...

C:\Program Files\Intel\SUR\ICIP\SURV8_ICIP.log

Download File

Process:	C:\Program Files\Intel\SUR\ICIP\SurConsent.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	4.956845533458097
Encrypted:	false
SSDEEP:	6:kzFGH8rTUzFGyRKPTUzYqr7pUzFGIpHGKa+Hfv7TUzFGtGKa+Hfvn:kAcHUACKrU9NUAIdr/v7TUAtdr/vn
MD5:	62BFC9F4653041F138104FED2B518F38
SHA1:	435F39EEA9DEE93337E7F728071844FF38057136
SHA-256:	2B53EEECA46B37567FCF1EBE118F84963B239376CE6F17708CB64AA15E6ED5F4
SHA-512:	0219050736C5620E078D3D7FEE9BC4DFDDEC233052322C9CA12BD5865655AE9DEB3A9F8FAE8966530F065B88FF0C9280A83EFEB1D063FF4AC5C2F67F4C62376F
Malicious:	false
Preview:	04/16/2024 10:42:27,INFO:ICIP:logger start...04/16/2024 10:42:27,INFO:ICIP:Starting ICIP...04/16/2024 10:42:27,WARNING:ICIP:Identified language: en..04/16/2024 10:42:27,INFO:ICIP:expandedConsentBox fonts are adjusted to 9..04/16/2024 10:42:27,INFO:ICIP:consentBox fonts are adjusted to 9..

C:\Program Files\Intel\SUR\ICIP\SurConsent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	388872
Entropy (8bit):	5.952889314430214
Encrypted:	false
SSDEEP:	6144:1n23f+vln/hoZXxH0tqy2Qlwd1qU7Q/W+Q/es:1nC+vZJoZXxH08y2QKd81/WRms
MD5:	890A5B4F011ED9238885C5A699C6CDC7
SHA1:	87FBDBF3CE013B42A9B58F8327DF0DE6D720658D
SHA-256:	0E0605182A3B8157735EAF1DF4660EA928272C895DE1A4484E64C45EC6CB8C8A
SHA-512:	32F95FC1BF5AD35BEE986F29F8A9593213A58E481181517CA3E06C9C5A7A04838B401C06AB5D4A4CB837DAA2AD4C22D74634AEF3E729E2374FD3C97AECEF4584
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e.........."...0......<......n.... ........@.. ....................... .......R....`.....................................O........8...............)........................................................... ............... ..H............text...t.... ...................... ..`.rsrc....8.......:..................@..@.reloc..............................@..B................P.......H........J...I......)...................................................V..(-...('....(.........0..e........s....}......}.....(........}......}.....(".....(.......( .....(......(......(....o......{....o.........0..9........(+.....,...{.....{....o....r...p.{....o....(....o.........{.....{....o.......o......{.....{....o.......o........{...........s ...o!.....{...........s"...o#......0..5.........o$....M.....,..($....M...o%....+..(%....M...o%........0..D.........o&........

C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60168
Entropy (8bit):	5.983450049458015
Encrypted:	false
SSDEEP:	768:LPSFFUnEKkxjZe6N8t2J1JBViUcrr2ILXDxRn80PXqBFAGj5SlIloQy6GehdDQeL:LPEUnOZeoHLlzcv20vqAG2IuneAeeiZ
MD5:	9152835AEF16DB91517164FCB5CBC810
SHA1:	3F0C2A7364F04DBD35E4EFBACAFDC74B9566FB87
SHA-256:	698C100F752A039DA698FB6F2E727BEC75B07C32A254CD782E153814E30D48C1
SHA-512:	6BFFD126CE97C7BCA060C42BFDB5DC39E22BBA6945662BBCDEC69C3AF6DA2D25A9B9608429E901303D757B5207BC5FC5950298C0F1DC79F47E1219ABE302B944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e.........." ..0.................. ........... ....................... .......1....`.................................L...O........................)........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........[..H~............................................................{...."..}......{...."..}......{...."..}......0..c........(........(.......(....r...p(....(.......(....r...p(....(.......(....rA..p(....}......}......}....r..(.....(....&.{.....(....&.0..X.........(....r...p(......(...........,...rW..p(....s....z.(....rA..p(......(........,....(....&...(....(......(...........,...r...p(....s....z.(....r...p(.......(........,....(....&...$....{.....r...p..o....(..

C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50952
Entropy (8bit):	5.22994247157155
Encrypted:	false
SSDEEP:	768:A3PLJNwHavZZlRvMs7yhcHLqFW/wehdDX4EFiRVY:IPLfwHavP97yhcHLqFW/weH4eig
MD5:	4105FAEAC52E6C6980035EAA5007A998
SHA1:	D1575B677A9A43092EAA785CE2A1DE70C7070694
SHA-256:	650BB37263D42C14EA0074369304E726B930D0FDEB8CADD26D843771F222D9B3
SHA-512:	F01D719AB5CF87DE8F7447684BF2F0A5A0D6A5880F03C51CC673C1889426C547D778F36A4C7C71DFA24F7CDC926BFDEFAECC8772D4E193DEB1FACBFC87296041
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............6.... ........... ..............................9.....`....................................O........................)........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......X7...\|..........................................................B.r...p..(..........0..V.........s........o.....s........o.....s........o.......#.....r%..p.o....(....r...p(..................12.#.....0.............{....o.....+\|..(.......{-........,^.......,&..%{/.....{)...(........(....X}/....+.........,$..%{......{)...(........(....X}........})......(....:x.............o......+.*.................0..........s.......}0.....{...........s....o...........,g.s........}(..

C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54024
Entropy (8bit):	4.620713496731865
Encrypted:	false
SSDEEP:	384:VwTo29CQI4U+ByIIin/cByNm8JpwKNsehdD8eiGoGCJEF8ZpH29:VCo29tpbvTn/cByNm9ehdDNAEFiR4
MD5:	1580E7AB2FBFA1A253509F05D1CD64D9
SHA1:	019BA387FEE2E5B9E7FB4A9FA9A0AFCD7F5141B2
SHA-256:	97793CE767A3EB1791FB0858AE367E0D13872DBE738040FD924CFD8D17DDE3CB
SHA-512:	DB4D9BFF822A2684E886C04EC6EB2C2DECD5D19F37080FA4735ADC0650197FBB12B18DABD9BFD831C3A6DE3E3EFAEE364940FCF7CE44F91E2D111301418BCBDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e.........." ..0.................. ........... ....................... ......e.....`.................................0...O........................)........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................d.......H..........t...........................................................B.r...p..(..........0...........s.....s......o.......o.....o.....o.............,.....r)..pr...p(.....8.....o..............,.....r...pr...p(.....8i.....s......r...p..r...p.."......#..........n.......(...+o............s....o.......o......8......(...........(...%...o....%..(...+....,A......o ...o!.........,.#.........+....o ...o!...vl#......N@[.......(...%...o....%..(...+....,.....o ...o!...vk.......(...%

C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19720
Entropy (8bit):	6.5699702451966955
Encrypted:	false
SSDEEP:	384:G/IIfKZ8PjiBMtd1dTcNkzjXgPSpwKNsehdDjtmGoGCJEF8ZpHfTE:GcBMtBT/w/ehdDhsEFiR4
MD5:	08E9081F433FDC6FE730B647BAB1D4CA
SHA1:	04A14702753898A5E9A071D5061380A7107185A5
SHA-256:	9FE7C35EE36391C5DB02C5FB1F2B5F36582D60141625BEB466CEFC3858382243
SHA-512:	A6A0F30BED1B757E950B67F7F384C745EEA9099C5B563A2C9BA0EFBD269892F7547181597CC84B0D348BEC200C8A802B385EC6544605497D65A2BBAB508DCF91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..............:... ...@....... ..............................<.....`.................................<:..O....@...............$...)...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................p:......H........&..,...........................................................".(......r...p.....r...p.....r...p.....r7..p.....rQ..p.....rk..p.....n. ....}.....r...p..(........0..............{....(.......(....o....r...p.o.....o.....(.........,...R...o.....(.......@.....r...p.o....(....r...p(......o.....r...p.o....(....o.................MN.@.....0...........s......o....~.........(....o....&.o....~.........(....o....&.o....~.........(....o....&.o....~.........(....o....&.o....~..

C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117512
Entropy (8bit):	4.398804678522216
Encrypted:	false
SSDEEP:	768:zS6zYgeCacDzpzYWaFltgIQY/01dsXbltgIQY/01dsXDkOnDCy+GqJXYyJehdDsR:VkqaChYWaGOnGy+DJXZeheiIp
MD5:	7EB4669E9C34E924EF4BA834ED2AC53E
SHA1:	6A4DDE52AE5447C31D9AE8F87BB667B9CDFB715A
SHA-256:	8B276658F47CCE169A4962D757876537D5377A3647AB704B7BD2D34A8843D640
SHA-512:	1D6DCECFFDACA9538C480AA544DD53D8E9C1C31AE5C2B29CB104705F5A263DD92CD51F58DBA3A2F15EFD3548F1A649C621AD490E0E61AB9B735A1DD179EC4E54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.................. ........... ....................................`.................................0...O........................)........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................d.......H........6..............................................................B.r...p..(......*....0..e.................o.....o.....(....s............o....(........,E...o...........,1..(.......o....r7..p(....o.......o.....(....&.....+............,h...o...........,%......o....r...p(....r...p(...........o...........,.....r...pr...p(......{.....o....&.r9..p..rm..p......o.......(....&r...p..r...p......o.......(....&r?..p....o.......(....&s........o....ru..po ...&..o....r{..po ...&..o.

C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23304
Entropy (8bit):	5.926986183066793
Encrypted:	false
SSDEEP:	384:WbdFrv/1TV/YmpwKNsehdD7FVKLVGoGCJEF8ZpH7WH:WbdN/1TV/sehdDiLtEFiRm
MD5:	32CB3DD682384A4585374DBD58ED9CC8
SHA1:	B6664135D6FA777C809A94FCD9116B8B75C070DE
SHA-256:	FAC088645652762E3D17030DDF4C580DE2DF795DD7B112AEFD9B2711209919B1
SHA-512:	18A921E3E19F79BCB1D811EFCC0F67CE16E9B492C08E2EAA9884ABC461B6057BFAE2F0A87D2C4A6FE4F68B0F84788803CA69E15011200D0DB51E6FCD1DB415C0
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............I... ...`....... ....................................`.................................<I..O....`...............2...)........................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B................pI......H.......t!...'..........................................................B.r...p..(..........0..............s......o....r#..p(........o....o....&r9..p.o....rK..p(........o....&ro..p......o.......o....&s......s..........o........o....o.......rz..po........o........o....&..%......r...p..o....(....r...p( ..................,...o!...................%................BSJB............v4.0.30319......l.......#~..........#Strings............#US..&......#GUID....&......#Blob...........

C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27912
Entropy (8bit):	6.497510671707344
Encrypted:	false
SSDEEP:	384:PNK/ILiaTHAcddZ9EPKaQEaSCSnDODpwKNsehdDvsMUGoGCJEF8ZpH6Bjy:PNv2+ddZHkrfzehdDUhEFiRv
MD5:	B70DA21B90C33C53B906A7E92D44B1FA
SHA1:	78EA464EF57938A1054CDAD10E81B2656CB99BD0
SHA-256:	1708ABB64D0D20A6C329896F9478ECA89ADC66CF6EF64D902DB4F0CEC1EFF18E
SHA-512:	2E0C16403DAC4668AC8C1A1C2C6F0064D5D92028E33FE573C631FBEA60E9CF70D640A8CEC7111DD67FA6B1446227FE51244F492A98303B674B09B7A11E37D700
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..e.........." ..0..<...........Z... ...`....... ....................................@..................................Y..O....`...............D...)........................................................... ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............B..............@..B.................Y......H.......D0..\|)............................................................{......{....V.(......}......}.......0..<........u......,0(.....{.....{....o....,.(.....{.....{....o....+... >.d. )UU.Z(.....{....o....X )UU.Z(.....{....o....X....0..b........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(.......0...........(.........}!.....}".....}#......}$.....}%......}'.........E................................+...}&...+...}&...+...}&

C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	348936
Entropy (8bit):	5.607734276704032
Encrypted:	false
SSDEEP:	6144:FFoth4pgZhXGyFd3URPTZG+aYtwIKDaP2/fZ5IQDIneQ:sURPTZG8KDIeQ
MD5:	34144750E202797BECE41B0E6B0B68AD
SHA1:	0A6BD4ECEA8254316996E8528D745B26CAA1630F
SHA-256:	592518CC77E90562964F4BA9DCF6DB7AC061A7D53AE4FE60F341781D52BB32BC
SHA-512:	6A095A98BBA41448510DC08EB226E4EEB55926F92F15DF8BFC0FE7BB35A39D72DF8F2F050F361ADF89F0DC6BF690188421A4625CE8C527B9A470CEEFC483846A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.."...........@... ...`....... ..............................f.....`..................................@..O....`..................)........................................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............(..............@..B.................@......H.......D{..X.............................................................{....:.(......}......0..$........u......,.(.....{.....{....o....+..v ... )UU.Z(.....{....o....X...0..:........r...p......%..{.......%q.........-.&.+.......o.....(......{......{....V.(......}......}.....0..<........u......,0(.....{.....{....o....,.( ....{.....{....o!...+... ..,. )UU.Z(.....{....o....X )UU.Z( ....{....o"...X*....0..b........r1..p......%..{.......%q.........-.&.+.......o.....%..{

C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16648
Entropy (8bit):	6.72188929894763
Encrypted:	false
SSDEEP:	384:eXqI/nXBZpwKNsehdDjUGoGCJEF8ZpHh9S8:ifoehdD6EFiRPS8
MD5:	4EEDDA870606568CEEF3EF66AFAAF58B
SHA1:	C684DEB636B3BCD8DD367CCBF0D26C561710D8A0
SHA-256:	0E9BE23727FAA117095D42E92A754A6817DF1F1AC1E61B45899BD6A820754666
SHA-512:	E4F66E694AE3018CF8280D72413A3047B35D62BE8C4C8E804AC223EA8D4F8C373CA22C1A4027004483AEF16269C4B5135C6B81C3653BE91BBD752CCA5C011D85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..e.........." ..0.............J.... ...@....... ..............................o.....`..................................-..O....@...................)...`....................................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................,.......H.......,"..............................................................".(......r...p.....~....r'..p(.........r3..p.......0...........rC..p(......((......(....-..(....-...o.......+....,;..~....(......(...........,..rC..p.(.....r[..p.(........+..r[..p(......+.......0..........ru..p.....r...p.....(.........r...p(.........r...p.....~....~....~....(.........~....r...p(.........~....r...p~....r#..p(.........r'..p.....~....~....(.............0..[.......rI..p.....r_..p.....r...

C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17672
Entropy (8bit):	6.655611864720354
Encrypted:	false
SSDEEP:	384:t5viAsQYDrHpwKNsehdDr0PGoGCJEF8ZpH2Iuqr:aQehdDorEFiRXBr
MD5:	C221B7F99CD9F49F9FA59EE3F6251FD3
SHA1:	90C3FC11A48902B24EB7EFAFE517A9C6F93115D0
SHA-256:	7F6B87909875F3305E3644D53B52B3B70E3E36D79DE67C70F8D1497A3ECE7B08
SHA-512:	F77360D687A05C2F06BD9BADEC0F1703DAC9026ABF2DC0AE0345ACE32829504880F845F2828889BC7560C8482D8AF88E87C19635571CFC6281BCB6B805DC038B
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e.........." ..0.............62... ...@....... ..............................f.....`..................................1..O....@...................)...`....................................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H.......x"..l...........................................................B.r...p..(..........0..............s.......o.....o....o....&r+..p~....rO..p(.......o......o....r...p.....(....o....&..o....o......8......o....t.........r...po....(......r...ps..........o........o........,......o ...r`..po!........rb..prh..po!.......rl..prh..po!.......r...p..o"......r...p..(#...o".......o$...:M.......u........,...o%.........o&......o'...&s(........o).......o...o+......rp..po,........o-..

C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79112
Entropy (8bit):	6.15522427214313
Encrypted:	false
SSDEEP:	1536:JPIoH7rzWjLZLK9S0dgV1ICCVDEeRmei3:JPIoHbkLZLK9SwgV6CgDEezi
MD5:	5AA3D546495B10201E6E34C1BBDE5544
SHA1:	E380F0EEDBCCCEA74EE6902695FDF4208BC73249
SHA-256:	86C15300329B30D8AFCCBEC6DA4A9C4961A95A9F1EDE88C8D510E048BE70E9FC
SHA-512:	C1EEFCEA1C856D0584BCBB3BC08F75E01D8A8E5AB19CEF9F9FF1ADD1E6DA1ED03E050F1F900C5E9B3FC953570DFADA9871DC8D9141FE483B956F2D5EB2B22F58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e.........." ..0.............."... ...@....... ..............................?.....`.................................@"..O....@...................)...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t"......H.......xz...............................................................{......{......{......{......(......}......}......}.......}........0..l........u......,`(.....{.....{....o....,H(.....{.....{....o....,0(.....{.....{....o....,.(.....{.....{....o....+...0..b....... r.(. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o ...X )UU.Z(.....{....o!...X*...0...........r...p......%..{.......%q.........-.&.+.......o"....%..{.......%q.........-.&.+.......o"....

C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	5.235481435245165
Encrypted:	false
SSDEEP:	48:3KGCrN0AA77k0JZZerd+Zeruzo6FBPJMZolNa44FoDoU:PBveoemDPh0ga4Rd
MD5:	E68EE5D235FF0F6284FAA8B190BEB004
SHA1:	EB3A28334C1E15080BC64B49C16C08FAB9B0F607
SHA-256:	6F2257A24675E4CE8C33E171A0AA0E314235F4E05FAAFEEE4006433E374875A6
SHA-512:	A007598D351731F8993F13B46786769B6A6C6EE713C3F09A17CAE38655FB4D219DA400FB7DC453D2ADEAFE5499D6E2C1F4F3429923EB6E6C9E3E23BA92C5D977
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>...<configSections>.... For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->....<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />...</configSections>...<runtime>....<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.....<dependentAssembly>......<assemblyIdentity name="System.Data.SQLite" publicKeyToken="db937bc2d44ff139" culture="neutral" />......<bindingRedirect oldVersion="0.0.0.0-1.0.112.1" newVersion="1.0.112.1" />.....</dependentAssembly>....</assemblyBinding>...</runtime>...<entityFramework>....<providers>.....<provider invariantName="System.Data.SQLite" type="System.Data.SQLite.EF6.SQLiteProviderServices, System.Data.SQLite.EF6" />.....<provider invariantName="System.Data.SQLite.EF6" type="S

C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	681736
Entropy (8bit):	6.193906258700221
Encrypted:	false
SSDEEP:	12288:pIrNxJLWVkK+dj2Uq/8IDkoOEewrA0tJiS0L+igdYVzMTWBi/mU4jkWj4IkzYNyl:6LWVkK+dj2Uq/8IDkoOEewrA0tJiS0LE
MD5:	5EDCB208C4FB0978E230B22D75078688
SHA1:	0533B1288E5735407481B5AD7942947C7634480D
SHA-256:	375E93EF5FD508A5D10CB3D2DB2090E20DFF39848732AFBA789825C61BD5E755
SHA-512:	DAD48E517AA0DDF7230D8E6E3671C742ED675DA3EDABEC52196092BDCBB8346D2520F537C8F5E4BB53A4C835814F11CC0257D6216F4B474569E6244FF7D2375D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I..I..I..@.0.A..W.0.K......R......A......J......L......E..I........[...\.H..I.4.H.....H..RichI..........PE..d....F/d.........." .........r......ab.......................................`......f.....`..........................................................@..H....0..$....>...)...P......`...T...............................8...............h...............H............text....V.......X.................. ..`.nep.....6...p...8...\.............. ..`.rdata..*c.......d..................@..@.data...p.... ...:..................@....pdata..$....0.......2..............@..@.rsrc...H....@.......6..............@..@.reloc.......P.......<..............@..B........................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114952
Entropy (8bit):	6.173929034038207
Encrypted:	false
SSDEEP:	1536:Z/KwfT4BizpeIL/F/VeU8rLVchFqS27zTeueiC:ZjMBgircjXizTeNv
MD5:	6A95DAE82BE413A5183B192DB13300FD
SHA1:	9C66ABC8E3B1F596537275B03513E303D028E939
SHA-256:	F49D7B099F5E26EBF7720E49B108D6E609183498C84505744705B3A8322DF9AB
SHA-512:	14B0A995E27154F11D3F4B2713B41FCB60C9C8C7D714DF61A7BDF7B5F021CC2B102187283F79FBF1225619BFFB840B7701BAC6585D36C59A88C0A19590EC7571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a............." ..0.................. ........... ..............................}.....`...@......@............... ..................................0................)..............8............................................................ ..H............text........ ...................... ..`.rsrc...0...........................@..@........................................H........... (.............................................................{...............................(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......0...........(......o6...(......o8...s....(......o:...s....( .....o<...(".....o>...($.....o@...(&.....oB...((.....oD...(*.....oF

C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28936
Entropy (8bit):	6.051800112431004
Encrypted:	false
SSDEEP:	384:7APEv8zdi/tciuqpwKNsehdDiiGoGCJEF8ZpHrV:EEv3mehdDXEFiRx
MD5:	A959BC93942264CAD80BB305BD87F196
SHA1:	A1DE27C30F2F7B199B61B349339EB6AC5F2256D0
SHA-256:	0254D20F82AAC6FB9F5E4DE3CCF92C5D0F1FAB100C37B746193F423C3DAFD095
SHA-512:	49DCE12921543F8D4A143B1F9A7E696F90865485A78D37481506BBA06759CFFA5C1F5F3EA8B877F3DD0C33321EFBEBFAF1CF966F657CE72BA96CA2E433562BE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..@..........._... ...`....... ....................................`.................................d_..O....`...............H...)........................................................... ............... ..H............text....?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................._......H........)...5............................................................{......{....V.(......}......}.......0..<........u......,0(.....{.....{....o....,.(.....{.....{....o....+... `v.. )UU.Z(.....{....o....X )UU.Z(.....{....o....X....0..b........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(....B.rq..p..(........0..d.........s........o.....s........o.......@.....r...p.o....(....rq..p(......o ....r...p.o....(....o!.......

C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44808
Entropy (8bit):	5.7458808138177195
Encrypted:	false
SSDEEP:	768:3DJaUVsuI/9il4xnVlyNwBvbehdDJgEFiRk:bVsN5NVlBe5gei2
MD5:	E1AC02C25943F78365F4AA42680CCAA0
SHA1:	B928F53EAA00C7E1A86B4F0FF8C3E5710AC04ABF
SHA-256:	B20B27AA0F539B6AB5DED16D397B10853AC8A80515C0F71AB1696FFD2FD87490
SHA-512:	2FF2DCDDE7CAE99A83D298BE6784D164B8BBFBE5191789F9AC98E3C5FE78AAA1F6D3D82BEADAF90921B611BD6C52B7116C048FE51B7BD3B848546115180E1B3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..~..........^.... ........... ..............................!.....`.....................................O........................)........................................................... ............... ..H............text...d\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......0@...[..........................................................".(.........0.............!...}3......!...}4....(..........}0.....}1.....}5.....}6.....+...{3.........X.......-..#........}7....#........}8.....}9....\|............{....}/.....0.............!...}3......!...}4....(..........{0...}0.....{1...}1.....{5...}5.....{6...}6.....+...{3.....{3.........X.......-...{7...}7.....{8...}8.....{....}......{/...}/.....}9...*.0................{0....{0..........,.....8.....

C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34568
Entropy (8bit):	5.270629610111939
Encrypted:	false
SSDEEP:	384:vskL8aVbb/ByvDxYqapwKNsehdDLivGoGCJEF8ZpHui:vsk/rByvDxY2ehdDGLEFiRh
MD5:	E432ED015B0C4C6342305B63A512CE6D
SHA1:	01EAC242DFC3FCC87B135E14EBED9B77290F4672
SHA-256:	DD0939B48C36DAE5149ADED267AB972037ADA6AB3936AD4368A21D74F1735878
SHA-512:	0F7BFFFFAC100371D6A25E62DE2AE822984D09DB4DEA91CDCDA21608240B68D8321037A813AA962B1869E0EF42AF23F4E72F0D58BD05DE70325BFCA4B3A98E81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..V...........u... ........... ....................................`.................................Hu..O....................^...)........................................................... ............... ..H............text....U... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B................\|u......H.......H#...R..........................................................B.r...p..(..........0..............s......o....r3..p(........o....o....&rY..p.o....rk..p(........o....&....o.......o....&r...p..r...p......o....&....o....&r...p..r...p......o....&....o....&r-..p......o....&r.).p..re.p..r...p......o....&....o....&....o....&re5.p..rJ6.p......o....&....o....&ri8.p..s.........o......r.F.p..r>F.p....o....rNF.po....&..o....rdF.po....&...o....o......+{..o....t.........r.F.po..

C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	6.5789721513496255
Encrypted:	false
SSDEEP:	384:+R8ZRfl54Ov9ngwpwKNsehdDD0FGoGCJEF8ZpHoULa:W8jHF8ehdDw9EFiRrLa
MD5:	EC58C01ECBC4A3ACD5997592ACA7CFB1
SHA1:	FB74B19162456315F850DDE63E15B22CF4B95828
SHA-256:	20D514D257A2B39EDB9163F0D2452C39BE3FF2E7CF9DABB41C36CE7C5D3DDC5D
SHA-512:	1C7A3EC090D3049F2F7A60BE854464EB6F598BF86F177718AB199037EF808607A195732E2C86A3292257FCA5677C40DEFB574B87AA0735C82CF98EBD838D8E47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{..e.........." ..0..............6... ...@....... ...............................V....`..................................5..O....@............... ...)...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H........#..............................................................B.r...p..(..........0...........~.....Y.....~............,Y..(....o....o.......0..+.........6...o.....r)..p....(....r...p.o....(....o................(....(........,...o.....r...po........+.~.........+..............!>.6.....0............,..o.......+....,..rd..prt..ps....z.o.....r...po.......(......,....(......+#..o.....r...p.....(....(....o.......o.....r...po......0.............(....r...p( ....+....0..

C:\Program Files\Intel\SUR\QUEENCREEK\DttEtlAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35592
Entropy (8bit):	6.356846934894977
Encrypted:	false
SSDEEP:	384:fye7E/3hfcjdokzbi7nJ9Tx+5E8YhkKRT0548SdHiXHqrnnRpwKNsehdDAlkGoG0:WmhokzboJ9tfBCarnOehdDVEFiRkO
MD5:	F3C46D7C38116ACB39521E4E8249BD73
SHA1:	6EFCDEF85D71F4F6F2EBD699E47555A11FEB29F2
SHA-256:	C3D78769ED2AD7DA45479C5E679061F7FE60BF881B415AB0E88B37C305FBE86F
SHA-512:	ADDF2A26A5E8B81C1440FDFB0F2A616406048CFA3B725752E55671BF5D2B562821ABF5C700F1BB202B8442CF7E3BECA6914CF729120252A439B6B2C95DE1541A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..Z..........~x... ........... ..............................C.....`.................................,x..O....................b...)........................................................... ............... ..H............text....X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............`..............@..B................`x......H........>..P9............................................................{......{......{....r.(......}......}......}........0..T........u......,H(.....{.....{....o....,0(.....{.....{....o....,.(.....{.....{....o....+...0..K....... .Y.. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(......{ .....{!...*..

C:\Program Files\Intel\SUR\QUEENCREEK\EntityFramework.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4992776
Entropy (8bit):	6.099003162124185
Encrypted:	false
SSDEEP:	49152:BPrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vbu:xnt8zi8o5jX24Y/fmLaZv7xK
MD5:	8819FA05AF53DFFB14718BE942E0CCE8
SHA1:	633E9BE50826C4A1FBB49A68F0BF7EE749069E82
SHA-256:	DA1F829894575F6171D0B7FF1222EAE6C6D93F1E144F08873878E8A7C10EF046
SHA-512:	4E8A2DCD96C40A15E73C76EF2459D62B0999204286DEE261A902E5C65C29CBBFE3AD9693858B68C352FF2D2F813D8B0923D3B9E6DA096F698AD9DAB485D2ADB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0...K...........K.. ... L...... .......................`L......AL...`...................................K.O.... L.$.............L..)...@L......~K.T............................................ ............... ..H............text.....K.. ....K................. ..`.rsrc...$.... L.......K.............@..@.reloc.......@L.......L.............@..B..................K.....H.......T0....).........l.A.....d~K.......................................{).....{...V.(+.....}).....}......0..;........u......,/(,....{)....{)...o-...,.(.....{....{...o/..... dL.. )UU.Z(,....{)...o0...X )UU.Z(.....{...o1...X.0..X........r...p......%..{)............-.&.+.......o2....%..{........z...-.&.+...z...o2....(3.....{4.....{5...V.(+.....}4.....}5......0..;........u......,/(,....{4....{4...o-...,.(.....{5....{5...o/..... ...z )UU.Z(,....{4...o0...X )UU

C:\Program Files\Intel\SUR\QUEENCREEK\EventLogCollection.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34056
Entropy (8bit):	6.307370984237071
Encrypted:	false
SSDEEP:	384:I0pXud98ioOmHuLxdZoZ7gnMFsmGB2pCx3oPivrj4h0QXpwKNsehdDaTyGoGCJEA:dq98MVoZ7gMfNClgyehdD6wEFiRus
MD5:	9816B1427DBED94746C208BCAB7F30CC
SHA1:	D8374F15CD22EF547CC9E405B28FC8C684CAE748
SHA-256:	C6CAD8C4E852E639382CA4471C0A64852B972AA0319AAB5EDC826F645703C309
SHA-512:	A4E9150580A7A88E848D4E1485EF2B189D73BA6EA9D91DAD89CDF9A4A4052901AABB5B3241FDAE61497B152F9A5B8380BE3C43CFCBBFD03BA9D8A4090AD777F6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..T.........."s... ........... ..............................T.....`..................................r..O....................\...)........................................................... ............... ..H............text...(S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........4...=...........................................................0..L............s...........(....s.......o....t........,..o........r...p.(.....s....z......... +..........56.......0...........~....%-.&s....%......+..&.(.......0............s......o.........,.rG..p.(....s....z.o......{....,&.{.....o....,..,....{....(.......+..+....,....(....}......}......}......{......+.......0............,..o ......+....,..s!....+...o ...s"....+...r...p........0..1........~#....~

C:\Program Files\Intel\SUR\QUEENCREEK\FPSAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67848
Entropy (8bit):	5.179015167833709
Encrypted:	false
SSDEEP:	1536:zBN7tbu+NfPMgLs3kPvsr/ifAMU/nfAMU/xfAMU/qOfAMU/XkzfXEmTYuGB1u2vT:zBhtpZWeA+
MD5:	C32B90DE842685953ADAEA797B2975F3
SHA1:	6FE4BFD2E61C0007EA6B5DC433382DB7A90DDF08
SHA-256:	49C57A6A27B6A07219DF3F0963B2FF219B4ECFF2862A7424524079CD67699338
SHA-512:	7BF1AEA48BB92953CF793ABDD1CEF892ED96EA583AB57EC7D132E6F50E4BC791D4D9C2018FEF9A828D5033395B6E17BD47C99F7EACC4EC25C22B3ABB20CEFB22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............F.... ........... .......................@......D.....`.....................................O........................)... ....................................................... ............... ..H............text...L.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................(.......H........A................................................................{......{......{....r.(......}......}......}........0..T........u......,H(.....{.....{....o....,0(.....{.....{....o....,.(.....{.....{....o....+...0..K....... F... )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(....B.rs..p..( ......

