blackmoon | 1da26ddd2b93eec00f5b4ed407e8360f7b31a51241d8cfe108b2b88c26948b4b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
14-11-2023 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tg.msi
Size

65.9MB
MD5

cfc82a8a640e156626dde4ca6bc3c8b1
SHA1

cc975d884ebaa3a8f1ba2050eba90c169ba70731
SHA256

1da26ddd2b93eec00f5b4ed407e8360f7b31a51241d8cfe108b2b88c26948b4b
SHA512

913125e3e8969cede39e8d92d20816c611401ba3bc2135c5c7bc8c4e752e40f6acbe5b96d04ab3856f6d6c06da6fdc2140ba64e7811f6f3f079cc81243b6c9a9
SSDEEP

1572864:7y0HNdfTIKjkuW9hSCNmMPKctkorSuHw2srpvKhzzApc:G0t5hJe5m+bOIWpv

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/2168-138-0x00000000028B0000-0x00000000028D5000-memory.dmp	family_blackmoon
behavioral2/memory/3408-169-0x0000000002E90000-0x0000000002EB5000-memory.dmp	family_blackmoon

Executes dropped EXE 3 IoCs

pid	Process
3396	Service.exe
2168	Service.exe
3408	Service.exe

Loads dropped DLL 16 IoCs

pid	Process
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1116	MsiExec.exe
1116	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
3396	Service.exe
3396	Service.exe
2168	Service.exe
2168	Service.exe
3408	Service.exe
3408	Service.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5860d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5860d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63E6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F20A49B1-CAA9-4ED3-AC24-85246FBFA881}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6201.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Service.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings	Service.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
220	msiexec.exe
220	msiexec.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe
2168	Service.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	220	msiexec.exe
Token: SeCreateTokenPrivilege	2320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2320	msiexec.exe
Token: SeLockMemoryPrivilege	2320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2320	msiexec.exe
Token: SeMachineAccountPrivilege	2320	msiexec.exe
Token: SeTcbPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeLoadDriverPrivilege	2320	msiexec.exe
Token: SeSystemProfilePrivilege	2320	msiexec.exe
Token: SeSystemtimePrivilege	2320	msiexec.exe
Token: SeProfSingleProcessPrivilege	2320	msiexec.exe
Token: SeIncBasePriorityPrivilege	2320	msiexec.exe
Token: SeCreatePagefilePrivilege	2320	msiexec.exe
Token: SeCreatePermanentPrivilege	2320	msiexec.exe
Token: SeBackupPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeShutdownPrivilege	2320	msiexec.exe
Token: SeDebugPrivilege	2320	msiexec.exe
Token: SeAuditPrivilege	2320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2320	msiexec.exe
Token: SeChangeNotifyPrivilege	2320	msiexec.exe
Token: SeRemoteShutdownPrivilege	2320	msiexec.exe
Token: SeUndockPrivilege	2320	msiexec.exe
Token: SeSyncAgentPrivilege	2320	msiexec.exe
Token: SeEnableDelegationPrivilege	2320	msiexec.exe
Token: SeManageVolumePrivilege	2320	msiexec.exe
Token: SeImpersonatePrivilege	2320	msiexec.exe
Token: SeCreateGlobalPrivilege	2320	msiexec.exe
Token: SeCreateTokenPrivilege	2320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2320	msiexec.exe
Token: SeLockMemoryPrivilege	2320	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2320	msiexec.exe
Token: SeMachineAccountPrivilege	2320	msiexec.exe
Token: SeTcbPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeLoadDriverPrivilege	2320	msiexec.exe
Token: SeSystemProfilePrivilege	2320	msiexec.exe
Token: SeSystemtimePrivilege	2320	msiexec.exe
Token: SeProfSingleProcessPrivilege	2320	msiexec.exe
Token: SeIncBasePriorityPrivilege	2320	msiexec.exe
Token: SeCreatePagefilePrivilege	2320	msiexec.exe
Token: SeCreatePermanentPrivilege	2320	msiexec.exe
Token: SeBackupPrivilege	2320	msiexec.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeShutdownPrivilege	2320	msiexec.exe
Token: SeDebugPrivilege	2320	msiexec.exe
Token: SeAuditPrivilege	2320	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2320	msiexec.exe
Token: SeChangeNotifyPrivilege	2320	msiexec.exe
Token: SeRemoteShutdownPrivilege	2320	msiexec.exe
Token: SeUndockPrivilege	2320	msiexec.exe
Token: SeSyncAgentPrivilege	2320	msiexec.exe
Token: SeEnableDelegationPrivilege	2320	msiexec.exe
Token: SeManageVolumePrivilege	2320	msiexec.exe
Token: SeImpersonatePrivilege	2320	msiexec.exe
Token: SeCreateGlobalPrivilege	2320	msiexec.exe
Token: SeCreateTokenPrivilege	2320	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2320	msiexec.exe
Token: SeLockMemoryPrivilege	2320	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2320	msiexec.exe
2320	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1008	220	msiexec.exe	73
PID 220 wrote to memory of 1008	220	msiexec.exe	73
PID 220 wrote to memory of 1008	220	msiexec.exe	73
PID 220 wrote to memory of 4844	220	msiexec.exe	77
PID 220 wrote to memory of 4844	220	msiexec.exe	77
PID 220 wrote to memory of 1116	220	msiexec.exe	79
PID 220 wrote to memory of 1116	220	msiexec.exe	79
PID 220 wrote to memory of 1116	220	msiexec.exe	79
PID 1008 wrote to memory of 3396	1008	MsiExec.exe	81
PID 1008 wrote to memory of 3396	1008	MsiExec.exe	81
PID 1008 wrote to memory of 3396	1008	MsiExec.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tg.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2320

