blackmoon | 0614ffd703c7d4f6c45cfa65f49d9fdd9c433efc532037185ef05ce694e0746d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AIcoin.exe
Size

76.9MB
MD5

cf3deb77043e5b73db5c85465dfa5de0
SHA1

b445283fbd7b08ade87d8ff9ebe4d0583c5c5133
SHA256

0614ffd703c7d4f6c45cfa65f49d9fdd9c433efc532037185ef05ce694e0746d
SHA512

83e40ffb72a0bfd3689f24792e6a66e61569d92c60e3738b7ebe9df0d655f54667c934d3787624a093932f186bd82544928b18d9bfb105d7f2a05564b40b4da9
SSDEEP

1572864:FdKv+HGnrxab+m11do9eCHSeZzgTQSugteyaPdBMAYxZVZWPY8ihHRE0NeY:uvPnYb+m11dd4Syjdd8ZVZrXHi0P

Score

10^/10

blackmoon banker discovery persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000600000002322c-103.dat	family_blackmoon
behavioral2/files/0x000600000002322c-104.dat	family_blackmoon
behavioral2/files/0x000600000002322c-100.dat	family_blackmoon

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AProtects = "C:\\Users\\Admin\\AppData\\Roaming\\BProtects\\AProtects.exe"	AProtects.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	AIcoin.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	AIcoin.exe
File opened (read-only)	\??\P:	AIcoin.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	AIcoin.exe
File opened (read-only)	\??\U:	AIcoin.exe
File opened (read-only)	\??\Z:	AIcoin.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	AIcoin.exe
File opened (read-only)	\??\J:	AIcoin.exe
File opened (read-only)	\??\K:	AIcoin.exe
File opened (read-only)	\??\X:	AIcoin.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	AIcoin.exe
File opened (read-only)	\??\M:	AIcoin.exe
File opened (read-only)	\??\R:	AIcoin.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	AIcoin.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	AIcoin.exe
File opened (read-only)	\??\W:	AIcoin.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	AIcoin.exe
File opened (read-only)	\??\H:	AIcoin.exe
File opened (read-only)	\??\V:	AIcoin.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	AIcoin.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	AIcoin.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	AIcoin.exe
File opened (read-only)	\??\S:	AIcoin.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AICoin\locales\cs.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\nl.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\uk.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\API-MS-Win-core-xstate-l2-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\et.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\hu.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\hu.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\zh-TW.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\v8_context_snapshot.bin	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-heap-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\api-ms-win-core-rtlsupport-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\fr.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\hi.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\kn.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\natives_blob.bin	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\ui_resources_200_percent.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\api-ms-win-core-util-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\resources	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-console-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-crt-heap-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\api-ms-win-crt-heap-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\views_resources_200_percent.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-libraryloader-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-sysinfo-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\ca.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\ta.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\node.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\sv.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\libGLESv2.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\resources\app.asar.unpacked\app\pydist\dataCenter\win\AICoin.exe	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\bg.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\bn.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\ru.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-crt-convert-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\ffmpeg.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\sl.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\resources\electron.asar	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-processthreads-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\API-MS-Win-core-xstate-l2-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\node.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\resources\app.asar.unpacked\app\pydist	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\cs.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\api-ms-win-core-namedpipe-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\api-ms-win-crt-convert-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\Uninstall AICoin.exe	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\fi.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\hi.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\ko.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\sr.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\v8_context_snapshot.bin	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-processenvironment-l1-1-0.dll	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\icudtl.dat	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\de.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\lt.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\sw.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-core-processthreads-l1-1-1.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\ca.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\ja.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\lv.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\api-ms-win-crt-conio-l1-1-0.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\ffmpeg.dll	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\he.pak	oin-1.7.1.exe
File opened for modification	C:\Program Files (x86)\AICoin\locales\pl.pak	oin-1.7.1.exe
File created	C:\Program Files (x86)\AICoin\locales\pt-PT.pak	oin-1.7.1.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI790B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FDB53462-746B-4011-A87E-BE06EFC74D8B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI797B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DA4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5777b0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5777b0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI795A.tmp	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
4532	MSI7DA3.tmp
3272	MSI7DA4.tmp
1592	AProtects.exe
1272	oin-1.7.1.exe
1704	AICoin.exe
4448	AICoin.exe
3964	AICoin.exe
2228	AICoin.exe