C:\Program Files\Intel\SUR\QUEENCREEK\FgndBackgrndAppsAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29960
Entropy (8bit):	6.349917330180397
Encrypted:	false
SSDEEP:	384:excnv9jQTGzYP0lCEhe/7sGqWYQebjQpwKNsehdDHHGoGCJEF8ZpHzm2:BBfIvsGobRehdDzEFiR/
MD5:	D5E3E9BB2B0F1254B1DA6417878F4673
SHA1:	0710760026B33E96EDD5AFF461790F901C6011AF
SHA-256:	C8A6961BEFB437445E6DACC60FD3CEE52F6B83E962D1499E27D89B526D215AAF
SHA-512:	BFD4F8EB6C3BE79CD292AAE2395D5DF858AF807A0375BACD3008ECBAA02DFF5478052DC2573023BF31E9ABB0FF4BAF568D2EC467A37C227DDB9D1EA36A3F63AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..e.........." ..0..D..........jb... ........... ..............................,.....`..................................b..O....................L...)........................................................... ............... ..H............text...pB... ...D.................. ..`.rsrc................F..............@..@.reloc...............J..............@..B................Lb......H.......P4...-...........................................................0...........s....%r...ps....% ....o.....% `...o.....%~....o.....o.....%r...ps....% ....o.....% `...o.....o.....}.....s....%r...ps....% ....o.....% `...o.....%~....o.....o.....}.....r;..p..(......*....0...........(........o.....o....s.........~.....o.....o.....{....#.........o............., ....ru..pr;..p(......o...........o ...o!............., ....r...pr;..p(......o............!&....ru..pr;..p(......o...

C:\Program Files\Intel\SUR\QUEENCREEK\GenericSqlATLSupport.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21256
Entropy (8bit):	6.5661051657110825
Encrypted:	false
SSDEEP:	384:fAuCT7TUjkmX2hA/cjJtCqrkpwKNsehdDP3gGoGCJEF8ZpHx/0:oucUjkmZc7dehdDyEFiRu
MD5:	DEF6B7D67DE7344555417111B63CF7B9
SHA1:	76C2AC82EB826C960FCCF5D7B0B9E6CC394B846D
SHA-256:	769A3DC872FFDCF5323B17F9DDEF82FA2E55BD40176601B262D022D118947484
SHA-512:	D8875E26E2D446E6EDBBAB9855F34B27D3A0682A415230FB1A8CA6667CAABC2A8B605AAF043A6262E06BA23793382ADC6ADDC9487CB9B75423750788ACF40868
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!..e.........." ..0.."...........A... ...`....... ...............................r....`..................................A..O....`..................)........................................................... ............... ..H............text...."... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............(..............@..B.................A......H........'..............................................................B.r...p..(........{...."..}.......0..;..........(.....(....o....&r/..p.(....o....rA..p(........o....&+...0.............(....o.....o....&..(....o.....o....&..(....o.....o....&.(....o....(....-'.(....o....(....-..(....o....(.......+....9.....s........(.....re..p.(....o....(.....r...p.(....o....(.....r...p.(....o....(.........o....&...o....&....o....&....,..o.......+...(.....r...po..............k.......

C:\Program Files\Intel\SUR\QUEENCREEK\HWMetaTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36616
Entropy (8bit):	5.705258791425713
Encrypted:	false
SSDEEP:	768:elPqErFLvNIklToWziVd9lmLehdDBHEFiRfK:2PqEBLvNImZimLedeiM
MD5:	2852CBBD1D1B7E607BDEB4A74298899F
SHA1:	8AF6E6468E2A0961713531F350EB47073462D88D
SHA-256:	B12E110089EB4C3A177560CF298CB83084CD941798D020DD9C19C25C7B9A5702
SHA-512:	E9FA3E9CA4216A6774FD39991149B54A330FA69BE481CF6D93EB88167CD6516EDA6167867648238F3EA2C2036365A76FEA7EB4D892B4622DC6C8A4D4002ECD60
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..e.........." ..0..^...........}... ........... ..............................wo....`.................................\|}..O....................f...)........................................................... ............... ..H............text....]... ...^.................. ..`.rsrc................`..............@..@.reloc...............d..............@..B.................}......H.......d1...L..........................................................B.r...p..(..........0............s.....s.....s.....s........r...po........r-..po........r?..po........r_..po.......C......r...p..o....(....r...p(......o.....r...p..o....(....o...................TU.C......*..0...........r+..p.s........o.....o....o....&....o.......o....&s.......o.......o....o.......o.......o.......o ...&..C......r...p..o....(....r...po......o.....r...p..o....(....o...................,...o

C:\Program Files\Intel\SUR\QUEENCREEK\HWPowerStatsTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40712
Entropy (8bit):	5.922674557415976
Encrypted:	false
SSDEEP:	768:6fE3fgPUXgfE3fgPUX7IfE4qnIUhMNQfE9Z9A4qnIUhMNGLiK0rrwuictoehdDV5:6fE3fgPUXgfE3fgPUX7IfE4qnI+MNQfC
MD5:	52274B5F2B138BCB402EE6678CCC01DB
SHA1:	FFDA24523BF2A75EA35820FE0C182D4BEAC3A614
SHA-256:	B8C6666B3ED0D543BA7D52AA0E0CEE678EB2A3722FD15F6B3B9EA0E879FBEC16
SHA-512:	EAEBD5B1A3AC93270422AB7460713B6E6F5F5F8A774AC4FA9B17C43CA71166348BEF462E6B149382A5F7CB4188C5D83350077301339C3697C32A3D444781781A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..n..........2.... ........... ....................................`.....................................O....................v...)........................................................... ............... ..H............text....m... ...n.................. ..`.rsrc................p..............@..@.reloc...............t..............@..B........................H........B...J...........................................................0..m..........(......s.....s........+_....o.......o.....o.......o.....o.......o.....o.....o.......o.....o.....o....(....o.........X.....o.....i......-....o.....o.....o....(....o......o....o...........,...o.....r...po..........o.....o....o....&s........o.......o....&...o........o....o.......rE..po.........o ...&..$....o.....rq..p..o!...("...o...................,...o#.......*...A4..........'...0...$.......

C:\Program Files\Intel\SUR\QUEENCREEK\HeartBeatAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51464
Entropy (8bit):	4.439028500934878
Encrypted:	false
SSDEEP:	384:EGg/9tItByNmebWNWEMWpwKNsehdDpyt0GoGCJEF8ZpH7v4:nRByNmyWNW7ehdDItmEFiRU
MD5:	F11331038CEF04E779621141C15A4555
SHA1:	5C929532B2CCD272A1F5E179E53EB6E43EED7305
SHA-256:	33FA95930277BACD4BC4CB77909BB3DFDBF4EB390529D53CE0FBB5B66347FDA4
SHA-512:	CC910D6C6277F854CD7A4B4D258E5B36E78825BCA7152F83A4336B565847401E093D34DFE24FDAD0D53DCBD682C18B50F445BE924673AF7CFFE70033F305CD7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(..e.........." ..0................. ........... ..............................y]....`.....................................O........................)........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........#..p...........................................................B.r...p..(......*....0..s...........s......o....r-..p(........o....o....&rM..p.o....r_..p(........o....&....o.......o....&r...p..r...p......o....&....o....&r...p..r...p......o....&....o....&r!..p......o....&r.).p..r.0.p......o....&....o....&r.U.p..rm].p..r.c.p......o....&....o....&....o....&r7h.p..r.h.p..r.i.p..r.j.p..r.n.p......o....&....o....&....o....&....o....&....o....&r"o.p..r.o.p......o....&....o..

C:\Program Files\Intel\SUR\QUEENCREEK\IntelFgndAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	6.716974810372372
Encrypted:	false
SSDEEP:	384:KWV4JSuvrmpwKNsehdDPyzpyGoGCJEF8ZpHVCY:ZV4HehdDKlwEFiRF
MD5:	45D3219970B963389042E018DE207A73
SHA1:	41FB3003154307932BFDF9C8621D3EC2B93F4651
SHA-256:	D97B5F47547A9FA5391C0CC34F39F7E7FCA2C9D704874C42907D9A821990C0C9
SHA-512:	56AD14BAB0D6A4E806D2B0F4DE06127A980CAC1737F7CB17A0A7D953509CB0F69D27A22B7498934C85138663D35A74C7FAF0AFF71D7595225D85F29434EF0458
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..............7... ...@....... ..............................F.....`..................................6..O....@............... ...)...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................6......H........$..............................................................B.r...p..(......*....0..................s.......o.....o....o....&(......~.....o.....o....o...............,.....r-..prq..p(......F....{...........,T..~.....o.....o.....{....#........o.............,........{....(......+....o.......+....o.......o....r...p.#...(....o....&..o....o......8......o....t.........r...po ...(!.......r...po ...(!........j......,/...r...p..vl#.......?Z..vl[.("....#...o#.....+8...j.....

C:\Program Files\Intel\SUR\QUEENCREEK\LICENSE.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17652), with no line terminators
Category:	dropped
Size (bytes):	17692
Entropy (8bit):	4.882802627437235
Encrypted:	false
SSDEEP:	384:X48ppJhXmjh6YDrDlKNdZtfMreRaVbfT36hD5s61TO:X48pfZK6YDfELKCo53695P6
MD5:	5ACDF6F167F4AF42D0E04A0F4CD0D2D3
SHA1:	BB22F780CABF835F41AFCF74F8570BA4725B3F08
SHA-256:	EAB09AD7512D63A72C9A7EAD089D9B8E164BC8174A6BA21AE6064A1E9A7E52E8
SHA-512:	7CEEA4F45C3A0ECC02EBECA18F56A54C0A5FD3A8D143C037029F674AE4DA9CECA27D7B7F067225FD2E3FBFCD67906BB845DCA29B6ADFDD7A4C9E67AE7ED5F518
Malicious:	false
Preview:	INTEL SOFTWARE LICENSE AGREEMENT (OEM / IHV / ISV Distribution & Single User) IMPORTANT - READ BEFORE COPYING, INSTALLING OR USING. Do not use or load software from this site or any associated materials (collectively, the "Software") until you have carefully read the following terms and conditions. By loading or using the Software, you agree to the terms of this Agreement. If you do not wish to so agree, do not install or use the Software. Please Also Note: . If you are an Original Equipment Manufacturer (OEM), Independent Hardware Vendor (IHV) or Independent Software Vendor (ISV), this complete LICENSE AGREEMENT applies; . If you are an End-User, then only Exhibit A, the INTEL SOFTWARE LICENSE AGREEMENT, applies. For OEMs, IHVs and ISVs: LICENSE. Subject to the terms of this Agreement, Intel grants to You a nonexclusive, nontransferable, worldwide, fully paid-up license under Intel's copyrights to: . Perform, display, distribute, and copy the Software internally for Your own dev

C:\Program Files\Intel\SUR\QUEENCREEK\NetworkBandwidthAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41736
Entropy (8bit):	4.654094002375981
Encrypted:	false
SSDEEP:	384:e5TPBySUEWOT0rryI6Nvrrrlgdzhw5dpwKNsehdD0LGoGCJEF8ZpHkt0Vpg:4ByDOT0S35g5OSehdDOEFiRDV2
MD5:	27E60057E3B47F9F3F4096A415913D66
SHA1:	9CC2186A916C70D7CAF9922D2D99B967153773E9
SHA-256:	070A7B3CE4539E506BB52594BD478107F5DC0967B389FDAD26D2F8A6895F7CA9
SHA-512:	70D428B16CA76FA668954DC6616E10477294F0D936415456D2757A8E6226241C2EE8C91C075EB0BC55A7E9664454F0B9EB719C230C3F9BE14400BF2399B5EBD1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<..e.........." ..0..r............... ........... ...................................`.................................<...O....................z...)........................................................... ............... ..H............text....q... ...r.................. ..`.rsrc................t..............@..@.reloc...............x..............@..B................p.......H........!..ho..........................................................B.r...p..(..........0../...........s......o....r;..p(........o....o....&ri..p.o....r{..p(........o....&r...p.r...p.....o....&....o....&r...p..r...p......o....&....o....&r=..p......o....&r,).p..s.........o......s.........o....o........o....o.......r!e.po..........o....&..%......rSe.p..o....(....r.e.p( ..................,...o!........A4..................%...............................BSJB............v4.0

C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32520
Entropy (8bit):	6.364711729041386
Encrypted:	false
SSDEEP:	384:4hV+hlsc1djFdcEEvFS3adLrvb+IJ/KpwKNsehdDS7EKGoGCJEF8ZpHnaRm:4hVu1PdAvF964nehdD+EFiRh
MD5:	502E4E5E893FDD6A9AF125559A6D38DA
SHA1:	6682CB287EB8834BA54BF73BEDDFA860D130E1A6
SHA-256:	A6664C8D8324C1E7E1BF48301B643E7A5A1CFDDAC1178970C8F4CEED001FEE79
SHA-512:	B18CC7A25D62C45683176A1A5571768E76540A1D5F748E37DD9A02A4663D676DAB303EC33F6C56CF00C2944057137D32206430F5183F7C0D8A43B4463E32B868
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..e.........." ..0..N...........k... ........... ..............................u.....`.................................0k..O....................V...)........................................................... ............... ..H............text....L... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B................dk......H........3..L7............................................................(&.......{...."..}.....0.................,..r...pr...ps....zs.......o.....+?.o........o....{....(.....(...+.($....s........o........o.......o....-....,..o........(.......(............(.Ks.......0............s......o......0..l.........(......,..(.....rK..po.....~.....+E...4...%..:.o....(...+..(......, .(.....r...p.( ...o.....~.....+...+....{...."..}....*....0..Y...........5...%.....(!...}........

C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	5.152084530360732
Encrypted:	false
SSDEEP:	48:3skN0b74g0YGZeru+ZerMEoBF0PJMZolIt44FBoX:cNcexet6mh0bt4yE
MD5:	16F805E23865423BC2171A0B5A202B97
SHA1:	3706BA831957257832B235C0BA14E83B35D51318
SHA-256:	231FEE71C7E9B5EDFB9029CF59DFB0EFE3E3D3292FC5219E2F3821C5829EEC44
SHA-512:	06FA7FD29628C3163C504D8619A0D1F5FCCB3D87347FDAB833008B86896AD5179AA340F1531EBDF9F88502B5472F8ADA3C4E9C6FA6CE081B9E60510ED0997633
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->.. <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />.. </configSections>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Data.SQLite" publicKeyToken="db937bc2d44ff139" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-1.0.112.1" newVersion="1.0.112.1" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>.. <entityFramework>.. <providers>.. <provider invariantName="System.Data.SQLite" type="System.Data.SQLite.EF6.SQLiteProviderServices, System.Data.SQLite.EF6" />.. <provider invariantNa

C:\Program Files\Intel\SUR\QUEENCREEK\OSSystemAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38152
Entropy (8bit):	5.261915208442192
Encrypted:	false
SSDEEP:	384:rtPmS13TW4vZFm1TBygg+S4Ak2OQpwKNsehdD03aiGoGCJEF8ZpHDPYT:rtPmSBBfGTByzZqehdDJAEFiRjYT
MD5:	88D319C3EC4F663A8791A634CFAAA661
SHA1:	808FEE4E7EB898F268951C3D44B58F0AC0369DAC
SHA-256:	10C711DACB7CA7819D4CECAF439753C86216D07D8BDB6AF84927C3F377B36FA7
SHA-512:	DE6621DC0766143D398DE4CACC5FD23C4539B51F5A163A44F2E4F91828C03D312AC3F9A0317541786FECF9D829C1ED706145FAD3C71055E29D580358A367123D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I..e.........." ..0..d............... ........... ....................................`.................................@...O....................l...)........................................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............j..............@..B................t.......H........0...Q..........................................................B.r...p..(..........0................s......o....r+..p(........o....o....&rI..p.o....r[..p(........o....&r...p..r...p......o....&....o....&r}..p..r...p......o....&....o....&r...p......o....&s.............%.r.).p.%.~.....%.rB).p.%.~.....%.r9.p.%.~.....%.r(+.p.%.~.....%.r',.p.(.............%.r.).p.%.~.....%.rB).p.%.~.....%.r9*.p.%.~.....%.r(+.p.%.~.....%.r.7.p.(..........o......s........o....r.A.po....&..

C:\Program Files\Intel\SUR\QUEENCREEK\PhatAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20744
Entropy (8bit):	6.081113939795651
Encrypted:	false
SSDEEP:	192:GfOD6LujYSpPIKfhig1/C5VgfhakDK7KqNGoGCwgEfV2oEhZnpHxEmVOy:FGGYSpwKNsehdDK7K4GoGCJEF8ZpHfb
MD5:	3C80BF1888EF3CFC88A2A7B2B7A9BD79
SHA1:	D383AFBFB6E3FFC23AA367D9D57F38973FB998AC
SHA-256:	1E6FE61C70826B814FC10D78EC6B9C453140E613A03D9D30205F90EBC5413025
SHA-512:	AE77FF3CE1FACF99A47059BE541E55DC124F4964A8D2104AAFA52272B9474ACEE2BEA439142CD148E4AB8276E37AC5193D68A6A4D3AC886B49776E3612F37157
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e.........." ..0.. ..........>... ...@....... ...............................Y....`..................................=..O....@...............(...)...`....................................................... ............... ..H............text...0.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......X!..............................................................B.r...p..(..........0..............s.......o.....o....o....&r#..p.....o.......o....&........,...o.....r...po......vs.......o.......o....o......r...po.......o.......o....&..$....o.....r...p..o....(....o...................,...o........*............$................BSJB............v4.0.30319......l.......#~..........#Strings........0...#US.........#GUID...........#Blob...........W..........3................

C:\Program Files\Intel\SUR\QUEENCREEK\ProcessAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49416
Entropy (8bit):	4.499979159703394
Encrypted:	false
SSDEEP:	384:rwyqhGmyeGBy+oSdAopuo9oFV3mpwKNsehdDxJOvGoGCJEF8ZpHXmuwg:M2BBy+oSdJ2ehdDrIEFiR2pg
MD5:	CBC162252065ABDB0B4160DA97B3F01E
SHA1:	DDE6AFD4D61EF9F594DA157190D2FD44BBBCE2F0
SHA-256:	65B5FCB5775D364580D93AAC785FB9D74408B1BFC0CD82A648C578775994388B
SHA-512:	FD86002FA28A63642B83EBFD0D1ACF6BD6C01EB284748395476BA1B6DA79D0CBAB8190F105F4B1176F17ACBC39306A4A06395D3DC0E2BBA8C629340801A4252A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P..e.........." ..0.............^.... ........... ..............................a.....`.....................................O........................)........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......D#.............................................................B.r...p..(......*....0..p...........s......o....r)..p(........o....o....&rE..p.o....rW..p(........o....&r{..p.r...p.....o....&....o....&ry..p..r...p......o....&....o....&r...p......o....&s......r.).p.....r.~.p....o.......o....&...o........o....r.~.po....&..o....r.~.po....&...o....o......8......o....t.........r.~.po....o .........o!.......,....o".......o#.......($..........,>....(%.......r.~.p..o&...o'....

C:\Program Files\Intel\SUR\QUEENCREEK\SleepStudyAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20232
Entropy (8bit):	6.546627262745822
Encrypted:	false
SSDEEP:	384:ToSIXQcgNNa8E1QNLCFh68juH0pwKNsehdDmrcvGoGCJEF8ZpHmwAtdj:j2gNc8zWShehdDnLEFiRc/
MD5:	D7ABD87E9C3A5DBDDBB88AEC14297ECB
SHA1:	0A68C34C8F7C49E58A7376ECA8197E508C48F1B8
SHA-256:	72C7C965FE75BDB5AF6DE750089841F09E2B600B00589278D93595FEBE9C2A2D
SHA-512:	D48E67A9C91EADC6A0F9919CF8496D7ED976BD64FCA380AEE15415EDC9D041F98F4B9997A1E45FC893430FC85FB98ACAB3770A3E308A464EA31D1E86C91EDC26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............b<... ...@....... ..............................A.....`..................................<..O....@...............&...)...`....................................................... ............... ..H............text...h.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B................D<......H........%..0...........................................................n.r...p..(.......s....}....*.0...........(....o....o....,4(....o....o....o....,.(....o....o....o....o.......+....,.....r/..pr...p(.....8....(....o....o....,7(....o....o....o....,!(....o....o....o....,..(.......+....,.....r...pr...p(.....8R....o....r...p(........o.....o....(......(.......(......(........,.....r...pr...p(............(......o....rC..prK..p(.......o......(........(....o....o....o.....(....( .

C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	206600
Entropy (8bit):	5.708063992323481
Encrypted:	false
SSDEEP:	3072:4cixUhBrf72T1dpoAaKdHG1UbzyYEFjY/0KmgJ3Xj2Vj2JheAq:jZfiHrHG1Ubzy/iHAsheF
MD5:	10CC7CECBD5509D498B49DB1EF448115
SHA1:	FE16BAEA8F7DBAFB5E5B1A03B49DA2ED92E39DFC
SHA-256:	39617AFEC4658E8538640D10F2F1A25F40813E59376EDFBCD1609036BE7981D3
SHA-512:	6A687148147C354AE7A6A0EADE71FCE516E5E1A5CA988E2491A1E3B0CDE26C39264864E336CF37C50C103EF1DC423F8091B1299356BF95219A6F4BA7008EFEDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........."...0.................. ... ....@.. .......................`............`.....................................O.... ...................)...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......h).........4...0....0............................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....

C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1894
Entropy (8bit):	5.2546246214715335
Encrypted:	false
SSDEEP:	48:3KGCrN0AA77k0CtBZerd+Zeruzo6FBPJMZolNa44FoDop:PBQleoemDPh0ga4RU
MD5:	B202F161A5C6891FB780A1719BA5F066
SHA1:	E0F37FEC6472B1DD89805FF800886C7B84209F12
SHA-256:	56FCEEA5F3347B7C8E3AE874C6934E1B6A036BB4598C7763C8B52BDBFE0A546E
SHA-512:	CEEDFAB7B68BCFE6521FA5D4EBB49F2EDFE6004A110DE88C7A5A3F98DAFEA0396941C0C8A915073B750121C003EA9B90B19C3439F96840169F831D19DBF2C89F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>...<configSections>.... For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->....<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />...</configSections>...<runtime>....<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.....<dependentAssembly>......<assemblyIdentity name="System.Data.SQLite" publicKeyToken="db937bc2d44ff139" culture="neutral" />......<bindingRedirect oldVersion="0.0.0.0-1.0.112.1" newVersion="1.0.112.1" />.....</dependentAssembly>....</assemblyBinding>....<AppContextSwitchOverrides value="Switch.System.Net.DontEnableSchUseStrongCrypto=false;Switch.System.Net.DontEnableSystemDefaultTlsVersions=false" />...</runtime>...<entityFramework>....<providers>.....<provider invariantName="System.

C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.EF6.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	195336
Entropy (8bit):	5.958676725774195
Encrypted:	false
SSDEEP:	3072:2Nh7rncCmjLf59v+I1XugZc6KP8cIeeSR:2b7zmjD59x+Z6KP8c5eE
MD5:	780FA7F370EAF481866BCAB66795C876
SHA1:	5700107E0A85FA48B985B70C5B4EB49FC80705E8
SHA-256:	E8968F62CE59CF362F91E3B36C64DCF87F013922DB5DF1222DBF16F600871D8E
SHA-512:	4F687B8DE9A36361EABD4F29374B5870EFC012B5409BA57822FE94CCC5E567D2F59DE6AEF88C4CBCF045DE105008D16B62AB380D43BF00C1725702B055165F76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..0.............N.... ........... .......................@............`.....................................O.......X................)... ....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...X...........................@..@.reloc....... ......................@..B................0.......H........................W..p...D........................................0..,.......~....s .......o!......r...pso.....r...po"...&.o#...o$....o%....o&...&...r/..po"...&.o'...o(....+A.o)...t.....,...+..r9..po"...&%o....o%....r?..po"...&o+....o%....o....-....,..o......,.........os........o,...o"...&.rG..po"...&.o&...&.rQ..po"...&.o-....o%....r_..po....&....o!....(......op...Q.o/...*......_.M........0..n.......~....s ...%..rc..pso....%r...po"...&.o#...o$....o%...%o&...&%rQ..po"

C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	392456
Entropy (8bit):	6.074235773705752
Encrypted:	false
SSDEEP:	6144:vHABaZr57Zfgk1i2RiZ0g+kzAHCapWW2Mpd9oXJ93Ta/p97iNsNL4rfiBCFNFfc2:IkZr57r1i2RiZGkzAHCapWjP7jsNLpBA
MD5:	454B3DCF443929C5FFE9FC855B9CAAD3
SHA1:	72C67985A0BA79B019739A996A7799E2A7EF4BA7
SHA-256:	FAFABB88D08576B6A771A38047D4273C86E27C22D220D7360C8B9FD8FFA4D6E4
SHA-512:	E3CDE1EDAA940588935A1619CF38A2C2A1E9F55CC59F4406EB132E0D5C63D03727A76FC17B85230C4BF8DFA4C0AEE6D7CA56D838E8D1654A4BA9C02F991444F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..0.................. ........... .......................@.......j....`.................................\|...O.......$................)... ......D................................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc....... ......................@..B........................H.......h8..............tU..P...........................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(.....(.....(.....r)..p.(........(_.....~;...(<...,z.....s....}.......}.......}............{............%......(=....%...D....%...!....%...%.........%....%.........s....(/...vra..p.(....,...}......}......{....vr...p.(....,...}......}......{....z.{....,......(=...o>...s?...z.0..(........{....-..(......o....&....(^

C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24840
Entropy (8bit):	6.540541575886181
Encrypted:	false
SSDEEP:	384:rmbq+UEonbrtf8n/H08veJpwKNsehdDpmc75GoGCJEF8ZpH9wz:uF4nbeU8PehdDX9EFiR6z
MD5:	97788704ABD8FBF9C00A28CA3900C60C
SHA1:	A8B8392C60AE491603E0D8BBF2462D4C2724C7A7
SHA-256:	8C5687EE9159AAB02B6735F4DDCD3FA990AD1FEECA9B917CD8CCC067C7064C4E
SHA-512:	52E91FAED34D7CA5434935D553D8361ED0475CC7501EAD1128CB67B4D66DF92FB5B4F210F910B11E20E03A2642F34BFF497839BA42629199A894D3F7CC9C929F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W..e.........." ..0..0...........N... ...`....... .............................."R....`..................................N..O....`...............8...)........................................................... ............... ..H............text........ ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............6..............@..B.................N......H.......x..,$............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}.....0...........(........o....(.......o....(........(....(........(....(........(....o....o....(........(....o....o....(........(....o....o....(........(....o....o....(.......0..b..............,...+S.o........r...p(....-).r#..p(....- .rI..p(....-..rg..p(....-.+...+...+...+.

