cdc3031a30bbab2c22d0ee211a1ede49cd809ff3b208f7fdd07f5108b0b4c52b

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2023, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

QxlWddmDod_0.21.0.0_x64.msi
Size

1.2MB
MD5

fd02685fa40e1d7c8340fca32a1ac8fe
SHA1

75c4b8150d866586a53ab171899e3689f263e04b
SHA256

cdc3031a30bbab2c22d0ee211a1ede49cd809ff3b208f7fdd07f5108b0b4c52b
SHA512

3ccdd2095298f65057829ac921e1cc0b53ae0a016a6d116795d5d727d3869e28284565f248ff6e7549538cda8cec4f99f68178332039b959d94cfaeea6029727
SSDEEP

24576:N7a1kxSYYKVIMgWFN/ExN0wh69DUwevflGIWh:JmnYGW0xph69gflG

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	4924	msiexec.exe
8	4924	msiexec.exe
10	4924	msiexec.exe

Loads dropped DLL 3 IoCs

pid	Process
3956	MsiExec.exe
780	MsiExec.exe
3956	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\qxldod.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\SET35C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\SET35D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\qxldod.inf_amd64_6199f9ecf2339133\qxldod.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\SET35D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\qxldod.inf_amd64_6199f9ecf2339133\qxldod.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\SET35C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\qxldod.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\qxldod.inf_amd64_6199f9ecf2339133\qxldod.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\SET2BF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\SET2BF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\qxldod.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\qxldod.inf_amd64_6199f9ecf2339133\qxldod.sys	DrvInst.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Red Hat\QXL-WDDM-DOD\qxldod.inf	msiexec.exe
File created	C:\Program Files\Red Hat\QXL-WDDM-DOD\qxldod.pdb	msiexec.exe
File created	C:\Program Files\Red Hat\QXL-WDDM-DOD\qxldod.sys	msiexec.exe
File created	C:\Program Files\Red Hat\QXL-WDDM-DOD\qxldod.cat	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4E1338D0-6035-4ED7-B2F0-57DBCF3369DB}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE6A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE8A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\e56fc58.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91B.tmp	msiexec.exe
File created	C:\Windows\Installer\e56fc56.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56fc56.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a8dca56a4fb650f70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a8dca56a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900a8dca56a000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D8331E453067DE42B0F75BDFC3396BD\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\ProductName = "Red Hat QXL controller"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\PackageCode = "43EC4A25AA2C5CB4697F92FE475A00AE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\Version = "1376256"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList\PackageName = "QxlWddmDod_0.21.0.0_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D8331E453067DE42B0F75BDFC3396BD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7E55D72928B94DB47B870B7F66D52E9C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7E55D72928B94DB47B870B7F66D52E9C\0D8331E453067DE42B0F75BDFC3396BD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D8331E453067DE42B0F75BDFC3396BD\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	msiexec.exe
2432	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4924	msiexec.exe
Token: SeSecurityPrivilege	2432	msiexec.exe
Token: SeCreateTokenPrivilege	4924	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4924	msiexec.exe
Token: SeLockMemoryPrivilege	4924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4924	msiexec.exe
Token: SeMachineAccountPrivilege	4924	msiexec.exe
Token: SeTcbPrivilege	4924	msiexec.exe
Token: SeSecurityPrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeLoadDriverPrivilege	4924	msiexec.exe
Token: SeSystemProfilePrivilege	4924	msiexec.exe
Token: SeSystemtimePrivilege	4924	msiexec.exe
Token: SeProfSingleProcessPrivilege	4924	msiexec.exe
Token: SeIncBasePriorityPrivilege	4924	msiexec.exe
Token: SeCreatePagefilePrivilege	4924	msiexec.exe
Token: SeCreatePermanentPrivilege	4924	msiexec.exe
Token: SeBackupPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeShutdownPrivilege	4924	msiexec.exe
Token: SeDebugPrivilege	4924	msiexec.exe
Token: SeAuditPrivilege	4924	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4924	msiexec.exe
Token: SeChangeNotifyPrivilege	4924	msiexec.exe
Token: SeRemoteShutdownPrivilege	4924	msiexec.exe
Token: SeUndockPrivilege	4924	msiexec.exe
Token: SeSyncAgentPrivilege	4924	msiexec.exe
Token: SeEnableDelegationPrivilege	4924	msiexec.exe
Token: SeManageVolumePrivilege	4924	msiexec.exe
Token: SeImpersonatePrivilege	4924	msiexec.exe
Token: SeCreateGlobalPrivilege	4924	msiexec.exe
Token: SeBackupPrivilege	3476	vssvc.exe
Token: SeRestorePrivilege	3476	vssvc.exe
Token: SeAuditPrivilege	3476	vssvc.exe
Token: SeBackupPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeAuditPrivilege	3808	svchost.exe
Token: SeSecurityPrivilege	3808	svchost.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4924	msiexec.exe
4924	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 5008	2432	msiexec.exe	95
PID 2432 wrote to memory of 5008	2432	msiexec.exe	95
PID 2432 wrote to memory of 3956	2432	msiexec.exe	97
PID 2432 wrote to memory of 3956	2432	msiexec.exe	97
PID 2432 wrote to memory of 780	2432	msiexec.exe	98
PID 2432 wrote to memory of 780	2432	msiexec.exe	98
PID 3808 wrote to memory of 2592	3808	svchost.exe	100
PID 3808 wrote to memory of 2592	3808	svchost.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\QxlWddmDod_0.21.0.0_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5008
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0D7C75B0BA4602FEA943028F8F28EDD3
  2⤵
  - Loads dropped DLL
  PID:3956
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B20BC347567C617EE97CBE70D6D1B1EE E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Red Hat\QXL-WDDM-DOD\qxldod.inf" "9" "476b3edbb" "00000000000000B8" "WinSta0\Default" "0000000000000138" "208" "C:\Program Files\Red Hat\QXL-WDDM-DOD"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e56fc57.rbs