Loads dropped DLL 50 IoCs

pid	Process
3576	MsiExec.exe
3536	MsiExec.exe
3536	MsiExec.exe
3536	MsiExec.exe
3536	MsiExec.exe
3536	MsiExec.exe
3536	MsiExec.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1592	AProtects.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1704	AICoin.exe
1704	AICoin.exe
1704	AICoin.exe
1704	AICoin.exe
1704	AICoin.exe
1704	AICoin.exe
1704	AICoin.exe
4448	AICoin.exe
4448	AICoin.exe
4448	AICoin.exe
4448	AICoin.exe
3964	AICoin.exe
3964	AICoin.exe
3964	AICoin.exe
3964	AICoin.exe
3964	AICoin.exe
2228	AICoin.exe
2228	AICoin.exe
2228	AICoin.exe
2228	AICoin.exe
2228	AICoin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b201ae15c8733f580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b201ae150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b201ae15000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db201ae15000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b201ae1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AICoin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AICoin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AICoin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	AICoin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	AICoin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	AICoin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	AICoin.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4220	msiexec.exe
4220	msiexec.exe
4220	msiexec.exe
1592	AProtects.exe
1592	AProtects.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe
1272	oin-1.7.1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4220	msiexec.exe
Token: SeCreateTokenPrivilege	1452	AIcoin.exe
Token: SeAssignPrimaryTokenPrivilege	1452	AIcoin.exe
Token: SeLockMemoryPrivilege	1452	AIcoin.exe
Token: SeIncreaseQuotaPrivilege	1452	AIcoin.exe
Token: SeMachineAccountPrivilege	1452	AIcoin.exe
Token: SeTcbPrivilege	1452	AIcoin.exe
Token: SeSecurityPrivilege	1452	AIcoin.exe
Token: SeTakeOwnershipPrivilege	1452	AIcoin.exe
Token: SeLoadDriverPrivilege	1452	AIcoin.exe
Token: SeSystemProfilePrivilege	1452	AIcoin.exe
Token: SeSystemtimePrivilege	1452	AIcoin.exe
Token: SeProfSingleProcessPrivilege	1452	AIcoin.exe
Token: SeIncBasePriorityPrivilege	1452	AIcoin.exe
Token: SeCreatePagefilePrivilege	1452	AIcoin.exe
Token: SeCreatePermanentPrivilege	1452	AIcoin.exe
Token: SeBackupPrivilege	1452	AIcoin.exe
Token: SeRestorePrivilege	1452	AIcoin.exe
Token: SeShutdownPrivilege	1452	AIcoin.exe
Token: SeDebugPrivilege	1452	AIcoin.exe
Token: SeAuditPrivilege	1452	AIcoin.exe
Token: SeSystemEnvironmentPrivilege	1452	AIcoin.exe
Token: SeChangeNotifyPrivilege	1452	AIcoin.exe
Token: SeRemoteShutdownPrivilege	1452	AIcoin.exe
Token: SeUndockPrivilege	1452	AIcoin.exe
Token: SeSyncAgentPrivilege	1452	AIcoin.exe
Token: SeEnableDelegationPrivilege	1452	AIcoin.exe
Token: SeManageVolumePrivilege	1452	AIcoin.exe
Token: SeImpersonatePrivilege	1452	AIcoin.exe
Token: SeCreateGlobalPrivilege	1452	AIcoin.exe
Token: SeCreateTokenPrivilege	1452	AIcoin.exe
Token: SeAssignPrimaryTokenPrivilege	1452	AIcoin.exe
Token: SeLockMemoryPrivilege	1452	AIcoin.exe
Token: SeIncreaseQuotaPrivilege	1452	AIcoin.exe
Token: SeMachineAccountPrivilege	1452	AIcoin.exe
Token: SeTcbPrivilege	1452	AIcoin.exe
Token: SeSecurityPrivilege	1452	AIcoin.exe
Token: SeTakeOwnershipPrivilege	1452	AIcoin.exe
Token: SeLoadDriverPrivilege	1452	AIcoin.exe
Token: SeSystemProfilePrivilege	1452	AIcoin.exe
Token: SeSystemtimePrivilege	1452	AIcoin.exe
Token: SeProfSingleProcessPrivilege	1452	AIcoin.exe
Token: SeIncBasePriorityPrivilege	1452	AIcoin.exe
