plugx | b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
13-09-2022 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Size

4.0MB
MD5

083f54e1891baeb8783adc6ee775fc41
SHA1

9f7b44476da46086e38f89f4eb2b9900629082a4
SHA256

b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1
SHA512

4c0ab2a86af49ed0fd129095962e11baa9fa9a9e0276473832be6c47bb8918c5c39a2f228a06e6f7d2aaa8d791c75645102ee5674ba44a9e3b9dc079c936d8ab
SSDEEP

98304:Zwa9JkoXTaSRr+aV1uHIx5gjSTBvq+TYIMV3hMAo:Zr9UY5g0v0g

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1292-85-0x00000000026C0000-0x00000000036C0000-memory.dmp	family_plugx
behavioral1/memory/588-93-0x0000000002060000-0x0000000003060000-memory.dmp	family_plugx
behavioral1/memory/388-97-0x0000000000C80000-0x0000000001C80000-memory.dmp	family_plugx
behavioral1/memory/1924-103-0x00000000020E0000-0x00000000030E0000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 3 IoCs

Processes:

MSI9A94.tmpbdreinit.exebdreinit.exe

pid process

1388 MSI9A94.tmp
1292 bdreinit.exe
588 bdreinit.exe
Loads dropped DLL 8 IoCs

Processes:

MsiExec.exeMsiExec.exebdreinit.exebdreinit.exe

pid process

684 MsiExec.exe
1180 MsiExec.exe
1180 MsiExec.exe
1180 MsiExec.exe
1180 MsiExec.exe
1180 MsiExec.exe
1292 bdreinit.exe
588 bdreinit.exe

pid	process
1388	MSI9A94.tmp
1292	bdreinit.exe
588	bdreinit.exe

pid	process
684	MsiExec.exe
1180	MsiExec.exe
1180	MsiExec.exe
1180	MsiExec.exe
1180	MsiExec.exe
1180	MsiExec.exe
1292	bdreinit.exe
588	bdreinit.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\N:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\Q:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\R:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\Z:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\M:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\O:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\F:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\T:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\Y:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\J:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\X:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\K:	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Program Files directory 10 IoCs

Processes:

bdreinit.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\BitDefender\Handler\log.dll	bdreinit.exe
File opened for modification	C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe	bdreinit.exe
File created	C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe	bdreinit.exe
File created	C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Microsoft\log.dat	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Microsoft\log.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\BitDefender\Handler	bdreinit.exe
File created	C:\Program Files (x86)\BitDefender\Handler\log.dll	bdreinit.exe
File opened for modification	C:\Program Files (x86)\BitDefender\Handler\log.dat	bdreinit.exe
File created	C:\Program Files (x86)\BitDefender\Handler\log.dat	bdreinit.exe

Drops file in Windows directory 16 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\6c915a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9736.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c915a.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI93B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\6c915c.msi	msiexec.exe
File created	C:\Windows\Installer\6c9158.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c9158.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI988F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI9456.tmp	msiexec.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Modifies registry class 25 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD82DDACD3274DB4AACFAF4E93AB6E74\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A63D6CDA60BAB248B02E4255D3A74C1\FD82DDACD3274DB4AACFAF4E93AB6E74	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\KET.FAST	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 36004500350032004200310035003600380044003000300036004600450032000000	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD82DDACD3274DB4AACFAF4E93AB6E74	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\ProductName = "Microsoft"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\PackageCode = "C3DCF6D77E9A82E4884CC7833DE2C026"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A63D6CDA60BAB248B02E4255D3A74C1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\PackageName = "Microsoft.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD82DDACD3274DB4AACFAF4E93AB6E74\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeMSI9A94.tmpsvchost.exeuserinit.exe

pid	process
1372	msiexec.exe
1372	msiexec.exe
1388	MSI9A94.tmp
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe
388	svchost.exe
388	svchost.exe
1924	userinit.exe
1924	userinit.exe
1924	userinit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exeb55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe

