d314979381670be394531a78835a56e5e5894aa7aa43da36d86fcda97db2567b

Resubmissions

09/03/2024, 00:10

240309-agetcabb6y 8

09/03/2024, 00:06

240309-adr99sac64 8

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AMASS 2.0/LicenseManager/LicenseManagerSetup.exe
Size

40.8MB
MD5

0b8af7b445e5eecf1674e198dcf422c6
SHA1

d8c0025cf41f2e313b6382001a45594e65896cd4
SHA256

c5e754131691a1362d9f28ba77e6ab2aec76b3834796c54a63b44d2a66916774
SHA512

d47617f496a7864260e94aacc7ff0c1b95b3ecb22981e09409da2bc4433a61a3ecb097053589fe58abc66eeb3c07f6f7b8d22f68aed5b2c5a94ecdc4fd1283da
SSDEEP

786432:ZIxZMrefY33o5l6QHaiWdWL22938+uNqMkyH1pK1oHEgBN:YiegHo5psdWx8+uNnH1p2opN

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\hardlock.sys	haspdinst_x64.exe
File opened for modification	C:\Windows\system32\drivers\hardlock.sys	haspdinst_x64.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA50D.tmp	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\akspccard.cat	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\SET9FC9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA50E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA50C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA50B.tmp	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\aksfridge.sys	haspdinst_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{439c8a9e-8af5-0c0e-73b5-65728c59646d}\SETA1FD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\aksusb5.dll	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\hasplms.exe	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{439c8a9e-8af5-0c0e-73b5-65728c59646d}\akshasp.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{038497a1-ebc8-73cf-e15f-df3686db8d63}\SETA353.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_neutral_b496304d4eb1ff2c\aksusb.PNF	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\aksusb.cat	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\SET9FC8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\akshhl.inf_amd64_neutral_69874431ab9bf72c\akshhl.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\akspccard.sys	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\akspccard.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\akshasp.inf_amd64_neutral_ebe154dbfd666efb\akshasp.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA50C.tmp	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\akshhl.cat	haspdinst_x64.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\hasplmv.exe	haspdinst_x64.exe
File created	C:\Windows\syswow64\hlvdd.dll	haspdinst_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{038497a1-ebc8-73cf-e15f-df3686db8d63}\SETA341.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\akshhl.sys	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{038497a1-ebc8-73cf-e15f-df3686db8d63}\SETA352.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA4F7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_neutral_b496304d4eb1ff2c\aksusb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\akspccard.inf_amd64_neutral_9f93197096fa4fb3\akspccard.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{439c8a9e-8af5-0c0e-73b5-65728c59646d}\SETA1EA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{038497a1-ebc8-73cf-e15f-df3686db8d63}\SETA353.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{038497a1-ebc8-73cf-e15f-df3686db8d63}\akshhl.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA4F7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA50B.tmp	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\aksdf.sys	haspdinst_x64.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\aksusb5.dll	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\SET9FCA.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{439c8a9e-8af5-0c0e-73b5-65728c59646d}\SETA1EB.tmp	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\akshasp.inf	haspdinst_x64.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\akshasp.sys	haspdinst_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\SET9FCA.tmp	DrvInst.exe
File opened for modification	C:\Windows\syswow64\hlvdd.dll	haspdinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{439c8a9e-8af5-0c0e-73b5-65728c59646d}\SETA1EB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA4F9.tmp	DrvInst.exe
File created	C:\Windows\system32\setup\aladdin\hasphl\akshhl.inf	haspdinst_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\SET9FC9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7bb54154-ed2a-2437-a5ab-8734b1d9df14}\akspccard.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\SETA4F6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}\akshasp.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02118b59-81f5-7551-288d-4a608918c760}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{439c8a9e-8af5-0c0e-73b5-65728c59646d}\akshasp.sys	DrvInst.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PANalytical\LicenseManager\hasp_windows_97093.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\ru.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\zh-CN.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\haspvlib_97093.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\es.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\fr.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\hasp_rt.exe	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\PANalytical.SecureLoading.dll	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\PanEnvCrypt.v2c	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\PANalytical.XRX.Licensing.Core_x86.dll	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\ReleaseAndInstallationNotes.rtf	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\Virus Scan Declaration.pdf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\vendors\97093.xml	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\PANalytical.XRX.LicenseManager.chm	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication_splash.png	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\de.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\haspdnert.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\it.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\ja.15.1.alp	haspdinst_x64.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\ApplyV2C.exe	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication.exe	msiexec.exe
File created	C:\Program Files (x86)\PANalytical\LicenseManager\Application.container	msiexec.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_ECCD81C95621472699D3D3C3C6F24B09.exe	msiexec.exe
File opened for modification	C:\Windows\aksdrvsetup.log	haspdinst.exe
File opened for modification	C:\Windows\INF\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_B3A5EFFDDD314312A2CF874488528003.exe	msiexec.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_ECCD81C95621472699D3D3C3C6F24B09.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	haspdinst_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\oem4.inf	DrvInst.exe
File created	C:\Windows\INF\oem5.inf	DrvInst.exe
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\f7792cd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9721.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_B3A5EFFDDD314312A2CF874488528003.exe	msiexec.exe
File created	C:\Windows\INF\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\f7792cd.msi	msiexec.exe
File created	C:\Windows\Installer\f7792ce.ipi	msiexec.exe
File created	C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\f7792d0.msi	msiexec.exe
File opened for modification	C:\Windows\aksdrvsetup.log	haspdinst_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
2580	LicenseManagerSetup.exe
1860	haspdinst.exe
1020	haspdinst_x64.exe