Token: SeCreatePagefilePrivilege	1452	AIcoin.exe
Token: SeCreatePermanentPrivilege	1452	AIcoin.exe
Token: SeBackupPrivilege	1452	AIcoin.exe
Token: SeRestorePrivilege	1452	AIcoin.exe
Token: SeShutdownPrivilege	1452	AIcoin.exe
Token: SeDebugPrivilege	1452	AIcoin.exe
Token: SeAuditPrivilege	1452	AIcoin.exe
Token: SeSystemEnvironmentPrivilege	1452	AIcoin.exe
Token: SeChangeNotifyPrivilege	1452	AIcoin.exe
Token: SeRemoteShutdownPrivilege	1452	AIcoin.exe
Token: SeUndockPrivilege	1452	AIcoin.exe
Token: SeSyncAgentPrivilege	1452	AIcoin.exe
Token: SeEnableDelegationPrivilege	1452	AIcoin.exe
Token: SeManageVolumePrivilege	1452	AIcoin.exe
Token: SeImpersonatePrivilege	1452	AIcoin.exe
Token: SeCreateGlobalPrivilege	1452	AIcoin.exe
Token: SeCreateTokenPrivilege	1452	AIcoin.exe
Token: SeAssignPrimaryTokenPrivilege	1452	AIcoin.exe
Token: SeLockMemoryPrivilege	1452	AIcoin.exe
Token: SeIncreaseQuotaPrivilege	1452	AIcoin.exe
Token: SeMachineAccountPrivilege	1452	AIcoin.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1452	AIcoin.exe
3260	msiexec.exe
3260	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	oin-1.7.1.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3576	4220	msiexec.exe	49
PID 4220 wrote to memory of 3576	4220	msiexec.exe	49
PID 4220 wrote to memory of 3576	4220	msiexec.exe	49
PID 1452 wrote to memory of 3260	1452	AIcoin.exe	50
PID 1452 wrote to memory of 3260	1452	AIcoin.exe	50
PID 1452 wrote to memory of 3260	1452	AIcoin.exe	50
PID 4220 wrote to memory of 4728	4220	msiexec.exe	103
PID 4220 wrote to memory of 4728	4220	msiexec.exe	103
PID 4220 wrote to memory of 3536	4220	msiexec.exe	105
PID 4220 wrote to memory of 3536	4220	msiexec.exe	105
PID 4220 wrote to memory of 3536	4220	msiexec.exe	105
PID 4220 wrote to memory of 4532	4220	msiexec.exe	107
PID 4220 wrote to memory of 4532	4220	msiexec.exe	107
PID 4220 wrote to memory of 4532	4220	msiexec.exe	107
PID 4220 wrote to memory of 3272	4220	msiexec.exe	106
PID 4220 wrote to memory of 3272	4220	msiexec.exe	106
PID 4220 wrote to memory of 3272	4220	msiexec.exe	106
PID 1704 wrote to memory of 4448	1704	AICoin.exe	114
PID 1704 wrote to memory of 4448	1704	AICoin.exe	114
PID 1704 wrote to memory of 4448	1704	AICoin.exe	114
PID 1704 wrote to memory of 3964	1704	AICoin.exe	115
PID 1704 wrote to memory of 3964	1704	AICoin.exe	115
PID 1704 wrote to memory of 3964	1704	AICoin.exe	115
PID 1704 wrote to memory of 2228	1704	AICoin.exe	116
PID 1704 wrote to memory of 2228	1704	AICoin.exe	116
PID 1704 wrote to memory of 2228	1704	AICoin.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\AIcoin.exe
"C:\Users\Admin\AppData\Local\Temp\AIcoin.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\oa-LLC\oa 1.0.2.1\install\setup-us.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\AIcoin.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1706119673 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:3260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 086A7698AE6AE5C895B320DF926639C1 C
  2⤵
  - Loads dropped DLL
  PID:3576
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EEB1A36509B09FFD0D0C9859CE0C52D9
  2⤵
  - Loads dropped DLL
  PID:3536
- C:\Windows\Installer\MSI7DA4.tmp
  "C:\Windows\Installer\MSI7DA4.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\BlockstreamGreen\aicoin-x64\oin-1.7.1.exe"
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\Installer\MSI7DA3.tmp
  "C:\Windows\Installer\MSI7DA3.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\BProtects\AProtects.exe"
  2⤵
  - Executes dropped EXE
  PID:4532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1020