C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll.config

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	5.152084530360732
Encrypted:	false
SSDEEP:	48:3skN0b74g0YGZeru+ZerMEoBF0PJMZolIt44FBoX:cNcexet6mh0bt4yE
MD5:	16F805E23865423BC2171A0B5A202B97
SHA1:	3706BA831957257832B235C0BA14E83B35D51318
SHA-256:	231FEE71C7E9B5EDFB9029CF59DFB0EFE3E3D3292FC5219E2F3821C5829EEC44
SHA-512:	06FA7FD29628C3163C504D8619A0D1F5FCCB3D87347FDAB833008B86896AD5179AA340F1531EBDF9F88502B5472F8ADA3C4E9C6FA6CE081B9E60510ED0997633
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->.. <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />.. </configSections>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Data.SQLite" publicKeyToken="db937bc2d44ff139" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-1.0.112.1" newVersion="1.0.112.1" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>.. <entityFramework>.. <providers>.. <provider invariantName="System.Data.SQLite" type="System.Data.SQLite.EF6.SQLiteProviderServices, System.Data.SQLite.EF6" />.. <provider invariantNa

C:\Program Files\Intel\SUR\QUEENCREEK\SystemUsageByFgndAppAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26376
Entropy (8bit):	6.407610905435669
Encrypted:	false
SSDEEP:	384:wjxTJ48dNZEIR0N/Fm6+U8uwG1Bm8PpwKNsehdDTeMGoGCJEF8ZpH89:yTJHR4ZpnOXehdDZEFiRa
MD5:	6FFB5A7649814295FE02A39123ADCB85
SHA1:	291640703FEEADBBC85BB0F61328260A9ADBD37C
SHA-256:	6A8E07007C23392D32A83AB20A91ACD9AC24D4BEAE73FB0DAED3256696FF4044
SHA-512:	7C950A06103E64503953B279D5BF606286BA8B2520A23B46C2583165237C8CDBAFCD4CCAE422E8C1BAC584AE9B6FF4E27D0AE20FC73088672A7C25A617CA24C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0..6..........bU... ...`....... ...................................`..................................U..O....`...............>...)........................................................... ............... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B................DU......H........1..P#............................................................r...p}......}.....r5..p..(......*..0..P...........(....,.(....o.......+......,...o.....rw..po..........(....o....o...........,...o.....r...po...........(....o....o....}......{.....o....(.....s.......o.....o....o....&...\|.....o....(......o.....r...po.......{.....o....(......,".{....o....,..{....o....(...+...+......,.....r...p.{....(......&...(......~.....o.....o....o.............,.....r...pr5..p(........

C:\Program Files\Intel\SUR\QUEENCREEK\TextExtractorAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21256
Entropy (8bit):	6.579828709908185
Encrypted:	false
SSDEEP:	384:Q6KdEenvr7z+mz/fqiQiT1AwpwKNsehdDkUNGoGCJEF8ZpHhZbo:QvHr+m/+ehdDd1EFiRk
MD5:	41FB357A74D6E96B41942CEB3D2A3530
SHA1:	53CCF5A4E4BC88E008FA3188E3FB5296441940AC
SHA-256:	4D7E65BF4EE754009602F51C73873576746A048405E9159175016DA7F74E50E1
SHA-512:	E111B41DF05CF48AB7A3F978BF5111A7EFABF42952A407A38F0D922996B30F1115C2DAC26A8A97EC143DFA9CD654C2F346B0A0442223DE1D1F3CC8D34C6693BC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^..e.........." ..0.."...........A... ...`....... ....................................`.................................LA..O....`..................)........................................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............(..............@..B.................A......H........(..P............................................................. ....j}.....r...p}.....r...p..(.......0.."........s.......o.....o....(........o....o....&..o.....\|.....o....&....,..o.......(.....r7..po.....(....o....,.(....o....o.......+....9y....(....o....o.......o.........8I..............o........o........o........o .......o!.......o".......o#.......o$.......o%.......o&.......o'.............o(.....()...&..o*...re..p(+.......,........rq..p(+...,...,.......+..+.....

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4922296
Entropy (8bit):	7.989144828318468
Encrypted:	false
SSDEEP:	98304:xeFc9FJqkmFHk9OuUZrSKZJNz3OWw9nlUrs7E+qC5OFs/8oklpVEtS3Ep:ZJqVk9utTJpMULrCms/8o9t9
MD5:	93A11F169C471CC354DE093B56A19082
SHA1:	821D3B68F305AB4CE332302959EB14F37C1044E2
SHA-256:	4D98E7A04BD4710978C32C5BB0084EA36C84F7EE0D8C2FC2239B71A5AF65D541
SHA-512:	BB96685B26A9714D32E9E4CD268E8754E01E89C454553A34E811ECA74CA8B8103F18D5908CFEF1FD55ADEB5613119F98AB383655D5ED7488D9BB01D8BF070E63
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~-...~...~...~......~...m..~......~...~...~.......~.......~.......~......~...~,..~.......~.......~Rich...~........................PE..L.....e.........."....$.P...................`....@..........................`.......GK...@..................................1..x....@..<.............J..)...@......p"...............................!..@............`...............................text...BO.......P.................. ..`.rdata..$....`.......T..............@..@.data........@.......2..............@....rsrc...<....@.......>..............@..@.reloc.......@... ...8..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\ScheduleUpdates.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182024
Entropy (8bit):	6.587088856933033
Encrypted:	false
SSDEEP:	3072:2goOSKa7zHQnClbKDFSaHsCCaz83hvVc5b5eOlk7k5msi77v7mzeXp:wPHmC9Cj9Ytc5bhO7Js3e5
MD5:	82B325A5839C0B1150A613CFAA56AC6B
SHA1:	B3BC6F7A027A0FE4364EFF383BAE2163AC738257
SHA-256:	6C1523CC824D7D06F995FC578A4D528B7C95550FFF44181C1A9BAF30AF64061E
SHA-512:	10F1BB969D88FDCC228847A4486F32355CFE3742626968AD227B661D43E5E05C7DC3BBA878A56C9E79F41670A7BA9CDD36404CE5D744CBB3934BD33721CDFDAF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+..E...E...E......E.......E.......E....5.E..<(...E..<>...E...D...E......E......E......E......E.Rich..E.................PE..L...m..X...........!......................................................................@..........................o......hg..x.......@................)......(...................................(C..@............................................text...A........................... ..`.rdata..qp.......r..................@..@.data....5...........Z..............@....rsrc...@............r..............@..@.reloc...$.......&...x..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\VCRUNTIME140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81160
Entropy (8bit):	6.7790003076069505
Encrypted:	false
SSDEEP:	1536:aNnwd+hWi87PBE4DkoRGucT6HTYOBrXFlecbGJckoJaepeizN:aN/Ai8tR3k6zYSTecbGSkoJaeIAN
MD5:	EF695566A2DED81DAB2A26ADD800706B
SHA1:	124AA690224A9FA2B200D0448449B4CA3692EC9C
SHA-256:	D2907B3858045F8B706B509E531786213B2EF6CAE402D5EEC6A02C5EEECB50B4
SHA-512:	8E8D7D90F183F944BFEE66C85718CF94F6E37CD1766975FEF17458333ECD8821FCB449066D2048D9AF1DF238C9BB734B8C06A95C59DE42D150804B84889F364B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................2........I..............o.......o.......o.......o.......o%......o......Rich............PE..L.....d..........."!...&............ ........................................P.......4....@A................................. .......0...................)...@.......$..T............................#..@............ ...............................text...$........................... ..`.data...d...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ctypes.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	111368
Entropy (8bit):	6.666796627885485
Encrypted:	false
SSDEEP:	3072:7kjmq923Sn2UBl40jGo/YwOppndzBIpLPaWZeW86:7kqq92S2t0jP/Yw0dzBeeWn
MD5:	7FD5EA1F6A183E2E3F9095E5705EA571
SHA1:	29F877C26BBBDDAA6FE4D40B99F301C5644C8278
SHA-256:	69900BDF6408E0C8027B517CC604B65855E69E0EB3F47BD6C127BB232FED8A47
SHA-512:	2770FB88ACEC85112BA9FAF35B0ED05F8E99C4D7753CC8E2CD4E9E9EC40238B6BB9F4508443BAFDB0D5C3919045D2A1C30A8B449F3598A7F74296803391DD59E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jX...6..6..6.s...6.t7..6.t3..6.t2..6.t5..6.7..6..s2..6..s7..6.Bw7..6..7.m.6.>..6.6..6....6.4..6.Rich..6.........PE..L....=re...........!...%.............................................................<....@.........................PD.......D...........................)...........@..T...........................@?..@............................................text...!........................... ..`.rdata.."L.......N..................@..@.data...@....`.......P..............@....rsrc................h..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_decimal.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200968
Entropy (8bit):	6.850570146811096
Encrypted:	false
SSDEEP:	6144:/3Ri2dxIBTGLhgnm0w99q2KZ3QrWugKvcbj2eX:/3Ri2dxuchgnm0VmcbjXX
MD5:	A3EAB7CE3F5EA9303DEBB86225511963
SHA1:	6818559C571B687710FD2C6E89F17E3A304BF866
SHA-256:	559AAE2E9B01F6709D20859E3A21B582409BD5B725A78FCE2C52F291B6F99251
SHA-512:	6C58D0C9BBC03A406F8C0ACFFE86BB383997247E07990BB0B8D4CDC0932B9319498A880BCD201BF819629F2EE4809F27DF0CC05B3071EDCA96FECAD0CCA576B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........e..6..6..6.#6..6..7..6..7..6..7..6..7..6.r.7..6...7..6..6B.6.r.7..6.r.7..6.rO6..6.r.7..6Rich..6........................PE..L....=re...........!...%............\|".......0......................................g.....@.............................P...`............................)..............T...........................@...@............0..h............................text...m........................... ..`.rdata......0......."..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_elementtree.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119048
Entropy (8bit):	6.766175213532668
Encrypted:	false
SSDEEP:	3072:9nKb4LEPy4qe9pVaxZST339x4tOdIp6f7Xje5Tk:5KcLKyiyM3Nx4tOpXje6
MD5:	3CFF26F5DC1D9A4FD73228460E7C167E
SHA1:	519B0DFA3C6CFD8E3E8018CBEFECA79670FB760E
SHA-256:	01EF503593D9B824F0FBCC69CEA4AB5172236DBA06DB98077F59AEC62F27379F
SHA-512:	D13CBBD033DD6747312143D28FF4F830C246F68AAC7D8BA8F727E6DF8E654932D48F2DB37AFEF4A2486957CCACEFDB46F86BA2D276D9D2BC7BFF7C2F34A064A1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f..........................................................................................................Rich....................PE..L....=re...........!...%.2...v.......6.......P.......................................8....@............................X...(...x........................).............T...............................@............P..X............................text....0.......2.................. ..`.rdata..:G...P...H...6..............@..@.data................~..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_hashlib.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48392
Entropy (8bit):	6.704779987141762
Encrypted:	false
SSDEEP:	768:iLrN0iw28rF5kDcda0/2TTkvyE8yFIpOIfOehdDSEFiRwIc9t:Eraiw28rF5kn7TkaE8yFIpOI2eCeimxf
MD5:	E0B65C280F24A37E66ED680D3B81175C
SHA1:	EA8ECACCEE750D208F6D76E5BD8B0B2AE3A74B93
SHA-256:	8B8184E38941809E12FB01C58263EEE042381EA688BA46B30872FA8266541C31
SHA-512:	6682BFBDD2D77614B233B65FC223B9857AB968AC476E4E51278415FB9AA1974F036D89A228FF12E0ADA6CED5A117CE3636629CFD7C2D1216F6F9401DF899FB29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........}...}...}....-..}.......}.......}.......}.......}.......}......}..>....}...}..d}.......}.......}....A..}.......}..Rich.}..................PE..L....>re...........!...%.@...T.......E.......P............................................@..........................w..P... x...........................)...........s..T...........................(s..@............P...............................text...g?.......@.................. ..`.rdata...4...P...6...D..............@..@.data................z..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_lzma.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147720
Entropy (8bit):	7.015007571519089
Encrypted:	false
SSDEEP:	3072:Fe3CO/4pp8o8ssXzYWvFP+EX5IPeAl2VpJTxse0DOfXHfi9mNow22KtIpZ1QvewC:FrtlIX6WB3F6YOV2K5veKM
MD5:	7EE8BF358014295B47FB0285E8FB60E8
SHA1:	036DDDBC37BD44134D002E322D62DD1C35148898
SHA-256:	D48D0C1C00F0C2EA26B7BDE12B21A0B3C2AD8AC43FAB184F62684269F6D8FBBB
SHA-512:	9F593EA98EA8ED3A777CF99AF87571CD705722CF3394FF295FDAB9FB4AF956C9285FD03793A9C976BE4ECEB1F55E7C8B7CCAB5D7FBAFDF3B9373967CF0CAA493
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U................).................................+,......Z..........p...+,..+...+,......+,E.....+,......Rich............................PE..L....>re...........!...%.j...........n.......................................@............@.............................L.......x.... ...................)...0..X.......T...............................@...............x............................text....h.......j.................. ..`.rdata...............n..............@..@.data...............................@....rsrc........ ......................@..@.reloc..X....0......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_multiprocessing.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29448
Entropy (8bit):	6.67951534746093
Encrypted:	false
SSDEEP:	384:FgBZVZFYDJeiYH8J7jyQAhuENDDdZT4jx5/41IpWBLypwKNsehdDDefGoGCJEF8i:FqGeX8AQ83T4tF41IpWtnehdD2EFiRKl
MD5:	41A9CB8392AFFAD156922F8E1688B7B3
SHA1:	B09E6EFFBB1F483A364489E560BC52D9034B98DC
SHA-256:	CC4A3D73689AC9213849804BFF5E08D1EFF239BE20114A508E9A2CF11E57B5D4
SHA-512:	2F8D7CBA20F0B5F7F55E74F2A23EA351FF8BA891A4F4756F83BB4FD7A188C3B499801BFF8A8C15FAB7F9AB462B7156D986A0A502D57EF6367AE64540D7C2D8FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1.w1...1..0...1..0...1..0...1..0...1.].0...1...1...1...0...1.].0...1.].0...1.].1...1.].0...1Rich...1................PE..L....=re...........!...%............c .......0.......................................'....@..........................<..`...@=..x....`...............J...)...p..<....8..T............................7..@............0..l............................text............................... ..`.rdata..L....0....... ..............@..@.data........P.......8..............@....rsrc........`.......<..............@..@.reloc..<....p.......F..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_queue.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27400
Entropy (8bit):	6.699700518425294
Encrypted:	false
SSDEEP:	768:/wrU58b/N6rkDgBBIpQUX5ehdDZEFiRMs:/yUKckDgBBIpQUpepeif
MD5:	B79352F4FD73BDA93FABAAB27A350DB6
SHA1:	6E445B231172A6E2636C1DFAE6922A42A8691C0A
SHA-256:	54D6B43AF866723E808D3B66E3D1C5F433E3230440DFFA79E1B3B9BA557DF964
SHA-512:	9F2BFC9A9AC8430585936FBCC10E202FEFB6BEC38D6CED6262D0C85BA24B3884611075B2C8C2181C640BF8F6CFCAA3EB575E7BE24360ACCDA0DAF2FDE4540D0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...F..F..F....F.G..F.C..F.B..F.E..F.oG..F..G..F..G...F.oN..F.oF..F.o...F.oD..F.Rich..F.........................PE..L....=re...........!...%.....*......s........0......................................5.....@.........................P=..L....=..d....`...............B...)...p..\...09..T...........................p8..@............0...............................text...7........................... ..`.rdata.......0......................@..@.data...L....P.......2..............@....rsrc........`.......4..............@..@.reloc..\....p.......>..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_socket.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71944
Entropy (8bit):	6.704219905419805
Encrypted:	false
SSDEEP:	1536:Sp+E4v99DXaTvh213r1ycMB9f8+Cepzn2WBWDAOBIpLwrreneilK:SprO/E2h1ycMB9f8Depzn2WB4AOBIpL4
MD5:	1B9F09D4229708BCDBBF34896AC3B476
SHA1:	EDACE7C1C31C9DF17EC0DC574CB4728147D1996F
SHA-256:	5E890D5390534BDB4E99784316EBDE5441C4456BFD275CAE54102EA254E906A4
SHA-512:	84749B008B7B926BE8679BA629C9EB08024A73CDF7E415431EF9989D84C4467E7013963E977ED2BE201F4EB44821881679E0D1BDCACB89FCBFEB4D826B6F1A9E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A..C............................................?l...........N......?l.....?l.....?lr....?l.....Rich...........PE..L....>re...........!...%.p...........t..............................................C.....@.........................P...P................................)......T...P...T...............................@............................................text....n.......p.................. ..`.rdata..._.......`...t..............@..@.data...............................@....rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ssl.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	155912
Entropy (8bit):	6.462815319154303
Encrypted:	false
SSDEEP:	3072:FErwFnHoxXyWJ4fO686E3NoXk3moBxtIpC7OJelt4:FErwBo136E3qU3mEyeA
MD5:	384E0837B0BCCFF9234C845BB94EEDA2
SHA1:	661E9E2CB04F50A3747CAFAF3A1C13F578170EF1
SHA-256:	9446F4E59F32D37FB1C958D0FC179B884918F8815577CE95A1AC0F6EB91F843E
SHA-512:	78787EFB2F9D4B28389689B1A2807A6C0FFAD0C2AD2E4B84C4FCFB06EF1968E144D160C99C1A187987A20C6F1D2AC4881593F713EAA706081A1E6FB7AC74368F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;8...Y...Y...Y..v!..{Y..j&..}Y..j&..sY..j&..uY..j&..~Y..E..}Y...$..{Y...Y...X..4!..xY..E..}Y..E..~Y..E.}.~Y..E..~Y..Rich.Y..................PE..L....>re...........!...%.....................................................p.......=....@.............................d...d........0...............8...)...@...!.. ...T...........................`...@...............0............................text............................... ..`.rdata..............................@..@.data...p].......Z..................@....rsrc........0......................@..@.reloc...!...@..."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\UpdateServiceProxy64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	504584
Entropy (8bit):	6.409752433133109
Encrypted:	false
SSDEEP:	6144:Bxq9KOr1od/sgwObddwNTlxNCXENvhppNVGBKiXlR+0IQua0kg4Y0m0es:Bxq9KOWEHUdg2EN51mFH+yujZps
MD5:	3FEEC0C3B44893DE86A3CFF6062FB713
SHA1:	AE783ABDF697EFE0A3EFBA837E65751547A1D412
SHA-256:	A0EB43538855B925E42A852BA23C3F09F5B5F80566905BAD565252AE6217B0F7
SHA-512:	E0BE6E37B9D6292417AC3277DC39B66758A8322D407F0FA64EE50D3F36270A4DA6C8D5CB7F289510719242981153A1C060A955E294BCB086442629C93E7D6105
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........e.a.6.a.6.a.6.. 6.a.6..N6.a.6...7.a.6...7.a.6...7.a.6...7.a.6g..7.a.6.a.6.`.6w..7.a.6w..7.a.6w..7.a.6w.L6.a.6.a$6.a.6w..7.a.6Rich.a.6........................PE..d.....e.........." ...............................................................Vo....`A........................................`...(...."..\|............`..pG.......)..........<...............................`...8............................................text...;........................... ..`.rdata...}.......~..................@..@.data........@.......$..............@....pdata..pG...`...H...2..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\base_library.zip