Loads dropped DLL 5 IoCs

pid	Process
2156	LicenseManagerSetup.exe
2560	MsiExec.exe
1860	haspdinst.exe
1860	haspdinst.exe
1020	haspdinst_x64.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\74559A0FED301D642BF03C3ACB81D5D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\PackageCode = "9819A9F9D930DFE40A59A5B6DCD7CB82"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Version = "16973826"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\74559A0FED301D642BF03C3ACB81D5D9\8A056D94542F6A644BE16FE8F55BB218	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\PackageName = "License Manager.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A056D94542F6A644BE16FE8F55BB218	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A056D94542F6A644BE16FE8F55BB218\LicenseManager	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\ProductIcon = "C:\\Windows\\Installer\\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\ProductName = "License Manager"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	msiexec.exe
2496	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2464	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2464	MSIEXEC.EXE
Token: SeRestorePrivilege	2496	msiexec.exe
Token: SeTakeOwnershipPrivilege	2496	msiexec.exe
Token: SeSecurityPrivilege	2496	msiexec.exe
Token: SeCreateTokenPrivilege	2464	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2464	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2464	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2464	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2464	MSIEXEC.EXE
Token: SeTcbPrivilege	2464	MSIEXEC.EXE
Token: SeSecurityPrivilege	2464	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2464	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2464	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2464	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2464	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2464	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2464	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2464	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2464	MSIEXEC.EXE
Token: SeBackupPrivilege	2464	MSIEXEC.EXE
Token: SeRestorePrivilege	2464	MSIEXEC.EXE
Token: SeShutdownPrivilege	2464	MSIEXEC.EXE
Token: SeDebugPrivilege	2464	MSIEXEC.EXE
Token: SeAuditPrivilege	2464	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2464	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2464	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2464	MSIEXEC.EXE
Token: SeUndockPrivilege	2464	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2464	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2464	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2464	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2464	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2464	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2464	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2464	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2464	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2464	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2464	MSIEXEC.EXE
Token: SeTcbPrivilege	2464	MSIEXEC.EXE
Token: SeSecurityPrivilege	2464	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2464	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2464	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2464	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2464	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2464	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2464	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2464	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2464	MSIEXEC.EXE
Token: SeBackupPrivilege	2464	MSIEXEC.EXE
Token: SeRestorePrivilege	2464	MSIEXEC.EXE
Token: SeShutdownPrivilege	2464	MSIEXEC.EXE
Token: SeDebugPrivilege	2464	MSIEXEC.EXE
Token: SeAuditPrivilege	2464	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2464	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2464	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2464	MSIEXEC.EXE
Token: SeUndockPrivilege	2464	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2464	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2464	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2464	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2464	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2464	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2464	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2156 wrote to memory of 2580	2156	LicenseManagerSetup.exe	28
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2580 wrote to memory of 2464	2580	LicenseManagerSetup.exe	29
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2560	2496	msiexec.exe	31
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 2420	2496	msiexec.exe	37
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 2496 wrote to memory of 1860	2496	msiexec.exe	39
PID 1860 wrote to memory of 1020	1860	haspdinst.exe	40
PID 1860 wrote to memory of 1020	1860	haspdinst.exe	40
PID 1860 wrote to memory of 1020	1860	haspdinst.exe	40
PID 1860 wrote to memory of 1020	1860	haspdinst.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\LicenseManagerSetup.exe
  C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\LicenseManagerSetup.exe /q"C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}" /IS_temp
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\License Manager.msi" /log C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager" SETUPEXENAME="LicenseManagerSetup.exe"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2464

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71AA24C0D003ADD91751A4B2E1E90076 C
  2⤵
  - Loads dropped DLL
  PID:2560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD140EE5F3C7BAA5D0C4A8490E4AFCB7
  2⤵
  PID:2420
- C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
  "C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe" -i -cm
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
    C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe -i -nomsg -32to64
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1456

