f80f8a725028bcc09639f7b1ff9439436d974f0bf92871048092eaec5d7458f0

Analysis

max time kernel
141s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f80f8a725028bcc09639f7b1ff9439436d974f0bf92871048092eaec5d7458f0.msi
Size

200.6MB
MD5

e43da50b0bbb9e87ce597440713a60b0
SHA1

7aac4d55e08cff1882297cff1c9bf67c4f69da68
SHA256

f80f8a725028bcc09639f7b1ff9439436d974f0bf92871048092eaec5d7458f0
SHA512

2fd0c58689588f04f7053c528c5d76bc678fa8bb1e4a9707a3a19b3517ce21c057249c210d46ba28dccf392216e9b9dfe44ca11773dac1f7f746ecea551d312d
SSDEEP

6291456:RyC80S2EhOoyizyq06TBo1u/3yFyAoJRsZF2:D8d2QfIq0V1uPyFyDJRq

Score

6^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1680	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDDA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE96B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76dc10.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF566.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76dc0d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA56.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED64.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF054.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIE013.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF565.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76dc0d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE880.tmp	msiexec.exe
File created	C:\Windows\Installer\f76dc10.ipi	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
2988	thelp.exe
1748	MSIF565.tmp
980	exodus-windows.exe
2688	Update.exe
1648	Squirrel.exe
640	Exodus.exe
704	Exodus.exe
2708	thelp.exe

Loads dropped DLL 39 IoCs

pid	Process
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
2988	thelp.exe
980	exodus-windows.exe
2688	Update.exe
2688	Update.exe
2688	Update.exe
2688	Update.exe
2688	Update.exe
2688	Update.exe
640	Exodus.exe
704	Exodus.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe
2708	thelp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	thelp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	thelp.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Update.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Update.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Update.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Update.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1680	MsiExec.exe
2680	msiexec.exe
2680	msiexec.exe
2688	Update.exe
2688	Update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2072	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeSecurityPrivilege	2680	msiexec.exe
Token: SeCreateTokenPrivilege	2072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2072	msiexec.exe
Token: SeLockMemoryPrivilege	2072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2072	msiexec.exe
Token: SeMachineAccountPrivilege	2072	msiexec.exe
Token: SeTcbPrivilege	2072	msiexec.exe
Token: SeSecurityPrivilege	2072	msiexec.exe
Token: SeTakeOwnershipPrivilege	2072	msiexec.exe
Token: SeLoadDriverPrivilege	2072	msiexec.exe
Token: SeSystemProfilePrivilege	2072	msiexec.exe
Token: SeSystemtimePrivilege	2072	msiexec.exe
Token: SeProfSingleProcessPrivilege	2072	msiexec.exe
Token: SeIncBasePriorityPrivilege	2072	msiexec.exe
Token: SeCreatePagefilePrivilege	2072	msiexec.exe
Token: SeCreatePermanentPrivilege	2072	msiexec.exe
Token: SeBackupPrivilege	2072	msiexec.exe
Token: SeRestorePrivilege	2072	msiexec.exe
Token: SeShutdownPrivilege	2072	msiexec.exe
Token: SeDebugPrivilege	2072	msiexec.exe
Token: SeAuditPrivilege	2072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2072	msiexec.exe
Token: SeChangeNotifyPrivilege	2072	msiexec.exe
Token: SeRemoteShutdownPrivilege	2072	msiexec.exe
Token: SeUndockPrivilege	2072	msiexec.exe
Token: SeSyncAgentPrivilege	2072	msiexec.exe
Token: SeEnableDelegationPrivilege	2072	msiexec.exe
Token: SeManageVolumePrivilege	2072	msiexec.exe
Token: SeImpersonatePrivilege	2072	msiexec.exe
Token: SeCreateGlobalPrivilege	2072	msiexec.exe
Token: SeBackupPrivilege	2504	vssvc.exe
Token: SeRestorePrivilege	2504	vssvc.exe
Token: SeAuditPrivilege	2504	vssvc.exe
Token: SeBackupPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2444	DrvInst.exe
Token: SeLoadDriverPrivilege	2444	DrvInst.exe
Token: SeLoadDriverPrivilege	2444	DrvInst.exe
Token: SeLoadDriverPrivilege	2444	DrvInst.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2072	msiexec.exe
2072	msiexec.exe
2688	Update.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 1680	2680	msiexec.exe	34
PID 2680 wrote to memory of 2988	2680	msiexec.exe	35
PID 2680 wrote to memory of 2988	2680	msiexec.exe	35
PID 2680 wrote to memory of 2988	2680	msiexec.exe	35
PID 2680 wrote to memory of 2988	2680	msiexec.exe	35
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 2680 wrote to memory of 1748	2680	msiexec.exe	36
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 980 wrote to memory of 2688	980	exodus-windows.exe	40
PID 2688 wrote to memory of 1648	2688	Update.exe	41
PID 2688 wrote to memory of 1648	2688	Update.exe	41
PID 2688 wrote to memory of 1648	2688	Update.exe	41
PID 2688 wrote to memory of 1648	2688	Update.exe	41
PID 2688 wrote to memory of 640	2688	Update.exe	42
PID 2688 wrote to memory of 640	2688	Update.exe	42
PID 2688 wrote to memory of 640	2688	Update.exe	42
PID 2688 wrote to memory of 640	2688	Update.exe	42
PID 2688 wrote to memory of 704	2688	Update.exe	43
PID 2688 wrote to memory of 704	2688	Update.exe	43
PID 2688 wrote to memory of 704	2688	Update.exe	43
PID 2688 wrote to memory of 704	2688	Update.exe	43
PID 2732 wrote to memory of 2708	2732	taskeng.exe	45
PID 2732 wrote to memory of 2708	2732	taskeng.exe	45
PID 2732 wrote to memory of 2708	2732	taskeng.exe	45
PID 2732 wrote to memory of 2708	2732	taskeng.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f80f8a725028bcc09639f7b1ff9439436d974f0bf92871048092eaec5d7458f0.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3292022A8CEC9A0B19989E9EBC01781
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\ProgramData\MoCo\thelp.exe
  "C:\ProgramData\MoCo\thelp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:2988
- C:\Windows\Installer\MSIF565.tmp
  "C:\Windows\Installer\MSIF565.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\exodus-windows.exe"
  2⤵
  - Executes dropped EXE
  PID:1748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000564" "00000000000005BC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Users\Admin\AppData\Roaming\exodus-windows.exe
"C:\Users\Admin\AppData\Roaming\exodus-windows.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:980
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\exodus\app-24.11.5\Squirrel.exe
    "C:\Users\Admin\AppData\Local\exodus\app-24.11.5\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:1648
- - C:\Users\Admin\AppData\Local\exodus\app-24.11.5\Exodus.exe
    "C:\Users\Admin\AppData\Local\exodus\app-24.11.5\Exodus.exe" --squirrel-install 24.11.5
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:640
- - C:\Users\Admin\AppData\Local\exodus\app-24.11.5\Exodus.exe
    "C:\Users\Admin\AppData\Local\exodus\app-24.11.5\Exodus.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:704