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1703739
Entropy (8bit):	5.563231295381844
Encrypted:	false
SSDEEP:	24576:uttcY+UHCiCAdTscqhdmmPHz/IiXKbB3EaYceo:ytcY+UH5sZIiabB3sy
MD5:	EB032FCC77BD00BB9247BDB32804CD1F
SHA1:	3788AF70E5CD8F0851B6FD65F9E7A24416A188AE
SHA-256:	2F7731DE4641C092709DD95D632CB50D9EEE47EED3CF59D4C5556E41DAE6D411
SHA-512:	09A41D6FB835071BD0E6AA430DC515A0D0248A11BE612B59D3ACBE6F556139BE9B71344E370EA5EDAD91D4F4A455DE5F791FE6D626D6C91AC78194B737A9629E
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libcrypto-3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3475720
Entropy (8bit):	6.044536787710373
Encrypted:	false
SSDEEP:	49152:9Tzvl4LDpNkmTOVrYqSeGvDKfuvEKzF5++/u1CPwDvt3uFlDCJc9uHDn:5zvl43ToLM5+P1CPwDvt3uFlDCl
MD5:	1D0241E77016FC7859467CE8131FECC9
SHA1:	0CD3443C05157459DCBF94E72E5D49DD0B9A9D39
SHA-256:	CB2026A33C91590A35C7B2AACA9CEF8E72A118DA33709597E613BAA081C04666
SHA-512:	75C5BEEFF1D4E8F9088D226BB076C187E04F723851450306DA16E47435E0259F4A284384CA8803C765684C3D785BD013E5FB1435D0862B85F0FB3059E2E95C9D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....d...d...d.......d...e...d...a...d...`...d...g...d...e...d.N.e...d..`.j.d..d...d......d..f...d.Rich..d.........................PE..L...R..e...........!...#..%.........>.........&..............................@5...../]5...@.........................../.0....53.T....`3.\|.............4..)...p3....X./.8...........................p./.@............03..............................text.....%.......%................. ..`.rdata........&.......%.............@..@.data...0>....2.......2.............@....idata..(....03.......2.............@..@.00cfg.......P3.......3.............@..@.rsrc...\|....`3.......3.............@..@.reloc.......p3.......3.............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libffi-8.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33544
Entropy (8bit):	6.901077664248987
Encrypted:	false
SSDEEP:	768:c4QHHH1n906QVjoPX2onHfQMehdD/EFiRr7:cDHHH1n28fJbePeit7
MD5:	6E9B7D74EF2FC1D6DDBA0EC7245BD685
SHA1:	EF78C0FBC5B6F31F900B0C2F1E018C63908A6B38
SHA-256:	321D972360FC8C07450C9171516055204817C1A7F4F7F9BCFC792311FD49420D
SHA-512:	960CEDF7A810F6C3EDB9364D179D2386DEB32871D301ADC1AAC04BFF5F3256C46FBAF0ED85F056280C180A61D31065BCCD49477A930BEE1A8B6A5EB86DA8A134
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./Bb.k#..k#..k#..b[..i#..$_..i#.. [..h#..k#..M#..$_..g#..$_..a#..$_..h#..._..l#..._..j#..._..j#..._..j#..Richk#..........PE..L....h.c...........!...".B...........G.......`......................................].....@.........................0f.......i..P....................Z...)......\|....b...............................b..@............`...............................text....A.......B.................. ..`.rdata..0....`.......F..............@..@.data........p.......T..............@....reloc..\|............V..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libssl-3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	636168
Entropy (8bit):	5.812790404997884
Encrypted:	false
SSDEEP:	12288:EWkw3Hj9L2fnecKCBd3uxPJdVMB//rxBuvEjmIFe9Xb1Os/+:EWk85Vy/1DjmIFe9Xb1Os/+
MD5:	D2B032623908E837F8591644360875A2
SHA1:	C4420AE4C15B044B1D7B63DE5640D1E7C3F31BE6
SHA-256:	0E55F9AABEE323B98295EFF997E602466CF8000D6D6AA98EB3E3562FB8A530FF
SHA-512:	976EB04E46BDC0AE828741B8D0F938F8D7E25F81835B66C91C0E95F1A1D1E38542877CBB11497BBE2D90BEE761718E23D61D72E9EDDAAA29E231ADC07B875F33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ti.[...[...[...Rm..U....i..Y....m..Y....i..P....i..Q....i..Y....h..X...[...B....h..j....h..Z....h..Z....h..Z...Rich[...................PE..L......e...........!...#............P$....................................................@..........................i...Q...........`..s................)...p...F.. X..8...........................8W..@............................................text............................... ..`.rdata..x...........................@..@.data....<.......:..................@....idata..<K.......L..................@..@.00cfg.......P.......2..............@..@.rsrc...s....`.......4..............@..@.reloc..5O...p...P...<..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pyexpat.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170760
Entropy (8bit):	6.671103855266887
Encrypted:	false
SSDEEP:	3072:WTevR/dSGJJNQSvrGT3LGLejJIRlTQogs4wjBIpLh1mjtWex0:1vR/dzJNtDGGLMSTQe4aHwe2
MD5:	50F856E5211958868C5DFCD62546951B
SHA1:	1CE83C3A57E822AB0B32CFAB7590A4F224081C61
SHA-256:	7F83395908831B8ECDA4F7DDEA7FDDE826724E1CEA364E71DD159A93183A0FB5
SHA-512:	78B5173D77CCF3BDDD9CA92A99FBF39DF45C4B559F1BED4FA4473C50B658D7CC65AB601A0AD35138010D0FA4A35D2FC7DC636CCDEC14179B30D7F52E08FF1E0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?...?...?...6.b.1......=......3......5......=....Y..=...t...<...?...N....Y..;....Y..>....Y..>....Y..>...Rich?...................PE..L....=re...........!...%..................................................................@..........................<..P....<.......p...............r...)......l ..p8..T............................7..@............................................text...5........................... ..`.rdata...X.......Z..................@..@.data........P.......8..............@....rsrc........p.......F..............@..@.reloc..l ......."...P..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\python312.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5870856
Entropy (8bit):	6.3019579505555345
Encrypted:	false
SSDEEP:	98304:ngrdh1oYGoaKMaQu95vrABxMHJMwEPS62A0:ng1WwH
MD5:	FD626F818050FB7363772EFB5AEEB23B
SHA1:	834778B4DC9875AE1A435673F9700EEF24C78EC7
SHA-256:	9846183CCF5D84AE67AAD57440D762E9BB93E354AF21CFC6B04D4F07FE45755C
SHA-512:	1C57199D5987ECF2A37F3F889EA39BB3182D6D4857C796847CDAF21AC66B9B03098003506B66F6F07AB1C25FE8AA250E051C957B568180FFCC13BC95E89D1A38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!..@DL.@DL.@DL.?EM.@DL.?.L.@DL.?AM.@DL.?@M.@DL.?GM.@DL.8.L.@DL.8EM.@DL.@EL.ADL..LM.@DL..DM.@DL...L.@DL..FM.@DLRich.@DL........................PE..L....=re...........!...%.&)...0......&)......@)..............................`Z.......Z...@..........................uG......BH......@W..............lY..)...PW......mG.T....................mG.....PlG.@............@)..............................text...@%)......&)................. ..`.rdata..."...@)..$...).............@..@.data...@ ...pH..n...NH.............@...PyRuntimH.....S.......R.............@....rsrc........@W......TV.............@..@.reloc.......PW......^V.............@..B................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pythoncom312.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	550664
Entropy (8bit):	6.527675049386185
Encrypted:	false
SSDEEP:	12288:Q36Rvx7hyyepX0FgGOgnWLZ74zUvRd1pdRm9D:QOvxsyEnUD
MD5:	B7D5D8DCB9E7B3D211FB1A7F43FB2407
SHA1:	B885D662BDDA0463621848DF5AE88EF8DFFDA59E
SHA-256:	7A61710AD64A91E603BC404D28C5874120D500EBD471F8DCDFC628ADA94A4D06
SHA-512:	A10E590BA4BE570C9B47D455A9CAF96387D795180F51C93613913402F56DC1982D6EDFB03586BCFDDC1FDE2216DEE74F708D4F30469327183E2CCCB66FE4EB18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.,...B...B...B..f...B.OkC...B.OkG...B.OkF...B.OkA...B..uF...B..kC...B..uC...B...C.R.B..kK.L.B..kB...B..k@...B.Rich..B.........PE..L...j..d...........!.........:......................................................a.....@.........................0...l`........... ..l............>...)...0..@...0 ..T............................ ..@...............l............................text...#........................... ..`.rdata..............................@..@.data........0...j..................@....rsrc...l.... ......................@..@.reloc..@....0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119560
Entropy (8bit):	6.672048940659212
Encrypted:	false
SSDEEP:	3072:OMhPekCGpe9McZ4yz+B/nVQIIea/voJfYPbLNrPbJ8KvXXGKu4fHwQe/j:OopeOcuyz+hIea/voJfYPbRHJ8K/XGKO
MD5:	3416EB8C7800A1708ACB543E8F7D1CFB
SHA1:	9000B1E4975AE50F9A7FD51217036B8CF2258CD0
SHA-256:	6F567DB1AAC4FC6861778FEEAA7B5C77B51BE7EF5BAA110A789182630F7B5C8D
SHA-512:	5D55C03BE567FD000F7D79B6484F0D760BE10962B9A63FBEA140EC7BCC4AEE4F7594A18F69E134DE88F8FCC3F7F0BAC050BFFC4558C15C0491FE12D79747D2DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZC..."k.."k.."k..Z..."k.LWj.."k.xM..."k.LWn.."k.LWo.."k.LWh.."k..Io.."k..Wj.."k..Ij.."k.."j.."k..Wb.."k..Wk.."k..Wi.."k.Rich."k.........................PE..L......d...........!................................................................:8....@..........................2..@@..Pr..........l................)...........(..T...........................0)..@............................................text...j........................... ..`.rdata.............................@..@.data................z..............@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\select.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25864
Entropy (8bit):	6.77949395574671
Encrypted:	false
SSDEEP:	384:v9mecPSSMrz3JPu0jMonqlrzADteGtNiBIpQGuZpwKNsehdD+vGoGCJEF8ZpHAgS:QzMH3ZuEnqqgg8BIpQGuWehdDUEFiRJS
MD5:	EE46F673499C6BB80EC330D0603CE502
SHA1:	CFECB2B6CF08B3B9276C5A848A11CBB19AA955C1
SHA-256:	CC300D1837189B3F254FB849225796E3DC2A500A337F1D11E23CBDB8C48AAB77
SHA-512:	7489CB439480ED8E83653377DD750477B5451CFC931F498C8E6A4D98E52F28F9D3B1F549E1FAE91F3C605E6BDB0BA5DEB6E529D1A0EBAC206FAE19C207E8EA3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U4...U...U...U...-b..U......U......U......U......U..+....U...U../U..Z-...U..+....U..+....U..+....U..+....U..Rich.U..................PE..L....=re...........!...%.....$...............0............................................@..........................;..L...\;..x....`...............<...)...p.......7..T...........................P6..@............0...............................text............................... ..`.rdata..n....0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......:..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\shell_executor.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20744
Entropy (8bit):	6.774340645813797
Encrypted:	false
SSDEEP:	384:oFMVmLyUBefz6JdGCPxM1ojpwKNsehdDNn4HWGoGCJEF8ZpHGQQ:orafz6JLmVehdDx4H8EFiRvQ
MD5:	40570A6F79E95AAFC1C7BB027347B4FA
SHA1:	8E52D8EFE0F87A993E243AEB4488F5A7D512A6C5
SHA-256:	90DCB2451E623485DD410A4999DEA5C902395FC026B0D446074AD2007CFF6B1B
SHA-512:	844D025C1E7CCD15E561273A5D33599C49695547E2F1ABF86B532C54FB52B5BE4795E8A8C3929E116EAFF34A56496C06BA51A9E55CA49FE9BC96CF29D5F03F3D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7..7..7..>.L.6..>.Z.!..>.J.3......2..7.....>.].4..).M.6..>.H.6..Rich7..........PE..L.....NR..................................... ....@..........................`............@.................................t"..d....@...............(...)...P......................................0!..@............ ...............................text...Q........................... ..`.rdata..h.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\unicodedata.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1128712
Entropy (8bit):	5.461825176483635
Encrypted:	false
SSDEEP:	12288:dj48CjJ43w9hIlCQtHdcM6hbpb0QN8MdIEiMeU2BNNmD+99FfRyzw3W:dj48CjfApX6bPNfvi02BN6yzpyzKW
MD5:	A1276B9E7E74BE81B1CB42FCD3ED1B36
SHA1:	9308320E48462A53A42ED14A014A7D2CDC281DD3
SHA-256:	36F9C8D879CDACC748DFDD36E248C05AF18F76AA07083ED410C511F0836B16E4
SHA-512:	BA6B3C6D63E1BBB5CD1DE37B2754B0BA74DDD763B07C9E3A932BE3ADCAA5F416CA590ADD60BD3E839A20C2669689B1E6375E2DED7952A04F8762F20DED0B50E2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!...OQ..OQ..OQ...Q..OQ..NP..OQ..JP..OQ..KP..OQ..LP..OQ.9NP..OQ..NP..OQ..NQ.OQ.9GP..OQ.9OP..OQ.9.Q..OQ.9MP..OQRich..OQ........................PE..L....=re...........!...%.4..........c8.......P...............................@.......^....@.............................X............ ...................)...0..........T...............................@............P..(............................text...-2.......4.................. ..`.rdata......P.......8..............@..@.data...(...........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\_win32sysloader.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22792
Entropy (8bit):	6.749877285820604
Encrypted:	false
SSDEEP:	384:yHj8T114SVI49v0jgmPYGTsg/LspwKNsehdDu1b3SGoGCJEF8ZpHD/Q:yHj8TjRVxpGjTX/L5ehdDmbQEFiRk
MD5:	40885034FF275728327A4FB6F3CBFE9F
SHA1:	5429473D6B8E1704373CBFA3351B185E3C92E70A
SHA-256:	2D104FAB58C0B6170AD5D6B130900B14A26E2D946BE8E3F1901C55DBEF6FA1E7
SHA-512:	3BDC779084E76D6E2F1186A6B32AD19FEF6686561C50F9C8A26A7B0AF5768DDF30203311B706BC2D190BF90E540464B0CCF05F95126B374E969C207F7935BFBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7...7...7...>.@.5...e...5...#...5...e...<...e...=...e...6.......4...7...........6.......6.......6...Rich7...................PE..L......d...........!.........................0...............................p......y.....@......................... 6..`....6..d....P..t............0...)...`..h...D1..T............................1..@............0...............................text............................... ..`.rdata..<....0......................@..@.data........@.......&..............@....rsrc...t....P.......(..............@..@.reloc..h....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\perfmon.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33544
Entropy (8bit):	6.570198803433219
Encrypted:	false
SSDEEP:	768:YOKNAlL7VMlMHMyM60QYMKcsp2ih/6AqNAiEehdD1eEFiRee:YOKNAlL7VMlMHMyM60QYMKvpt6AqNAiS
MD5:	B783DF0B1537497A3F28728348683F49
SHA1:	26BED7EC8134EC5344C51707570D5739C147F8FE
SHA-256:	94703CF7990B7095B45B004B277601C6F68269FE1D7BCF7D465A6471BD320DF4
SHA-512:	CFDA15DF29E5A34909D9DA9AED9EFCA35107D31FFBF5DA514985504FDE500A52AD639846BD223F4D2953D1BF615B01A2D50D9C12B36EC0495A6640C7D20C0A7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........., B.BsB.BsB.BsK..sD.Bs..Cr@.BsV.Cr@.Bs..GrR.Bs..FrH.Bs..ArC.Bs..CrG.BsB.Cs..Bs..KrF.Bs..BrC.Bs..@rC.BsRichB.Bs........................PE..L......d...........!.........(......v*.......@............................................@..........................M..P...@N.......p..T............Z...)......(....G..T...........................`G..@............@..,............................text...3,.......................... ..`.rdata..d....@.......2..............@..@.data...\|....`.......J..............@....rsrc...T....p.......P..............@..@.reloc..(............T..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\servicemanager.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44808
Entropy (8bit):	6.419242153979817
Encrypted:	false
SSDEEP:	768:lucddj6ifvuMuRh+lRCRZPR5OXMgejXOz5m8PGmdpehdD4EFiR0:pddjQRWURBR4MgaXOz5hPlpeoeiK
MD5:	721998A689E574BF72389C936F776C23
SHA1:	B18548151009F1BCD6A082EFEAFA9C579D71D834
SHA-256:	F907A66B3D32C8AD45A857F1557B0C1240081CA5C923552219B4D910697F3297
SHA-512:	9BCDA84662D4E41F74102706F9A9C5BAC9F06C8BAE007D4A9094ED47A25309104004082A2EF956FD1F9C794FC8A93E607DDB1EC4A17B96A35C1DB08D26116727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)uS.m.=.m.=.m.=.dl..g.=.?a<.o.=.?a8.\|.=.?a9.g.=.?a>.l.=..a<.i.=.y.<.f.=.m.<...=..a4.l.=..a=.l.=..a..l.=..a?.l.=.Richm.=.........PE..L......d...........!.....<...F......W;.......P......................................$.....@.........................pc..`....d..........x................)......p....\..T...........................`\..@............P.. ............................text....:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....rsrc...x............j..............@..@.reloc..p............~..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32api.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114440
Entropy (8bit):	6.580675261626668
Encrypted:	false
SSDEEP:	3072:hBzJecLY1YsPAC0QkiGH6gVhVFhLqN6/ZyymFKymCOThTe/yb1beab:hBzJecdTVhVl/ZyQymCihaE1bey
MD5:	21F52C2C98849DCC86A38329422997FA
SHA1:	C3FAC25208F1768CCFC96C5F33A5B7B80664CD36
SHA-256:	551A174E20E67EA5AA488D75170B3203E7D2FD4E2DFFD62FB11BFD1BE030C030
SHA-512:	33B8C60E453FEF0A84C571A1EFDE7B294D2848F2A004606DB96346A846BB4B5BD0286EA90B2F1C4AE2A1D6AB1D13C0D7961A1389AE5612BD72DE973E647CA4EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{...?...?...?...6.l.9...m...=...m...5...m...<.......;...m...*...+...4...?...m.......=.......>.......>...Rich?...........................PE..L......d...........!................................................................\.....@..........................C......TD..........\................)....... ...:..T...............................@...............p...\C..@....................text............................... ..`.rdata..`k.......l..................@..@.data........p.......^..............@....rsrc...\............p..............@..@.reloc... ......."...t..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32event.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33032
Entropy (8bit):	6.794236049375771
Encrypted:	false
SSDEEP:	768:b1dR8+arca5dMhfbp/Th/Gddbc7+B07+h6DQZoFRaYPehdDjEFiRp:b1dR8Tmh9/Th/GddbcKu7+h6DQZoFRad
MD5:	DDCC11527EF517D7F0FFA124FB6C5FCF
SHA1:	7AFA970647254AE2CE320D0454EBA49B98B3FF73
SHA-256:	5E28FA725F66B3F527E92126AFB1E782217952A02C3A912F1B7F04E1854B0AB5
SHA-512:	6017AC7797483EBFAA774FDDB54CE13D06F70E20B58B7F6B3C4E63B05E61F803F2B241B59E61491D95F2ACAB21412104EC7E54E54F690196D79CB9DDF4E0F6E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..X+.p.+.p.+.p.".../.p.y.q.).p.y.u. .p.y.t.!.p.y.s..p..q./.p.?.q...p.+.q.}.p..y..p..p..p..r..p.Rich+.p.........................PE..L......d...........!.....0...$...............@......................................?.....@..........................L..T....L.......p..d............X...)...........G..T...........................@H..@............@..t............................text............0.................. ..`.rdata.......@.......4..............@..@.data...X....`.......L..............@....rsrc...d....p.......N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32evtlog.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71944
Entropy (8bit):	6.634516854237088
Encrypted:	false
SSDEEP:	1536:6mV+RpoQwJPHRMa/CPld8KvtT6fJhOnYa8tWM7NAwaK485iXpBRAvF+95TnxfpY+:FV+Rp4Jua/CPld8KvtT6fJhOnYa8tWMu
MD5:	B01F42DE32A875622B99CE15C6A7B120
SHA1:	688E048CF173F3BA6A25FF5415977DB4A6FF3F83
SHA-256:	64E1D13A8F3DA01E8A6A5A2AC9600DB6F2DC805669A8DC4B30EE7AE8D15B509F
SHA-512:	40467B11B30DAF12547E9C27E2D8E9D35AAB8FCB577E10620E735EEC01F9848A5B66C83205429FCDD446E3B3AD7417A7016AEB1E06CDF8EF18FBC5A19CDCEAC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........e.y.6.y.6.y.6..v6.y.6...7.y.6...7.y.6...7.y.6...7.y.6...7.y.6...7.y.6.y.6^y.6...7.y.6...7.y.6...6.y.6...7.y.6Rich.y.6................PE..L......d...........!.........h.......{.......................................0............@.............................X...h........... ................)......T... ...T...............................@...................L...@....................text............................... ..`.rdata..0C.......D..................@..@.data...............................@....rsrc... ...........................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32file.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	125704
Entropy (8bit):	6.681492480465494
Encrypted:	false
SSDEEP:	3072:25FPfRwZMz+pFoaCuhSwELL3My7N+AeoIC/CBW0fvH+TvM5DEoG8GZJ6FUz4geWm:a0ZiaguhSwELL3My7N+AeoIC/CBW0fv/
MD5:	AA36009F0E909D1FEA8C4E6610691B8E
SHA1:	6096CAD608DA7D21FB48EDBCE510FAB965EF7584
SHA-256:	26590759212663C1AC54586E5178C8B5E1DDB7939218CF1CAFD1BD80A99C09E0
SHA-512:	EAFBB57E3C25C14FBF0880A362576DFA07B2C2A9D98A8D878C5C895010FAE8DF7C3EB8124B71B027B44FAC790394370F705E487A95FBC9AE6F70193386E55D6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.5.a.[.a.[.a.[.h...k.[.3.Z.c.[.3.^.q.[.3._.k.[.3.X.`.[...Z.e.[.u.Z.f.[.a.Z.q.[...R.c.[...[.`.[...Y.`.[.Richa.[.........PE..L......d...........!.........................0............................................@..........................{..T...D\|..........\................).......#...q..T...........................@r..@............0..l............................text............................... ..`.rdata..Hk...0...l..................@..@.data...d...........................@....rsrc...\...........................@..@.reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32inet.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54024
Entropy (8bit):	6.684325011844017
Encrypted:	false
SSDEEP:	1536:IUPVeU2J6NPlKv+xVFIXaf1xUag0Eeceii:IU0UzN4vUIXa9xUakezF
MD5:	9017FD8458AE2072F44C374544631660
SHA1:	DF9FD2DCE1485B8E6F50341D63764AC232579A84
SHA-256:	DB08AFC261A2960FD92DAABE5D826A99EF735165FCFB26E26A8BA843EB9D7708
SHA-512:	2DD982A037E101979FCE23193B8B45B342A9C246CBB49CB71F592B1224184493C280F32E1C84171B7E43709DF9DA6A191ED8DFF95B15698DBA9516AE73349FFE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z. ...s...s...s..Bs...sL..r...sL..r...sL..r...sL..r...s...r...s...r...s...s...s...r...s...r...s...r...sRich...s........................PE..L......d...........!.....b...D.......]...............................................a....@.............................T...4...........\................)..............T...........................`...@...............@............................text...1a.......b.................. ..`.rdata...+.......,...f..............@..@.data...............................@....rsrc...\...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32pipe.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33032
Entropy (8bit):	6.785086671819446
Encrypted:	false
SSDEEP:	768:6nNYG3LMjRzX6ICET7/ThiuehdD6CEFiRy:6nNX34jRWIhT7/ThiueKCeiU
MD5:	D387E195742DD45D720D9AD5FB8B1911
SHA1:	23EF01C764A3742438F5F1985408E093927B3612
SHA-256:	67F35263F31561B7FF95E84C975C6270BBE185DF8236A943DC5B15ACBD567443
SHA-512:	EF7DE77CDCAACE6548D2687074D8CD5E14B37210BD2D795324FF649F5B3D5D98B9EFBD53BE789171BD6314FF64344A0AEC184CD38FAAFE2C93FA1576969BB141
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tiH.............m.......`.......~.......`.......`.......`......X`..............X`......X`......X`......Rich............PE..L......d...........!.........&.......+.......@......................................6.....@......................... M..T...tM.......p..\............X...)...........G..T............................H..@............@...............................text...;,.......................... ..`.rdata..`....@.......2..............@..@.data...8....`.......L..............@....rsrc...\....p.......N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32process.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53000
Entropy (8bit):	6.724160269104646
Encrypted:	false
SSDEEP:	1536:P6uWFwB6iYX1eFLuxyrZ8a9hI0EQ1XWal9rTzseBeiyUb:K9+uxyhI0EMXWal9rTzsewu
MD5:	8C303AD56E26B541DC0E80BDE7F084AA
SHA1:	68F9EA6D0CC828956DE7385EAC980B86586169D4
SHA-256:	99F68E1C593F7224897FF6215949BB17C3068C623AAA4236234BC6059999FF6E
SHA-512:	1D7A043E7E409B9C21DDA699B9009D93E491B0A7311DCB2CEE9F20517FCD647198BDD315462758264189C62F92D0FBFEF7DD7F2BAFBE584A60AAF5B195E61686
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\. ...N...N...N.......N.J.O...N.J.K...N.J.J...N.J.M...N..O...N...O...N...O..N..G...N..N...N..L...N.Rich..N.........PE..L......d...........!.....^...D.......Y.......p............................................@.............................X..............l................)..............T...............................@............p..0............................text....\.......^.................. ..`.rdata...-...p.......b..............@..@.data...l...........................@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32profile.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32008
Entropy (8bit):	6.703284847749053
Encrypted:	false
SSDEEP:	768:Jcp3A6m4YKGPwx7IPyRRnFwWJPD3NKCroyFmehdDtpEFiRsO:Jcp3A6m4YKSwx7I+RFxJPD3NKCrbFme3
MD5:	A8B78C0545500E82316FE5F0D5113799
SHA1:	0ABF77A8BB91075ADA9841CDEFF6113547E73DCD
SHA-256:	29D4335ED5F1B984D5B69D461006963B00E5DDC7027B07905733CC29AC9088FB
SHA-512:	43BEC269AA075C69962BF3B89FC3B63C2DDB1FC594F8657E7BD63B5B7706370008CE9AD3B3859179A65D7628E7E7D5AEC0B1F9C82D79994DF96FBEA25B43EF30
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_v..>.W.>.W.>.W.F.W.>.W.K.V.>.W.K.V.>.W.K.V.>.W.K.V.>.W+K.V.>.W.U.V.>.W.>.W.>.W+K.V.>.W+K.V.>.W+K.V.>.WRich.>.W........................PE..L......d...........!.....&..........#.......@......................................y/....@..........................P..X....Q.......p..l............T...)...........H..T............................I..@............@..@............................text....%.......&.................. ..`.rdata.......@.....................@..@.data........`.......F..............@....rsrc...l....p.......J..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32security.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119048
Entropy (8bit):	6.6317268351415235
Encrypted:	false
SSDEEP:	1536:fw0b+L8CHz2gjcvKxUt1pzaFeEuQF80M3YzxwXvzRnJUdNkGRPepeino:fUL8CTb6HEY0wXvzRnJUdNkkPeIeo
MD5:	4BFEBE17359EA39C5802D3E7FCB65365
SHA1:	25D63B79E10DB4CEFF99D930976AFA46FF1E7CE9
SHA-256:	0016748C50A3758F1814147464C38854A747F15C1011DC3501BBFF0AB377FCB6
SHA-512:	875676C4196711BBF927C242292E14937AD9F710B700E7736277BED5363635FA62AAF0106E3CD3F750E027074E163F4881752861B14D2D9BEB553F7797BB673B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-...L.Y.L.Y.L.Y.43Y.L.Y.9.X.L.Y.9.X.L.Y.9.X.L.Y.9.X.L.Yo9.X.L.Y.'.X.L.Y.L.Y.L.Yo9.X.L.Yo9.X.L.Yo9.X.L.YRich.L.Y................PE..L......d...........!......................................................................@..........................j.......k..........l................)......4 ...^..T............................_..@............................................text............................... ..`.rdata..............................@..@.data................t..............@....rsrc...l...........................@..@.reloc..4 ......."..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32service.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58120
Entropy (8bit):	6.645366450872884
Encrypted:	false
SSDEEP:	1536:N4jjinhNo3U1pkkt9YaC4xkEuyJR7IzjI8Nx/N03tebxei9d:N4Uqgt9hBuyzI/I8Nx/NKe0S
MD5:	28AB0C0623A1D726330693CAB3BC5BBA
SHA1:	9C4351FD383576DF3EBC92BCD70FB13609B28EC4
SHA-256:	63845D8AC9A96C6F9B00E6D1FD55D34857AC1C36BE2D494906D8750820E7C949
SHA-512:	996DEC4F2FB42A0FDB1E86E12923C3A045C7A3034660CAFE58299929F9230074A418078F411149DF43168D4ACFCF16608BDE9FBFAB2BE94D6EC698F673E9E192
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.L.T...T...T...,...T...!...T...!...T...!...T...!...T..=!...T...?...T...T..uT..=!...T..=!...T..=!j..T..=!...T..Rich.T..................PE..L......d...........!.....`...V.......[.......p......................................A.....@.............................X...X...........(................)..........\...T...............................@............p..L............................text...:_.......`.................. ..`.rdata...9...p...:...d..............@..@.data...............................@....rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32trace.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29960
Entropy (8bit):	6.650644523018781
Encrypted:	false
SSDEEP:	768:Gq3EMHcm+Rn20LXHVPDpeBpT0ehdDw9EFiRN:GqMm+R20LX1PDcB+e2ei3
MD5:	FAA0DFDA09604A103E235935F83DDDB7
SHA1:	0007FE329B3B62A080ED9230527234B644A7167B
SHA-256:	B24368F883B43EF875B38352D8FC7E66B975B2DCD8D586DACF37A97F81ACF8DC
SHA-512:	0217D53874FF94A73C872105ACA725FF01862D8F85D298B9E2FAE7CD71076509C246431A34C40DB6C28D68937C46E9D66E1BC98DC258532FB072DC503941CD66
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\..p...p...p......p...q...p...u...p...t...p...s...p.(.q...p...q...p...q...p.(.y...p.(.p...p.(.r...p.Rich..p.........................PE..L......d...........!.....&..."......H$.......@......................................p#....@..........................J..T....J.......p..d............L...)...........E..T............................E..@............@..D............................text....$.......&.................. ..`.rdata..T....@.......*..............@..@.data........`.......>..............@....rsrc...d....p.......B..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32\win32ts.pyd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37128
Entropy (8bit):	6.649779197095021
Encrypted:	false
SSDEEP:	768:sJvh5ai4mw0n/wlsXAVjaOtgDwJFvvVhehdDMEFiRu:sJ55ai4mw4/wlqyjH+DwJFvvDe8eic
MD5:	D827729C0797E46BC57C4311FC6F346D
SHA1:	EF5885CAC0EF32A78B8F2947CE48AB05A311FE2D
SHA-256:	3589A5F45187ADE3DEEC447DB48952496CD29987764A79D7EE6B429F2B5F37E0
SHA-512:	39FDAB05BB80D94C96ACF62A0C8157E24AB73E2F5FDBEECC04F4DE917E3226F9E5F70F8C6456E4612F07A6E00AC0EA08E9C68EA193501D1293E8D9C6DB2AAA6B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_v..>.U.>.U.>.U.F.U.>.U.K.T.>.U.K.T.>.U.K.T.>.U.K.T.>.U/K.T.>.U.U.T.>.U.>.U.>.U/K.T.>.U/K.T.>.U/K.T.>.URich.>.U................PE..L......d...........!.........6.......*.......@............................................@..........................Y..P....Z..........T............h...)...........Q..T............................R..@............@..d............................text...1,.......................... ..`.rdata...$...@...&...2..............@..@.data........p.......X..............@....rsrc...T............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\cacert.pem

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	22940
Entropy (8bit):	6.032017157463409
Encrypted:	false
SSDEEP:	384:iq/pQNjnJvRi6F47Myb4UeHiOqJkEbJCJHJtSjBeP/q0f5CWOxmgWZ1GjOJWXTYf:J/pSvx47My2HitJkE1SHJc4PyVWOxmD5
MD5:	DF414BC2D2943295BFC40521B774CAAD
SHA1:	A6C1ABF2125D92C955AC18E3C93FF6363583118C
SHA-256:	DFFFC4FE5826C089665F8B92B7519D184ECBFB000D49D2A24E51769E2D28A076
SHA-512:	D6EA29563B747A15921C43CD498CDBABD7EDDA29AE67988E3E552D2F9DA8DBA0073E12552165854A300CB67BEA90A62AB84789F78923AAA79BCAE54A9D716E4E
Malicious:	false
Preview:	Subject: C=US, ST=CA, L=Santa Clara, O=Intel Corporation, CN=Intel External Basic Issuing CA 3B..Issuer: C=US, O=Intel Corporation, CN=Intel External Basic Policy CA..Serial Number: 61:2c:ff:88:00:01:00:00:00:10..-----BEGIN CERTIFICATE-----..MIIGuTCCBaGgAwIBAgIKYSz/iAABAAAAEDANBgkqhkiG9w0BAQUFADBSMQswCQYD..VQQGEwJVUzEaMBgGA1UEChMRSW50ZWwgQ29ycG9yYXRpb24xJzAlBgNVBAMTHklu..dGVsIEV4dGVybmFsIEJhc2ljIFBvbGljeSBDQTAeFw0xMzAyMDgyMjIxMjNaFw0x..ODAyMDgyMjMxMjNaMHkxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEUMBIGA1UE..BxMLU2FudGEgQ2xhcmExGjAYBgNVBAoTEUludGVsIENvcnBvcmF0aW9uMSswKQYD..VQQDEyJJbnRlbCBFeHRlcm5hbCBCYXNpYyBJc3N1aW5nIENBIDNCMIIBIjANBgkq..hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsACTrvLKbKZNzEi/SiP8KpvIbu0Lgwex..PGc5dWKAbRDRqPDWpzOgmNiF+oXPCuvJ9b2bC7T3uLPBZOOfYD/QSy2cP7s+H9aL..imiok3H+MNLll6zvIIYV6rH3bkN/bfMAnnOn16HUo1jbbWHCvlFqoyT6b4AnMqAS..2Hyc9kZYtsgdYWoFqoX3KOEIKcsCpN9zdir7Ha6Yv+vYfwkaYju/sQ4Gy4yM4urM..RYGyleP6h/SoF+rsvwgPf7FAD097vOm2qjPiZMZDbxKuGKlyBBrlJhAT9+ErUVCw..FpxSGRYKJAoGuybd8BrTHV4xrODE5yqz

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Generic INItialization configuration [ScheduledUpdate]
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.617771016530702
Encrypted:	false
SSDEEP:	6:k6EoLLwKq3b471bFLLwKq3IR7RJqUFLLwKqSkxCO/r5vyn:HDLEX3WhLEX3ID4cLEXtAOFyn
MD5:	3019BB65EBA7A06B65AA7925EAAF7E40
SHA1:	D136782AA2EE9029C74B2F577B1DB7347A141C19
SHA-256:	213443D0D3522F425B10FF3853D4C81F0615A7B9EF65D67E3F375EC4EBF0113E
SHA-512:	D76A9EECC27231D8425810EB1C99A4DDB2A41B592AF93F58D58124B053BFC9003939E57D98DEE5CCF178DA213D2E6FF3D4D311ADF9B36E2FDA21202293037485
Malicious:	false
Preview:	[Directories]..downloads_dir = ..\..\program_data\downloads..assets_repository_dir = ..\..\program_data\assets_repository..program_data_dir = ..\..\program_data....[ScheduledUpdate]..scheduled_frequency = 30....

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config_api.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.326465890981193
Encrypted:	false
SSDEEP:	3:k3WtMyUH/Dn:kN7H7n
MD5:	900C9A37AA17DC7DDBAAB099B3498AAC
SHA1:	967D5C0472E972BEDF2466E5F714F67C571578E7
SHA-256:	47C3223460EB379B126BA0579B1225722D8D7154F2D41733C44877EE22D86CFB
SHA-512:	297FC2FEE73AFEF3AA7FEB183F62D04355A261883C9A707F2173124AA8221EFE65927AAB14DE343203A18C6744814A6097322FAB2ACCC30A301150BC375A9ACB
Malicious:	false
Preview:	[Directories]..BinPath=./libs/api/..

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\licenses.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2404), with CRLF line terminators
Category:	dropped
Size (bytes):	141197
Entropy (8bit):	5.013409225713492
Encrypted:	false
SSDEEP:	3072:7DcSQy+yuZQ/OH/R9aJTtOyKFmc0OuEfIYHw9aJTnoERy:7ZQy+yuPKOPmc0OZfIWwn
MD5:	8AB74CAFB3151D7229D226D3E0E254AD
SHA1:	B50734768C0E6727CF621BAF0CA066DD57425C9A
SHA-256:	C4BC3C7B81A4DA8532222B1D20BCB66C56FF69D24DDF39083AAE91063D667DD7
SHA-512:	97675D09A98B6669DEBE4342F37AB0B26087EBB969D69838ACBD8C76AAACBB2A1F87883515EE4AC6B4E84E22558F61E6C30E82547A32E0B89E846A8E3766DB10
Malicious:	false
Preview:	Third Party licenses:..---------------------....Contents..--------....1. bbfreeze..2. bottle..3. Christian Heimes wincertstore..4. Curl and Libcurl..5. gevent-websocket..6. globalize..7. jquery..8. Microsoft MSDN Subscription..9. Microsoft Visual Studio 2008..10. Microsoft Windows 2000 Driver Development Kit (DDK)..11. mozbase..12. mustache.js..13. Python..14. python-dateutil..15. python-future..16. pywin32..17. Qt..18. requests..19. setuptools..20. virtualenv..21. Visual Studio Autogenerated Code..22. werkzeug......1. bbfreeze..--------------------------------------------------------------------------------..Copyright (c) 2017, Marcel Hellkamp.....bbfreeze contains a modified copy of modulegraph, which is distributed under..the MIT license and is copyrighted by Bob Ippolito.....bbfreeze contains a modified copy of getpath.c from the python distribution,..which is distributed under the python software foundation license version 2..and copyrighted by the python software foundation.....b

C:\Program Files\Intel\SUR\QUEENCREEK\Updater\logging_config.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	4.3513485013160516
Encrypted:	false
SSDEEP:	24:1rDLqVKj16Pn8VKj5kVKGZrzHGo8oh2maWvHyUo/Lxsg3/PEovZqh8r0Ey:YKOgKaKYn/86Ba/LRcSM8jy
MD5:	ABD90527A422AFC5C956E806CA94CBDC
SHA1:	8F44EA3705B602917D7B5E9DE0943F63EA5DF2B1
SHA-256:	F722DF8F21FC9FAED68192C5E9528DEFB53BEDCF444396121760A4794BAC0BED
SHA-512:	2DF67750FF60EBD680DFD81A33EEFED25032FF0F62F783388FD53300525D3166BD893607735E80AD69039C17D7A6FB6D7A9F34E76F485DE91D8A8D3FD489B764
Malicious:	false
Preview:	{.. "version": 1,.. "formatters":.. {.. "precise":.. {.. "format": "%(asctime)s %(thread)-8d %(levelname)-8s %(name)-60s %(funcName)-30s %(message)s".. },.. "brief":.. {.. "format": "%(thread)-8d %(levelname)-8s %(module)-35s %(funcName)-30s %(message)s".. },.. "full":.. {.. "format": "%(asctime)s %(thread)-8d %(levelname)-8s %(process)-6d %(name)-60s %(funcName)-30s %(message)s".. }.... },.. "handlers":.. {.. "console":.. {.. "class": "logging.StreamHandler",.. "level": "DEBUG",.. "formatter": "brief".. },.. "file":.. {.. "class": "logging.handlers.RotatingFileHandler",.. "formatter": "full",.. "maxBytes": 1000000,.. "backupCount": 3.. }.. },.. "loggers":.. {.. "updtr":.. {.. "level": "DEBUG",.. "propagate": 0.. },.. "werkzeug":.. {.. "level": "WARNING",.. "pro

C:\Program Files\Intel\SUR\QUEENCREEK\UserWaitTimeAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20232
Entropy (8bit):	6.552555418072741
Encrypted:	false
SSDEEP:	384:AJhA/mmXLjkpwKNsehdDdAfGoGCJEF8ZpHZjS:xrLNehdDeEFiRRS
MD5:	50D4E8B51D9876D5CAE517225DC7E718
SHA1:	9A6C4A27465E1D785E7D7EA3974F00C4002D21D8
SHA-256:	2BACA38B99624F6096AA79D26B1DE861B3F6347384B2921ABC90326064089BDA
SHA-512:	E3E1C0F0752C6DF99D17D1EEE108A37B042A6B61BE266362B45C516F614B49678AEA3E380F886F029675715D79DA4552E4610AC2B41D495E614D368E3C4A4558
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.............J=... ...@....... ..............................@!....`..................................<..O....@...............&...)...`....................................................... ............... ..H............text...P.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B................,=......H.......\%..............................................................B.r...p..(..........0...............(.......(....o....r...p.o.....o.....(.........,...d...(.......@.....r3..p.o....(....r...p(......o.....r...p.o....(....o...................,...o....&..............AD.@.................0...........s........o.....o....o....&....o.......o....&s.......o.......o....o .....r...po!.......o"...&..#.....r)..p.o....(....r...p(...................,...o#.......*........Y`.#........

