Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-08-2022 07:19
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Microsoft.exe
Resource
win10-20220812-en
General
-
Target
Microsoft.exe
-
Size
4.0MB
-
MD5
083f54e1891baeb8783adc6ee775fc41
-
SHA1
9f7b44476da46086e38f89f4eb2b9900629082a4
-
SHA256
b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1
-
SHA512
4c0ab2a86af49ed0fd129095962e11baa9fa9a9e0276473832be6c47bb8918c5c39a2f228a06e6f7d2aaa8d791c75645102ee5674ba44a9e3b9dc079c936d8ab
-
SSDEEP
98304:Zwa9JkoXTaSRr+aV1uHIx5gjSTBvq+TYIMV3hMAo:Zr9UY5g0v0g
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4944 MSI5397.tmp 1508 bdreinit.exe 4300 bdreinit.exe -
Loads dropped DLL 9 IoCs
pid Process 3624 MsiExec.exe 1256 MsiExec.exe 1256 MsiExec.exe 1256 MsiExec.exe 1256 MsiExec.exe 1256 MsiExec.exe 1256 MsiExec.exe 1508 bdreinit.exe 4300 bdreinit.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: Microsoft.exe File opened (read-only) \??\S: Microsoft.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: Microsoft.exe File opened (read-only) \??\M: Microsoft.exe File opened (read-only) \??\W: Microsoft.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: Microsoft.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: Microsoft.exe File opened (read-only) \??\U: Microsoft.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: Microsoft.exe File opened (read-only) \??\F: Microsoft.exe File opened (read-only) \??\P: Microsoft.exe File opened (read-only) \??\R: Microsoft.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: Microsoft.exe File opened (read-only) \??\Y: Microsoft.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: Microsoft.exe File opened (read-only) \??\Z: Microsoft.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: Microsoft.exe File opened (read-only) \??\N: Microsoft.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: Microsoft.exe File opened (read-only) \??\Q: Microsoft.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe bdreinit.exe File created C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe bdreinit.exe File created C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe msiexec.exe File created C:\Program Files (x86)\Microsoft Office\Microsoft\log.dat msiexec.exe File opened for modification C:\Program Files (x86)\BitDefender\Handler bdreinit.exe File opened for modification C:\Program Files (x86)\BitDefender\Handler\log.dll bdreinit.exe File opened for modification C:\Program Files (x86)\BitDefender\Handler\log.dat bdreinit.exe File created C:\Program Files (x86)\Microsoft Office\Microsoft\log.dll msiexec.exe File created C:\Program Files (x86)\BitDefender\Handler\log.dll bdreinit.exe File created C:\Program Files (x86)\BitDefender\Handler\log.dat bdreinit.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e57472b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4F8A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e57472e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4E80.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CADD28DF-723D-4BD4-AAFC-FAE439BAE647} msiexec.exe File opened for modification C:\Windows\Installer\MSI5121.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI522E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4844.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5397.tmp msiexec.exe File created C:\Windows\Installer\e57472b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4D75.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5142.tmp msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\CLASSES\KET.FAST svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\PackageCode = "C3DCF6D77E9A82E4884CC7833DE2C026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\PackageName = "Microsoft.