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000390" "00000000000005B0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2020

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3df29104-54a2-3835-c0e7-e57e1797b176}\akspccard.inf" "9" "62250386f" "00000000000003EC" "WinSta0\Default" "00000000000005B0" "208" "C:\Windows\system32\setup\aladdin"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2748

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{27836015-da9e-3d8c-e53d-110bf49e4502}\akshasp.inf" "9" "6d1770e3f" "0000000000000588" "WinSta0\Default" "00000000000005B8" "208" "C:\Windows\system32\setup\aladdin\hasphl"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2148

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{18f04d2e-f09f-6ab7-41c2-306f204cce32}\akshhl.inf" "9" "68e7fedb7" "00000000000005B8" "WinSta0\Default" "00000000000003DC" "208" "C:\Windows\system32\setup\aladdin\hasphl"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2116

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{136a682f-4409-0d1a-a90e-9b097ca57e6d}\aksusb.inf" "9" "686f4dfd7" "00000000000003DC" "WinSta0\Default" "00000000000005A8" "208" "C:\Windows\system32\setup\aladdin\hasphl"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication.exe

Filesize
20KB

MD5
68373dea49681bf1d7eb22b18f6e484e

SHA1
5fc48022539d444fb76ee91aef6c78fef134dbe9

SHA256
416e8afc3ed2e11972ce1cec17b9edee3106e38a7e4710b615facd2bfc6bb395

SHA512
4063f9de49b89a5537390bda15b91466cb10a5c74c2693c7a6827778e3fcfa18ebe4c3df9a4ce606870273290b57022506fe4343eae17b707d5fb47babe50be0

Download Submit
C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe

Filesize
2.1MB

MD5
852a0b9fceff1b31f06d069aff78cca0

SHA1
1f43c28864bd110a3026cb881ac1ecb9659ab1db

SHA256
03e2b3f934f4069401a92b15ed3d1c1aa39e1aea88d6ee20e9c1569041146eba

SHA512
ee40ec7904b63648f86a11f3ad51f5593209561bd848634f11d2df7aae3056ea9cc16240e9e47cc976fba77f98e6d085a360ca3c8a0ec987476a0f880d3911a9

Download Submit
C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe

Filesize
1.9MB

MD5
1555c5ddd1057cdd56149fd327255a37

SHA1
93f8f5060f2f0fd8ea21fe6fcdadcb8f585a311b

SHA256
6ca866878bc51b3ed3dcf26f57da616b9ecf0d443dd61892009c47df02b0d0fd

SHA512
94cfb98cc2fa6802258ac1810fdffb1aeacd7a7d1b1294ec159b30d5c3205b48460fa49d17d08daef089ec2d7edac9a3cc79448585937431e0d720d97f68dbdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\0pdc.txt

Filesize
4KB

MD5
175c58d6c736ddd3cec0d3fe8e29b115

SHA1
2a0ddc74ab6d53931a66643c9d9d5de7865d5338

SHA256
aa9223ed8ab7ab3e555242dcc62cd25c63f129522150f56425da7740bb24e529

SHA512
32eb8af3bdba3251b70c03b2f402fc41e47178eb2c754fc9c408d7badd06af9d21e063f2673a022ca7c9bcc26eb6616ea205c601787ab0b75d1c59e70aef8e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log

Filesize
7KB

MD5
8041ed8006a9d368f49203a56b817db8

SHA1
f53bdf25830d2379c50353e3af264bd9b14336ed

SHA256
c590ef365c5275bd5a16c711557f02f4d45d1f10cb003b637116b5e75a107c90

SHA512
732ea1cafa735e2c3a4ea986fbecb5682b2640f4be309bb86a444fb74072745785d47706a844a72b0086e3dc8649d5727986ae70afaf9bb14769288d7cb7f8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI51E7.tmp

Filesize
165KB

MD5
b5adf92090930e725510e2aafe97434f

SHA1
eb9aff632e16fcb0459554979d3562dcf5652e21

SHA256
1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b

SHA512
1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509

Download Submit
C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe

Filesize
640KB

MD5
faad7dab6468cee7623cdc31b99e07f2

SHA1
46cd0d757705038df342f6f1d65d8302be9600ad

SHA256
2b4473a4d97dc12a135f6ca0b1cd63f77c7c355dd1533a8380405a5c1e5ba1e2

SHA512
6b209e87a1657c1223294ca27e81499ea0eeed009342e08e7ad05e5a7a6c59f734bf9e488d10e7e7224881d7bb176aee51cb10b72db05d53c6581d08996920a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe

Filesize
522KB

MD5
654789407345c9a0a81c1f7082770024

SHA1
621b59417b14f89ceb41a971cc16d70281238af3

SHA256
6d60249e9032d29e413133f27f443b1d8b31f0b47976f9c053607e8eef808e1c

SHA512
3d73900223775571f72ef89dbcc917d2d14181b7122f97a6079a1cd4f777fe2178af7a52e4731ca0efe6c978590b47043171846a2a25785cca98dd75b580fb4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll

Filesize
719KB

MD5
e6547a067be5f617b6d8b1fb313e009b

SHA1
1e8220d42c6f4543cd7bf6988a79a957b73d473c

SHA256
b5ce6dec2ec635ea4cffc0662744e4d8623d6fe5fab4481ecee358b7649325c5

SHA512
efbc109b6d08d4cd81daed55eba2c72b199a906ac40ab2da6163c9c9af68900372fdef9977ba0f01076b56312d8102d6e32f22be6f01fa0bb62492571df87344

Download Submit
C:\Users\Admin\AppData\Local\Temp\hhl01.cab

Filesize
257KB

MD5
4348cd8cc55d109e0f0e1e759cb55a79

SHA1
df19120717764e69152e0824cc54337b9384520a

SHA256
5706d43f59123ed380a8eaf43879342fe20c07f802b02cceec8a15a486653b54

SHA512
17f0f6e992dfdcdab3df7854d2b4757002f27ffc4bc18302182040f016355ed8f80f72109b85064c0439385ba047fb8cdc227a7a6bb8ae8ba89d97bfa0bb29a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hhl01.cab

Filesize
1.5MB

MD5
36d0fd8d91542d5a476f7ffabc0c3767

SHA1
ae08f1ec825cbaf62394686eb51adff2fffa46e3

SHA256
ff2c4b3066da0c2f2d77b1d3ddc5f8d17ca586f0f86cbad3ebcf6634d28a5f1c

SHA512
7de52b37f125009c81abed52e7e80c4122fef41c6ba990d5ed7fd5b1947164aaa7c901fc3c5f2af77351c2ae5365bfce405c9be1fb2ef69d1d5e23794f04f4ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\{136A6~1\aksclass.sys

Filesize
11KB

MD5
364e99662aa6baf66dedbbbaf1ec1219

SHA1
b8f225443ef98c3c936108fa2f85b846a9f21a44

SHA256
cf067f3a246a9a948cb192f223b926a324fd81e382d5766fdc6be8bbd2d30df1

SHA512
855b2d29551393f2dd8bcbd4c8239b0e425cd0962a52e9a65b1dd60368b6597d6b59e098ff48aba5d948a42d934a78611318ceee380dd8060e2aa3baa0fe7325

Download Submit
C:\Users\Admin\AppData\Local\Temp\{136A6~1\akshhl33.dll

Filesize
52KB

MD5
fe4a1477eb122ff2b7f4bfc4969a0fd0

SHA1
4ed5b113c1cca186cfa2c97c012142e1430bd5a3

SHA256
1bb0f5506821412c1b781f99d499dd1395bcfe17e4ff192ac4bf8be4c7abe97e

SHA512
ce041333cf2ca2ca8a882d282c67419884f54d0d13581c677161050411380b8f63a27e77a9092561bf29a374bed6d80f178e8e88d1c27c1777db21f98325aa37

Download Submit
C:\Users\Admin\AppData\Local\Temp\{136A6~1\akshsp53.dll

Filesize
33KB

MD5
19c448807118749f1953c2e3c95a6f68

SHA1
402f380a1652b2e89eb48ff1fcb4e546cf429a84

SHA256
62f632bae3069425347b315acd78f14a7159e644875f2fcb76fc6cfcbafec6a8

SHA512
4b6903bfbf90cf66ef1a06a03280af1721cdf6b8607fb26270e6032703bef6a357767a484ae541a1df0fd6a97dd05557a4f345519b002f42aa953ffbb0c77cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{136A6~1\aksusb.sys

Filesize
190KB

MD5
92256140ea673d07bc9acad8562ef548

SHA1
5470d65f2239214dbd2548ee7b1e8dd541fe9d32

SHA256
ebb9b59a4cd9239ab31b3713349daf080cf7031d32d52caa179a7e8492b4f1ae

SHA512
e68c022a037f386ca3cd92a4c62a2bb3436c217289ef06919efefdd6d55c64e2eb198304d1a48b8615466f5145b65811ec5f2bbbfdf7ed927f90bac9b770dc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\{136A6~1\aksusb5.dll

Filesize
40KB

MD5
eeb7ebdf8c592a9869b151ae63331002

SHA1
3aed130469aca37b3170223148894935bd84439a

SHA256
e2dc01b52cf4d936ae7578f80075e305425d36d0be50a489fecf93a070f19fea

SHA512
a4030967fa64d540ff0ccd3a78a892eeb2249b5f8183515b9a93aada3c8007b76fda31bbec92b9066b0d440fe380f6c7b025608661f5bd4284ab9e7dd8ef5021