C:\Users\Admin\AppData\Roaming\BProtects\AProtects.exe
"C:\Users\Admin\AppData\Roaming\BProtects\AProtects.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Users\Admin\AppData\Roaming\BlockstreamGreen\aicoin-x64\oin-1.7.1.exe
"C:\Users\Admin\AppData\Roaming\BlockstreamGreen\aicoin-x64\oin-1.7.1.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Program Files (x86)\AICoin\AICoin.exe
"C:\Program Files (x86)\AICoin\AICoin.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\AICoin\AICoin.exe
  "C:\Program Files (x86)\AICoin\AICoin.exe" --reporter-url=https://s.aicoin.cn/api/3/minidump?sentry_key=fcd8f9a00f934a67911bdcd19759ad6a --application-name=aicoin "--crashes-directory=C:\Users\Admin\AppData\Local\Temp\aicoin Crashes" --v=1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4448
- C:\Program Files (x86)\AICoin\AICoin.exe
  "C:\Program Files (x86)\AICoin\AICoin.exe" --type=gpu-process --enable-features=FixAltGraph --no-sandbox --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=0AAF7898D052F85CD7DD156BD4D34618 --mojo-platform-channel-handle=1580 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3964
- C:\Program Files (x86)\AICoin\AICoin.exe
  "C:\Program Files (x86)\AICoin\AICoin.exe" --type=gpu-process --enable-features=FixAltGraph --no-sandbox --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --service-request-channel-token=7E88F737845D99A920ABCA6078198098 --mojo-platform-channel-handle=1564 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5777b3.rbs

Filesize
2KB

MD5
64bccb3042f57bc2a3d27db10d978c80

SHA1
be415464bb675a074bff23611da6e6b66e337d3c

SHA256
0d6f18c3eed32cc83e940333805d7dfb7750b25f506066edb7ee437b0da15d85

SHA512
b148a33ad76815991fb2204abdc1c57b2beca58469128a129eebc45fd1ba9df65b2ecc983acea3e0b51b0ffe3b6c72c0836d18f900eb8d6a17c4a072f3ef5b67

Download Submit
C:\Program Files (x86)\AICoin\AICoin.exe

Filesize
38.0MB

MD5
79ac9f85c78a35da759c896667c0554a

SHA1
a244b07c24b7a76fe2dca241deca0bd22adbab94

SHA256
9188296d4991b3e2608d5493e818c153ef5b52f35c3680c5b5bf82350c3509d6

SHA512
886285e4bb29bb08a5a1e893efedc80b9cb9703407101abc286280d3f5080b242c2b1364398287eaee065280f2b90b041d6bf436287cbbbdef3fbc649d2bbb1c

Download Submit
C:\Program Files (x86)\AICoin\AICoin.exe

Filesize
3.1MB

MD5
6b4e3f3fe57ff0039bbe479696242cda

SHA1
b4f2bf52f1560b0c9faefc599777ca1b0c8381db

SHA256
ebaec4a1d88d258586c1367ac80928688d655df1525aab0b1a8d858154cfcbfa

SHA512
79fcd8b1add649caa3a524499a4c257db0a3afae2930fcb2a92ddfba234eb456fc0d32520ffd11bed300beb7eae164ccde1162039b3e82e765089662263d603c

Download Submit
C:\Program Files (x86)\AICoin\AICoin.exe

Filesize
3.9MB

MD5
06e701955e44fe13596caef0e3c15078

SHA1
e2dedb0c7eb62a03a065547e3872439deadc3050

SHA256
193a2e936b7ff13d94eba297723c19f78c985618e5bffdf8d599a9940e289dfa

SHA512
766499dbb84b9912fc74c77f9197241cf887208135c721fffbb63d7c1ac24757f192a9e2401b889bb62c0362b8f1eea6f6042b4caa484f951a9439ebbaad56df