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A1363A05836AD5CFC5AF456FC1B3B515 C
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe
    "C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:3396
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DA4A4B8A48B56377C3D6462C356B7AA5
  2⤵
  - Loads dropped DLL
  PID:1116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1856

C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe
"C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe" AAAABBAAAA
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2168

C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe
"C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe" AAAABBAAAA
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5860d9.rbs

Filesize
4KB

MD5
d9a0335d4c991e54d2f19e6c63a3ad99

SHA1
a0ce9a21ed473c75192302975f31a06e6a1ae5f9

SHA256
aa7aa9ed0f30ecbaa72255cdb4908b8db421c984bf981c7b01d3dba8d92762fb

SHA512
8e3c28bbe55ae9bd3bb1dbf05184c0039fdf12aa91363e7a17160f312dbad3e0865b0b995851263dea8aebe3dfd41eca32d9679fc6fd59262d53955fef5c0041

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8108.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8177.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEF23.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF0C9.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF167.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF167.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF1D5.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF243.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF419.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram.exe

Filesize
135.1MB

MD5
0a2c35b334695d658172aa72e06ca09b

SHA1
db5e5d2129cb2423239b17360a301c1636192c44

SHA256
ac97c0a4651ee45cb77ec4e1b2ea3b8e409ee9904e2769fd385acc537e3545f3

SHA512
42134bb9f1bb05a2d829367616f1d5b4766237afe3346599ca669adbf3a75383430c6b8577e563b8a113c90884a8997d2c7e671cce221b6a525fcd60f7a33003

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\DuiLib.png

Filesize
789KB

MD5
a9b064de7683e8f09b792d6b88800daf

SHA1
cf457585e649dcf98e9fb9fea7366075a5493290

SHA256
1157df29097c9290c88faa365c189324f1d5409fabf9a9b0c6bb3e30c4f2e3f8

SHA512
13f17053f511df7b416c9d14dbe7aa2be2afae5a38a41502b394419a30a178ea6924d0cc98958a4fd1160794fdfaaa3cd045957f83883253173aa7a225deef72