Filesize
698KB

MD5
4b77ab134883f58ba0acea6d234a5fed

SHA1
adf69eba9d198f58cb4f0165be2ea1c499a8e1cd

SHA256
401e4f871e8e624cd373078a854f9d1848d5ab8b8a285b77bf9a3722290ac5fc

SHA512
42b920fdeebc89d8449fa1ed5871b77baa7e5f3d4c5a9e34a010412d59cb1a6a40e7b68b76e0bcfc89b3f142ec6bc7b450631288e0400d8557c6405836441817

Download Submit
C:\PROGRA~1\REDHAT~1\QXL-WD~1\qxldod.cat

Filesize
9KB

MD5
ddce849b2f010068231b2af8a30f4b2e

SHA1
7fd76c6bacf7bc85aca9a8a5460d06f48b20300d

SHA256
2d8411beb9c58ea117c34c59cecd2c0f8df0780b13120cbf6e07b966c415ba13

SHA512
42d338e286868e3b18b672937eab88b8110915c67818c7487906ce9c1001dcebef0278b202c5c38db0490caaa86987b075940d3fcdb4627f42ffb153bf11a275

Download Submit
C:\PROGRA~1\REDHAT~1\QXL-WD~1\qxldod.sys

Filesize
100KB

MD5
aee3763b71a78ab2ae3d9c0852ca1d1e

SHA1
8afd00717a78ec703723826cc5f43b6b5f0153e6

SHA256
1b2f517044d5349c6e338c8a035274d1a423c129f376208a8702568812bcff8e

SHA512
ad5d93be10befa3369f78407a0ea9e3f3310137d0dc370754f9d3db7878107864c5b971e9bfc62ce4cf0eef49a941b519500dafe4f9dbb6753ab5b3a3b34fa85