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 37003300450032003500350043003400310037003200410045003400370033000000 svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A63D6CDA60BAB248B02E4255D3A74C1\FD82DDACD3274DB4AACFAF4E93AB6E74 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A63D6CDA60BAB248B02E4255D3A74C1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD82DDACD3274DB4AACFAF4E93AB6E74 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD82DDACD3274DB4AACFAF4E93AB6E74\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\ProductName = "Microsoft" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Assignment = "1" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 msiexec.exe 4484 msiexec.exe 4944 MSI5397.tmp 4944 MSI5397.tmp 4468 svchost.exe 4468 svchost.exe 4468 svchost.exe 4468 svchost.exe 4468 svchost.exe 4468 svchost.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 4468 svchost.exe 4468 svchost.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 4468 svchost.exe 4468 svchost.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 4468 svchost.exe 4468 svchost.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 4468 svchost.exe 4468 svchost.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe 208 userinit.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4484 msiexec.exe Token: SeCreateTokenPrivilege 2696 Microsoft.exe Token: SeAssignPrimaryTokenPrivilege 2696 Microsoft.exe Token: SeLockMemoryPrivilege 2696 Microsoft.exe Token: SeIncreaseQuotaPrivilege 2696 Microsoft.exe Token: SeMachineAccountPrivilege 2696 Microsoft.exe Token: SeTcbPrivilege 2696 Microsoft.exe Token: SeSecurityPrivilege 2696 Microsoft.exe Token: SeTakeOwnershipPrivilege 2696 Microsoft.exe Token: SeLoadDriverPrivilege 2696 Microsoft.exe Token: SeSystemProfilePrivilege 2696 Microsoft.exe Token: SeSystemtimePrivilege 2696 Microsoft.exe Token: SeProfSingleProcessPrivilege 2696 Microsoft.exe Token: SeIncBasePriorityPrivilege 2696 Microsoft.exe Token: SeCreatePagefilePrivilege 2696 Microsoft.exe Token: SeCreatePermanentPrivilege 2696 Microsoft.exe Token: SeBackupPrivilege 2696 Microsoft.exe Token: SeRestorePrivilege 2696 Microsoft.exe Token: SeShutdownPrivilege 2696 Microsoft.exe Token: SeDebugPrivilege 2696 Microsoft.exe Token: SeAuditPrivilege 2696 Microsoft.exe Token: SeSystemEnvironmentPrivilege 2696 Microsoft.exe Token: SeChangeNotifyPrivilege 2696 Microsoft.exe Token: SeRemoteShutdownPrivilege 2696 Microsoft.exe Token: SeUndockPrivilege 2696 Microsoft.exe Token: SeSyncAgentPrivilege 2696 Microsoft.exe Token: SeEnableDelegationPrivilege 2696 Microsoft.exe Token: SeManageVolumePrivilege 2696 Microsoft.exe Token: SeImpersonatePrivilege 2696 Microsoft.exe Token: SeCreateGlobalPrivilege 2696 Microsoft.exe Token: SeCreateTokenPrivilege 2696 Microsoft.exe Token: SeAssignPrimaryTokenPrivilege 2696 Microsoft.exe Token: SeLockMemoryPrivilege 2696 Microsoft.exe Token: SeIncreaseQuotaPrivilege 2696 Microsoft.exe Token: SeMachineAccountPrivilege 2696 Microsoft.exe Token: SeTcbPrivilege 2696 Microsoft.exe Token: SeSecurityPrivilege 2696 Microsoft.exe Token: SeTakeOwnershipPrivilege 2696 Microsoft.exe Token: SeLoadDriverPrivilege 2696 Microsoft.exe Token: SeSystemProfilePrivilege 2696 Microsoft.exe Token: SeSystemtimePrivilege 2696 Microsoft.exe Token: SeProfSingleProcessPrivilege 2696 Microsoft.exe Token: SeIncBasePriorityPrivilege 2696 Microsoft.exe Token: SeCreatePagefilePrivilege 2696 Microsoft.exe Token: SeCreatePermanentPrivilege 2696 Microsoft.exe Token: SeBackupPrivilege 2696 Microsoft.exe Token: SeRestorePrivilege 2696 Microsoft.exe Token: SeShutdownPrivilege 2696 Microsoft.exe Token: SeDebugPrivilege 2696 Microsoft.exe Token: SeAuditPrivilege 2696 Microsoft.exe Token: SeSystemEnvironmentPrivilege 2696 Microsoft.exe Token: SeChangeNotifyPrivilege 2696 Microsoft.exe Token: SeRemoteShutdownPrivilege 2696 Microsoft.exe Token: SeUndockPrivilege 2696 Microsoft.exe Token: SeSyncAgentPrivilege 2696 Microsoft.exe Token: SeEnableDelegationPrivilege 2696 Microsoft.exe Token: SeManageVolumePrivilege 2696 Microsoft.exe Token: SeImpersonatePrivilege 2696 Microsoft.exe Token: SeCreateGlobalPrivilege 2696 Microsoft.exe Token: SeCreateTokenPrivilege 2696 Microsoft.exe Token: SeAssignPrimaryTokenPrivilege 2696 Microsoft.exe Token: SeLockMemoryPrivilege 2696 Microsoft.exe Token: SeIncreaseQuotaPrivilege 2696 Microsoft.exe Token: SeMachineAccountPrivilege 2696 Microsoft.