C:\Program Files\Intel\SUR\QUEENCREEK\WifiAnalyzerTask.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76040
Entropy (8bit):	4.358536328688689
Encrypted:	false
SSDEEP:	768:8lQgmrMByNmEjz5Dv1YUULEehdDylEmEFiRlBk:8ygmoByNmEjz5DtYUUYemEmei9k
MD5:	6DD0A05CE1AA479FB3DDC2B84DDF4359
SHA1:	C07518531C4D547AF9CFBE698BFD132EBD6C2366
SHA-256:	3E24B5AB5E7DF6B6FE61AFFC246D629D096CF95BCAC63E6C7CE3F9D87BCAC3A7
SHA-512:	E79179DC97B69B29E94A4E61AA4CD02A4C7F2B9B3E02A52F9C92AD6BE12F785B387EB1DB0F1976704DBC713F579C091B3E9803B83A2AE08799CFCB260FB86478
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..e.........." ..0.................. ... ....... .......................`............`.....................................O.... ...................)...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........,..............................................................B.r...p..(......*....0..............s......o....r#..p(........o....o....&r9..p.o....rK..p(........o....&ro..p.r...p.....o....&....o....&rm..p..r...p......o....&....o....&r...p......o....&r.(.p..r./.p......o....&....o....&r.U.p..rY].p..r.b.p......o....&....o....&....o....&r#h.p..s.........o......s........r2m.po......rHm.p..s.........o........o....o.....Y..8-......o......o....rux.po....o....r.x.p(....-)..o.

C:\Program Files\Intel\SUR\QUEENCREEK\analyzer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	264968
Entropy (8bit):	5.895294832473358
Encrypted:	false
SSDEEP:	6144:Tsbq43vem2u5AShT4013LmwFbnqpYCedq:Ibqmem2oASh9mw0pms
MD5:	B6F1D920BEC7CA84C238D09870A26D69
SHA1:	EF0EAECF2F2342F9E1E071039BCC281E96A391D6
SHA-256:	2652F7C3F35480B77F378B23CB8FBDB018E5A18E618E2EB4190ADF5E1624C257
SHA-512:	0801707B79405ABB6D019C06A962F63645AFE4BEC2DCC22C16AB3CB40B7E2B1C34E3B0A10770846AE4277E4B13FDA68C0BF0A67DF4DFED51885CFFFC487592C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.........." ..0.................. ........... .......................@......^.....`.................................l...O........................)... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........I..l............................................................0..l........n.....r...p.....r...p.....rI..p.....rS..p.....rI..p.....r_..p.....rq..p.....r...p.....r...p.....r...p......0............%.....V....&.....V....'.....V....(.....V....).....V.........V....+.....V....,.....V....-.....V..........V..../.....V....0.....V....1.....V....2.....V....3.....V....4.....V....5.....V....6.....V....7...*....0..........#.......@.8.....=.....>.....?...#.......@.A.....E.....F.

C:\Program Files\Intel\SUR\QUEENCREEK\apptable.csv

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	4.905611656026584
Encrypted:	false
SSDEEP:	24:XvpUG+RFJT0s7KsYCjW9zMy4RxQLdn/XDIFg+8qlJ25IzgYKb:XvpUG+BAoYCqjaeJ/zIFg+8qn25IcDb
MD5:	4204D6A9D01151FAC8D50ED32EBD789A
SHA1:	992D18FB4563F5261DA93ECFE82BD60BD591843F
SHA-256:	124524102E9DCC3E3A78B2DD7413AA497B7B75BA2836AE9179BD9F775453E19F
SHA-512:	268B1AD76FF8E225C02224C09643C9306D4E1CF0E3D41B42D1D3CF45D78B7EBB82BE662D5D105F3A4835FC04A9EE81803F2B6F8BCA37F1815FE19F976914345E
Malicious:	false
Preview:	Acrobat_sl.exe,bg..acrord32.exe,fg..acrotray.exe,bg..AcSvc.exe,bg..AOLICON.exe,bg..AolTbServer.exe,bg..AOLTbServer.exe,fg..AppMonUtility.exe,bg..audiodg.exe,bg..AutoLaunchWLASU.exe,bg..BcmSqlStartupSvc.exe,bg..BESClient.exe,bg..BTStackServer.exe,bg..BTTray.exe,bg..ccApp.exe,bg..ccSvcHst.exe,bg..collsvc.exe,bg..Corel Paint Shop Pro.exe,fg..crysis.exe,fg..csrss.exe,bg..ctlcntr.exe,fg..devenv.exe,fg..dwm.exe,bg..ehmsas.exe,fg..ehtray.exe,fg..Etqw.exe,fg..EXCEL.EXE,fg..explorer.exe,fg..FlashUtil9d.exe,fg..FNPLicensingService.exe,bg..GameOverlayUI.exe,fg..Hl2.exe,fg..home.exe,fg..IAAnotif.exe,bg..IAANTmon.exe,bg..ICDESK.exe,bg..ieuser.exe,fg..IEXPLORE.exe,fg..Is3sp.exe,fg..Isbmgr.exe,bg..iviRegMgr.exe,bg..Iw3mp.exe,fg..jusched.exe,bg..LANUtil.exe,bg..LostPlanetDX10.exe,fg..LostPlanetDX9.exe,fg..lsass.exe,bg..lsm.exe,bg..mobsync.exe,bg..MSASCui.exe,bg..msworks.exe,fg..MyMemoryCenter.exe,fg..Napster.exe,fg..notepad.exe,fg..NSUService.exe,bg..OUTLOOK.exe,fg..PhotoshopElementsFileAgent.exe,bg..

C:\Program Files\Intel\SUR\QUEENCREEK\lookup.zip

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3038547
Entropy (8bit):	7.995615389726128
Encrypted:	true
SSDEEP:	49152:/UYv3jlcBgNwWAwTo5rvNhSlntCQf8VJy/PEKXmjmLtWMsxNVVyEoyuS11p:/UYv3jWaBc5rvrShtNfoJyDmjmRDsHhz
MD5:	A1296CE3E82BDBA8D987E501E3658A47
SHA1:	9D79A58B67B4B8635AA542DD26EBC92C8E591234
SHA-256:	E3A1D56C1516DB96A7778B1E19BAE57003B1DF244564210F23556E65FF1FF37B
SHA-512:	F8B4AF2EB122594551352AF41F82F418DBEA1F836AFD261E80FACF602A06ACFADAC2A3EEB1B331D42D99548B7FB069FB9C93C5FC2D28C2E061B56806B93BDEBC
Malicious:	false
Preview:	PK..........P.....\..........lookup.txt.]...._.....P.,^o.O^.v.G.H.$.......zg.R...$.....B. .Z.........'?..y1...aM...??..h?..q.v.w?..=...G?...`k...~..N....Y..~../........~../M...C......g7......0V......?.....~..\|s...G\..6&.....P.U.8}w}...6..U..q.U..K.qu..ih....z.[l.#.f.....7.N?.......M..e...6.&,\|..b..._.....Xu......Wa..lB0.. =..........3E.n....[.@.'.]....L.>,_93\..._.W.z.5..L..G..bY'+/........`J..a.pi.\|.......k.o......ZE.R..vr6.}...66..o.af..[r.[n..U.. .zp8..!.5T..e.0.......eq'.l.....4l..s..<G.;U.q.3.<.[........xr....2.......:?....c..]..L...C...H.5U...l..&...k.f..^z......._:o..W..0X..yJ.....t..iB&...bF..V.~.?.~\...`........N...fC.......!:...!.{..;\|d.n...O......7k..}>N...H...{.....m\|..XCo..m8.J>.n...T.E.'...]....a.v.0....8.O..9...C;...&...f,..././.........F7...u...].......w.....Y...1.-...1S._..E...{dZ#..,....@l../....,7].DM.\|..}7.8..F.&....<I....A.}...$..3..X...pnD....\0......o.Vn...N.6.5d...8...,S.B....Q....%.,ke...L..sr...4.{..`j0..

C:\Program Files\Intel\SUR\QUEENCREEK\policy.json

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	94100
Entropy (8bit):	5.498136427554891
Encrypted:	false
SSDEEP:	1536:L1nM9nP2nvsncuFgZb0TG67SOoq6X5N5D5gYpYp:lnq6X5N5D5gh
MD5:	70C849B3BA5EA101BD97188E3B421A95
SHA1:	93AA433CADB25FAB8A8A5CFF96DDD7169D42CB07
SHA-256:	8F697A78E2D7BCA4476B66B4FFAEFA3D46621CE1C78103B812B53DBF6649EDF6
SHA-512:	A3D9275F58D46E7948E8FF1714977B52D5F6162BE0CDF14FBD2FCEB3F160B5F1FDB21A7C40BD87EC2D33D9B618C2B826028090EFB63EB907A4676F48D123DB11
Malicious:	false
Preview:	{"SURVersion":"2.4.10577","event_log_collection":[{"name":"Intel_Installer","description":"Intel Installer Installation (1033) and uninstallation (1034) status","query":{"source":null,"query_string":"[System[Provider[@Name='MsiInstaller'] and ((EventID=1033) or (EventID=1034))]] and [EventData[Data and ((Data='Intel') or (Data='Intel Corporation'))]]","more_sources":["Application"]},"output":[{"key":"product_name","type":"string","xpath":"//Data[1]"},{"key":"product_version","type":"string","xpath":"//Data[2]"},{"key":"product_language","type":"string","xpath":"//Data[3]"},{"key":"installer_return_value","type":"string","xpath":"//Data[4]"},{"key":"manufacturer","type":"string","xpath":"//Data[5]"}]},{"name":"igcc-next-ui-event","description":"Intel Graphic Command Center Next UI events","query":{"source":null,"query_string":"([System[Provider[@Name='Intel-GFX-Info'] and (EventID=8087)]]) and ([EventData/Data[@Name='Ver']=1]) and (*[EventData/Data[@Name='CId']=202])","more_sources"

C:\Program Files\Intel\SUR\QUEENCREEK\x64\SQLite.Interop.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1626624
Entropy (8bit):	6.514625574823887
Encrypted:	false
SSDEEP:	24576:/qxPLobo1lzXSB1aWTvZrLQDu8mY70Mmzrk5Ngv9TEJ3xHf1aW1YLm89W2JFfhs:/qRCmJXSBimDMTkS3xHf1b1YLF
MD5:	E415F470B2557524BF900904F7B64A02
SHA1:	FCD9E7CD20102FE317BC6F534E666B9B6C49B8A9
SHA-256:	B7DFA963A09C21AE3EE7642416A168EEDBE690416C30C274E1666873117DF06D
SHA-512:	BDD902FD5F6C746D4DE35ACC67A8B7BBBACA43AFE9B06D2060ADC4DEE71570ABF5895829736323E42E5BA805CB93276CED157568F304747BD8A46B0A95BFC66F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I..............\.....................................M.................................0.............Rich............PE..d......d.........." ....."........................................................../.....`..........................................<..X4..(q..........8.......\......................p...........................`................@..p............................text....!.......".................. ..`.rdata...?...@...@...&..............@..@.data....I.......@...f..............@....pdata..\...........................@..@.gfids..............................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11113
Entropy (8bit):	7.259709187516043
Encrypted:	false
SSDEEP:	192:+FM3yFeJCNOL7yKnUi8rFWQF8olh+Il+jX01k9z3AevY57N:M0A4CFRBbEjR9zzvI7N
MD5:	4C8DA2A2CB7D869F319139A2F45D163B
SHA1:	B3313CCE1641373E303C650A1A1D5BDAE9AD6252
SHA-256:	F3A55EFEF76AB432ED24973DAD36116D7572AD717439E23B829E904638245C37
SHA-512:	04DD724CFE9E836053AAF1BE18DEEEC0E0E3D7EE8D665A10E76EAF39E7E28AE57378D7B03CF806A0A2EA8DF15F52F6D9D55C40BEE2499E20B490F610DEDB29E9
Malicious:	false
Preview:	0.+e..*.H........+V0.+R...1.0...`.H.e......0.....+.....7......0...0...+.....7.....w....(.F..%-4R....220809175614Z0...+.....7.....0...0....RB.9.1.2.3.0.F.7.B.5.C.7.6.C.6.6.F.E.7.5.5.9.5.6.D.7.1.B.A.2.4.9.B.E.F.F.C.A.7.8...1..70@..+.....7...1200...F.i.l.e........b.e.r.t.r.e.a.d.e.r...s.y.s...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........0...lf.uYV...I...x0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.1.3.D.B.D.A.9.9.1.4.C.D.2.5.E.3.3.3.8.9.F.C.6.2.D.D.F.9.7.D.4.E.8.5.D.C.A.8.5...1../0@..+.....7...1200...F.i.l.e........b.e.r.t.r.e.a.d.e.r...i.n.f...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+.........=...L.^38..-...].0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l...

C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	5.392342502355359
Encrypted:	false
SSDEEP:	48:RAiEo12NhqelOo57VGBIBbC8na5h9WnB6PNDwgNvYHAyj2a4Vo:eidsqDo5UR74qYkad
MD5:	461D311D15AC651FDB302FA836B1962F
SHA1:	D13DBDA9914CD25E33389FC62DDF97D4E85DCA85
SHA-256:	A27F0F9EBF2A8E1A394AF7F9A8459F912832ACDC6A0C5FD0122464E4858C7C86
SHA-512:	017E211FED07C4FA57AE569A0A3194A9768AEE2C013AD553751B55D5ABB63454FCC69303588852B5EAA4E1DF2DD5BB55A70296D23144A05D8753B8D160FE3352
Malicious:	false
Preview:	;..; bertreader.inf..;....[Version]..Signature="$WINDOWS NT$"..Class=BERTREADER..ClassGuid={bc930840-406a-4de0-a156-26a1e492bc9c}..Provider=%ManufacturerName%..CatalogFile=bertreader.cat..PnpLockdown=1..DriverVer = 07/03/2022,22.25.0.152....[DestinationDirs]..DefaultDestDir = 12..bertreader_Device_CoInstaller_CopyFiles = 11....; ================= Class section =====================....[SourceDisksNames]..1 = %DiskName%,,,""....[SourceDisksFiles]..bertreader.sys = 1,,..;.....[ClassInstall32]..Addreg=BertReaderClassReg....[BertReaderClassReg]..HKR,,,,%ClassName%....;***************************************..; Install Section..;***************************************....[Manufacturer]..%ManufacturerName%=Standard,NTamd64....[Standard.NTamd64]..%bertreader.DeviceDesc%=bertreader_Device, Root\bertreader....[bertreader_Device.NT]..CopyFiles=Drivers_Dir....[Drivers_Dir]..bertreader.sys....[bertreader_Device.NT.HW]..Addreg=DeviceSecurityReg....[DeviceSecurityReg]..HKR,,Security,,%SDDL_DEVO

C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	6.793582806994879
Encrypted:	false
SSDEEP:	768:tHCpyImp/xaAS0qqtLDz1WfUfdPt8yiRpnjxlWF//dj9zl7n:tHURL90qWBHfdPt8yibn9lWZzl7
MD5:	27332C4D2D9B469399A66379D33FC1AC
SHA1:	7395903B16BAD6F9FB0E55FBF64C7E02BB3BD44A
SHA-256:	3D9D9922B92A00EAC17E765EE6E76CDD84D70A71FE107D9705BF4177B588A2BA
SHA-512:	0C7FD0D1AB24217861F1242C5AA06DF605C7B6E3354817B8BCCEF066FE27944D233A0B2E0477D42126C705830B205A51E27D2A683FC275BB5F28269F322114C4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l.aDl.aDl.aD..fEo.aD..`Ek.aDl.`Dv.aD..bEi.aD..eEd.aD..gEm.aD..dEo.aD...Dm.aD..cEm.aDRichl.aD................PE..d....y.b.........."......@.....................@....................................,......A................................................H...P.......h....`..4....`...N......<....D..T............................D..8............@...............................text....(.......*.................. ..h.rdata..P....@......................@..H.data........P.......<..............@....pdata..4....`.......>..............@..HPAGE....l....p.......B.............. ..`INIT....t............R.............. ..b.rsrc...h............X..............@..B.reloc..<............^..............@..B................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_extractor.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	408448
Entropy (8bit):	6.389380622179822
Encrypted:	false
SSDEEP:	6144:+hJuQAO0BqV3FC/IsKdUAaGpLBTdWiUJdpaUohjH1jeKtDkn0SYi:yonBkFC/IsKd1a69TUl9oRAAi
MD5:	FE1D8D9A9E5A34E4C981E181FCD6ADF8
SHA1:	6ABE6A895816776F4A0700AAB265C3730F1D4090
SHA-256:	1AE5A7106C5EE9D56536589BA6880969A64BD1AF67B43D9FCE4FA2BF80E834AF
SHA-512:	AC3CDB07D256BB7B3B96BBE70309F6D96E32EF0D6E8B98F0AC9D143B7B942BB5EC53836B22971876FBEE698C8EB98850116ED80199D52E74EDAF549B9321F2F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k].C.3.C.3.C.3.x0.I.3.x6...3./~7.S.3./~0.I.3.x2.A.3.x7.P.3./~6...3.C.2..3.Jr..L.3.~:.D.3.~..B.3.C...B.3.~1.B.3.RichC.3.........PE..d...n1.b.........."................. ..........@.............................p......0.....`.................................................\........P...........4......./...`.......>.......................@..(....>..8............ ...............................text...\|........................... ..`.rdata....... ......................@..@.data...$4..........................@....pdata...4.......6..................@..@_RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_options.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	5.100277303699631
Encrypted:	false
SSDEEP:	24:1Ta8LRk25pRZf+VI/ZUOb1JIzZ+0z9r2Df0r9zrMMrAgZa5nZv:1TR6upnf+GRUOb1mt+0Jr2T0r9zrMMrI
MD5:	F6869C194C8886770001FFE5DDEE3CC5
SHA1:	910D9B4EF76BE6FADFA111D9AC82AC3B4E1E38AC
SHA-256:	008CB33AA2B572CDC49CFB14B1D7E40B0BE69692BF66186A62FAA6C6604DCCD7
SHA-512:	BB3531E182B580BEFF1B0BB29E7F6A028EB92D685BACDBD9488F47857F978FA644B0F53CA28E272ED0B878FE0C72CFDC5833076E56DDDA22E5CE677EB294F257
Malicious:	false
Preview:	cpu_signature=0x6066.// Cannon Lake Y, U..cpu_signature=0x806e.// Coffee Lake U, Whiskey Lake U..cpu_signature=0x906e.// Coffee Lake S,H,E..cpu_signature=0x606a // Ice Lake SP LCC Package 1/2, SP HCC, SP XCC, SP XCC -NS, 80L XCC ..cpu_signature=0x706e // Ice Lake U 4+2, UN 4+2, Y 4+2, YN 4+2, D HCC..cpu_signature=0x806c // Tiger Lake UK 4+2 Product, YK 4+2 Product, Tiger Lake Y 4+2 Product..cpu_signature=0x806d // Tiger Lake H 8+1 Product, Tiger Lake H 8+1 Product old, Tiger Lake HLP 8+1 Product, Tiger Lake S 8+1 Product, Tiger Lake S 8+1 Product old..cpu_signature=0x9067.// Alder Lake S, SBGA, ..cpu_signature=0x906a.// Alder Lake P, PS, HSB, M, Raptor Lake PX, Meteor Lake M, Meteor Lake P..cpu_signature=0xa067.// Rocket Lake S..cpu_signature=0xb067.// Raptor Lake S, SBGA..cpu_signature=0xb06f.// Raptor Lake S..cpu_signature=0xb06a.// Raptor Lake P..cpu_signature=0xb06e.// Alder Lake N..cpu_signature=0xa06a.// Meteor Lake P, S, M..cpu_signature_stepping=0x806eb // Tiger L

C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119560
Entropy (8bit):	5.940917095752776
Encrypted:	false
SSDEEP:	3072:OX49NYrrEIG00JFCEaPa2a6ezzESSfaz4zXa0p15RRxRFfssNeFr:OoXYrrn702leh
MD5:	E3B8ACB3AFCBDF92E7063E73CFC26F44
SHA1:	8BB66B835A6C7F9F976B2EDD429EA09DF494ABA3
SHA-256:	0396813FB6A8E0A0E4F8D2DCC9E4127E976CA99329C8EAB4033AD9FFD450E707
SHA-512:	451AA3DA80736EEB57D5F9CDECCDE742924651BC0B4CE4D2BF84A340CC9CEF900382C7252828E530A07BC97C40A6D261A83C9457BB8489AACFF2814B22E97D02
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.~.~...~...~.......\|...........w..\...............s.......v.......z.......\|.......k...~...C.......o..........................Rich~...........PE..d...`..e.........." .....&................................................................`A.........................................e.......n..h.......4................)......t....H..T...........................`H..8............@...............................text...&%.......&.................. ..`.rdata...?...@...@...*..............@..@.data....A.......0...j..............@....pdata..............................@..@.rsrc...4...........................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1082632
Entropy (8bit):	6.425010213531054
Encrypted:	false
SSDEEP:	24576:71GPSrRhtcOLx5N/q+q8bCjoEQ7y/M7erBxKr5leTrvVaHVdGeoEsgGqNfkfHffc:71Yk/lbCjoE5MCrBxKr5leTrvVaHVdGS
MD5:	C00CA03FB0B365570959515CCDDB33B1
SHA1:	AF0FC85CD1AEEC328C7911E241BE28AC48626122
SHA-256:	50C296CD1CE89E47AB63966DE8303C6274D536D281F77E87F0E15ADAC1F7533E
SHA-512:	3265588651B61EB6FD2D40023EFD348971531C37C44007CAD2BF74E15FA727A877D96A810C0358450E3A92C220ABA12FD048E495F4086F9BE6F416F8754D7194
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........n...n...n.......n..D....n..D....n.......n.......n.......n.......n..U....n..D....n..D....n...n...o..N....n..N....n..N..n..N....n..Rich.n..................PE..d...X..e.........."......T...........#.........@.............................`.......m....`.........................................P................@..4........+...\...)...P..........T.......................(......8............p..X............................text....R.......T.................. ..`.rdata.......p.......X..............@..@.data...@....@.......(..............@....pdata...+.......,...$..............@..@.rsrc...4....@.......P..............@..@.reloc.......P.......V..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	511752
Entropy (8bit):	6.433311516810351
Encrypted:	false
SSDEEP:	12288:FRV+hnSugWgxl+1+OR1CZyeDu7RUJwZj18weewSwC8w/183d7W:DV+hSugTxl+1+OzCZyeDYRUJwZj18weY
MD5:	6EA7DE91B0084EB7A1766631ADEB3772
SHA1:	0A0D50DAF8769A2ADFE085CC3BA17727B18898B1
SHA-256:	1B568079260B117BC4EE4AD711DA9E2B7D3E77DC8684B4C79C20C388BBC13414
SHA-512:	53E86E250FFE7FF2BC21773EC86E6EE8115AF2F56724035E5EDEC4B9E031BB0D73811A1624F4C0823DFE569F59B405897FED70510F603DB9E9EE2A91E9125B84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U...;...;...;.:...;...?...;...<...;......;.>...;.?...;.8...;...:...;...=...;...:...;...:...;...3...;...;...;.......;...9...;.Rich..;.........PE..d......e.........." ................. .......................................@......./....`A........................................0...4...d........ ..4................)...0..P.......T...........................p...8...............0............................text...x........................... ..`.rdata..............................@..@.data...P....@...\..."..............@....pdata...............~..............@..@.rsrc...4.... ......................@..@.reloc..P....0......................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_daq.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	521480
Entropy (8bit):	6.427829120286925
Encrypted:	false
SSDEEP:	12288:hYDrdaVNVs7Dx/DhbYMQ1DcP3m7rUJwZj18weewSwC8w/18GQRd:hYD4NG7Dx/dEZ1DcP3grUJwZj18weewJ
MD5:	CC76E7DFEA8C834E8B8211AB0F3E6F65
SHA1:	18855DC5A2BA88464F73A8BD6596FDB88FA53053
SHA-256:	CFD6AE0F3CED866876810AB121D4FA0DC8DA07CD6B8B3715D3F3C631D2F7AD2E
SHA-512:	34FA25237B48ADDDD6A10BA5F90C3EE057A274B999CE6434A8721B1334B97CDCFF6557BB2A377E19C2B0A21D672CE9422ACA33CEA656BDF303ED965DED737C1F
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........V7.8d.8d.8d..9e.8d>.<e.8d>.?e.8d..d..8d..=e.8d..<e.8d..;e.8d/.9e.8d>.>e.8d>.9e.8d.9d.8d4.0e..8d4.8e.8d4..d.8d4.:e.8dRich.8d........................PE..d......e.........." ................. ..............................................g1....`A.........................................>.......@..........4....`...........)......h.......T...........................p...8...............`............................text............................... ..`.rdata..6...........................@..@.data........`...\...H..............@....pdata.......`......................@..@.rsrc...4...........................@..@.reloc..h...........................@..B........................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_security.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25864
Entropy (8bit):	6.456628853486327
Encrypted:	false
SSDEEP:	384:Tbioi0UHfld3jotn9RZODylpwKNsehdDKNPGoGCJEF8ZpHqPrgF:PhU/3sBzcm6ehdDwEFiRqTc
MD5:	88B72EFE86D33D8663D5B43AFA3A6444
SHA1:	4887146C9A20CFE69273A4ABB5DCA1648304704E
SHA-256:	2500783FD81162EA1974032CF1349070DD91489A5BF711717ED1E8231AD8ACB3
SHA-512:	DE23FA10A563E61BDB9A5920C800F18C4F6BDB70576B1199AB957706D6795411A66CA5D3D96C0A5240D1D4AABDE33EEF8F6C65CC7D64AA8A4AEEF5ED1D93E6D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u...............l#......`.......`.......`.......`.......f...............`.......`.......`O......`......Rich............................PE..d...6..e.........." ......................................................................`A........................................@9.......9.......`..4....P.......<...)...p..(... 2..T............................2..8............0..h............................text...2........................... ..`.rdata.......0......................@..@.data........@......................@....pdata.......P.......0..............@..@.rsrc...4....`.......4..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1144584
Entropy (8bit):	6.40226213824259
Encrypted:	false
SSDEEP:	24576:Dm5h1wS2S6WdHqs+3A3zQJ6tyfRaXYG8KIsJj4o0LTfgakFtDAfbGGMnwGyOugwF:DAaIzQJ6tyfRaXYG84Jj4oeTgakFtDAZ
MD5:	0D51EE3EB45603737DF304F9633F8AED
SHA1:	B1119698D6EA1E43A1B872CFEB87759D49DDC109
SHA-256:	265F763D4F322DE189000BFA4BF58CC398369BCFCAF926956B8690C646C12AE9
SHA-512:	EC4D3B804B9517CA8DD2A469C8607948BF2E29944B3A39F7FBC0CF89F2596B7FF333A156B4F06BC077575514497CE30A5619F50F7891A6A2F669A4B5A0E3BFF5
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........D...................w......w...................................f......w......w..........4...}......}......}.t.....}......Rich....................PE..d......e.........."......"...(.......#.........@............................. .......l....`.............................................................4........)...N...)...........q..T....................s..(...`q..8............@..`............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data...@........$..................@....pdata...).......*..................@..@.rsrc...4............B..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_thread_monitor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	168712
Entropy (8bit):	6.265181923097744
Encrypted:	false
SSDEEP:	3072:L36HjlPeby8V0LGIZTe9cUIDsssNxsss5AkWV00W02R2222gR5cccccccccccccp:LUjlPebyCMGE7WSUeh9
MD5:	C475B5848DFC0BB8D142A4EBF687E500
SHA1:	BCA6C051CF775C933281865DF6F9ABE8A31B39CF
SHA-256:	FB0C7EE78BCF29D7EACE961986941E5008C22D46B2B02318F4DE9F27FE768939
SHA-512:	61F67C0CB7CD502AB0BBDDDA710EAA2EF07F234401005A099577AEBAD61ED5B27A54486FFF387D1EBC763BAEEF6611DC397A8F54ED57D0B3DE5AEACBE2DB4F9E
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........\...\...\...0..^.....]...U.;.D.....]...0..P...0..T...0..X.....^.....G...\...q.....R.....]....W.].....]...Rich\...........................PE..d...t..e.........." .........R......p................................................\|....`A........................................`V...... [..h.......4............j...)......T....6..T...........................07..8............0...............................text............................... ..`.rdata...:...0...<..................@..@.data... ....p.......T..............@....pdata...............X..............@..@.rsrc...4............b..............@..@.reloc..T............h..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\etw_options_config.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5791
Entropy (8bit):	4.8869643649784855
Encrypted:	false
SSDEEP:	96:Wxy6mg4vk/1EUs2Q2ggyArHdxyKmgURk/1EUs2s285yWTAe5j2eh8dLe8b8nHa:Lzg4pUFZg3ArHuDgUHUFF84WTAe5j2eY
MD5:	0EDDD7E898816F32E5C6B278B760D789
SHA1:	B791F945A10E46DCB2C40372D47344830B8C3E1D
SHA-256:	925116F43758DBC25000CCB0B076D9A6E137C89C317A47F059C4E1D826EF4B5E
SHA-512:	8621C801A79AAFD15DF2E57DB62125C1B810E58F5B0FA451E7E1917B0065BB35AD113419733B29D4A6DE6BB1FEBBC3F127EE649ED7039D4D117C51EB7D54F426
Malicious:	false
Preview:	<Session>.. SessionName=CAPISession. // a real-time session runs within its own thread; a session can host one or multiple ETW providers.. EtwBufferSizeRecommendedKB=8 // 0 to let ETW decide.. EtwMaximumBuffersRecommended=100 // 0 to let ETW decide.. LoggerQueueCapacity=0 // max live queue capacity.. ParsingWorkersCount=0 // number of parellel ETW event parsing workers; default: 0.. ParsingQueueCapacity=0 // maximum number of ETW events pending in the parsing queue to be parsed; default 0 means no limit.. LoggingSpeedup=No // use speed-up mechanism for logging pre-configured event data.. OverrideExistingSession=Yes // whether to overwrite existing ETW session with the same name; default: Yes.. EnablePropsAutoDiscovery=No // Whether to enable auto-discovery of properties/keys of the specified ETW events.. LogEventsToEtlOnly=Yes // whether to log events to etl file only without parsing/logging