description	pid	process
Token: SeRestorePrivilege	1372	msiexec.exe
Token: SeTakeOwnershipPrivilege	1372	msiexec.exe
Token: SeSecurityPrivilege	1372	msiexec.exe
Token: SeCreateTokenPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeAssignPrimaryTokenPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeLockMemoryPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeIncreaseQuotaPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeMachineAccountPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeTcbPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSecurityPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeTakeOwnershipPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeLoadDriverPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSystemProfilePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSystemtimePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeProfSingleProcessPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeIncBasePriorityPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreatePagefilePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreatePermanentPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeBackupPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeRestorePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeShutdownPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeDebugPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeAuditPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSystemEnvironmentPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeChangeNotifyPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeRemoteShutdownPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeUndockPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSyncAgentPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeEnableDelegationPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeManageVolumePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeImpersonatePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreateGlobalPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreateTokenPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeAssignPrimaryTokenPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeLockMemoryPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeIncreaseQuotaPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeMachineAccountPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeTcbPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSecurityPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeTakeOwnershipPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeLoadDriverPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSystemProfilePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSystemtimePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeProfSingleProcessPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeIncBasePriorityPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreatePagefilePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreatePermanentPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeBackupPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeRestorePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeShutdownPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeDebugPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeAuditPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSystemEnvironmentPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeChangeNotifyPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeRemoteShutdownPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeUndockPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeSyncAgentPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeEnableDelegationPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeManageVolumePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeImpersonatePrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreateGlobalPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeCreateTokenPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeAssignPrimaryTokenPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
Token: SeLockMemoryPrivilege	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exemsiexec.exe

pid process

2024 b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
568 msiexec.exe
568 msiexec.exe

pid	process
2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
568	msiexec.exe
568	msiexec.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

msiexec.exeb55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exebdreinit.exesvchost.exe

description	pid	process	target process
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 684	1372	msiexec.exe	MsiExec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 2024 wrote to memory of 568	2024	b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe	msiexec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1180	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 1372 wrote to memory of 1388	1372	msiexec.exe	MSI9A94.tmp
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 588 wrote to memory of 388	588	bdreinit.exe	svchost.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe
PID 388 wrote to memory of 1924	388	svchost.exe	userinit.exe

C:\Users\Admin\AppData\Local\Temp\b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe
"C:\Users\Admin\AppData\Local\Temp\b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\Microsoft.msi AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\b55abbc07b02308c5315aa31de307ca62665d340806114a1992536584a5895d1.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1663054546 "
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:568

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1BFC53243C5C4EE9DEA581B151F54DA7 C
  2⤵
  - Loads dropped DLL
  PID:684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BCC7AAFC74DC48295E4203C176497324
  2⤵
  - Loads dropped DLL
  PID:1180
- C:\Windows\Installer\MSI9A94.tmp
  "C:\Windows\Installer\MSI9A94.tmp" "C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1816

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000056C" "00000000000003E0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:588

C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe
"C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1292

C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe
"C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe" 600 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 601 0
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\system32\userinit.exe 609 388
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BitDefender\Handler\bdreinit.exe

Filesize
192KB

MD5
8a8db1e20dc508af5a81fc00b1929468

SHA1
32e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f

SHA256
386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd

SHA512
9c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87

Download Submit
C:\Program Files (x86)\BitDefender\Handler\log.dat

Filesize
199KB

MD5
4d46b087b62183d86c53bf05ce4e2c8d

SHA1
174bd3886bd598f621eb758f469f69e85532f5c0

SHA256
49686cbde9535055fa48a0742bbe765f9d6ec1104e7efa8f71d1894f2d7d7873

SHA512
cf87b40dd69306285adff88de6050c1d456c34b2056e8f98ca7cf046459b6839afe67f4b13e25e5162ab311f1033a004b7e1bdc2955a10e8490eaef0f882a117