Download Submit
C:\Users\Admin\AppData\Local\Temp\{136a682f-4409-0d1a-a90e-9b097ca57e6d}\aksusb.cat

Filesize
11KB

MD5
0dc3fd5d19ebd6c1525c547fbf5a9d0d

SHA1
2f50b13a9380b85096bbe42b26a2cba8f6607daf

SHA256
a71d9d4ce4ed79325fb708502c8e3e3adf3dd6b36e0acd878150cbd32396a5cf

SHA512
894b578fb0195b1336c69a953fa3fc5db89b63b68cfdcda8a4498fe30518fe5df2ac9326f5b81324ce23b5c68892bfb1c49c3d32b1d1cab03e70e94d71b967c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{18F04~1\akshhl.sys

Filesize
66KB

MD5
d885a9cd59ef699df92d163a365119ec

SHA1
0080abf2536cbf47f2c656483f41debaa99ab996

SHA256
4a80438e8c8aa89b9e356fb9320b57d7c01c9b1ff66e7b8fdf69d4022024750c

SHA512
4bbaba4f3b7aa570855e20352293523cfbfcbf8d615fd1593e032841ae5e41ad05c981efdbe2fe3cc34f813b27e6e6e523b34abb32bd3606472d5c441eb5ac23

Download Submit
C:\Users\Admin\AppData\Local\Temp\{18F04~1\akshhl33.dll

Filesize
273KB

MD5
6b7146812b4d8d282a55bb58aebe1106

SHA1
4ea6cd560bdc5c2a0a9703267b5aa05997a7c32d

SHA256
046b84032596cf064c28cfb40ab839f484304a9e8e8c05c32c09cf875b5a922b

SHA512
17c4a91ba9d4addca449696579bed70074c4a9ec559bae5879aea71fb616450a33867d60154bb262fcd8dc29c829dbbd86361892295c2f75e0736af9f8283af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\License Manager.msi

Filesize
318KB

MD5
83b3eb7fea027ba324fdf4541ba2f38a

SHA1
15a45d2514e6249e26393d846855549a5b03d621

SHA256
07a4df484e41aca0f39795e8939db940ce94499f0689b7dec06c44229d24a565

SHA512
469ee44cfbc9e1db50a0583848cddb7ffff16193f083eb912a6a0e7135a7e3ed2ae75d96972632a932c5b6809c7156b542b122913727b80188a497bcbde98645

Download Submit
C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\LicenseManagerSetup.exe

Filesize
1.5MB

MD5
f52c77f552e26eac791d1ea4a5ed1e05

SHA1
c9e7e6f54c4a39247dd85e7575b41d9621534871

SHA256
405f96d501a2a1601c67a959d63d1334ed8d6c4656aacba004cf9011e76b72cf

SHA512
ebeabf89ae059fa48da5d4ef434e74be4b76a815f0a834d2c74abae5fe744a06bac24cd8526f6086e69fc307e8333b5587461b3398e15bd897a4e57a3e0dfc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\LicenseManagerSetup.exe

Filesize
1.2MB

MD5
cc09eddedf4564b897bd8dc719c544ff

SHA1
78ac2f01fd8f200b65da14d59d20b93976f0d4da

SHA256
69a1c3ff89a27ccb2f9c9a84cec4440be95f3739911d019808c5b3087a6a6076

SHA512
38e803362b29c1d85117ed4492193328eaec0fac6e45f41cf881915a0307c632a719a4e5a7b3eb3e9021568dbad91be6029b9a7433aa15dec55f1916c880efd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\_ISMSIDEL.INI

Filesize
648B

MD5
e3e7e76a915a25836e94cb193387fa84

SHA1
9409766256cee7d249b7c3c7dec153e2b62d3e20

SHA256
7b47a5106ecf5e450e75438674ba33b80dcffff898d0720dedd0eeac29b1f336

SHA512
2280ea34e8d4011b47c8c8cdf33361b205478aa3339a5f23ec37f9642df7ed81032ac2f45fb2d853d0dd15066e274a55c2f4b131a310c1c6779bd9004b9cf8fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~3BF9.tmp

Filesize
5KB

MD5
1315aa99778e319357eaa30728fb3369

SHA1
0c3610795869eabba7bf113e6b64434caf049148

SHA256
f5d115bd6743167068e550f5b5a81d915762b3ca6b052e322defd64ac69ed070

SHA512
47d3ae5200941b4211e6cef2977f4b0ed3f2b12cd514134041c6cda9d9c6f89a31ee0c7907611977d2c1df7623681d2373fc21f4396cffe10be5c608b6171d71