C:\Program Files\Intel\SUR\QUEENCREEK\x64\installer.bat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	DOS batch file, ASCII text, with very long lines (1006), with CRLF line terminators
Category:	dropped
Size (bytes):	95002
Entropy (8bit):	5.165349551731283
Encrypted:	false
SSDEEP:	1536:oiqHq4BednSBoE2KMTImYXo1PZASIzQsF60ZJKIGJKNRwt7KxhQkqQxInLrA8J5N:0mYXo1I6yHpPer
MD5:	64644ED0FEF5DED2FDC74DE4CE93316C
SHA1:	BF408F98D4AE8F8B93ED611C514F82DCC8071743
SHA-256:	07BC6737F5488E2447E6E087D8E2D0E0A545528CA9AB462DE47FB5A876B6C09B
SHA-512:	802EAB341DA551C6661177236D1D0A90FC7A56772FDCCAE967AA2554484303F6FBED3A84EBF8F5C2469E0B7F6BA945091DDAF412A62B1B185D0A2AF50B3C7C07
Malicious:	false
Preview:	@echo off..setlocal enableextensions..setlocal enabledelayedexpansion..%SystemRoot%\System32\chcp.com 437 > NUL 2>&1....rem //-------------------------------------------------------------------------..rem // ATTENTION: must be run from BIN_FOLDER! This will be checked...rem //-------------------------------------------------------------------------....rem //-------------------------------------------------------------------------..rem // Configurations...rem //-------------------------------------------------------------------------....rem //-------------------------------------------------------------------------..rem // Install mode...rem //-------------------------------------------------------------------------..set INSTALL_DISABLED=NO....rem //-------------------------------------------------------------------------..rem // Debug & execution settings...rem //-------------------------------------------------------------------------..set DEBUG=YES..set EXECUTE=YES..set /A COMMANDS_C

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256264
Entropy (8bit):	6.2955594026089035
Encrypted:	false
SSDEEP:	3072:es6ryPjYTMityGIIzkEGir0ZHHrCnd2T2lwOEsKAkuWKzvvMvvvvvvvRRvvvva9e:eM70ty2kcQeEsxpYNt1TenE
MD5:	2973E0674914E74DE09DAEB46197BC3A
SHA1:	731D1C39765EB42192DFFC6198927780B4EB407B
SHA-256:	3C30A87F958C91A4AE8363069234860D4EBB32C14841D7C8D34DB2AE647DF57A
SHA-512:	BED02535BBC99300FB14064C859D97BABF4106239044A1E424B0B5E5885FD8412DE4AC9FB8F973C9B8CA1828F7CCC649C305A4004B3DE69897441D2E5EF97C43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J..+..+..+..._..+..S2.+..iY..+..._..+..._..+..._..+..iY..+..iY..+..x^..+..+..*..c_..+..c_..+..c_^.+..c_..+..Rich.+..................PE..d...b..e.........." .....2................................................... ............`A................................................L...........4................)......d...0X..T............................X..8............P..H............................text...f1.......2.................. ..`.rdata...M...P...N...6..............@..@.data....J.......&..................@....pdata..............................@..@.rsrc...4...........................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_audio_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	399624
Entropy (8bit):	5.716675188724347
Encrypted:	false
SSDEEP:	3072:5I4PhB9D8zsVZ0QtqhPLoFppKccIosyjojAeJxAQxiyAUUS7ARqw+LVk3hSXlllw:5HRozsVOQtTmsy0j5JW8LHDeH
MD5:	7A8280D048AE335F09ADA5EF339D7399
SHA1:	7F650EDE674915E5C58D2AE10DBE057DF9CEB393
SHA-256:	5BB34C81EB1E5A59871EC3BE9D29E1B3097907721C72C6D7D23B82D0C01ACF84
SHA-512:	D477805AB0519FF0E38E2316E5EB6105C65901B63B3DD19C1251ED4295F4C16D19BDDD086F9068F0DAFD2ADDFE84B151B32287A1C87C813774EA09DAEC293941
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*vGvD%GvD%GvD%+.E$EvD%N..%_vD%..C$FvD%+.A$JvD%+.@$OvD%+.G$CvD%..@$EvD%..E$]vD%..E$DvD%GvE%}wD%..L$PvD%..D$FvD%...%FvD%..F$FvD%RichGvD%................PE..d......e.........." .....t...x...............................................@......Q&....`A........................................@...$...d...\|.... ..4................)...0..d.......T...........................p...8............................................text....r.......t.................. ..`.rdata...P.......R...x..............@..@.data...............................@....pdata..............................@..@.rsrc...4.... ......................@..@.reloc..d....0......................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_crashlog_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	269576
Entropy (8bit):	6.280263281558818
Encrypted:	false
SSDEEP:	3072:ZpxUsIuaRoP07cRB8P+jcxLCafHOr7o69hk5j9t1Lt3+vTKlnZvVwJKyJK7AkRxj:Zpx/aRowLCaOo69ejFR5jse5
MD5:	BECCE56400BB738C9615B80FF28381BD
SHA1:	B113DC13C38567D6CCC46BB68DA53785AA4DEAB3
SHA-256:	F13E48A53ED4279A3BF90DC6B73470CDC1ED3C692FE7EF40C6100A90141697F6
SHA-512:	336DC0B47082DEE4E5C066462744BC658A17AA41A3492D65AB64D53A0C0930A8BB89089DFBC796E528A13593CED2A4A665B32B010A4707DD2DC38981A345C642
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......]..O..............F...................u.......u.......u.......u.........................z..................................Rich............................PE..d......e.........." .....@...................................................@............`A............................................(............ ..4.......X........)...0......te..T............................e..8............P..x............................text....?.......@.................. ..`.rdata...k...P...l...D..............@..@.data....9.........................@....pdata..X...........................@..@.rsrc...4.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_csme_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	241928
Entropy (8bit):	6.2760909894753425
Encrypted:	false
SSDEEP:	3072:T47/QLNEF/YO54685ppm26xC+Vb1BMgAevjTiDtee10HbqvnRCMRxcccccccccce:T4cLNEFwO54H5pd4jWDmC7yOHeT
MD5:	B3686538E1F8E7C22C11BBBFF34E3F88
SHA1:	5E9895D9517747A9E7849C24B1C3D8B376F408CA
SHA-256:	AB5CDE036D0D3F98E1BEA52A25F6DEA1DB8C93E4D70F4B893BA662073421BD6C
SHA-512:	39FF49F2C0A5D34631352D704B71CA4E730487C87D7C4D38365B1C09A3F74B0135746C9133749991C299B73DE589F9F1D3E93E21E4B17C5A62A62838D927A583
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..T3...3...3...:.../.......2.......2..._...5..._...%..._...;..._...7.....1.......(...3...j....+.....2....s.2.....2...Rich3...................PE..d.....e.........." .................+...................................................`A.........................................T.. ....]..........4................)..........0%..T............................%..8...............p............................text...,........................... ..`.rdata..$d.......f..................@..@.data...`............j..............@....pdata...............p..............@..@.rsrc...4...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_desktop_mapper_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	273672
Entropy (8bit):	6.276752678336845
Encrypted:	false
SSDEEP:	3072:/4h2mw+wtBgI+4LaE+pfsXgAuYTwNIyDldGm1MBLNgkUhia2NN8N1N04NNNNNeNp:/jtBgIIsXim2MoYRfaZex
MD5:	7E57150540A32984D9765D9D4C93EAF2
SHA1:	AAD1EC7650BE3B4F809F658B17C8CC183CB49BDF
SHA-256:	55D3880CBEA86F2825F7FC397D5F55FFFA3D6B8479CA87D544C75FE732ECCE04
SHA-512:	81BE36B761B9F5A0B1168A8647E531A0819F099F42821D092BEABD7E11A50D6478D7583CA1AE4B59523B9C18E20A1188AF226D252FC6EE12994C1A22C5ADF390
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................a.........a......................a....p..........k.....k.....k.t...k.....Rich............PE..d...a..e.........." .....b..........p.........................................}...........`A........................................ ...$...D.........\|.4.....\|.t........)....\|.T...@...T...............................8............................................text....`.......b.................. ..`.rdata...Y.......Z...f..............@..@.data.....y.........................@....pdata..t.....\|.....................@..@.rsrc...4.....\|.....................@..@.reloc..T.....\|.....................@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_display_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	239880
Entropy (8bit):	6.264757151382625
Encrypted:	false
SSDEEP:	3072:YTeYoVj/sNArIKx0Fp2jp+uep+zZxGGGGpGGGGGwNYGGGGGGGGGGGGGMGkk2bDRQ:YGVj/ru+9ARXq/ey
MD5:	D8E485DB4B5BF1D0748204162703B00F
SHA1:	D8940AF77D5CE13713D1C7F1F455DF183B8E9181
SHA-256:	8421AF80FF3ECFB00601594D76CDC693DF1CFF6A76002899DAFEDEBA53CE2E81
SHA-512:	EC4AE22CEC62B58F10A48D71136AE59FC84384352CB275E432BCF0D96136F9F8FE13A274DDC670F4FBECA7A0BC8780A5D8ED0969A921A7F886FBB58886EC46B2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K9[PW.PW.PW.<^V.RW..XS.QW.YR..HW..XP.QW.<^R.]W.<^S.XW.<^T.TW..XV.LW.._V.SW.PV..+W..^_.DW..^W.QW..^..QW..^U.QW.RichPW.........PE..d...)..e.........." .........z......................................................o.....`A.........................................Q..@...@Z..\|.......4.......x........)......l....(..T............................(..8............ ...............................text............................... ..`.rdata..lM... ...N..................@..@.data........p.......T..............@....pdata..x............j..............@..@.rsrc...4............x..............@..@.reloc..l............~..............@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_etw_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	483592
Entropy (8bit):	6.1449228854921305
Encrypted:	false
SSDEEP:	6144:nBEEWM1UhOHWXNRcDfjdYXySvN/rhtjWJBiAOedl:nBEG0OkKjdYXySZ8iAfdl
MD5:	52B5FB30961038FD29EC7577805D2C4E
SHA1:	D7F25D1A72DBB03B58541A2AC972AE36F1493F77
SHA-256:	A036CAAAB82E28C9B20215BD2128B5615BAB16B9B8C4BA423AE7CBBC6955D51B
SHA-512:	9F47D4DD6D5F5460D8539916F4E3D058130874D6D07FF6D7193EB07F2CAA40209CDFA67E98D5463E977771B0EC85B5C12AA4738FD146F6B49ACB2F87EF988DC1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g:Ta.iTa.iTa.i8..hVa.i]..iBa.i...hUa.i8..hYa.i8..h\a.i8..hPa.i...hVa.i...hta.i...hWa.iTa.i<`.i...hta.i...hUa.i...iUa.i...hUa.iRichTa.i................PE..d......e.........." .....6..........0.....................................................`A........................................p.......h........`..4....@.......8...)...p......0]..T............................]..8............P.. ............................text....5.......6.................. ..`.rdata...j...P...l...:..............@..@.data...(x.......p..................@....pdata.......@......................@..@.rsrc...4....`.......0..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_foreground_window_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	251656
Entropy (8bit):	6.29005781863675
Encrypted:	false
SSDEEP:	3072:hIBDBGfBMh6NTsts9NpAQFfFXXHKG0BCgqKvuhyuTGGGJJHHXHEHCpa27AkRxccr:hCBGfBMh6NTYizCCgqKqaRgzRkeI
MD5:	71748AEB40ED6266549AF7F5ECB7EA3A
SHA1:	9D01AF1E4535DF3E890C662E9511A4BFA352E2B5
SHA-256:	DCE31E6814FAAFDCBC8EA4F8CA27E1EB70982A020B332BECA764C90B24EE957B
SHA-512:	B94A9988FA0B363FDE39D7FFC61EF15308B4943DD5EA276D212DA216B462BBBD64C3635D2080BAE832E3D4589EE7704E0811A24A184DA328574FC579809785B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>Qxqz0."z0."z0.".D.#x0.".B.#{0."sH."f0.".B.#{0.".D.#t0.".D.#r0.".D.#~0.".B.#b0.".E.#y0."z0."11.".D.#i0.".D.#{0.".D."{0.".D.#{0."Richz0."................PE..d...h..e.........." .....................................................................`A.........................................t.......}..\|.......4................)......p....H..T....................J..(...0I..8............@...............................text....)......................... ..`.rdata...Q...@...R..................@..@.data...4&..........................@....pdata..............................@..@.rsrc...4...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_fps_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	390408
Entropy (8bit):	6.332806734980657
Encrypted:	false
SSDEEP:	3072:obtjFXDK0ThXr4QLI7JUpU7ru26vn7wvqEJ85Y2z8t+kKkOiXDeWaM4VBILy3BFv:oZd0QLI7KpU7rvdQkEqbqPBzUjRBUe/c
MD5:	00764A85FDB79269ACD2AEF706CB7B31
SHA1:	17F8FF5847FC1BE6B5AB9D4A5E0E1DEAC0AABEAE
SHA-256:	B580EDCAAB6EDEAC4B342221221B74967C250090FE6F373E210D18DB33D2AFB2
SHA-512:	84B11176442180C42ABF42BC1AE52957AAD3D1ABDC2C1D7A1FF8B774D662376379368F217917AB052DE388B176F3BAC3044AFB2C388308A13B599C01987C32E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=...S...S...S...R...S.%.W...S......S.%.T...S...V...S...W...S...P..S.%.R..S.4.R...S...R...S./.[..S./.S...S./....S./.Q...S.Rich..S.................PE..d......e.........." ................p........................................0............`A....................................................\|.......4................)... ..........T...............................8............................................text.............................. ..`.rdata..nS.......T..................@..@.data........0......................@....pdata..............................@..@.rsrc...4...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_heartbeat_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	81672
Entropy (8bit):	5.617444801614595
Encrypted:	false
SSDEEP:	1536:5EucRPE1eJA893GttTHJszDz4zExRRxRssreU8eia:5EucRfJA893GttTHJszDz4zExRRxRssz
MD5:	86580E6455D4B421AE878D07FA5461A7
SHA1:	78AC4DA3D20D53AE58920E211AEBC5C7FA11103F
SHA-256:	4F00932ECBDDC71AF7346A18ACB567F5CAF8F7B38DC3F8EC96698BF695B71567
SHA-512:	F3BFAC79DCEFF85DF079D4F6F3C06121CFBD1923C77D9A01B5E809DB285F6A5ADA6EB061995311B35181C94DD871F99D3C7F02B1DECF3ABE58B8AFB48A956152
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.jY<...<...<...P...>.......=...5..........=...P...1...P...4...P...8.......>.......3...<...........-.......=.......=.......=...Rich<...........PE..d......e.........." .........`...............................................p......$*....`A....................................................,....P..4....@..0........)...`..0.......T........................... ...8...............0............................text...&........................... ..`.rdata...2.......4..................@..@.data...@"..........................@....pdata..0....@......................@..@.rsrc...4....P......................@..@.reloc..0....`......................@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678664
Entropy (8bit):	5.894124774349094
Encrypted:	false
SSDEEP:	6144:Zl1rjUtf9yGkptwujoy4Jphr+4pnlMaFR4IiEi6Wse8:FrjUh9KpLjo/r+qltdi608
MD5:	D6B2BD53D1D19AA24CF46CFA48A02B06
SHA1:	FF3A531C99DB90AC11BD749A69F0AE9198E9F178
SHA-256:	DDF7EDE41D995FBCAEF8B38F36EDBF63E91E6A85BA4B824DF1163C3390D3F883
SHA-512:	0D3FFED6778410903B322594649F42908E73938410C27B8BFAF418835A5BED7613506816E800E4E821F6D300E89682472C77294599751EF9C45598580DC992CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......OI..(...(...(...Z...(...P...(...Z...(..g\...(..g\...(..g\...(..g\...(...Z...(...]...(...(..Q)...\...(...\...(...\z..(...\...(..Rich.(..........PE..d......e.........." .....6...........\..............................................Y5....`A.........................................w..................4.......<....2...)......@...P1..T....................3..(....1..8............P...............................text....5.......6.................. ..`.rdata...G...P...H...:..............@..@.data...............................@....pdata..<...........................@..@.rsrc...4............*..............@..@.reloc..@............0..............@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2556680
Entropy (8bit):	5.094270976710373
Encrypted:	false
SSDEEP:	24576:1xBzqOnlc4Z1PN2cct5SatyY+wtAqH1p1D+ZE/LoQ1KZkdtnkrW:1xBzqOnlc4Z1cFt5SatyYbVp0Z4oW6i
MD5:	6EE41CAF9C991325D4AEFF29035B043E
SHA1:	0EBE710253392C8AF39DAE1342EBB09CD59C256A
SHA-256:	8B056BC5176E08D6028D15108201F666EB4BD130A518012D294A1856D0942D5F
SHA-512:	41E9FBBC64F6CEF08CDA3598EC179F356F47D081D4F0B15B8A91E68996B5F860BD954548085E035CC949BF2E7E194B64F19E05D9B5A9D3A2879F1B106657E56D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[...[...[...Z...[..._...[......[...\...[...Z...[...^...[..._...[...X...[...Z...[...Z...[...Z._.[...S...[...[...[.......[...Y...[.Rich..[.........PE..d....e.........." ................ ".......................................`A.....&$'...`A............................................,............@A.4.....A.......&..)...PA.t....I..T....................K..(....J..8............0.. ............................text...K........................... ..`.rdata.......0......."..............@..@.data...`.".. ......................@....pdata........A..0....&.............@..@.rsrc...4....@A.......&.............@..@.reloc..t....PA.......&.............@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	596232
Entropy (8bit):	6.300206199908601
Encrypted:	false
SSDEEP:	6144:CPWZCCrARfpBzLN2hfqLw0p1h+isz9QKBNey:56RfLzLN2hCLw0jgisRQKBIy
MD5:	1C00526F660FE0AE069CC37BDCFC7C0D
SHA1:	F53EE60F8729C3DB3B180B3C03D99A8054732C10
SHA-256:	546E0EE8849B361C5A3B5E482B76D5088D34A8E9BECB47A72164E8179F584CB4
SHA-512:	A3F6EC6AC7A92C89C5F2E4D2EF3E184C5BB624E1354416A18876D05A1AD0E1085309D664D530AB5EAAC022B894A03176D24CFD9407F2E3285E234AE2B58B7A59
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X. ...N...N...N.p.O...N...J...N...I...N......N.p.K...N.p.J...N.p.M...N...O...N...O...N...O.V.N...F...N...N...N......N...L...N.Rich..N.........PE..d...d..e.........." ................`^.......................................@............`A.........................................v............... ..4................)...0..h....:..T....................<..(....:..8............0.. ............................text............................... ..`.rdata..Hh...0...j... ..............@..@.data....W.......J..................@....pdata..............................@..@.rsrc...4.... ......................@..@.reloc..h....0......................@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_phat_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	225032
Entropy (8bit):	6.222482962825028
Encrypted:	false
SSDEEP:	3072:/bjh6AYjRbUxfj1/jITaiRTt4gq3BruDZK4Z7x6////////en/////////Nt5t/N:/x9YNijIfBBZXGGea
MD5:	DFB40ECA78AB2C220A93CEA99895E6F8
SHA1:	6B5D02B81812B751954A51ECEA6D57A01F3A6C72
SHA-256:	FB00C17965A92800BA0FCA9665C92D369E0E15C97993C3AB35E4774FD92AC496
SHA-512:	7B2E457837B0CA29A3F98F4A75A07FCBBD5706A26485F16D4FD2D2FF502CD2070D1EB08DA77CBFF081589940E4479E413B24FEF3AA525662DEA98A8EAC0395DA
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........}............................................................................................................................Rich............................PE..d.....e.........." .........j......0................................................R....`A.................................................6.......`..4....P.......F...)...p..........T...........................P...8............................................text...L........................... ..`.rdata...Z.......\..................@..@.data........P.......8..............@....pdata.......P.......0..............@..@.rsrc...4....`.......>..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	364808
Entropy (8bit):	5.958819853143265
Encrypted:	false
SSDEEP:	3072:Qknak715+8l8lZQztQthfpxhHFm0q6ePe1EoYl3zTB4YOqbsmBXmYk5AHeUjJ+0K:QCa+1bl8lCzt6hfpTH476oBnsKaeBRY
MD5:	4F83266FA036C9F30D934E87EEFCE9AA
SHA1:	3498EE5F051E99F39A3B8229D550C9F6EE90771C
SHA-256:	D23174B4F9924936088FD215001CCD8E38BBEE3DE2A60F487C95D16CD3F686DE
SHA-512:	442C412969C57B1287718A54BE47816DB8BFE6A2AF1DDDD14FCD07D86CE19F20BBBF2524650F49AF0AD1CFAAE6F4E2930370B8F07475A22740C8DBA40607678B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........KH...H...H......I...A.#.V......I...$..N...$.._...$..@...$..L......J......_...H..........\......I.....O.I......I...RichH...........PE..d......e.........." .................L..............................................$y....`A........................................P@......LI..........4.......L....h...)......X...0...T...............................8............................................text...l........................... ..`.rdata..@...........................@..@.data....3...p.......P..............@....pdata..L............J..............@..@.rsrc...4............`..............@..@.reloc..X............f..............@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_watcher_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	270600
Entropy (8bit):	6.301787319782967
Encrypted:	false
SSDEEP:	3072:Rn2ZqblLj1IsfdboYaSXRpKOmDBncjfJCOTGm/PrZ6ozLS49Q2cQnK1ARZD3FrV2:RvblLj1IWz7KOmDWZoZh8LeZ
MD5:	949AA97C46BD86156C5A1F4553CAF022
SHA1:	8E0FDDB11583F6FCDE8774438E8C3EF6F3A9876A
SHA-256:	C662B9484A289ABB166CEAA98F11A79D5BBA0E969CE3D83A888A52FD8D3CB25C
SHA-512:	B16B22640037B3447DC4826AB548818BD495DDFE0A8A96B46BF0547AC326B09E27B7DE189C1EA6A886A766DDCDCFC9F285569D52B4F1A6196576D4FCC1E2F0F6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.\|t3..'3..'3..'_..&1..'...&2..':.')..'...&2..'_..&=..'_..&;..'_..&7..'...&)..'...&0..'3..'...'...& ..'...&2..'...'2..'...&2..'Rich3..'........PE..d......e.........." .....Z..........p........................................@V.....C.....`A......................................................... V.4.....V..........)...0V.....Pz..T....................\|..(....z..8............p...............................text....Y.......Z.................. ..`.rdata..TS...p...T...^..............@..@.data...$9S......0..................@....pdata........V.....................@..@.rsrc...4.... V.....................@..@.reloc.......0V.....................@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sur_sysprep.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22280
Entropy (8bit):	6.575331791120531
Encrypted:	false
SSDEEP:	384:WQJ1r55vj4pwKNsehdDiDGoGCJEF8ZpHti3f:WWNJZehdD4EFiRSf
MD5:	3702C4510906FF0F2514EE6C6E726A8E
SHA1:	C45A800C86AB82235BC99394E4ECE862F41BCD52
SHA-256:	11910BEB0841E07983125A81B99D84D8D46BDDB2F3ADB357EE457358EB478F95
SHA-512:	A084B0B5781037C9F2D8735B10DCC8D572483D5631A64BA7E7D439DFA39363ECF1B3BAF3238088FB9471FDFCBD0926CE7DC58E85081784BB9487F446794C6883
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................'.......................{.........q.....q.....q.K...q.....Rich...................PE..d...F..e.........." ................`........................................p......_.....`A.........................................(..l....)..d....P..4....@...........)...`..(....!..T...........................P"..8............ ...............................text...H........................... ..`.rdata..2.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc...4....P.......&..............@..@.reloc..(....`.......,..............@..B................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	226056
Entropy (8bit):	6.261126304744114
Encrypted:	false
SSDEEP:	3072:UlLTR+7XrwUIq7JYBw6tFn3s/u1l6Pa7AkRxcccccccccYCB3cRa1aaRa1aooESb:aTarnXSVRKyLeh
MD5:	3799B7BBECD22FF78301DA75290B4C1B
SHA1:	8A709D2E2BFA3AD8C097E50F746A8790FEE7FC58
SHA-256:	C21732838ED3505EF8662760FCB2BF01D991E5DC63F3EDB2B6F965E0D7A1313D
SHA-512:	C07ED748C005E4D36B62A588CBC8A8F485A7198C29F7FB2F2C1432B5B1E6BD62274EC856BE1E923C99CAD0692ADDC8F2D7851811C37C27286C2E9FC972C7F82A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..bV..bV..bV..W..bV.".R..bV......bV.".Q..bV..S..bV..R..bV..U..bV.3.W..bV.".W..bV..bW..cV.(.^..bV.(.V..bV.(....bV.(.T..bV.Rich.bV.........PE..d......e.........." .........b......................................................;.....`A.................................................7..\|....p..4....`.......J...)......l.......T...........................p...8...............@............................text...V........................... ..`.rdata..2J.......L..................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc...4....p.......B..............@..@.reloc..l............H..............@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_user_waiting_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	220424
Entropy (8bit):	6.270355792021361
Encrypted:	false
SSDEEP:	3072:NBrEjuZF7h++uzwJ3jsfXV4yuHZev4xrIADRxcccccccccaccccccGCF1aRa1aaY:NZlXh+S9xbRrAsleVl
MD5:	859CB3BFB9E8FE580E7F8FC1BA31C85E
SHA1:	10807F657DD500E5F61A01645202712AC90DF538
SHA-256:	650CF32759AE4A698DCA7A18E7DDDEB18980A3EEC768061E3597A815AB7C962C
SHA-512:	61AA0FDD01ED313A8EA7D47D8B916F71D5752D749B4292E299C28F5FF0EEAE13D6E375F667AF0139407C9194CD5BFCD6550AAD278F69C821B0F46AA1D9ACA220
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........0..^...^...^..._...^.].Z...^......^.].Y...^...[...^...Z...^...]...^.L._...^.]._...^..._...^.W.V...^.W.^...^.W...^.W.\...^.Rich..^.........................PE..d......e.........." .........b...............................................p......^c....`A....................................................\|....P..4....@..d....4...)...`......@...T...............................8............................................text............................... ..`.rdata...I.......J..................@..@.data...D....0......................@....pdata..d....@....... ..............@..@.rsrc...4....P.......,..............@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248072
Entropy (8bit):	6.201775417295103
Encrypted:	false
SSDEEP:	3072:N1e7WJkf9tzrHBTZh5OuZHE7OCwheapJ2tu/t/z///ZPI8c9cc//M8kKfH6cccc9:NY7ZjlFheabqe9
MD5:	470FA95862CF58FF44A596955BFA3120
SHA1:	D778F02D9C4279BA973BDD5551F5F08C96C400A8
SHA-256:	699B0FB12C8C08D3376BCE9B328E815B9112DBC19FACBFAC680C7008FF8B8B61
SHA-512:	39FD03C07646084161ED857C2742731E9FD36B33A1BBBA71AC253437E81D065906832C688A525F88DDAD76ABC83B92EBD4550FDF0D599C85391C0D1BD97C5840
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D$...E...E...E..l1...E...7...E...=o..E...7...E..l1...E..l1...E..l1...E...7...E...0...E...E..-D...1..E...1...E...1...E...1...E..Rich.E..................PE..d......e.........." .....@...\......p................................................[....`A........................................p{......h...h.......4.......,........)......h...@W..T....................Y..(....W..8............P...............................text....?.......@.................. ..`.rdata...E...P...F...D..............@..@.data...$...........................@....pdata..,...........................@..@.rsrc...4...........................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\libcrypto-3-x64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6314248
Entropy (8bit):	6.072578410906629
Encrypted:	false
SSDEEP:	98304:+j+FQs+/Wc1uzl4eLzbnoPe1CPwDvt3uFFZC3:YYQs+/Wd4eLz7o21CPwDvt3uFFZC3
MD5:	93707F4CA824BD85C5874A1BA6DDAA71
SHA1:	6B8DB7D76762A6B5A298C82E7D3D0652506F3EF9
SHA-256:	BC4499A24CEFD52705E4FC4CDB2FF6C5E893714838AB4BE5093AC1022172A02C
SHA-512:	B8C11A8B55E9236805CA5B53846905679F0FB6C7DD655159A31297DC1DFE379375B57C0F581B87B9118CF96F5B348D50D4D984376877207E1E1A08E030DA334A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........?.e.l.e.l.e.l..Tl.e.l...m.e.l...m.e.l...m.e.l...m.e.l.e.lSe.l...m.e.l.e.l.e.lT..m.f.lT..m.e.lT.8l.e.lT..m.e.lRich.e.l................PE..d....#fe.........." .....6G..,......g.........................................`.....y.`...`...........................................X.j...P._.@....._.s.....\......0`..)...._.......T.8.............................T.8............._.P............................text...d4G......6G................. ..`.rdata..J....PG......:G.............@..@.data...!.....[..V....[.............@....pdata..d.....\......$\.............@..@.idata...(...._..*...._.............@..@.00cfg..Q....._......B_.............@..@.rsrc...s....._......D_.............@..@.reloc..P....._......L_.............@..B........................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	229640
Entropy (8bit):	6.3043952868606485
Encrypted:	false
SSDEEP:	3072:kGe0Dm3e4qdTFiabTJT2ej9bk0kVfP6vvaHA28RhhPOOASK1F4glgX6YdlM9jr5X:kgmuJdtx96RskKeh
MD5:	18444BDEB01A9C54E148949C6C3A198B
SHA1:	A35AF0E22A0DE38AD1220EEDC65ABFED588A6DFA
SHA-256:	0E31B8717E7FD67C2D19D9A64F9C4741B9E692B3473420347D45B987E683547D
SHA-512:	34DD030D0F6FC3BB58701F88CA52B629A95D51E661A4CAF24F326339075F04D19EDCEE9C46E95A6A7912FFBC1B41914545C993C12502A660D4AD3790E7DFA1F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f^O."?!."?!."?!.NK . ?!..M%.#?!.+G..:?!..M&.#?!.NK$..?!.NK%.*?!.NK".&?!..J . ?!..M .9?!."? ..>!..K).)?!..K!.#?!..K..#?!..K#.#?!.Rich"?!.........PE..d...H..e.........." ................................................................._....`A....................................................h.......4.......T....X...)..............T...........................`...8............................................text............................... ..`.rdata...;.......<..................@..@.data...(........Z..................@....pdata..T............F..............@..@.rsrc...4............P..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\process_input_options.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.422531119173795
Encrypted:	false
SSDEEP:	3:MQTgLqNrEnP24M0MPktFEPzWL9bA8VoiFLxW:pgL7m7PYFEP6q8CB
MD5:	CE2FD881F8F772189AAA8217D4C1C10A
SHA1:	9AF8564B0FC89B3C3D18E8310E425A0AE3FA858D
SHA-256:	92CBCFF73CCD6FC6DC728EF09FD0122C8EF4F0EE27FD89A70FF646E41F230D83
SHA-512:	D6579AFEF64A0C455CDB1F45D03395DD82B5A459E9CAFDF2D25CA58135DB3B6C0BA7842B472E79D9E175C4B8451809F4A4AF0194EA3D68895EE2409CCFA0CA42
Malicious:	false
Preview:	sampleinterval=10000..processETWstats=yes..diskETWstats=yes..memoryETWstats=yes..networkETWstats=yes..ETWtrace=yes..overrideETWsession=yes..topNprocesssamples=10..highcpuutil=yes