Download Submit
C:\Program Files (x86)\BitDefender\Handler\log.dll

Filesize
139KB

MD5
c55b6938f885c07d627c15165c21390a

SHA1
9d2e460fd11791e78eb7fbc1357c973493293572

SHA256
f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c

SHA512
9f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9

Download Submit
C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe

Filesize
192KB

MD5
8a8db1e20dc508af5a81fc00b1929468

SHA1
32e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f

SHA256
386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd

SHA512
9c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87

Download Submit
C:\Program Files (x86)\Microsoft Office\Microsoft\bdreinit.exe

Filesize
192KB

MD5
8a8db1e20dc508af5a81fc00b1929468

SHA1
32e1ebec9672ad7cc5dc36d8a1c87bbf47a4fa9f

SHA256
386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd

SHA512
9c5747fd7563b29ecf43b71b5480b260b083892d37054ff77cc6c613c3db380ce2bdf990fb466edc8705f784b051dc1be208b454696e67eb0c90c20470f4ea87

Download Submit
C:\Program Files (x86)\Microsoft Office\Microsoft\log.dat

Filesize
199KB

MD5
4d46b087b62183d86c53bf05ce4e2c8d

SHA1
174bd3886bd598f621eb758f469f69e85532f5c0

SHA256
49686cbde9535055fa48a0742bbe765f9d6ec1104e7efa8f71d1894f2d7d7873

SHA512
cf87b40dd69306285adff88de6050c1d456c34b2056e8f98ca7cf046459b6839afe67f4b13e25e5162ab311f1033a004b7e1bdc2955a10e8490eaef0f882a117

Download Submit
C:\Program Files (x86)\Microsoft Office\Microsoft\log.dll

Filesize
139KB

MD5
c55b6938f885c07d627c15165c21390a

SHA1
9d2e460fd11791e78eb7fbc1357c973493293572

SHA256
f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c

SHA512
9f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI906.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.msi

Filesize
1.5MB

MD5
df26d42194e934122c73559987f3ab84

SHA1
c526f8e1f8f4b22c0b62f76af448c63a7e5f2073

SHA256
eec36f5b2d28bb8076648f96899def8e297347322dd7d13368234680eaaee01d

SHA512
e62bd5773649251dfaa4870b2e5f6ebff6e69dd18ac4ecdeb296d0826b02b4a76d878037ea183a2653044afe5b807cee15c9fd1d7032bb6e75e761609e8f30b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft1.cab

Filesize
351KB

MD5
a66bc9849ba7d090a983e1aa64275e9a

SHA1
86f35c1a29cde722c2c822c46e4c4eac0b360f4a

SHA256
1b1a6809886af74850a817d23854ada702af6e6f094ac477049faa46c317d9cc

SHA512
e1a5f7b65bbca6a6eba9bcfaa278882961e3d0ad3b03a18a6fdda91558372d9a902d6ebe2f203d5b1174145eb84b3b5ebfe9fc78bb1d081f34d72b9b03993f90

Download Submit
C:\Windows\Installer\MSI92BF.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
C:\Windows\Installer\MSI93B9.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
C:\Windows\Installer\MSI9456.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
C:\Windows\Installer\MSI9736.tmp

Filesize
529KB

MD5
aab600da7532150b6fd984f3c6e6d781

SHA1
30c95ec5f80d8595221c9f37c0f172ea2ce7b917

SHA256
c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019

SHA512
70c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06

Download Submit
C:\Windows\Installer\MSI988F.tmp

Filesize
529KB

MD5
aab600da7532150b6fd984f3c6e6d781

SHA1
30c95ec5f80d8595221c9f37c0f172ea2ce7b917

SHA256
c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019

SHA512
70c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06

Download Submit
C:\Windows\Installer\MSI9A94.tmp

Filesize
401KB

MD5
8c7085c86a4b14296f6e76525f20c828

SHA1
6113087876f86c9247bc4080c08ce1ae578d9a99

SHA256
beeaa8bfc97d87c1739611a88d3f4fa9a561cecbc5379309543dd850cc3f956c

SHA512
97dcbe469ec14114b90c0c52c289af173c6078b8aad3f9bb78c212278f1980d2750ce8bfba6b1ac0aaf72aa956f4c0be0c471ffbc7e811d4affa5896d36367e0