Download Submit
C:\Windows\Installer\f7792cd.msi

Filesize
3.7MB

MD5
06e90ac0bfc26668bd52f4f073f47514

SHA1
e23281380d2927ca82628f9794accd8381d4e9c7

SHA256
5ef32845dd9c6fdff7b09d473d73ef0116866557bc81d90bb5ec19dba6f2a675

SHA512
085fabc0347db5990850711f3ba1ef5d129af335e106108ec88869a7e008ba15b357a9f6f1be5616ce11d5eea03bc3a251a3e6fb1dbd9032f5a3179b02374b12

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
806KB

MD5
80aca4057ea74053d7290633113e7b9e

SHA1
d6956e9a69090f30d039037ea3cc920e0f2a11bc

SHA256
3ff911948e18e682cf52705f1b9ff8b72546c54f46fa42df72fb37116a6b343b

SHA512
da893cdd7e802e4096ba88374c53c573da4dee7f82c72beb49aa11e68c0163d66d9d497d8b27074582477644abcf97384e4c69491ac6288337400458891eafb8

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
443KB

MD5
cdde52dca77bfb014eaabc4a87401248

SHA1
5336b789d1edf62f5c71869de54562103a577757

SHA256
cbf60997f1a555df92fe1e056747a5ae912c70c2703c6136c846d4623ba02e5e

SHA512
af8259c7030dd42a1ed0953f668522a39d118fbb130d26bbe35596aaf2401a129508c65161e592da3014b01fb384963529e1643e6eb9d51a932f7cf53b326980

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
173KB

MD5
6ac9e7a43711f8b4bb661280dbb9dffc

SHA1
a3354118baccd1cf4b5185de5e75a4a9640e8139

SHA256
4f683341e1f236105c9dbfdfc8d21543dda17a5798cab34f70ecac11fb7d64c5

SHA512
c6584e9c13c7e7e329ce4fbfa6f380b27a9aa7aa454059a6d8b52bac9e03f8025f78c83d6ed253af4f7df19fef71e76b4fea14a6c2479ef5b9e666c466ca6377

Download Submit
C:\Windows\System32\Setup\aladdin\akspccard.cat

Filesize
8KB

MD5
c8556048ba9510f2059f9bb72a85d4ae

SHA1
5dc717acf2924248aaa08565579ecb2793352c87

SHA256
287479577e22d62d5ba7e683a856ba87c73826a98db19c6603de2403d1668c89

SHA512
06fa5f01adc9d0d86c87c80b682f8d049d83920491a59bc2a539f2a8b8b76de8be36cbe245ff384945e0b21a849dc31214357b4c05a3c524cf41b41f12f35ef7

Download Submit
C:\Windows\System32\Setup\aladdin\akspccard.inf

Filesize
2KB

MD5
1c5e9dea337306dea633ac711ef94e6f

SHA1
ddd3e218df64b9279944a0fc027f568bca680217

SHA256
c3bf22bb08752a8c732049c64060669c80d6d6539db16f701f4ba9b09d828325

SHA512
b34d1d3e2976adf1c70490023511ce3d93dd0bae90053e6acd452c2e40045f9ac96eac1760776aa8d94b031b0e4d10fd61bd91f2fa4de878de5f1d03a406ea17

Download Submit
C:\Windows\System32\Setup\aladdin\akspccard.sys

Filesize
20KB

MD5
30d81e838a6494a57be79467076b0d7a

SHA1
29d7e2bd588591e89cb33d7d4788f4fa64871423

SHA256
50eb9b01cbc8d1263ba39a8f9410abe76342516ce1cd01abaebe784abe1a39eb

SHA512
5cd7de34b5dbd87513e1a2fca6174fb5c103785e97d93bff7c5c04e81c0ada0c6632559ecb7191b177408976c173a865e39c03ebb60ef9bfa18e8feec113f0e7

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\aksclass.sys

Filesize
30KB

MD5
c9fe36d2bb921a06a0e6b247273734ab

SHA1
4c552e3097d238455668b2e0173d19e942254431

SHA256
740bffacf2f383c9e5180203adc7fcb8476df876a1097791b97cea8d7689c11a

SHA512
703568c05193c1289469bc59d9596d42439f433e6e67e37f7135df232abf5766b51407016f691cb6dd5be1beb97324c73caa9df9ab5c3844dceb982a9d046bfb

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\akshasp.cat

Filesize
9KB

MD5
db676cf7da13308a53380addcf2d273c

SHA1
b61190e5ca0569d092ff0470daebec584814931e

SHA256
f4739fca522e29627af4ae3eb8149fb89ddea18631cd1f9ba29deb2e845f353a

SHA512
7a41bbbfa7b1ae01792c043e7c677902cca398c98b77e781f49ccdc8a8cd86ada70809c49fe36b9adc925369251c78968289e9c04460d267debdf0675c5d9766