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\DuiLib_u.dll

Filesize
489KB

MD5
0b98bd6bf1956a04d626bf45c8a8f24f

SHA1
4d33a107a39071d5f3dfb0d5e6665920eea1ecf0

SHA256
d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2

SHA512
6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe

Filesize
1.4MB

MD5
f69465ef1bc5fcfd30a667a4eec19c66

SHA1
70074fd04a8fe4804421b215b3f13252c2fe31de

SHA256
dda4924824054c574b5a7c96b2e30f7fb6e643b510db8288b1a6721fa7ff463a

SHA512
7445615aa9798315f13da7a354898f4463792d1292dfea3be398e782964bad16150791bb07e6a9e6dbf9372657c3ca5afa3cc8eb8d3d039e846a67fdd889af83

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe

Filesize
1.4MB

MD5
f69465ef1bc5fcfd30a667a4eec19c66

SHA1
70074fd04a8fe4804421b215b3f13252c2fe31de

SHA256
dda4924824054c574b5a7c96b2e30f7fb6e643b510db8288b1a6721fa7ff463a

SHA512
7445615aa9798315f13da7a354898f4463792d1292dfea3be398e782964bad16150791bb07e6a9e6dbf9372657c3ca5afa3cc8eb8d3d039e846a67fdd889af83

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe

Filesize
1.4MB

MD5
f69465ef1bc5fcfd30a667a4eec19c66

SHA1
70074fd04a8fe4804421b215b3f13252c2fe31de

SHA256
dda4924824054c574b5a7c96b2e30f7fb6e643b510db8288b1a6721fa7ff463a

SHA512
7445615aa9798315f13da7a354898f4463792d1292dfea3be398e782964bad16150791bb07e6a9e6dbf9372657c3ca5afa3cc8eb8d3d039e846a67fdd889af83

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\Service.exe

Filesize
1.4MB

MD5
f69465ef1bc5fcfd30a667a4eec19c66

SHA1
70074fd04a8fe4804421b215b3f13252c2fe31de

SHA256
dda4924824054c574b5a7c96b2e30f7fb6e643b510db8288b1a6721fa7ff463a

SHA512
7445615aa9798315f13da7a354898f4463792d1292dfea3be398e782964bad16150791bb07e6a9e6dbf9372657c3ca5afa3cc8eb8d3d039e846a67fdd889af83

Download Submit
C:\Users\Admin\AppData\Roaming\tdata\dumps\Utility.dll

Filesize
64.4MB

MD5
b96d148b4e040965b00a6e3d64acc6dd

SHA1
9a73d4dc1b22b8caec3395c227555aa2c2c95009

SHA256
03af5482a42522b14b491726e9cc578bd464ad8974460ce5c0d1173ac46c7376

SHA512
28b7c5654de478c1d7bb11447c3dd817badbeb275cbf1f06755345ab0af21703a41d80d32fe3a67c8f62b10a38ff8bf9dbcb0a73e65a14fba5821bda077fbfeb

Download Submit
C:\Windows\Installer\MSI6201.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI63E6.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
c11bec8f60d30a41a6ffdd630f27a4c8

SHA1
112bd52664d8c17995ab3c2cd7d9f305827fd8c1

SHA256
30e2ad83ee511f335e765ba330cd732c2dba01e1c4d0f13a66d0962ba64959dd

SHA512
c9e109b635a50592b865233f4a3d530b2295a516a52639b3e9b002d7b4911d6a7eeeedef04a94c6dde75a3dc89ede578fe3f0fd4a24b011033dbddfd99f58a37

Download Submit
\??\Volume{ee705b7c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0408e721-85d3-40de-8f34-3a2e3400669c}_OnDiskSnapshotProp

Filesize
5KB

MD5
10c314abb84c088c7fc53d994c4e3104

SHA1
24ab5081a06ee4554608cac7e7f73c99e2e37b6c

SHA256
98fca05c943c44585dafd6d6514c85f8fe8f72667b3b23a5464540a6be939bdb

SHA512
ffde2ab92b0d963ad9d83b038129c04a72d03824eda13b32ab5b24e14178341d02df815d42304b24832244b9709d738bd26c4b6dfaac17dd8cd2599e833e0729