Download Submit
\Program Files (x86)\BitDefender\Handler\log.dll

Filesize
139KB

MD5
c55b6938f885c07d627c15165c21390a

SHA1
9d2e460fd11791e78eb7fbc1357c973493293572

SHA256
f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c

SHA512
9f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9

Download Submit
\Program Files (x86)\Microsoft Office\Microsoft\log.dll

Filesize
139KB

MD5
c55b6938f885c07d627c15165c21390a

SHA1
9d2e460fd11791e78eb7fbc1357c973493293572

SHA256
f534e7193ff51dcf12e4d1f09825a38e3f4992f88b071f288c6d628ec626582c

SHA512
9f225317c7f60621dfd43ccc9c4cfeef5cbaf8cf304702189283d8b74f179487d857a5ebeff87b40d008e71c369200b7a490babe39d4423fdbf55b8c39c1acd9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI906.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
\Windows\Installer\MSI92BF.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
\Windows\Installer\MSI93B9.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
\Windows\Installer\MSI9456.tmp

Filesize
377KB

MD5
316ed83688978925aa47a0c4d5662d2c

SHA1
96aaa52977cbd62ba865b35f9730c7c2861e5c2b

SHA256
da354085bcbca5ed614e754eb78a5aa9b879b8d5375625b6d1e34f5ea63c097e

SHA512
14eba103ed9cf5780e9bb59feb903159f928a6abdc0fdcede29d9cb59ea7df2cc379dc92d74e0c527ce98ee73b83fcf5fcc677ab82dcddcab581f7a87e9399e9

Download Submit
\Windows\Installer\MSI9736.tmp

Filesize
529KB

MD5
aab600da7532150b6fd984f3c6e6d781

SHA1
30c95ec5f80d8595221c9f37c0f172ea2ce7b917

SHA256
c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019

SHA512
70c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06

Download Submit
\Windows\Installer\MSI988F.tmp

Filesize
529KB

MD5
aab600da7532150b6fd984f3c6e6d781

SHA1
30c95ec5f80d8595221c9f37c0f172ea2ce7b917

SHA256
c4241c23b49fcf5da34862aa43b801b9282d4613b2220effe2332150c13fb019

SHA512
70c41d7c5e76e169e1f41f96a8a68d1ca2a9206f87a46f08519b8301205cba40368ad1dd7a7266d2bed5a22d54dd1937f52eb18bc7d153608081bdc3e035ce06

Download Submit
memory/388-105-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/388-99-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/388-97-0x0000000000C80000-0x0000000001C80000-memory.dmp

Filesize
16.0MB

Download
memory/388-96-0x0000000000000000-mapping.dmp

Download
memory/388-94-0x00000000000A0000-0x00000000000D0000-memory.dmp

Filesize
192KB

Download
memory/568-61-0x0000000000000000-mapping.dmp

Download
memory/588-93-0x0000000002060000-0x0000000003060000-memory.dmp

Filesize
16.0MB

Download
memory/684-57-0x0000000000000000-mapping.dmp

Download
memory/1180-64-0x0000000000000000-mapping.dmp

Download
memory/1292-87-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download
memory/1292-85-0x00000000026C0000-0x00000000036C0000-memory.dmp

Filesize
16.0MB

Download
memory/1372-56-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1388-77-0x0000000000000000-mapping.dmp

Download
memory/1924-102-0x0000000000000000-mapping.dmp

Download
memory/1924-103-0x00000000020E0000-0x00000000030E0000-memory.dmp

Filesize
16.0MB

Download
memory/2024-55-0x00000000742C1000-0x00000000742C3000-memory.dmp

Filesize
8KB

Download
memory/2024-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download