C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36616
Entropy (8bit):	6.435871744344736
Encrypted:	false
SSDEEP:	768:FQsSu+dFIxMKaASGq6JBeW6xaxehdDrFEFiRN:RR+9Kn1JT6xme7FeiH
MD5:	262614FB76F7132B2F98AEDA4052C374
SHA1:	70B59E6FAD1AEAB0D3A0161EE3E8F0E55A244E32
SHA-256:	23C0712CBC95A22BEDC1BAE33F2FFBB36C678E06BCD2D5D8BCA3D4E0D20868D8
SHA-512:	9F4D075CBB0BB392444E8B740ABE426FF36B8EC8A892DDC4DF8F799A3FA2100ED6F5A24C47D6021B8B120CEEAE8C424EEB11465747FB431FDE6F80F812F1D1D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]!.A.@...@...@...8...@..u4...@..u4...@..u4...@..u4...@...2...@...@..P@...4...@...4...@...4s..@...4...@..Rich.@..........PE..d...7..e.........." .....:...(......................................................U.....`A........................................ \.......\..........4.......L....f...)......(....T..T............................T..8............P..P............................text....9.......:.................. ..`.rdata..R....P.......>..............@..@.data........p.......T..............@....pdata..L............Z..............@..@.rsrc...4............^..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link_helper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62216
Entropy (8bit):	6.109755553207947
Encrypted:	false
SSDEEP:	768:7xHQWztGUCtnRfrePusKFwt6xUsTGWMpgZuK06QlhP2kg/JWCPgHQaJsvHgXXuSk:7xH2tnRwtZUQr2BJuDz9drElfeOmeis
MD5:	9EC0F279AA47347651C14CE07FB2D9DD
SHA1:	54831C0FD9D76AE078536356BB11C04E89BBE8A2
SHA-256:	6442996B672AD20F2CEAE10271455F85B699F16ABF1D343396B63EB7BE064AC4
SHA-512:	3DC39D0C3EF8A610BBD771B0A193E9173372A42712666E7BBAABDC0E92E91E6037DF9C322B51563AB2477198C91C8C982A5E1D20E62DE554F1049D00ED568FE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x-.z.~.z.~.z.~...~.z.~.....z.~.....z.~.....z.~.....z.~O....z.~.z.~.z.~E....z.~E....z.~E..~.z.~E....z.~Rich.z.~................PE..d...*..e.........." .....l...Z............................................................`A........................................0...d...............4................)......(......T...........................@...8............................................text...xk.......l.................. ..`.rdata..&............p..............@..@.data....6.......2..................@....pdata..............................@..@.rsrc...4...........................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11150
Entropy (8bit):	7.283284626349284
Encrypted:	false
SSDEEP:	192:OMUoGOvjyrWjJCmOL7yKnUi8rFWQFm7f+y50Nr7OxX01k9z3AzskXVXqrfn:OKJvv4CFRk7my50ZSxR9zusku
MD5:	30EF631B5F1AD4B5893BB5243E0D4C4E
SHA1:	C4419428B53E6B32F81282F20F8CD0ED496494A6
SHA-256:	7C3C3B345C52AA569A3F377B3CB7A858C93B66635C089E0F554D4CDBF545CBC9
SHA-512:	8C0C5CEE4529DB0E2D18D02F1D3E5C41B3849EB4F2B98B89C4A4C711290DC344429F5474C02C6A19B7A22218BBC6026FD21C8DC3A4F1C17918509D13C00043AB
Malicious:	false
Preview:	0.+....H........+{0.+w...1.0...`.H.e......0..A..+.....7.....20...0...+.....7.....`M.-A..H..5^'p....220809175113Z0...+.....7.....0..p0.... ..:<.(.(_.m.(...?..,..../E.C.d[1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... s.e.m.a.v.6.m.s.r.6.4...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..:<.(.(_.m.(...?..,..../E.C.d[0....;...'.c..YB....E.iy1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... s.e.m.a.v.6.m.s.r.6.4...i.n.f...0.... ...n.'..v.g.-xz(.\|.F..J.O....#1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... s.e.m.a.v.6.m.s.r.6.4...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...n.'..v.g.-xz*(.\|.F..J.O....#0......D7Zq..y..W....=..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... s.e.m.a.v.6.m.s.r.6

C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2194
Entropy (8bit):	5.415461243479411
Encrypted:	false
SSDEEP:	48:RlBHWXrNcDjiods4CGobBNpSyjaMNnzRZB96KUmlAfMOjHNG4oa:poNMRsfGkSyj3DjAUOn
MD5:	70E18044ED3D82188B89F728528FC40C
SHA1:	3BC8169D27BB63F9CD5942D1B11EF5A945966979
SHA-256:	1C063A3CDD88281D285FEA6D9028BF0ADE3FF59E2CA0BF80012F450C4317645B
SHA-512:	41274EDF40424BDF11A94C531A8DAA8428A7A1D070BC4DA98DCCBABAE9A410A23D0C3609DB28ADAFEDF60662BFD242AC776AEA60C4CFF0D12D1411BE1B3D5AF2
Malicious:	false
Preview:	[Version]..PnpLockdown=1..Signature=$WINDOWS NT$..Class=%SAMPLECLASS%..ClassGuid={7B40B6C5-A603-40CA-88BD-D8248E55D370}..Provider=%MFGNAME%..DriverVer = 06/06/2022,2.4.2.8..CatalogFile=semav6msr64.cat..DriverPackageType=PlugAndPlay....[ClassInstall32]..Addreg=SEMADriverDeviceClassReg....[SEMADriverDeviceClassReg]..HKR,,,0,%SAMPLECLASS%..HKR,,Icon,,-5....[DestinationDirs]..DefaultDestDir=10,System32\Drivers ;Drivers directory..SEMADriverDeviceCoInstallerCopyFiles = 11 ; System directory....[SourceDisksNames]..1=%INSTDISK%,,,....[SourceDisksFiles]..semav6msr64.sys=1..WdfCoinstaller01009.dll=1 ; make sure the number matches with SourceDisksNames....[Manufacturer]..%MFGNAME%=DeviceList,NTamd64....;[DeviceList]..;%DESCRIPTION%=DriverInstall, ROOT\SEMAHWID....[DeviceList.NTamd64]..%DESCRIPTION%=DriverInstall, ROOT\SEMAHWID......;-------------- Driver installation..[DriverInstall.NT]..CopyFiles=DriverCopyFiles..;LogConfig = LogConfig_Device....;[LogConfig_Device]..;ConfigPriority=NORMAL..;IRQ

C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47240
Entropy (8bit):	6.764388916875618
Encrypted:	false
SSDEEP:	768:Vi4vmZoK1QaD4cTM+lU8KGuafVD/0wupGU1KLziYtPtAC92yiRm4cnnLYj/9zt:V7n3alleAVD/LPtACsyiYfn8Zzt
MD5:	0A430B184878A92E6C94E1B6A7F217B3
SHA1:	1B17E03BBCCC709A1A4CB3210FF1880330CD7E79
SHA-256:	01CBBF324E77BA9947FC28BD9E1A624BE29CFEB1ACE5FD03C605D609BA823641
SHA-512:	6CA4EF1CED1537655D469F7F6D2572C234DA70795FE4FEE620DEAA6AB64299D6C03D56BFE671648448258642E9A20EBAE54CF258031E3B2823FC544A3A1ED2D7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?d..^...^...^...,...^...,...^...^...^...,...^...,...^...,...^......^......^...*...^..Rich.^..........................PE..d.....b.........."......F...&.................@..........................................`A....................................................<............`.......j...N......@....8..T............................9..8............0...............................text............................... ..h.rdata..t....0......................@..H.data........P.......(..............@....pdata.......`.......,..............@..HPAGE.....'...p...(...0.............. ..`INIT....\|............X.............. ..b.rsrc................d..............@..B.reloc..@............h..............@..B........................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	872712
Entropy (8bit):	6.088386563633023
Encrypted:	false
SSDEEP:	12288:JMMAY0Pdm/4NKh1ob2s9y07LXa89Jq+htd:JMvYa44NKO2s9JXbBtd
MD5:	DEBE7C098976D96EE08267B6F7301DF3
SHA1:	5A17D975A08A876B531A9DA64EDE72B3E6430A4D
SHA-256:	D6CF8979268A57959D5E58AE4CD677D4B7F30DEAD1112FFF1BCB9D74DDBFEEDB
SHA-512:	B8C53A7A2DADD210481ECA83B0983C8DA4D3669124B03E2D9FA82D4CAD38617CDE9009F61FC4BC138F4A78F9B834BC13058BCD18A205425E7F4E62E536549FD1
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......5..q...q...q.......s......p...x...o......p.....s.......\|.......y.......u......s......d...q...(......c......p....`.p......p...Richq...................PE..d...h..e.........." ................@...............................................CK....`A................................................P...\|....p..4....P.......(...)..........@...T...............................8............................................text............................... ..`.rdata...m.......n..................@..@.data....0..........................@....pdata.......P......................@..@.rsrc...4....p....... ..............@..@.reloc...............&..............@..B................................................................................................................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\sqlite3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2973696
Entropy (8bit):	5.942645707828203
Encrypted:	false
SSDEEP:	49152:cYycyweenoG6hHoik6ofG3GSKE6kFI3ZWWRQRSY5NmW3SfM5wLw4V:Jx6g09FEZWWR2SYNmWRwLw
MD5:	9C15CE380F1A09D8697A6ECD3797BFFC
SHA1:	FB9989CBD42B297B0A253C115B94391507AB5316
SHA-256:	A070C03E4B1AB38C7E980447B6C98DF9E7E30200C50B36D328A8A017CA41D9BD
SHA-512:	FAE03CFEEEC16D059C777886601913C15F4C61B2EA860BF7F77D072D4F85EAF7B6875D246EA7AD593CA7E2D4C55D5537F70DEEA118670DAE92A31935166C2521
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&_.iH..iH..iH...K..iH...M..iH...L..iH...I..iH..iI..iH...M..iH...L..iH...K..iH...L..iH...H..iH.....iH...J..iH.Rich.iH.................PE..d......d.........." ...%.T%..0................................................-...........`.........................................0..~4..xE-.(.....-.......+..b............-.....0((.8............................&(.@............@-.x............................text....S%......T%................. ..`.rdata.......p%......X%.............@..@.data...).....+....................@....pdata..\.....+......n+.............@..@.idata.......@-.......,.............@..@.00cfg..u....`-.......-.............@..@_RDATA.......p-.......-.............@..@.rsrc.........-.......-.............@..@.reloc...7....-..8...(-.............@..B................................................................................................................

C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_eqs.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.7004397181410926
Encrypted:	false
SSDEEP:	3:8Q:t
MD5:	2EB1EC3EB2BE8F788246F3E5CD594346
SHA1:	FEB4086F6B540200873FF547D134A30913D08ABC
SHA-256:	CCE3244892180A2B0431D4CAAA38109851EEC95C3CA88531FE9E65AB6B96FD73
SHA-512:	78A23763EEC938B600B1BC91217FE63F31EA048A8C71D7E7B2975588165D734198F7E45F5357F69B37D7A6DD7DE7E7A0B4418750DA6237D9C51B32A9B9AA0BA3
Malicious:	false
Preview:	FPS(0) MACD..

C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_hw_config.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11990
Entropy (8bit):	5.208061063352467
Encrypted:	false
SSDEEP:	192:CK8NLmd3f87xdySVm5i0S9mvm7mWmcmBm5mGmmmqmqmymVmmmEmAmD5SW6mAzBpR:g7xdyPIPklp0f3Vu
MD5:	373E6D42B5FA7D9367879AAFAF79E685
SHA1:	3AC7E3F1D1CEB76EE10CBBD7497802C84CF88F58
SHA-256:	059484EEA97B786BFABA99FEB1E681B5B1DBF6FEFA7092220953DFD317CAF536
SHA-512:	C5438B4AED08127DA37DC001B122C07C8F2E5B8DD59F29283FAFC5D085BE1725ABDAE5BADAC6C6AF045AAE7392BBFA218440B89077DB54D348C7BD60BB08A8B2
Malicious:	false
Preview:	<global>..clock=5000..</global>....<metric>..name=CPI..level=core..eq= msr_10 msr_309 /..</metric>....<metric>..name=pkg_energy_units..units=joules..freqtype=meta..eq=0.5 msr_606 8 >> 0x1f & POW..</metric>......<metric>..name=power_units..units=watts..freqtype=meta..eq=0.5 msr_606 0xf & POW..</metric>......<metric>..name=rap..units=watts ..level=package ..max=300..eq=msr_611 pkg_energy_units * msr_10 IA_MAX_NON_TURBO_FREQ_MHZ / 1000 / / 1000 ..</metric>......<metric>..name=temperature..units=centigrade..level=core..max=120..eq= 0 tj_max msr_i_19c 16 >> 0x7f & - msr_i_19c 31 >> 1 & ?:..</metric>....<metric>..name=C0..units=percent..level=core..max=102..eq=msr_30b msr_10 / 100 ..</metric>....<metric>..name=avg_freq..units=mhz..level=core..max=7000..eq=msr_30a msr_30b / IA_MAX_NON_TURBO_FREQ_MHZ ..</metric>....<metric>..name=memory_read_bw..valid_cpu_signatures=0x706E 0x706D..units=MBps..max=50000..eq=mmio_5050 64 msr_10 IA_MAX_NON_TURBO_FREQ_MHZ / 1000 / / 1000 * 1000000 /..</met

C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_os_counters.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3906
Entropy (8bit):	5.236903123491591
Encrypted:	false
SSDEEP:	96:16V6/45qe9KLTTvEI+eJa5Ma6acGmyC2zhM+eL3L1LKpELKt0S0JLKK3JLffLPLw:IV6w5T+3SyATGjkK3e3
MD5:	D763669FC98809F06505885C35862EC5
SHA1:	BBC6BB9471E4311FC840796426293ECEAD6D359C
SHA-256:	5A5FACC300773109F8CC9F4290A8E0F5CF62C04624F1B7C28722744E7863C346
SHA-512:	71026A27127478035C9ED151E33C2D2BBCFF199CA3E48092E99E4FBDE155205BE36506042B86147A08530D34B7D68E8E3E683E2078524516548451D7504133A1
Malicious:	false
Preview:	counter=\Processor Information()\Processor Frequency expand=yes..counter=\Processor()\% Processor Time expand=yes..counter=\Processor(_Total)\% Processor Time..counter=\Processor(_Total)\% C1 Time..counter=\Processor(_Total)\% C2 Time..counter=\Processor(_Total)\% C3 Time..counter=\Processor Information(_Total)\Idle Break Events/sec..counter=\Processor Information(_Total)\Interrupts/sec..counter=\Processor(_Total)\% Privileged Time..counter=\PhysicalDisk(_Total)\Disk Bytes/sec..counter=\Network Interface()\Bytes Received/sec expand=yes..counter=\Network Interface()\Bytes Sent/sec expand=yes..counter=\Memory\Available Mbytes..counter=\Memory\Page Faults/sec ..query=baseboard get product, Manufacturer, version description=MOTHERBOARD start_at=auto..query=path win32_pnpentity where "caption like '%Chipset%'" get caption description=CHIPSET start_at=auto..query=diskdrive get caption, status description=DISK_STATUS start_at=auto..query=diskdrive get Caption, status, FirmwareRevision, In

C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363272
Entropy (8bit):	6.414681398502372
Encrypted:	false
SSDEEP:	6144:fGXrAzSVpCreFHGjWIH6BlSIQEaohkHfPvl9eZ:ObAzSVpCr5WAhvoSHHWZ
MD5:	8A02BF22F75FBF6A3C9172238717BA4C
SHA1:	78543F6EA51A8F49FEC95D4AC7631CA0C06BE645
SHA-256:	5C6C61DE91323D8BB5027333B75E9EBFCA4E42C5141FD440DAED5011943C2545
SHA-512:	C4CAF5565BE05C979D260B9B3B07755E490A4E99DF0FB76E8B27E61583CAE912B93D907B524E4C8ABF11A046C8A91F098A7993F3AE09798C8D241E7325F4858F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....DK..DK..DK..GJ..DK..AJ.DK..@J..DK...K..DK..CJ..DKs.AJ9.DKs.@J..DKs.GJ..DK..EJ..DK..EJ..DK..EK.DK..LJ..DK..DJ..DK..K..DK..FJ..DKRich..DK........PE..d...~..e.........."......&...8.................@....................................k.....`..........................................+......$-..........4....`..\....b...)..............T...............................8............@...............................text...,$.......&.................. ..`.rdata.......@.....................@..@.data........@.......*..............@....pdata..\....`.......4..............@..@_RDATA...............R..............@..@.rsrc...4............T..............@..@.reloc...............Z..............@..B................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	315784
Entropy (8bit):	6.2803385461310235
Encrypted:	false
SSDEEP:	6144:aINDWSs7LnKn26xdTY/H4y5a6lDgl/O1aYUMnWzgcQ6JJ:johKnfY/4kajz
MD5:	C4FE3F03EFD3188252CAA101F954FFEB
SHA1:	98B613AEE45C71AED9D2BE0D61D7ACE323929E9C
SHA-256:	95BB425BE3D515A6A58F7399D44DD9E032BAEA11667DFDBA29517C460171880A
SHA-512:	80018E0BDDF079367D3568433A5F89F0144AA0A75286B0105FE32AEEB5D80876C9B2E1ECAAFB70FB041271E27A234A2CB88A2D3D160A4AA3768CCFCFC574704A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S].Y.<...<...<...L...<...DR..<..EI...<...<...<..EI...<..EI...<..EI..C<..EI...<..EI>..<..EI...<..Rich.<..................PE..d....(.`.........." ......................................................................`A.............................................M...+...................6.......#......p....4..T...........................p4..8............................................text...\........................... ..`.rdata...M.......N..................@..@.data....?...@...8..................@....pdata...6.......8...f..............@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	565640
Entropy (8bit):	6.489297717161362
Encrypted:	false
SSDEEP:	12288:C/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6z/yjQEKZm+jWodm:EN59IW6z/8QEKZm+jWodEEY
MD5:	CD0C37F1875B704F8EB08E397381AC16
SHA1:	249D33C43E105A1C36EC6A24E5EF8DBC5F56B31B
SHA-256:	D86AC158123A245B927592C80CC020FEA29C8C4ADDC144466C4625A00CA9C77A
SHA-512:	D60C56716399B417E1D9D7D739AF13674C8572974F220A44E5E4E9AB0B0A23B8937BD0929EEE9F03F20B7F74DB008F70F9559A7EB66948B3AFAB5B96BDD1A6D5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y...................Z.........O.....O.....O.....O.....O.....O.6....O.....Rich...........................PE..d....(.`.........." .....<...\.......)..............................................".....`A.........................................5..h...(...,............p...9...~...#......0.......T...............................8............P...............................text....;.......<.................. ..`.rdata..j....P.......@..............@..@.data...`:...0......................@....pdata...9...p...:...6..............@..@.rsrc................p..............@..@.reloc..0............t..............@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23944
Entropy (8bit):	5.998942809132306
Encrypted:	false
SSDEEP:	384:lXt9apR9/u8FON2WWc65gWZTI14gHRN7FBz4UslGsty:lXK79/u8FOEZwFBrN
MD5:	8AD9C7CFFBB2413F4D5FF9F3AAA1A69B
SHA1:	2B5116E49AC5913EF8A512A7299E9A459DAB4778
SHA-256:	18AEF42187072C35B537BE80E3B2DA7CE4919B2C9574ADD19409D98E3026D916
SHA-512:	D489B82CE896A06CD37905BC5B2FE9620F4E7FEB2A9B77FC93F94E0270B67E7A2F3879AFBA6B546AD44F2EE96F050E83BFC93830010A707126667857BE79028A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h.......h.......h......h......h...h...h......h......h......h...g..h......h..Rich.h..........................PE..d....(.`.........." .........$......................................................Y,....`A........................................P?..L....@..x....p.......`.......:...#......\|...@3..T............................3..8............0..0............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`.......0..............@..@.rsrc........p.......4..............@..@.reloc..\|............8..............@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	185736
Entropy (8bit):	6.539441890812417
Encrypted:	false
SSDEEP:	3072:zo8fdbDQ2RAIQSP3cNkquWHSWnwTXsY0YqgwAlrX/Fv1Yq9lrEl:zVZgIQDkgyWnZlfgX/17re
MD5:	84269806DCE633E56E492EF060FA8F88
SHA1:	A1E71CB750D25E7A63E0C9D0B01063DF421F1938
SHA-256:	5FCA695ED2CEFEC010D546310699226EEF4B305DF38CBE3DEA2FDF9494ABC163
SHA-512:	B25D25A35E6E431BACAF4D5FEA0E40F3FE49CCA14895C64DDBD78C212A2EF0B09B56616154A3D26813E9FAAF3DB1F6BB24A300B5F39B8CE286A41A12F6920EF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...E...E...E.j.D...E......E..A...E..F...E...D...E..D...E..@...E..E...E......E..G...E.Rich..E.................PE..d....(.`.........." ......................................................................`A........................................0...................................#...........K..T........................... L..8...............P............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56200
Entropy (8bit):	5.099650247805685
Encrypted:	false
SSDEEP:	768:aHzT4jKmYfXyHSRroXfjNHbd/X/QL3Ns63z:4T4DpSpQNHx/X/QL3N3z
MD5:	1D2A0D23E35B93464BB5B09E5E4C02B2
SHA1:	04D1A1EED3868433C5B7652ECAE0FDCD29E1EF39
SHA-256:	A577B5FC4E3A14AE141657C30A38D11FF8593135E51E55485B252EB821D47E75
SHA-512:	18A0DB760E4C4D9C4E014CFF5EE0F433B298B65FDECA95B8F5F172B9BC534A1C7F64A1B2751B90E89CF76F41EE1AB468415466D2A657905ECA9835E41CAE264E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7`.#s..ps..ps..p.q.qw..pzy&pu..p!t.q{..p!t.qp..ps..p...p!t.qt..p!t.qo..p!t.qr..p!tJpr..p!t.qr..pRichs..p........PE..d....(.`.........." .....:...........>.......................................@............`A.........................................f..D...Tk....... ..0.......P........#...0..x... W..T............................W..8............P..@............................text....9.......:.................. ..`.rdata..n$...P...&...>..............@..@.data...........B...d..............@....pdata..P...........................@..@.rsrc...0.... ......................@..@.reloc..x....0......................@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20360
Entropy (8bit):	6.113539156200981
Encrypted:	false
SSDEEP:	384:3Yp02YGv8EWiwEWk14gHRN7PwlX7aJdlGsMIm:3Y02YGvsaPe7aJGD
MD5:	4266E7BB9BFCE998083D2F4F938B11C9
SHA1:	23FC9C4C9DE9FD3E71941DF86E26C4DD44F2A95B
SHA-256:	E1EE6D29E30708AD5812035626BBC1058EA12FD5503D5A79D28C9CB67FAB4A14
SHA-512:	5DC1E769F973AEC3F0F766AD7C2364A184B9F71C1266F5E5A874C3E63CA7082E9A2C38346D387AA516E2F23ACAAF62979434819697B2695644883CE07BBFD867
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P.N.P.N.P.NE .O.P.N.(4N.P.N.P.N.P.N.%.O.P.N.%.O.P.N.%.O.P.N.%.O.P.N.%.O.P.N.%XN.P.N.%.O.P.NRich.P.N................PE..d....(.`.........." ................@........................................p......C.....`A........................................P(..0....)..P....P..0....@.......,...#...`..(....!..T............................!..8............ ...............................text...X........................... ..`.rdata....... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc...0....P.......$..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	334728
Entropy (8bit):	5.937217679926928
Encrypted:	false
SSDEEP:	6144:o+dqDim64W44od8wyW9I8RbAA2d3a6JD36a:o1Iud8wy6I8DD6t
MD5:	7EF7EAB654DF53E087AC4703C9EA0B16
SHA1:	743DC76D168326B60F09347945FE1342A6EFFC4C
SHA-256:	13E568FDCDE1B7B7F2D1C97A474BDB8858F5AB761157F0FEA7201CCECF84B9B8
SHA-512:	0B860F10C03ACB3866E82FD6044C29D63A2C6A1D5F6628F3D31F1CD1E44D7144E3660DF3446B7A0B76B7811B261675E5AA39FB27EFEEC060D287FDE3E630EDD2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,..]hz..hz..hz..a.T.xz..:...nz..:...rz..:...`z..:...lz......oz..hz...z..:...yz..:...iz..:.8.iz..:...iz..Richhz..................PE..d....+.`.........." .........z......P~.......................................@............`A........................................0....>......,................ .......#... ......`...T...............................8............................................text...v........................... ..`.rdata..............................@..@.data........0......................@....pdata... ......."..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97160
Entropy (8bit):	6.422776154074499
Encrypted:	false
SSDEEP:	1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5:	11D9AC94E8CB17BD23DEA89F8E757F18
SHA1:	D4FB80A512486821AD320C4FD67ABCAE63005158
SHA-256:	E1D6F78A72836EA120BD27A33AE89CBDC3F3CA7D9D0231AAA3AAC91996D2FA4E
SHA-512:	AA6AFD6BEA27F554E3646152D8C4F96F7BCAAA4933F8B7C04346E410F93F23CFA6D29362FD5D51CCBB8B6223E094CD89E351F072AD0517553703F5BF9DE28778
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d....(.`.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Windows\Installer\$PatchCache$\Managed\B2D17E516404D9B48ABBBECFC51CD268\2.4.10717\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37256
Entropy (8bit):	6.2987721506649335
Encrypted:	false
SSDEEP:	384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
MD5:	7667B0883DE4667EC87C3B75BED84D84
SHA1:	E6F6DF83E813ED8252614A46A5892C4856DF1F58
SHA-256:	04E7CCBDCAD7CBAF0ED28692FB08EAB832C38AAD9071749037EE7A58F45E9D7D
SHA-512:	968CBAAFE416A9E398C5BFD8C5825FA813462AE207D17072C035F916742517EDC42349A72AB6795199D34CCECE259D5F2F63587CFAEB0026C0667632B05C5C74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d....(.`.........." .....:...6......`A....................................................`A.........................................l.......m..x....................n...#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\447489.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Intel(R) Computing Improvement Program, Author: Intel Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Intel(R) Computing Improvement Program., Template: x64;1033, Revision Number: {BBF8B85D-F894-44F2-9844-AEC4CA522F8F}, Create Time/Date: Sat Jan 6 01:19:30 2024, Last Saved Time/Date: Sat Jan 6 01:19:30 2024, Number of Pages: 405, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.9.1208.0), Security: 2
Category:	dropped
Size (bytes):	24121344
Entropy (8bit):	7.92653060040943
Encrypted:	false
SSDEEP:	393216:QmR529+8ce5hoDSrZrbtykon2XzNd5IwQIR85JuY19C1UfgHsn4Gb1XR7b:Qh9+YhPV/tykoyv5IURwuY19Lcsn7ZRb
MD5:	71CC51C86999C3630DF3FF6169412916
SHA1:	90CD3C54A1B5596C093A7282F0A3DB5109094983
SHA-256:	1FF9C7139A86D45F92CD939C9F5FFDD5205DDEB87480D21FA753E29FB4370126
SHA-512:	4750C71D81E4AA2CA9A554A42A227499F5E1551AE5357F4ACD099BD98A01B82077DB3413EA99EDE9D0C678142EEFDE65138B3565C3DFD94FAE7C2F5117EF8DDD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI77D5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	185344
Entropy (8bit):	6.514301120114459
Encrypted:	false
SSDEEP:	3072:Wg38cb2LZb0y8qjOR0npgIcW8Ce+cxlQOOOO+BB:WgnFjm1PhAB
MD5:	B1298B75B1C09FDBB3906AEEC500F066
SHA1:	D84B4FE247A47EA7649F75E88791D34A60454F2E
SHA-256:	826289B33E9046FD86C559AC3C888129451534BFB2F31FA264D0C62760E0E35E
SHA-512:	2359518D0C5A19123B3491143D20F453E09D973323863B51B917434A5989790F0AAD47AC41FB142AB5ACEED973AD924392F7EFA7244A17D2374D262CC2B8FAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................... ............!......B......R.............. ...................V...........Rich...................PE..L....*.T...........!.........D......B........................................0............@.........................p...................p...............................8...............................@...............(............................text............................... ..`.rdata..............................@..@.data...`@..........................@....rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI790E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156160
Entropy (8bit):	6.397019863458208
Encrypted:	false
SSDEEP:	3072:JfpfhBZ9nKWcT+c4JIS+jcug64vM/CDnGvlEm:JxfhBZ9K76ISVuxF/hm
MD5:	C62F1D994BB13E677211BBDBA96433F8
SHA1:	3A00D34DF6EC81035234E339194FB49FBE317DBF
SHA-256:	3585CCF92C60150CF863E26C0EB2948E206841CA8FF91DAC092CF567EEF0880B
SHA-512:	C3269BCC5A639E7B8EBFFC6F75313E12B27C8AD83ABD99708E2AA7B5ADFBB46A9FAD1EBEE81C2C53B9F84EA0E5EF200611A6DB7B9F7165D43AF04D853D47BEF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......12-ruSC!uSC!uSC!n..!eSC!n..!.SC!\|+.!vSC!\|+.!dSC!uSB!.SC!n..!7SC!n..!tSC!n..!tSC!n..!tSC!RichuSC!........PE..L......P...........!.....p..........5................................................Z....@.........................`3......4#..........8...............................................................@............... ............................text....o.......p.................. ..`.rdata..q............t..............@..@.data... =...@.......,..............@....rsrc...8............<..............@..@.reloc........... ...B..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI796D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156160
Entropy (8bit):	6.397019863458208
Encrypted:	false
SSDEEP:	3072:JfpfhBZ9nKWcT+c4JIS+jcug64vM/CDnGvlEm:JxfhBZ9K76ISVuxF/hm
MD5:	C62F1D994BB13E677211BBDBA96433F8
SHA1:	3A00D34DF6EC81035234E339194FB49FBE317DBF
SHA-256:	3585CCF92C60150CF863E26C0EB2948E206841CA8FF91DAC092CF567EEF0880B
SHA-512:	C3269BCC5A639E7B8EBFFC6F75313E12B27C8AD83ABD99708E2AA7B5ADFBB46A9FAD1EBEE81C2C53B9F84EA0E5EF200611A6DB7B9F7165D43AF04D853D47BEF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......12-ruSC!uSC!uSC!n..!eSC!n..!.SC!\|+.!vSC!\|+.!dSC!uSB!.SC!n..!7SC!n..!tSC!n..!tSC!n..!tSC!RichuSC!........PE..L......P...........!.....p..........5................................................Z....@.........................`3......4#..........8...............................................................@............... ............................text....o.......p.................. ..`.rdata..q............t..............@..@.data... =...@.......,..............@....rsrc...8............<..............@..@.reloc........... ...B..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7BFE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2659889
Entropy (8bit):	6.3988670168171495
Encrypted:	false
SSDEEP:	49152:p9H9+Ah9b9TA7KHJ2wfvaLZtt65k/3YwkS9L9a:UipHJ9KwGYN
MD5:	EA387E7C0CCBD9B8940A4F7BED1282E2
SHA1:	55933D80CAB1D81B90FEF7EB77DBA734566453EC
SHA-256:	11B78AACC83972F30F9317E297FE061E56B05AB2D1A8031EB429A39421270918
SHA-512:	B08CA27EF31DC51E7B221DDDE6A789BE936D579BFC1FF6F491765F914832F2D77C5874EC8E44BD20438A51AEBFE93F66C0F47540C1D32E2AC657A8E760C2CFD5
Malicious:	false
Preview:	...@IXOS.@.....@JU.X.@.....@.....@.....@.....@.....@......&.{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}&.Intel(R) Computing Improvement Program!.WIN_DCA_2.4.0.10717_sursvc_qh.msi.@.....@.)...@.....@......vmp..&.{BBF8B85D-F894-44F2-9844-AEC4CA522F8F}.....@.....@.....@.....@.......@.....@.....@.......@....&.Intel(R) Computing Improvement Program......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........uninstall.4FFF4AAB_22AE_4C10_B00D_4F1423082A83....J...uninstall.4FFF4AAB_22AE_4C10_B00D_4F1423082A83.@A.........MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................... ............!......B......R.............. ...................V...........Rich...................PE..L....*.T...........!.........D......B........................................0............@.........................p...................p...............................8.......