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\akshasp.inf

Filesize
2KB

MD5
34f5a5f56ddea6ef57022046d5c03e8f

SHA1
62de609029398186648359815e68ca9e3fdcc2cc

SHA256
2083bca634feb5c9faf3eb2a4488ac1faec2bd36f6c6de53277be528509a3e7c

SHA512
9ff5390f9ffd73df2f7963d252ea5d09590bdfe2be3c340535c9cc2d845abe15d2a3a37781a9466bb6cd34c5749625ab86a01624be4a7cf32ef861cc3b6f8dd9

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\akshasp.sys

Filesize
67KB

MD5
f1adc7ded5184045a47e02a85bf2917c

SHA1
2f3711aeb6e50d1c35040acaecbdc6aa930719dd

SHA256
3c635791b9b514a152ff9b3a853458864acdf668ba72d4a8b2840619ad93055b

SHA512
40161eb931c3fe7a2af2060e5f7ed3cd608bd61377112e73a6a0d7c114ea9cfd60ab01a609628f4c1d70a68d097113efd78cd26a5ed127c517c74cc56ea9e17f

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\akshhl.cat

Filesize
9KB

MD5
545a0bf637f55a48972780dbf58c8d55

SHA1
1f5369492f34aa3088b6e1433a81e1faff1d32ce

SHA256
e097b13d615ed6874e95954393017ca2b357f05ee164d5588d02545d842b5ae2

SHA512
7f2c122653f74e1e166488d0ca44827e5ec3cfb19b36c38550c36f956155e02e2f73364b814219492703943f2ab139c3758ee63eb3b9ad8a86ff3431028584c1

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\akshhl.inf

Filesize
2KB

MD5
c46095c8fbad763043c03e7333cedbcc

SHA1
1e854d5a5ad0e4f8c77d60b08aa9f2732bbf0e02

SHA256
758192f976302955fa8130ff85a0b459ac7a5df2ff05cf258c7255a5d4697dd5

SHA512
a93442a716dd58eeb710270f4a0f4d3175f3cbd0b6121ea60b1233a792a59548e7ab0417d0409c49064e649aec423c4ac9583632284792ff31d5b68d67f3bb29

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\akshsp53.dll

Filesize
72KB

MD5
a462556de56256e4e27a92e84f16e0b6

SHA1
b333a7df15d813ca3a4ee7caa897be7657322946

SHA256
488a800297c3357e855937730a51ac61fce86ef42d34c467c1109789f1fab385

SHA512
b3876d96b36ff89e1e1b6ea5a340086b98f1ff2f0de8f86b221372198d3f4820ae3c168b1332b5292672390757ed13b6df47099023d7502a2de639c6b80a558c

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\aksusb.inf

Filesize
2KB

MD5
086aa6a5eac4bdebb28aef6e4a63ce41

SHA1
cd475bc06cd13d105f92ce92fbd2f69b39f6e15f

SHA256
10a13e9a15a18016a8bdbc2b235dffb819e4229a7f5a7c352d3fb0923a569b7f

SHA512
a06a2c1e32c95d16cc401c137c5cc63b8ae37ec92df0043ad10f6f348ebf2240d1108e0e3f3b42f139270d0dfe20d4242f765dee829b6e4e49f86c1d16b9b7e0

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\aksusb.sys

Filesize
243KB

MD5
f1a75232cbf552ab9d37b466a149c281

SHA1
7b33ff7d5511beb03e631155990faf904382d7bf

SHA256
610b7d782b99318ebc67cb5ed61b68f1f67dbf195451d3e6f52e728332ca01f6

SHA512
063192106c614ce4fce1b9beee06470ca0668dde3545d3d2e0f38913f7b5b8835a26aee5145bea59e99ef0c1d20a96469817a2cafce4eac78c050dc856726360

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\aksusb5.dll

Filesize
83KB

MD5
ad417d60cfbe9c46507852273a8cbdc1

SHA1
c5e590667cd0b4b6e1acfa378952f794afe533a6

SHA256
514972afcd1d1f3792cba8434e7b1ac0a2bb04752597d2372882726d725e9b1d

SHA512
261106b9c76f3387fc61a5a22ae4f5a99233e636ca56051d4d278e55736a36f5d3e2177637440d3c3798a476c011b0de357356d0411da95f1d5a3cea26b01424