Download Submit
C:\Program Files (x86)\AICoin\ffmpeg.dll

Filesize
1.5MB

MD5
20ef19ae5aa07c8e6b34eab97b08d44e

SHA1
961cb50a82c44c8b5da2b5e4aaaf162d0b062cd3

SHA256
0bf8329244b163fa8a687d2a266f53e25e7a63cbffab1c0d3e4c667fe4313955

SHA512
01e74ddef6fa67a981bb5df19202810638a7416904ce634984f9d61c18e6a2dc10a31429086c40ee2e400edb0fe8a4e850e58a5b45c703ebad7a051a4f26768c

Download Submit
C:\Program Files (x86)\AICoin\icudtl.dat

Filesize
7.8MB

MD5
c645d4d81506b2b3060991709646a2f6

SHA1
7d3c3c14da9d4ce0b9c1c2f6917ccdc3ebfd22f1

SHA256
16154d8eca3fe369e8bb60055550632960f04e45a1e8d81d920ff21f9f57a10f

SHA512
c9e6faa6d9491292f5ea3913689c29a834e9ad44367328824994a82f5627d4745f49c01e228f30d0da269ac53e58dde8345d0bc3cec6d2b07808679464186b9b

Download Submit
C:\Program Files (x86)\AICoin\msvcp140.dll

Filesize
428KB

MD5
ff6500e6b534ecc42e4fde64a2f9e126

SHA1
babf9019c54e1a7da32f534d5601f7fa2cf5572c

SHA256
1d44fd0333a39c6c2475098ef8d0c15551f6be8002a3f687d788074e094b8896

SHA512
edc89f231cbe725b82f8c32d3ff969ae9f337ec3ce2521647e1b4bad1d97312faa59a0d9273c064c8406c6d5fc25ebaa2ffa504ce598fe201b65c63752eb09a2

Download Submit
C:\Program Files (x86)\AICoin\node.dll

Filesize
4.8MB

MD5
d9d1109d924218814daa4bd6ae74bcf6

SHA1
04f9ad1fea92bee05253c68532fc54a25240875a

SHA256
5e3412766e86f60cd659e7f23bbff77d91fc1be21b290142a9bf5dfa6d5ecd54

SHA512
8eefba315d13efe34b7cd7100fccaac9d36b2a99465887163142d836f37b6bf750d11085682c3002f1a545bab35ffc5666c0baec299dab2094fd4bf5d6e14275

Download Submit
C:\Program Files (x86)\AICoin\node.dll

Filesize
5.5MB

MD5
93afd364adfcb46c824533d58fd03407

SHA1
2f8501dedbaf6e9167cad8a5c5c7d8e18ccc1387

SHA256
76b2e7f43349fdaf53de062f93895f9b468c9bc2ab2d8a1fd6602d7edd4fd148

SHA512
806183e1d9183facb2a4e171ba376fecf3baf0517b47d4d9cad9b5cc8da4ae8cc7af447930e762f20f6da8ae918d4b51d4d348887454edb786a3c1daf4e20465

Download Submit
C:\Program Files (x86)\AICoin\vcruntime140.dll

Filesize
80KB

MD5
1ee82a5705ca3d3d037360435c6d6c43

SHA1
f28d0ccea727a773175f0db9dc61a4092f24653d

SHA256
e78bdf409f02701812cb351c9fc5e3fc9e93aec290a4259907ddc67a6ae7a7a7

SHA512
7eef7393b36e556ff1562c1b85d16e29364a713b9264dc5d368552951a6e2a717d391324864c0cca1529cce3f4263b89368923f23d541b90acb2e8da6b4b6355

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI48A3.tmp

Filesize
374KB

MD5
5e33a5224c4d523a2517ba8a96aaff42

SHA1
12e41a9380cc890053b5c7e19769c76bfa1608d4

SHA256
d64407a6d5a5d48ddefd8376d8e7732f6e5d2318cf1671cb367302d566ed958c

SHA512
bdb2d57de5104db15c06e5aa4b852a007ef29139750eec050cd3ee013b7df1e15376b01528e32a1859a2132452032f27a4fcd58d163dd927b4b00a6b1b2ad8f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\nsDialogs.dll