C:\Windows\Installer\MSI7C3E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156160
Entropy (8bit):	6.397019863458208
Encrypted:	false
SSDEEP:	3072:JfpfhBZ9nKWcT+c4JIS+jcug64vM/CDnGvlEm:JxfhBZ9K76ISVuxF/hm
MD5:	C62F1D994BB13E677211BBDBA96433F8
SHA1:	3A00D34DF6EC81035234E339194FB49FBE317DBF
SHA-256:	3585CCF92C60150CF863E26C0EB2948E206841CA8FF91DAC092CF567EEF0880B
SHA-512:	C3269BCC5A639E7B8EBFFC6F75313E12B27C8AD83ABD99708E2AA7B5ADFBB46A9FAD1EBEE81C2C53B9F84EA0E5EF200611A6DB7B9F7165D43AF04D853D47BEF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......12-ruSC!uSC!uSC!n..!eSC!n..!.SC!\|+.!vSC!\|+.!dSC!uSB!.SC!n..!7SC!n..!tSC!n..!tSC!n..!tSC!RichuSC!........PE..L......P...........!.....p..........5................................................Z....@.........................`3......4#..........8...............................................................@............... ............................text....o.......p.................. ..`.rdata..q............t..............@..@.data... =...@.......,..............@....rsrc...8............<..............@..@.reloc........... ...B..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7C5E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	5.992736307445017
Encrypted:	false
SSDEEP:	1536:Fs6wSMZLS76YDdzTsXOyaopL7mvof+86kWl0Ax1/6y7s046JYhnUTrv7Z:ESMZLu6YDJTeHWgG8+2y/g6JYhnqrd
MD5:	DE7D44980B18FECE3E6FE8C8716BF9DD
SHA1:	CDF9CDCB483A34F1AB209582CA67203BDA54EFD5
SHA-256:	7B6596E88C53CD036BDAA7F76C84320A949E31F26092EEFC5879EF298F9DA8DC
SHA-512:	BDFDFE6702E44063B5E0A9440DD739A912DADBCDE2FB9CBD3092EDF84CFB23C801272066AE0E3C7038D79C53CE948AA513C3FFEFAC62BC035F3712EDAB4A5E99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.ML7.#.7.#.7.#.,/..j.#.,/..>.#.>..5.#.>..6.#.>..&.#.7."..#.,/..u.#.,/..6.#.,/..6.#.,/..6.#.Rich7.#.........PE..d......P.........." ................@W..............................................nF....@......................................... P......xD..d.......8............................................................................................................text............................... ..`.rdata...`.......b..................@..@.data....G...`.......:..............@....pdata...............N..............@..@.rsrc...8............Z..............@..@.reloc..b............`..............@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI81CD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156160
Entropy (8bit):	6.397019863458208
Encrypted:	false
SSDEEP:	3072:JfpfhBZ9nKWcT+c4JIS+jcug64vM/CDnGvlEm:JxfhBZ9K76ISVuxF/hm
MD5:	C62F1D994BB13E677211BBDBA96433F8
SHA1:	3A00D34DF6EC81035234E339194FB49FBE317DBF
SHA-256:	3585CCF92C60150CF863E26C0EB2948E206841CA8FF91DAC092CF567EEF0880B
SHA-512:	C3269BCC5A639E7B8EBFFC6F75313E12B27C8AD83ABD99708E2AA7B5ADFBB46A9FAD1EBEE81C2C53B9F84EA0E5EF200611A6DB7B9F7165D43AF04D853D47BEF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......12-ruSC!uSC!uSC!n..!eSC!n..!.SC!\|+.!vSC!\|+.!dSC!uSB!.SC!n..!7SC!n..!tSC!n..!tSC!n..!tSC!RichuSC!........PE..L......P...........!.....p..........5................................................Z....@.........................`3......4#..........8...............................................................@............... ............................text....o.......p.................. ..`.rdata..q............t..............@..@.data... =...@.......,..............@....rsrc...8............<..............@..@.reloc........... ...B..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI822C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	5.992736307445017
Encrypted:	false
SSDEEP:	1536:Fs6wSMZLS76YDdzTsXOyaopL7mvof+86kWl0Ax1/6y7s046JYhnUTrv7Z:ESMZLu6YDJTeHWgG8+2y/g6JYhnqrd
MD5:	DE7D44980B18FECE3E6FE8C8716BF9DD
SHA1:	CDF9CDCB483A34F1AB209582CA67203BDA54EFD5
SHA-256:	7B6596E88C53CD036BDAA7F76C84320A949E31F26092EEFC5879EF298F9DA8DC
SHA-512:	BDFDFE6702E44063B5E0A9440DD739A912DADBCDE2FB9CBD3092EDF84CFB23C801272066AE0E3C7038D79C53CE948AA513C3FFEFAC62BC035F3712EDAB4A5E99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.ML7.#.7.#.7.#.,/..j.#.,/..>.#.>..5.#.>..6.#.>..&.#.7."..#.,/..u.#.,/..6.#.,/..6.#.,/..6.#.Rich7.#.........PE..d......P.........." ................@W..............................................nF....@......................................... P......xD..d.......8............................................................................................................text............................... ..`.rdata...`.......b..................@..@.data....G...`.......:..............@....pdata...............N..............@..@.rsrc...8............Z..............@..@.reloc..b............`..............@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8356.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	185344
Entropy (8bit):	6.514301120114459
Encrypted:	false
SSDEEP:	3072:Wg38cb2LZb0y8qjOR0npgIcW8Ce+cxlQOOOO+BB:WgnFjm1PhAB
MD5:	B1298B75B1C09FDBB3906AEEC500F066
SHA1:	D84B4FE247A47EA7649F75E88791D34A60454F2E
SHA-256:	826289B33E9046FD86C559AC3C888129451534BFB2F31FA264D0C62760E0E35E
SHA-512:	2359518D0C5A19123B3491143D20F453E09D973323863B51B917434A5989790F0AAD47AC41FB142AB5ACEED973AD924392F7EFA7244A17D2374D262CC2B8FAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................... ............!......B......R.............. ...................V...........Rich...................PE..L....*.T...........!.........D......B........................................0............@.........................p...................p...............................8...............................@...............(............................text............................... ..`.rdata..............................@..@.data...`@..........................@....rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI85F7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	185344
Entropy (8bit):	6.514301120114459
Encrypted:	false
SSDEEP:	3072:Wg38cb2LZb0y8qjOR0npgIcW8Ce+cxlQOOOO+BB:WgnFjm1PhAB
MD5:	B1298B75B1C09FDBB3906AEEC500F066
SHA1:	D84B4FE247A47EA7649F75E88791D34A60454F2E
SHA-256:	826289B33E9046FD86C559AC3C888129451534BFB2F31FA264D0C62760E0E35E
SHA-512:	2359518D0C5A19123B3491143D20F453E09D973323863B51B917434A5989790F0AAD47AC41FB142AB5ACEED973AD924392F7EFA7244A17D2374D262CC2B8FAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................... ............!......B......R.............. ...................V...........Rich...................PE..L....*.T...........!.........D......B........................................0............@.........................p...................p...............................8...............................@...............(............................text............................... ..`.rdata..............................@..@.data...`@..........................@....rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8665.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156160
Entropy (8bit):	6.397019863458208
Encrypted:	false
SSDEEP:	3072:JfpfhBZ9nKWcT+c4JIS+jcug64vM/CDnGvlEm:JxfhBZ9K76ISVuxF/hm
MD5:	C62F1D994BB13E677211BBDBA96433F8
SHA1:	3A00D34DF6EC81035234E339194FB49FBE317DBF
SHA-256:	3585CCF92C60150CF863E26C0EB2948E206841CA8FF91DAC092CF567EEF0880B
SHA-512:	C3269BCC5A639E7B8EBFFC6F75313E12B27C8AD83ABD99708E2AA7B5ADFBB46A9FAD1EBEE81C2C53B9F84EA0E5EF200611A6DB7B9F7165D43AF04D853D47BEF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......12-ruSC!uSC!uSC!n..!eSC!n..!.SC!\|+.!vSC!\|+.!dSC!uSB!.SC!n..!7SC!n..!tSC!n..!tSC!n..!tSC!RichuSC!........PE..L......P...........!.....p..........5................................................Z....@.........................`3......4#..........8...............................................................@............... ............................text....o.......p.................. ..`.rdata..q............t..............@..@.data... =...@.......,..............@....rsrc...8............<..............@..@.reloc........... ...B..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI880C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	185344
Entropy (8bit):	6.514301120114459
Encrypted:	false
SSDEEP:	3072:Wg38cb2LZb0y8qjOR0npgIcW8Ce+cxlQOOOO+BB:WgnFjm1PhAB
MD5:	B1298B75B1C09FDBB3906AEEC500F066
SHA1:	D84B4FE247A47EA7649F75E88791D34A60454F2E
SHA-256:	826289B33E9046FD86C559AC3C888129451534BFB2F31FA264D0C62760E0E35E
SHA-512:	2359518D0C5A19123B3491143D20F453E09D973323863B51B917434A5989790F0AAD47AC41FB142AB5ACEED973AD924392F7EFA7244A17D2374D262CC2B8FAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................... ............!......B......R.............. ...................V...........Rich...................PE..L....*.T...........!.........D......B........................................0............@.........................p...................p...............................8...............................@...............(............................text............................... ..`.rdata..............................@..@.data...`@..........................@....rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI97EC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	185344
Entropy (8bit):	6.514301120114459
Encrypted:	false
SSDEEP:	3072:Wg38cb2LZb0y8qjOR0npgIcW8Ce+cxlQOOOO+BB:WgnFjm1PhAB
MD5:	B1298B75B1C09FDBB3906AEEC500F066
SHA1:	D84B4FE247A47EA7649F75E88791D34A60454F2E
SHA-256:	826289B33E9046FD86C559AC3C888129451534BFB2F31FA264D0C62760E0E35E
SHA-512:	2359518D0C5A19123B3491143D20F453E09D973323863B51B917434A5989790F0AAD47AC41FB142AB5ACEED973AD924392F7EFA7244A17D2374D262CC2B8FAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................... ............!......B......R.............. ...................V...........Rich...................PE..L....*.T...........!.........D......B........................................0............@.........................p...................p...............................8...............................@...............(............................text............................... ..`.rdata..............................@..@.data...`@..........................@....rsrc...p...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{15E71D2B-4046-4B9D-A8BB-EBFC5CC12D86}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7744906551752184
Encrypted:	false
SSDEEP:	12:JSbX72FjUtliAGiLIlHVRpUh/7777777777777777777777777vDHF0MXkBGagVG:J6tIQI5EFXkcagwR6F
MD5:	19C7A290F3DC60237FCF4873F2124E73
SHA1:	15A66D355A74EF5A036FC8B16E8421A4C4ABDFF2
SHA-256:	37B0F2E845CB2BEEB5CFFD8DB84E89CE7060E64A65B81A5009DB3D7B3A841B3E
SHA-512:	A8D4B34AA2B97A7B68B00C3731CD371CD8229FEAB0E0B18078976947951D3F643E8C2FFFA1AC8BF0107E0C6ACBB9C33F2257FFFE5846B32BE075A9804257ACB6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2270510182199674
Encrypted:	false
SSDEEP:	48:bsE3unNveFXJDT50UPyn5DxqtSTtDdiXduderd3C6UdOUd/6jrOS2jrOS1hM6d3R:bR3jbTO22st/kVfIkVOf
MD5:	B74DED343A9C40387482500FCF0DB7A6
SHA1:	90F75FA8A88C09DD105B8426578D6743F1D3C199
SHA-256:	9C9676B0615454797997772E44BD4F69A73D7ADF9B77EB4A18FE1FE5BCA1F7E8
SHA-512:	9111521A97BB02799D971A991CD79A9563F845545BD9F675E2E8438C5100B01CDB36D3EC12B0AF55BCD3F193F28AFC581A8B7598D4CE68F45799AF6438DF2F41
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365494581136137
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauU:zTtbmkExhMJCIpEb
MD5:	3A4F453771915531FE945C7FC52CA50C
SHA1:	648C8E08D4B6AD896DE0CAA1F5B780EE58A62C73
SHA-256:	21180862B15F9DAA3D279ED80BD08AFA16416C58F9AC69B997266D18EFF16E5A
SHA-512:	F165A084EBEFC3C2028BA385EC2EC7F7C903B83D162493BD53217965078F5E844F5A7CF9AF08D00937820C616E41DAC14315BA21908328E1CB564325999DDEB4
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF174F48C68588024F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7B356C39A422480F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2270510182199674
Encrypted:	false
SSDEEP:	48:bsE3unNveFXJDT50UPyn5DxqtSTtDdiXduderd3C6UdOUd/6jrOS2jrOS1hM6d3R:bR3jbTO22st/kVfIkVOf
MD5:	B74DED343A9C40387482500FCF0DB7A6
SHA1:	90F75FA8A88C09DD105B8426578D6743F1D3C199
SHA-256:	9C9676B0615454797997772E44BD4F69A73D7ADF9B77EB4A18FE1FE5BCA1F7E8
SHA-512:	9111521A97BB02799D971A991CD79A9563F845545BD9F675E2E8438C5100B01CDB36D3EC12B0AF55BCD3F193F28AFC581A8B7598D4CE68F45799AF6438DF2F41
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF91EC66383DD0AB80.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.2934146063515412
Encrypted:	false
SSDEEP:	48:WFTbjIfeSytDdiXduderdC6UdOUd/6jrOS2jrOS1hM6duqtSTtDdiXduderd3C6i:rfeIkVvt/kV8
MD5:	1EB3CDE163B12B51D459E2404536DFAE
SHA1:	3BE4A0847A61B5E8823EE621ADE4C3F392C3684F
SHA-256:	92B817D8F91DE4679BB02587F55CCFFA81795303FE30F967FC2C84E8DC417841
SHA-512:	E470A2309C52F8CC4006C9E841E737DEAA0EFDB9327AE70CA3D158CAC82BAD6AF8FFD482522B683195CCA5F9A2D3D9C5D089C94193F939575330C27B307C2291
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA5799AD3BF81B0CB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07972099038635444
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOgUyMXknByhagVncTttSVky6l/X:2F0i8n0itFzDHF0MXkBGagVnitL/X
MD5:	1BAC07BCCD10D33A2DDAE0E116A3B18B
SHA1:	6999CC2B91F24C6984DD2C774F2C0C73B4F05C80
SHA-256:	41901B3B44B030CECADE8D150A165AF82467344EA178250EE2E7433D8D60EDC2
SHA-512:	FA1238408EAE790F6A6FB38B88B613B6A97F9EE10D6D4447DB26614382F1E2EA16730F0A5C8A1A8E1CEA3EA541AA0878AF1C4DAED44019EACAA5DC8678FD042D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Intel(R) Computing Improvement Program, Author: Intel Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Intel(R) Computing Improvement Program., Template: x64;1033, Revision Number: {BBF8B85D-F894-44F2-9844-AEC4CA522F8F}, Create Time/Date: Sat Jan 6 01:19:30 2024, Last Saved Time/Date: Sat Jan 6 01:19:30 2024, Number of Pages: 405, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.9.1208.0), Security: 2
Entropy (8bit):	7.92653060040943
TrID:	Microsoft Windows Installer (60509/1) 57.88% ClickyMouse macro set (36024/1) 34.46% Generic OLE2 / Multistream Compound File (8008/1) 7.66%
File name:	WIN_DCA_2.4.0.10717_sursvc_qh.msi
File size:	24'121'344 bytes
MD5:	71cc51c86999c3630df3ff6169412916
SHA1:	90cd3c54a1b5596c093a7282f0a3db5109094983
SHA256:	1ff9c7139a86d45f92cd939c9f5ffdd5205ddeb87480d21fa753e29fb4370126
SHA512:	4750c71d81e4aa2ca9a554a42a227499f5e1551ae5357f4acd099bd98a01b82077db3413ea99ede9d0c678142eefde65138b3565c3dfd94fae7c2f5117ef8ddd
SSDEEP:	393216:QmR529+8ce5hoDSrZrbtykon2XzNd5IwQIR85JuY19C1UfgHsn4Gb1XR7b:Qh9+YhPV/tykoyv5IURwuY19Lcsn7ZRb
TLSH:	993722EC2077B169F6970374A32DA2B4DD37AC20B720448BA2F5B95A2D35DC3B93524D
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Target ID:	0
Start time:	10:42:04
Start date:	16/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WIN_DCA_2.4.0.10717_sursvc_qh.msi"
Imagebase:	0x7ff71f6b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:42:04
Start date:	16/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff71f6b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:42:18
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 704D2DC67D6894EEBDB1CD33E2207CDD
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:42:19
Start date:	16/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\MsiExec.exe -Embedding 1630123FD6E99419F490FEE5EE1376B7
Imagebase:	0x7ff71f6b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:42:21
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 4A304068329E687C086DF1B908D49B47 E Global\MSI0000
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:42:21
Start date:	16/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c cd "C:\Program Files\Intel\SUR\QUEENCREEK\" && if exist SurSvc.exe (start /b /wait /d "C:\Program Files\Intel\SUR\QUEENCREEK\" SurSvc.exe /uninstall)
Imagebase:	0x7ff7390c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:42:21
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:42:22
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"CMD" /C RMDIR /S /Q "C:\Program Files\Intel\SUR\QUEENCREEK\Updater\" && RMDIR /S /Q "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:42:22
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:42:26
Start date:	16/04/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R
Imagebase:	0x7ff797b40000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:42:26
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:42:26
Start date:	16/04/2024
Path:	C:\Program Files\Intel\SUR\ICIP\SurConsent.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Intel\SUR\ICIP\SurConsent.exe" -install
Imagebase:	0x20b65a80000
File size:	388'872 bytes
MD5 hash:	890A5B4F011ED9238885C5A699C6CDC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848A90EAE Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431b8b002e22a06f976dbb84e27eefcf5abb23b141639f65d1d000cd5b39ab8c
Instruction ID: 498661ff993f5a3717d693f2cb8e65c8c1d4642409057cc4097225d86033907f
Opcode Fuzzy Hash: 431b8b002e22a06f976dbb84e27eefcf5abb23b141639f65d1d000cd5b39ab8c
Instruction Fuzzy Hash: 9AA1B030C0E2598FEB65EB18C8557A8BBF1FF59344F1405BAC00DE7291DBB86984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A910CE Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a162c82f923f67ee0371ed29273e355d5f5263d6a0e6b776fea97135709bd16d
Instruction ID: f594f0f6e5772a941ef67e70978f20f1240dfbe5620a8b27d8ddc2c35309a55b
Opcode Fuzzy Hash: a162c82f923f67ee0371ed29273e355d5f5263d6a0e6b776fea97135709bd16d
Instruction Fuzzy Hash: F4311170D196199FDBA8EF18C490BACB7B1FF19344F5045AAD00EE7291DB38A984CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A910B9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97ae13faa6b89430c0ef6d6608ada93ffa74e423bf3e89ab2cb4d7322526143
Instruction ID: 8b190372ab8a4c0b18e5827354d82e6a64150faa16160557842fffe90d3a8027
Opcode Fuzzy Hash: f97ae13faa6b89430c0ef6d6608ada93ffa74e423bf3e89ab2cb4d7322526143
Instruction Fuzzy Hash: 3A318B34D0E61A9FDBA4EF18C8857A8B7B1FF15388F1009B9D00DE3681DB78A885CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A909D1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ec4a022759d618727273e3a0c803995818d126f57e43618d50fdb435c4dd25
Instruction ID: dfd6b190a22385a4ad6b2485ea24a7512b9f758e1bfdcdc33fb7fc8dc243d1c8
Opcode Fuzzy Hash: 16ec4a022759d618727273e3a0c803995818d126f57e43618d50fdb435c4dd25
Instruction Fuzzy Hash: 2DE01A31D5E59C8EDF40FA98D8929FCBBB4EF8A351F101136D109E7185DA60A8418755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A92E19 Relevance: 1.7, APIs: 1, Instructions: 236
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE ref: 00007FF848A92FBE

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1c27c6557a621ac40454dc7b000b9aa57f6647a583b4ec1218f9fe4bdd5e5f9f
Instruction ID: e57057bc805ad606d6ca2f7d5a68c7bddde5474abc8ccc2db293f867da236cd1
Opcode Fuzzy Hash: 1c27c6557a621ac40454dc7b000b9aa57f6647a583b4ec1218f9fe4bdd5e5f9f
Instruction Fuzzy Hash: 8E71483090864C8FDB99DF68C895BE9BBF0FB5A314F1041AED04DE3252DB75A884CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A914FD Relevance: 1.7, APIs: 1, Instructions: 225
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF848A91677

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a29e2f428ad4b5182d7eca084c10a0497040d79b204b7c0cdb9835ae45aacf5a
Instruction ID: aea936927039c44bae9c02c3737b87c9722706457582a93f507fbe780bdea187
Opcode Fuzzy Hash: a29e2f428ad4b5182d7eca084c10a0497040d79b204b7c0cdb9835ae45aacf5a
Instruction Fuzzy Hash: 4F616970908A5C8FDB98DF68C895BE9BBF1FB6A310F1041AED04DE3252DB749981CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A90774 Relevance: 1.7, APIs: 1, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867bd5dd1a74b068c1a1b290b83084ece9a7a63c4822dc1d07a26587319a7f1e
Instruction ID: 2544a0da4f5fe94c2815973616161d886359ab82a41a637d99edbd839ec12b8d
Opcode Fuzzy Hash: 867bd5dd1a74b068c1a1b290b83084ece9a7a63c4822dc1d07a26587319a7f1e
Instruction Fuzzy Hash: 20612770909A5C8FDB98EF68C845BE9BBF0FB69315F1041AED04DE3252DB74A981CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A92B6F Relevance: 1.7, APIs: 1, Instructions: 167
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 00007FF848A92C88

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8834b6bed65939a1929e4d0ece07fd8def80fe9619fa6c4021389f31c94d42e6
Instruction ID: d46426cd6502698d9f8a20f05827930337b9658756da8f8e35fd7906681b08c2
Opcode Fuzzy Hash: 8834b6bed65939a1929e4d0ece07fd8def80fe9619fa6c4021389f31c94d42e6
Instruction Fuzzy Hash: 51513A34D09A1D8FEBA8EB18C845BE9B7F1FB58304F0041AAD40DE3251DB716A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A916F9 Relevance: 1.6, APIs: 1, Instructions: 145
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE ref: 00007FF848A917D1

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ba5ac33485a87ea507169e4c8dbef085b0f6b0f2eb61e6b9e54117e0133713a3
Instruction ID: 59e17ce5403fd2a3bb82cf8811a3f6275a0d9391821d280798a44392494bb3f1
Opcode Fuzzy Hash: ba5ac33485a87ea507169e4c8dbef085b0f6b0f2eb61e6b9e54117e0133713a3
Instruction Fuzzy Hash: 6B414970D0864C8FDB59EFA8D889BEDBBF0FB5A310F1041AAD009E7252DA74A845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848A92B8D Relevance: 1.6, APIs: 1, Instructions: 143
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 00007FF848A92C88

Memory Dump Source

Source File: 0000000D.00000002.3310234329.00007FF848A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff848a90000_SurConsent.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d3d64fc495865dd0dc0d97388b36e5ec9f3bb035084016c79b37efe272fccb81
Instruction ID: 241986229c4781ae07eefc66b2a2dd31efe30ad41cd6f843598c4fc65865cda8
Opcode Fuzzy Hash: d3d64fc495865dd0dc0d97388b36e5ec9f3bb035084016c79b37efe272fccb81
Instruction Fuzzy Hash: BA51A574D09A5D8FDB98EF18C895BE9B7B1FB68300F1041AAD40DE3291DB74AA84CF45

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WIN_DCA_2.4.0.10717_sursvc_qh.msi

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\44748a.rbs

C:\Program Files\Intel\SUR\ICIP\Config.dll

C:\Program Files\Intel\SUR\ICIP\SURV8_ICIP.log

C:\Program Files\Intel\SUR\ICIP\SurConsent.exe

C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll

C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll

C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll.config

C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll

C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll

Windows Analysis Report
WIN_DCA_2.4.0.10717_sursvc_qh.msi