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8108.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8177.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSIEF23.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF0C9.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF167.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF1D5.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF243.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF419.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Roaming\tdata\dumps\DuiLib_u.dll

Filesize
489KB

MD5
0b98bd6bf1956a04d626bf45c8a8f24f

SHA1
4d33a107a39071d5f3dfb0d5e6665920eea1ecf0

SHA256
d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2

SHA512
6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed

Download Submit
\Users\Admin\AppData\Roaming\tdata\dumps\DuiLib_u.dll

Filesize
489KB

MD5
0b98bd6bf1956a04d626bf45c8a8f24f

SHA1
4d33a107a39071d5f3dfb0d5e6665920eea1ecf0

SHA256
d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2

SHA512
6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed

Download Submit
\Users\Admin\AppData\Roaming\tdata\dumps\DuiLib_u.dll

Filesize
489KB

MD5
0b98bd6bf1956a04d626bf45c8a8f24f

SHA1
4d33a107a39071d5f3dfb0d5e6665920eea1ecf0

SHA256
d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2

SHA512
6211b41cba988de9728659f0577dc8afe774e6a7037f9447177605193c07106330ee710deae9e70beb0dcb9164b690863b905d97b3db7a19fdaae4e502f319ed

Download Submit
\Users\Admin\AppData\Roaming\tdata\dumps\Utility.dll

Filesize
64.4MB

MD5
b96d148b4e040965b00a6e3d64acc6dd

SHA1
9a73d4dc1b22b8caec3395c227555aa2c2c95009

SHA256
03af5482a42522b14b491726e9cc578bd464ad8974460ce5c0d1173ac46c7376

SHA512
28b7c5654de478c1d7bb11447c3dd817badbeb275cbf1f06755345ab0af21703a41d80d32fe3a67c8f62b10a38ff8bf9dbcb0a73e65a14fba5821bda077fbfeb

Download Submit
\Users\Admin\AppData\Roaming\tdata\dumps\Utility.dll

Filesize
64.4MB

MD5
b96d148b4e040965b00a6e3d64acc6dd

SHA1
9a73d4dc1b22b8caec3395c227555aa2c2c95009

SHA256
03af5482a42522b14b491726e9cc578bd464ad8974460ce5c0d1173ac46c7376

SHA512
28b7c5654de478c1d7bb11447c3dd817badbeb275cbf1f06755345ab0af21703a41d80d32fe3a67c8f62b10a38ff8bf9dbcb0a73e65a14fba5821bda077fbfeb

Download Submit
\Users\Admin\AppData\Roaming\tdata\dumps\Utility.dll

Filesize
64.4MB

MD5
b96d148b4e040965b00a6e3d64acc6dd

SHA1
9a73d4dc1b22b8caec3395c227555aa2c2c95009

SHA256
03af5482a42522b14b491726e9cc578bd464ad8974460ce5c0d1173ac46c7376

SHA512
28b7c5654de478c1d7bb11447c3dd817badbeb275cbf1f06755345ab0af21703a41d80d32fe3a67c8f62b10a38ff8bf9dbcb0a73e65a14fba5821bda077fbfeb

Download Submit
\Windows\Installer\MSI6201.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Windows\Installer\MSI63E6.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
memory/2168-134-0x0000000010000000-0x00000000100CD000-memory.dmp

Filesize
820KB

Download
memory/2168-138-0x00000000028B0000-0x00000000028D5000-memory.dmp

Filesize
148KB

Download
memory/3396-118-0x0000000010000000-0x00000000100CD000-memory.dmp

Filesize
820KB

Download
memory/3408-165-0x0000000010000000-0x00000000100CD000-memory.dmp

Filesize
820KB

Download
memory/3408-169-0x0000000002E90000-0x0000000002EB5000-memory.dmp

Filesize
148KB

Download