C:\Windows\system32\taskeng.exe
taskeng.exe {13C21108-31C2-4C32-B54C-AD1DC140B10D} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\ProgramData\MoCo\thelp.exe
  C:\ProgramData\MoCo\thelp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76dc11.rbs

Filesize
377KB

MD5
d49662a60d1e330d3e9dc80a0ac92b67

SHA1
4ab4e2d5de06d779c3c85e21fc5ba4d18c990a1a

SHA256
478c57ce46cfacdd1949a39a607d59189a6badacbd1302dfa7429dcf52561497

SHA512
322a25cecec4742c4be9e99701216ab7993be51f01b9575f40aea28520b424f0d1a2a7ad6fe61c72404d0dbbbbad72aa1455ee15b308a8d84b770158e78ce58b

Download Submit
C:\ProgramData\MoCo\thelp.exe

Filesize
226KB

MD5
17749f66292f190ef93652eb512c5ab7

SHA1
e2f651aa9d37404063ffc79e920787c9d3e71fdb

SHA256
0aa17ee66b8dae520e82a94388b1a1d603ec2aed20c464d6cac9a521d4167f24

SHA512
2ef192a191dc40a16c9b8768e749175c1a57319ab896809691effcc5de61c4a38fd8a8388b8907a1985e505907a8529f4d10990e362831092c75dafb8900b13e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\660092cbfa9388b569a12e2f\62.24.11\tracking.ini

Filesize
84B

MD5
f8e834ce90a9486af2ef44ffc0e30da2

SHA1
95e4e1e7f730e70599763f71a050321a66f69b47

SHA256
66334de91bee11f6a7e50b1d0c05af73437af10a48e8bf6fd56a22d29100293a

SHA512
c8fc0b7f53cf968d132b36879f9e6982f4471a13ccb3e571a1e409928c81286be4a8fb3c3987a85ca27fa9a6c46bd719bbad08606f7e5c3d810b221659587412

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\660092cbfa9388b569a12e2f\62.24.11\{F5E9323F-479B-402E-B175-9C14CD8A08BC}.session