Download Submit
C:\Windows\System32\Setup\aladdin\hasphl\hardlock.sys

Filesize
1.9MB

MD5
a3b46f3b34f97c81fa956026769f0c39

SHA1
40e530c48c7a2797a11c0d38287e274e3df32b93

SHA256
1d3e3dc116eb68c6a22ef06d92c06ce9f650cb8fa772c623545d2b974f87520a

SHA512
e7f6687cf7bcb3d8757a0a1243facc4304df69bf1a9de41b34e15784b378ac9f9db487873ec74bd6ba79d4d52544e21e9fc78b888491195849b50acb70601b5e

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
192KB

MD5
204bd7a9e6886ef4a7cb1c64a26c35ab

SHA1
1ecf0447bd0c6fe39c2a0f0b371e87f4a302ecdf

SHA256
8a6b5b2e37b6e2f5b1f183bc229eeb0cdd6d29b94a842f79820adc493e86dfb6

SHA512
d0a25a5903b6b46c6cf94f46164cfb608a02faf2574dc72d394ba35d4ecff462dce0aae9eccf9f311065fc9fa051d03f53e4f4279b5bf58ea24cc0a9ef0bd1a8

Download Submit
C:\Windows\aksdrvsetup.log

Filesize
1KB

MD5
11c1c69f48924a2fac493925467b69ac

SHA1
12c127ffda98dec4546c24b79f78ab13306d3c94

SHA256
ecfd306c9ed0a37366e056c082ab442ae9e127ef5493097fda8c01cd6c404f66

SHA512
c3aa0bb9ef89c244ebaf17212cc01c5f62269db1897ccc57c6a3f40a6e33c558237dfe7ee0699c1eca89e08b2ea1a74fb0ed779522c1a68cc5f1a582a849a02b

Download Submit
\Users\Admin\AppData\Local\Temp\MSI51E7.tmp

Filesize
158KB

MD5
56d6a938b65bad8ab71046cadfd18296

SHA1
d5b5ac62e156d9120abfd543da7910671489175d

SHA256
5da4c8c3d5bcde6df8fe19a0ad6d79538d4ebcbb8c62698624886cf2404b4f2f

SHA512
d9535a30083b6241d87f5efa169cd02ce0d6b02e5b3389bad3703eefa764bff0a3132668eb9a212096ad96b8562772da9ebbfcb7ca6c4154fdc894ef3c51c3fb

Download Submit
\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe

Filesize
554KB

MD5
241c8cca227779d50d82e684fcba8811

SHA1
02eb24b8d03a232b7de9893fa52fdfc9382a6fab

SHA256
96a10b41a2442dd0cb06af75e1cb8c8dd87a935b7f9d7743b5b7cc04e0223b4a

SHA512
dc08c07c7eda2cb006219ee0b98915c22d34c3594311139e949d97b35b9bf5b078c1505f3093e927d9e3740bfbebeb09119ca9481d0cf9f6b91a3e55706b1051

Download Submit
\Users\Admin\AppData\Local\Temp\haspds_windows.dll

Filesize
1.3MB

MD5
cb2d59dd78d19913c4060b443189cb35

SHA1
96d2f22cdfe02ec22a5012371ebd40947695a02d

SHA256
38831f82ce1a11c4ed8a341ed9f33e06f03b38b9e15c99cc40363509fceb0181

SHA512
8465b6bb81e2660dd6627b978dfe5c91a782f06b4178c4a177878c47b2b8f1630d163af5c6f2125aa9d748f61fa1b65ec8d6cd164e88ea503834d75434cb0760

Download Submit
\Users\Admin\AppData\Local\Temp\haspds_windows_x64.dll

Filesize
442KB

MD5
d31b65140683c7021cc5e391fedb2f7b

SHA1
d5abd54d0feff3990e9c0324fb3af51bbb8a6a00

SHA256
8d561a9b89f37dcc8c22fe2962b1e1ac5d456943e79043f5a228311a8c125a05

SHA512
9d5e009fde0d579846891f41d3c146b0694de36bcc05bef2391fdae17592c2387c494389cffc4689bec212495a2405f2b579c314e358e07341ae16a21f2d067a

Download Submit
\Users\Admin\AppData\Local\Temp\{552E3CA3-0D94-401B-9FEF-4B8C75934EFC}\LicenseManagerSetup.exe

Filesize
2.8MB

MD5
22e2549f1a8dd2e69ba33f38cef181d9

SHA1
dfdd43df2f1e4b5b503fcca6816bf6272f9baf81

SHA256
415d0d6c5df85a462eab94bf6091cad491ecc610a53824effa443beb129885c0

SHA512
f1891160d14148e7aa93ab21a5427030212bdac7be8ad6f4f2b0a85959cf9501e3c1f80f6005bb464401284cb2ba0c3b24674ee6829a06787cd2a6781416b8e0

Download Submit
memory/2420-67-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download