Filesize
9KB

MD5
466179e1c8ee8a1ff5e4427dbb6c4a01

SHA1
eb607467009074278e4bd50c7eab400e95ae48f7

SHA256
1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

SHA512
7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd81B4.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\AProtects.exe

Filesize
754KB

MD5
84a7cf38c6520ac3173cef1093a97a5e

SHA1
f39b8d0ab28f37700818f2e84b12516cc2acc4d9

SHA256
b5b374e78edd0d92133210dd9fa727fd5d9a9b1f5b8cf07919495050d7717c1b

SHA512
7e74ecc0bd9441e9017ad809d007e687f37d733bc7ffc129c7575d41375da27ecdbdd49ced1988e9aeb5c28b2c356f4f7bb568675ad1a9a9648c1c593283a5c6

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\DataState.dll

Filesize
704KB

MD5
c74b08cdbdba19b356702dbf6571777c

SHA1
4a544b34f81c3ad77210e4b65c6b7d89ee7c61c9

SHA256
c5d1e524f526d9820d57d419d3cc0bf0a44a68f75544aba5c15e022c09a85071

SHA512
2dddb3721a179dd22f5dc33ebc40ebd24f1975128d965a0bcb7bec41fe9e6c8727f799c5a0f6eaf8a751e5641873f061963d20026370829f6fcfc973f8885b07

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\DataState.dll

Filesize
1.1MB

MD5
007c82bcc76455e77961faa81ecf7321

SHA1
8c70339066cdce80e6a1ddd411b5072f12af77ce

SHA256
f7100611933e01ffbf5511bea59f94f15211b99a5e0d74b41ca8e8fb96ab2a17

SHA512
ba5bf2fada77969bf8192a71c7ebbac19300b3a2dfa1c95b22b41aa2c18c056050aa0de554579bb96828f46e37de87edeb9b9f25c2e6e9f06b5f5b8612e7e6e2

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\datastate.dll

Filesize
872KB

MD5
c4d25c3fcf035889e289a00a3fc897e1

SHA1
7111020d8ce1c3b36aa446a9b8e5c120ed9ab8ca

SHA256
b690f0bcd9c0f4f867cbd1f5246bda1bf08d6b707bc8e5cae22f4890769caf75

SHA512
57bd68fa77640a5ba83e98d2f8cb00f0b456acd3243ae585fddfbdd43699a77e1d06aabf9bf4d1c6bc25fef86527bcb67e2b87b86388757c9e47cd14d99be54f

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\madDisAsm_.bpl

Filesize
58KB

MD5
d7b420736278f0d741daec22883dedd7

SHA1
0c3836c63771da52a82e5ed35c6e9bc4a6af02e9

SHA256
6b0b62cd5ab2ba7071cced2c028ba7faa86ba90ed87e5b81fc116e1bc3056871

SHA512
6ee74c8745dfc8d644ac2d8c9e19fbd53d5876121fb81aea1cac262a53e46b976864b43fd37f0295734b53c38efe933a72798e19dabf97a0ea58e7eba23e5de9

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\madbasic_.bpl

Filesize
205KB

MD5
e9cc245287b0f8169f90305dc4394380

SHA1
225af87bf23430c8716dcb517f3d5df565a400c3

SHA256
490ab7aa4c70f4af678d39bafe1c48eab6bb7033461b70e6296206c533b872ef

SHA512
d08d67fb4a958d3ddd17a14884338438c02560b6d6fdf2f74b5a6c30ca1164f23ad5afe9bad38588eb588665cc302a1c52f2f09a88747687a8a2c7e78628aabf

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\madexcept_.bpl

Filesize
431KB

MD5
aed2a27145cd7a8794ef1c0bd5c3ada8

SHA1
74fb3dfeba50651216fc55f6371027dd0cee3018

SHA256
64c929380edc996bdecbfd78959f25f81259a163080f85793f484e0d8bdc99fc

SHA512
3824f79e447cdf441aacf137e9dd93abadc463d8e9296f1a6c9834d28c23a7e541f0e922831a790a5e5fd24bf941b9f337fda0cc984f0038044a902f5546eda1