Download Submit
C:\Program Files\Red Hat\QXL-WDDM-DOD\qxldod.inf

Filesize
2KB

MD5
6a37574f102b0b14351d8b8a0c0bffe6

SHA1
ad4fbb886840a38b58282de85a05a843b822df26

SHA256
ce760456db38bc2f4169cd347ee9bd18129440da6d87274e7e3cae4814b07ab3

SHA512
173d5b0192a88009d2f4c960f99221cd5b83ffb2222e2b774ef9e7bfa16d694782a13c1678cd67d5e9de9ed7f9a623e03fe339df814875a8af3d5430536abe98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
1KB

MD5
73bc507b9a08db40cf5e786c9147700c

SHA1
35c2b2cc42e0ebe76c157dbfbcde947826722444

SHA256
32fadfeed09ceecb9b4af9fc411c820911c3c909558107b2d21c1da861326ec4

SHA512
d7d2b8d31c85f4d661c65045b3107ad3f4cee17be74df06e77f7451fbf3a7c2399f14c026710ba14ab248a929ad6f15190408323d0eb95f24081c988722d85d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_0B8D2F2AE9116DAEFA3CA328805C1EB0

Filesize
1KB

MD5
7e1642ddbb3f4a77a6f4aacdcc0647db

SHA1
8c720adc75ed31addfcf6dcb50586ebf8fd132cb

SHA256
2ab5e1d2423388093376f4c903a3a896a238b0ee856a6f3891f3822085d79792

SHA512
4bd6604f2295afb3a42d5511c45d9ccc7ee544407599d1e8a2d8e62f9c1a3a7d6570a61744e443d8cb0505c4ec8526b0c4783e8e4959a85b4075e4edf1d8738e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
388B

MD5
4eb01deceba05c271fb5e110e484769f

SHA1
485eaaccb864871682a0e15ad8d6ca163c04ed64

SHA256
b82243520c85d39c7a05cbcecd21c9071f4e2bff4f503574eda8a59c806db653

SHA512
4716233e7114bde08114df73d3332e682cab5b9f9accfaeedf9b8374ad6c595f31955f26140ae5b3609fb518a08a8137e17d5c23d0edb2ace84a960bb13afe34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_0B8D2F2AE9116DAEFA3CA328805C1EB0

Filesize
390B

MD5
124c65565d3e499578fb83a4af0b0a9b

SHA1
d756dd97457d727b6358a5294c73dd50ea3fb526

SHA256
96a334c09d3c488bd81f971f3f7037b74440be69d49fbf9aaee745c4f7a44d8f

SHA512
0638c10f392bae21958560b32ed3305749eb1bb61ae51a0b1113ca50b51ce0da286cfeccb9dbb8247e385bef94a51cf3738f2d071ef3d62661908a73d87bf231

Download Submit
C:\Windows\Installer\MSI11.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI11.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI91B.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI91B.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSIFE8A.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSIFE8A.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\e56fc56.msi

Filesize
1.2MB

MD5
fd02685fa40e1d7c8340fca32a1ac8fe

SHA1
75c4b8150d866586a53ab171899e3689f263e04b

SHA256
cdc3031a30bbab2c22d0ee211a1ede49cd809ff3b208f7fdd07f5108b0b4c52b

SHA512
3ccdd2095298f65057829ac921e1cc0b53ae0a016a6d116795d5d727d3869e28284565f248ff6e7549538cda8cec4f99f68178332039b959d94cfaeea6029727

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
2KB

MD5
b9cc02e84de1b863c1d74d61d4af569e

SHA1
2af0c321c5e7866c718d8c832108a7f0e7aaafdd

SHA256
26f634f43e5dfbb8149e594ff9b73bbcf080d69c46b9dfd602f7d88861907938

SHA512
68816cac2b9a890fd58cda41f4ec8d6794bc715005912f62058beffe7765d81d510e67d20b3061728e620168bf69dec6a2f96363e6216601c61bfd7d44c099e5

Download Submit
C:\Windows\System32\DriverStore\FileRepository\qxldod.inf_amd64_6199f9ecf2339133\qxldod.cat