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2696 Microsoft.exe 4608 msiexec.exe 4608 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4484 wrote to memory of 3624 4484 msiexec.exe 68 PID 4484 wrote to memory of 3624 4484 msiexec.exe 68 PID 4484 wrote to memory of 3624 4484 msiexec.exe 68 PID 2696 wrote to memory of 4608 2696 Microsoft.exe 69 PID 2696 wrote to memory of 4608 2696 Microsoft.exe 69 PID 2696 wrote to memory of 4608 2696 Microsoft.exe 69 PID 4484 wrote to memory of 368 4484 msiexec.exe 73 PID 4484 wrote to memory of 368 4484 msiexec.exe 73 PID 4484 wrote to memory of 1256 4484 msiexec.exe 75 PID 4484 wrote to memory of 1256 4484 msiexec.exe 75 PID 4484 wrote to memory of 1256 4484 msiexec.exe 75 PID 4484 wrote to memory of 4944 4484 msiexec.exe 76 PID 4484 wrote to memory of 4944 4484 msiexec.exe 76 PID 4484 wrote to memory of 4944 4484 msiexec.exe 76 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4300 wrote to memory of 4468 4300 bdreinit.exe 79 PID 4468 wrote to memory of 208 4468 svchost.exe 80 PID 4468 wrote to memory of 208 4468 svchost.exe 80 PID 4468 wrote to memory of 208 4468 svchost.exe 80 PID 4468 wrote to memory of 208 4468 svchost.exe 80 PID 4468 wrote to memory of 208 4468 svchost.exe 80 PID 4468 wrote to memory of 208 4468 svchost.exe 80 PID 4468 wrote to memory of 208 4468 svchost.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\Microsoft.msi AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Microsoft.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1661178651 "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:4608
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4D492D9E0E6733A6F6FE51B774888CAD C2⤵
- Loads dropped DLL
PID:3624
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:368
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E39084A8437525B154ED8E26B18466A2⤵
- Loads dropped DLL
PID:1256
-
-
C:\Windows\Installer\MSI5397.tmp"C:\Windows\Installer\MSI5397.tmp" "C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:428
-
C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe"C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1508
-
C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe"C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe" 600 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 601 02⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe 609 44683⤵
- Suspicious behavior: EnumeratesProcesses
PID:208
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD58a8db1e20dc508af5a81fc00b1929468
SHA132e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f
SHA256386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd
SHA5129c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87
-
Filesize
192KB
MD58a8db1e20dc508af5a81fc00b1929468
SHA132e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f
SHA256386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd
SHA5129c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87
-
Filesize
199KB
MD54d46b087b62183d86c53bf05ce4e2c8d
SHA1174bd3886bd598f621eb758f469f69e85532f5c0
SHA25649686cbde9535055fa48a0742bbe765f9d6ec1104e7efa8f71d1894f2d7d7873
SHA512cf87b40dd69306285adff88de6050c1d456c34b2056e8f98ca7cf046459b6839afe67f4b13e25e5162ab311f1033a004b7e1bdc2955a10e8490eaef0f882a117
-
Filesize
139KB
MD5c55b6938f885c07d627c15165c21390a
SHA19d2e460fd11791e78eb7fbc1357c973493293572
SHA256f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c
SHA5129f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9
-
Filesize
192KB
MD58a8db1e20dc508af5a81fc00b1929468
SHA132e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f
SHA256386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd
SHA5129c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87
-
Filesize
192KB