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\rtl120.bpl

Filesize
1.1MB

MD5
70bd0aa6735978e576c5ff68cf8644f9

SHA1
a9b9751e0cd3b2d1b32856fe96e51fd83d9a2414

SHA256
1ba0938282b250909ee57790f793ded4d7849bc110d9a3b32a1cba1a333664b1

SHA512
d371d675087e79095fa3303bec76488571309df23d22681326e43abc8a718b346c9b6aa2e8da2f0f0a382843698a1cc5710bbffdd6c4fce0fafc3b6ca474f32e

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\vcl120.bpl

Filesize
840KB

MD5
5a13da4cff9450ea512d8a86eafeee8d

SHA1
b279b38c155d2fc228ff05bca6e94a48d568a21c

SHA256
fa8fd92f8bf6ed7a5a6bddb4fc581034922b1a37876656cd7729a8fb5e785340

SHA512
b574d149ae9675a05d14d6ce4ec38f6f55f54855385eb748bbb641035d30d089e05457e5bb1f5b8affb9e109246416a12a8bd89371f3e2caa081c92f3483d3f5

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\vcl120.bpl

Filesize
693KB

MD5
95ad51787737db709b7cdcc226890aa5

SHA1
73baef62d0f0aff7d813aff1dcc4353b2c9b64ce

SHA256
99e4ea7a4f55687d64611328871d3d1b7c046d58b652a14ba3807366f589bf5f

SHA512
a5cad3edf0d6ce5e1f32afa7279f7ae311f000ba7ea087ab6c4684635c1a0005d6adb8ef21a2581c5dfb10719604202f109f819d0a9ca73b606c7cca23db75d9

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\vcl120.bpl

Filesize
965KB

MD5
b2458c0c29319f3b7f7e1789bd054a9a

SHA1
65a518f755feef4a208cf650ff5c39959a2ca47f

SHA256
cc7a85de0a193d1293f5556b33249ad31361e011d357e884ab8abc4a0a7b05cc

SHA512
9d332a30bcf9258cde2b08b5ea073dbb1cc0c009c5664605be3d013cb17457df1a98294ade156dc15742d32cc972f0a0f1cf44ed40ed9091c5dde1e824083ca1

Download Submit
C:\Users\Admin\AppData\Roaming\BProtects\vcl120.bpl

Filesize
957KB

MD5
4258edeeb05f7189c45f76fd0e556634

SHA1
0b3450cae2d8d657c07776e514dd764f86e25cc8

SHA256
c5cf19b231c4906768cd16ca2218d0436382d29e8cad9c62007c182abf08a393

SHA512
f41603f9e15cbdb3c384c5b35c65c971caf3a93829d1991c00d1dccc333ac07fae81d91720803c3952b9bbb7081c5d755d25825dea1b3dcdd0f8da4725a9dc21

Download Submit
C:\Users\Admin\AppData\Roaming\BlockstreamGreen\aicoin-x64\oin-1.7.1.exe

Filesize
829KB

MD5
4817529d1f5448e3bbf39eb0ad7e486e

SHA1
070f2c0ebfa77b4a8e39537582732586c77be453

SHA256
d99209aefbf2fe1a754b2f0b703bb9bddedc1d0e7f445a2ed1312066c12f147e

SHA512
960f03a40033aa12300a8ec13921c10e1362110d3860dbc598b37490a1aee8c7bb84ff93938190b59a83a67544cf8d0d8ebf351a037cea2cea3ca0458142a3ff

Download Submit
C:\Users\Admin\AppData\Roaming\BlockstreamGreen\aicoin-x64\oin-1.7.1.exe

Filesize
1.3MB

MD5
c8010733d5043a39b721fe96712a9a97

SHA1
d90804a0a90c4c700322b812befb57fcf824088b

SHA256
0c0a0f08bda50ed64e6e8cc5d97741002a0bb32aca096b2446f90db189b20677

SHA512
f6dc242043419286c1c0e4aca3c82a8651fc32af042b87bc0c877f1ec2506bb0e3123125ec2332214c7c4437b54c917b4756dbfba2521256b7fef738b91735d8