Filesize
18KB

MD5
17dde65abc94b0407cee16dc02400433

SHA1
3d0fd0726d046f00a237f4d51df6a88ea432b756

SHA256
46859084a23eb9779ef7e3b5f0f854465b0dc8781b11373552bee1e1e9efc36e

SHA512
5329333937eb094f3bf30e74428f159b9c0a10bcaa6d1adcc02149dab40667c4944da59a347fc571484dfe055f14719b82f6e11a85b134209d278a0ab14c0fa0

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
79B

MD5
bddf30a15918f601082de1c96730bd7b

SHA1
f0b31e72c2e4006100f9bc38db177b17697c1249

SHA256
42936fdf2935a38d89cbbf6bd6f00e14ccae5debbd695851b0810ce5c85644e4

SHA512
0fc189ff9098b3a2661f33e3c03810ebca2eed80ef1d4a2f6a6b3f8bb5bee9c16711f350afc6623217a0d332c8365e0146c9490c067cbe73fc88349f31e73444

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
50KB

MD5
363c5ad8df3970b235d28adc553f7065

SHA1
8f56f63a8e802cf24eb4afb8ea29b36a1f13aed3

SHA256
c8cfbfc802db89b3037f5ff75e3ee58dd32b2c06c19b63897687d7bfefea80b2

SHA512
9c9b8f9c33c6eb3083f5c5d58fcb2b0ab7fcead60089eb5197b682d3d6c7570584c5189e184f304cd9c1cfb42f580292e0ccd1cc778cf1de92ff16a82b88e1aa

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\exodus-24.11.5-full.nupkg

Filesize
190.1MB

MD5
e2841e8cb8ddba33308aaa924dac7024

SHA1
5dd1c7ff5d1cacca06c5a138bf4f1e6cc9e93959

SHA256
f93fa15b29b806c667ccacc460c358dc5ad0bd516e3fbc0833fce6c1fb04ebd6

SHA512
9d019d5fc0398d0d7245ec9c2ab2250720cf46ae37a4799b19775ed5b8cbb376576570c227b1fa4c4e6af91c2c7a3ed7b5a40583ad559a7fac58e85551ccf7ae

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico

Filesize
352KB

MD5
f4fd06cc518f26026049ccce65a4ec81

SHA1
6298ba68c06b31f1ec19e7ce757c26ff3e6df3f7

SHA256
381905c1421a53741029db9ac3b9544bc39daabc8e14a8883ab0b64c5c0d2ca3

SHA512
e53583d6a33b8f4b8d9d71aa19b1027b2152e35bc1595ee62916be3f1eb95015b4b1ca70d6bdeaa54742c11a374ccd663062229ce22410dc3d2b96bf8d6538d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81E4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\exodus-windows.exe

Filesize
191.3MB

MD5
fe063a1baa11fc6b7174a4cc8bd37c7a

SHA1
bdc56bec72e49084ea979fbc668d63ce8a7130a8

SHA256
081959d5da7d73a2691cda5e49bcb48ade28a9376fa75b45b44f8d31abbec845

SHA512
abe4fdca24a52ccef7f5ae8bb071da8d25f7b6a8be9e019dbdeadb5090d52a9c85ceb6c0a8606d63747375a2704c6df6f999fd4c0f087e9cb08fbc3539b72397

Download Submit
C:\Windows\Installer\MSIDDA2.tmp

Filesize
770KB

MD5
356fc2c181cc37e3f8ae4d6b855ebfcb

SHA1
2ead1e69f14099ae33a3216a9312c88007b73cd1

SHA256
c92b2d9623f19f8acfeac5fd894346515631ebb590e68f22c40a35fbacbef03c

SHA512
74ea73d3206ba1c6f1963caa4866589fe86636f68815c74733644ad6c4913de3f1399770f6095a48c9d94a7d934072d8d8b409a393de644265f6e456455dcebd

Download Submit
C:\Windows\Installer\MSIE013.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIE1CA.tmp

Filesize
897KB

MD5
6189cdcb92ab9ddbffd95facd0b631fa

SHA1
b74c72cefcb5808e2c9ae4ba976fa916ba57190d

SHA256
519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

SHA512
ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

Download Submit
C:\Windows\Installer\MSIED64.tmp

Filesize
187KB

MD5
f11e8ec00dfd2d1344d8a222e65fea09

SHA1
235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

SHA256
775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

SHA512
6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

Download Submit
C:\Windows\Installer\MSIF565.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\ProgramData\MoCo\XLFSIO.dll