Filesize
9KB

MD5
ddce849b2f010068231b2af8a30f4b2e

SHA1
7fd76c6bacf7bc85aca9a8a5460d06f48b20300d

SHA256
2d8411beb9c58ea117c34c59cecd2c0f8df0780b13120cbf6e07b966c415ba13

SHA512
42d338e286868e3b18b672937eab88b8110915c67818c7487906ce9c1001dcebef0278b202c5c38db0490caaa86987b075940d3fcdb4627f42ffb153bf11a275

Download Submit
C:\Windows\System32\DriverStore\FileRepository\qxldod.inf_amd64_6199f9ecf2339133\qxldod.inf

Filesize
2KB

MD5
6a37574f102b0b14351d8b8a0c0bffe6

SHA1
ad4fbb886840a38b58282de85a05a843b822df26

SHA256
ce760456db38bc2f4169cd347ee9bd18129440da6d87274e7e3cae4814b07ab3

SHA512
173d5b0192a88009d2f4c960f99221cd5b83ffb2222e2b774ef9e7bfa16d694782a13c1678cd67d5e9de9ed7f9a623e03fe339df814875a8af3d5430536abe98

Download Submit
C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\qxldod.cat

Filesize
9KB

MD5
ddce849b2f010068231b2af8a30f4b2e

SHA1
7fd76c6bacf7bc85aca9a8a5460d06f48b20300d

SHA256
2d8411beb9c58ea117c34c59cecd2c0f8df0780b13120cbf6e07b966c415ba13

SHA512
42d338e286868e3b18b672937eab88b8110915c67818c7487906ce9c1001dcebef0278b202c5c38db0490caaa86987b075940d3fcdb4627f42ffb153bf11a275

Download Submit
C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\qxldod.inf

Filesize
2KB

MD5
6a37574f102b0b14351d8b8a0c0bffe6

SHA1
ad4fbb886840a38b58282de85a05a843b822df26

SHA256
ce760456db38bc2f4169cd347ee9bd18129440da6d87274e7e3cae4814b07ab3

SHA512
173d5b0192a88009d2f4c960f99221cd5b83ffb2222e2b774ef9e7bfa16d694782a13c1678cd67d5e9de9ed7f9a623e03fe339df814875a8af3d5430536abe98

Download Submit
C:\Windows\System32\DriverStore\Temp\{5d60a020-9fa2-5042-bd8f-fc47cf03ec4f}\qxldod.sys

Filesize
100KB

MD5
aee3763b71a78ab2ae3d9c0852ca1d1e

SHA1
8afd00717a78ec703723826cc5f43b6b5f0153e6

SHA256
1b2f517044d5349c6e338c8a035274d1a423c129f376208a8702568812bcff8e

SHA512
ad5d93be10befa3369f78407a0ea9e3f3310137d0dc370754f9d3db7878107864c5b971e9bfc62ce4cf0eef49a941b519500dafe4f9dbb6753ab5b3a3b34fa85

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
11.8MB

MD5
44d1b651647eb6503e59b0b03172e213

SHA1
d2819e4b1c14b347683952bdd4ccb9454464f88e

SHA256
94522fa6348dd77544e9cf6fc080288a015ac57ba9a5595daf7a075cc47dcda9

SHA512
2f25a345ad9c34a51bda72f7762c69be43d0ce97e59fa4ab91385e56276389319583ea4b6068dbea8e9e8078c11591439de87440c6d2af04c619ec5dc89f9514

Download Submit
\??\Volume{6aa5dca8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{580a25f7-4aef-4a47-9c24-2fd6a42ea9cb}_OnDiskSnapshotProp

Filesize
5KB

MD5
07986796a435aa9acfe79f99eb2d4f85

SHA1
d4608c196dd8e61e35d7f06d41bf1beadacb7903

SHA256
571e9c7a6ac5228e82055028c5cce6a241917ca32d2e6934f756625f62fb710c

SHA512
f70064fd288ea31ff6c478ff71aad78321afc29ef4f965e7745e2cb0f013d9fe8810302258c8ab89c199c011dddcf0e15f5da066089e276f9911d6eb5eb63f6b

Download Submit