Download Submit
C:\Users\Admin\AppData\Roaming\oa-LLC\oa 1.0.2.1\install\setup-us.msi

Filesize
1.5MB

MD5
da17e03809d8d5d06f61b66c1e743bbe

SHA1
064bd79ada58e730015274554b712742e7ab911a

SHA256
6d57be5da4f47e9113c7c6ee401824301b6d00340d06036414bba2be588c4f13

SHA512
ea70868520b623a42c036966c432265b29e86dffd52d0041d0cfaed6aa706ee5c997e8b10b0b1f30608d9694720ba9f372058670160753e1f632a2e646f1ff13

Download Submit
C:\Users\Admin\AppData\Roaming\oa-LLC\oa 1.0.2.1\install\setup-us1.cab

Filesize
2.5MB

MD5
a5147b533692b40c56ef7d4bf6cf9b1f

SHA1
c5baf77907846910bad27979e3acbc5fe5aee5b1

SHA256
70dd06d708d57b119f53460fd05d87817e83f1bf234234da6f66b1391e9e9eff

SHA512
4ef3a01c62a89aa06ae428ce77398d0c30888c72d871b7846a8f155a8d9b332b0f3e556acaf9ff4246e6013d21393bb3e72022de52c90ec54c44221427545b90

Download Submit
C:\Windows\Installer\MSI797B.tmp

Filesize
533KB

MD5
2b6fa5bfa4831df74de91db162bfaad1

SHA1
83c0bf7bbdecd65bcae1757a6a400ed8606cf8ab

SHA256
005e3260c33fb8c8033dec123d4e71613523fc5d11b32c93c74e86a35c876740

SHA512
fc4739b9fc23fb13765c107aa61ea57ae965d329874c4a57a62b980bb363939c53d8a966c0bc9bb92a794ebe6e3b52672bb403f684a273bce7193164d19ecc1c

Download Submit
C:\Windows\Installer\MSI7DA3.tmp

Filesize
396KB

MD5
79f3b2b5594d100ca5bd27ca85939224

SHA1
6cea8cc4638baee738e7174f33ee6281e5c4c059

SHA256
bc20f45927b68af1c6f4ce602bad6350756cacc74398901e654e93511a43e6d7

SHA512
79b1a330425c3c39f00f319b26ac57dc361510c722a26842e29769e07287f23766d8cbe5603bd16d494735cb78b2a49a87964fff2043e7b92a2799bd0bf76c8c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
6.1MB

MD5
cf90bb79dadb392a40f7833d28159c16

SHA1
a9bbdaa0d5f6c67637728fda33a737d2a54d4c12

SHA256
89f47623b22642209a91e3b8ba7c3a1fb49815b16a12e332b997da9536d4f97d

SHA512
60744d6317e2376703f3d80f8ee577fa07c275b71117931ebb98a459f85dda016c675c61f705925a93e835769e019d515f331776bd15e490caed628109495ded

Download Submit
\??\Volume{15ae01b2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c661c515-f2d0-4c56-89cd-77a40463886a}_OnDiskSnapshotProp

Filesize
6KB

MD5
80cc64e916cc9ac3819eb1122ac4116e

SHA1
3bf7591a6443d8c1bf3e407cec7559a70affd713

SHA256
2e16d52f9dfdbe2d51f166bddb6399d6e54c2ae8f5db0e106a89dad6747f14b6

SHA512
754f3b881dbb3a54f3980108e526da52eb3ffb43147d81f6caa0039395dbb95b464769b813eb0fe3219220ecd4663272ff0cbc8da2d559e816f4cb592cb588ec

Download Submit
memory/1592-136-0x0000000050120000-0x000000005030E000-memory.dmp

Filesize
1.9MB

Download
memory/1592-108-0x0000000007C80000-0x0000000007CCF000-memory.dmp

Filesize
316KB

Download
memory/1592-131-0x0000000000400000-0x0000000000665000-memory.dmp

Filesize
2.4MB

Download
memory/1592-105-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1592-135-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/1592-134-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/1592-133-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/1592-132-0x0000000050000000-0x0000000050117000-memory.dmp

Filesize
1.1MB

Download
memory/1592-143-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download