MD58a8db1e20dc508af5a81fc00b1929468
SHA132e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f
SHA256386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd
SHA5129c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87
-
Filesize
199KB
MD54d46b087b62183d86c53bf05ce4e2c8d
SHA1174bd3886bd598f621eb758f469f69e85532f5c0
SHA25649686cbde9535055fa48a0742bbe765f9d6ec1104e7efa8f71d1894f2d7d7873
SHA512cf87b40dd69306285adff88de6050c1d456c34b2056e8f98ca7cf046459b6839afe67f4b13e25e5162ab311f1033a004b7e1bdc2955a10e8490eaef0f882a117
-
Filesize
139KB
MD5c55b6938f885c07d627c15165c21390a
SHA19d2e460fd11791e78eb7fbc1357c973493293572
SHA256f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c
SHA5129f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
1.5MB
MD5df26d42194e934122c73559987f3ab84
SHA1c526f8e1f8f4b22c0b62f76af448c63a7e5f2073
SHA256eec36f5b2d28bb8076648f96899def8e297347322dd7d13368234680eaaee01d
SHA512e62bd5773649251dfaa4870b2e5f6ebff6e69dd18ac4ecdeb296d0826b02b4a76d878037ea183a2653044afe5b807cee15c9fd1d7032bb6e75e761609e8f30b1
-
Filesize
351KB
MD5a66bc9849ba7d090a983e1aa64275e9a
SHA186f35c1a29cde722c2c822c46e4c4eac0b360f4a
SHA2561b1a6809886af74850a817d23854ada702af6e6f094ac477049faa46c317d9cc
SHA512e1a5f7b65bbca6a6eba9bcfaa278882961e3d0ad3b03a18a6fdda91558372d9a902d6ebe2f203d5b1174145eb84b3b5ebfe9fc78bb1d081f34d72b9b03993f90
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
529KB
MD5aab600da7532150b6fd984f3c6e6d781
SHA130c95ec5f80d8595221c9f37c0f172ea2ce7b917
SHA256c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019
SHA51270c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06
-
Filesize
529KB
MD5aab600da7532150b6fd984f3c6e6d781
SHA130c95ec5f80d8595221c9f37c0f172ea2ce7b917
SHA256c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019
SHA51270c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06
-
Filesize
401KB
MD58c7085c86a4b14296f6e76525f20c828
SHA16113087876f86c9247bc4080c08ce1ae578d9a99
SHA256beeaa8bfc97d87c1739611a88d3f4fa9a561cecbc5379309543dd850cc3f956c
SHA51297dcbe469ec14114b90c0c52c289af173c6078b8aad3f9bb78c212278f1980d2750ce8bfba6b1ac0aaf72aa956f4c0be0c471ffbc7e811d4affa5896d36367e0
-
Filesize
25.0MB
MD58b7ddb38e783f2fdd5673daa60cfcd09
SHA169cf064df5388dbae4203c99a85271d2ae40c725
SHA25619c90a60443f9b1c0158d28b892e6d963dddb3a00720025d43e226cecd9c0b73
SHA512f037a3242be9f45f1c63a97338e5854f828b821730f1da3d67febb9775576d14bb0aba0b4dc783730109f318d7f096adab998def0911e0713a84b4ea669fba56
-
\??\Volume{5f334692-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{77f20257-456d-4dcd-a204-31ed62586c71}_OnDiskSnapshotProp
Filesize5KB
MD57fa67915620f98810aa49c84ea820988
SHA1d8fa8c98f74a94c4eb14eaedfbfbea1c96f32225
SHA256f2ac33e84ceb85d6e286b3ba386a72303105349831d11036c5d89c56affe3367
SHA512cda1f324110fa2e121054111cbbcbb18681e09a1543576df80250d925b0c4e7024ea071ae59e7bd70e461aac57300fc8549436a5f57b2efaa2b87979eb172a8a
-
Filesize
139KB
MD5c55b6938f885c07d627c15165c21390a
SHA19d2e460fd11791e78eb7fbc1357c973493293572
SHA256f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c
SHA5129f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9
-
Filesize
139KB
MD5c55b6938f885c07d627c15165c21390a
SHA19d2e460fd11791e78eb7fbc1357c973493293572
SHA256f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c
SHA5129f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
377KB
MD5316ed83688978925aa47a0c4d5662d2c
SHA196aaa52977cbd62ba865b35f9730c7c2861e5c2b
SHA256da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e
SHA51214eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9
-
Filesize
529KB
MD5aab600da7532150b6fd984f3c6e6d781
SHA130c95ec5f80d8595221c9f37c0f172ea2ce7b917
SHA256c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019
SHA51270c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06
-
Filesize
529KB
MD5aab600da7532150b6fd984f3c6e6d781
SHA130c95ec5f80d8595221c9f37c0f172ea2ce7b917
SHA256c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019
SHA51270c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06