Filesize
180KB

MD5
8f23573e476b9018a72c0e9f19783faa

SHA1
e83dbda18cb70bbb9f786e648521ad51921fea68

SHA256
f68e8554cdeaff01c5a1c3be74d86d1236156004180011430c93b38718539110

SHA512
1846cc11825a751fbdb5e9ba07aeea33ccb070bb75c2b2859ab73d4210ff22847b610c62bdda94e3ca1d919e7356331427c4a0243e13d494f194eb4c2fa9c6ad

Download Submit
\ProgramData\MoCo\XLFSIO2.dll

Filesize
209KB

MD5
1bc7af7a8512cf79d4f0efc5cb138ce3

SHA1
68fd202d9380cacd2f8e0ce06d8df1c03c791c5b

SHA256
ef474b18f89310c067a859d55abd4e4f42fdac732e49eafe4246545e36872a62

SHA512
84de4d193d22a305be2ba28fc67bd1cccf83616cead721e57347f1b2e0736d351fef1abf168f7914caa1bcc7a72db43769991016673cd4646def544802ee8960

Download Submit
\ProgramData\MoCo\XLGraphic.dll

Filesize
730KB

MD5
74c75ae5b97ad708dbe6f69d3a602430

SHA1
a02764d99b44ce4b1d199ef0f8ce73431d094a6a

SHA256
89fbb6b1ca9168a452e803dbdc6343db7c661ad70860a245d76b3b08830156e2

SHA512
52c5f7e00dffb1c0719d18184da2cc8ec2ad178b222775f167b87320f0683a3c2846e30190bc506f12d14c07fa45896935b3d4ac396baa14d7564996e35c2ada

Download Submit
\ProgramData\MoCo\XLLuaRuntime.dll

Filesize
249KB

MD5
5362cb2efe55c6d6e9b51849ec0706b2

SHA1
d91acbe95dedc3bcac7ec0051c04ddddd5652778

SHA256
1d7519acca9c8a013c31af2064fbc599a0b14cfd1dfb793a345fab14045fed40

SHA512
dbd591c3d0b9847d9cef59277c03ec89e246db0e54b58fbbe9d492b75cdcb32d75444012cdfb1c77376d15db7fde1f74e694d2487c481ce29a2133342b91e1f5

Download Submit
\ProgramData\MoCo\XLUE.dll

Filesize
2.4MB

MD5
0abbe96e1f7a254e23a80f06a1018c69

SHA1
0b83322fd5e18c9da8c013a0ed952cffa34381ae

SHA256
10f099f68741c179d5ad60b226d15233bb02d73f84ce51a5bbbbc4eb6a08e9d4

SHA512
2924e1e11e11bd655f27eb0243f87002a50a2d4b80e0b0e3ad6fd4c3d75c44222fab426fcaa695881b0093babf544e8aeee50a065ea92274145b0f88b1db0c58

Download Submit
\ProgramData\MoCo\libexpat.dll

Filesize
668KB

MD5
5ff790879aab8078884eaac71affeb4a

SHA1
59352663fdcf24bb01c1f219410e49c15b51d5c5

SHA256
cceca70f34bbcec861a02c3700de79ea17d80c0a7b9f33d7edd1357a714e0f2f

SHA512
34fbaffc48912e3d3fa2d224e001121e8b36f5be7284a33eb31d306b9a5c00de6e23a9fdc1a17a61fb1371768f0b0e30b9c6e899a08c735fc70482d5aa8ea824

Download Submit
\ProgramData\MoCo\libpng13.dll

Filesize
157KB

MD5
bb1922dfbdd99e0b89bec66c30c31b73

SHA1
f7a561619c101ba9b335c0b3d318f965b8fc1dfb

SHA256
76457f38cbbdd3dce078a40d42d9ac0dc26ae1c4bb68ab9c880eb7ffb400fd99

SHA512
3054574dd645feb1468cee53db2fd456e4f923eaf5fd686557a01c72c0572b19d70f3885d47fe42e97cdf7ccc2c674a6e966ff19668907cf7828e0a943cf474a

Download Submit
\ProgramData\MoCo\mt.dll

Filesize
186KB

MD5
9d74c6ece4a296e885e80001898cef6c

SHA1
8296d2537bb00605f1a1a009165611f480309947

SHA256
9cbc5aed2affb3b66667157638b4e62ebe76ae8f1a1229bbbfd4eadb84176819

SHA512
413cc639cde1df30bc35307e6b959fb39a89b1a11cdb391c4c539a97dd34e6bfa34545c195d0bf83eb71671dd7558f8221c4644316028f6b562bd78b2eebe473

Download Submit
\ProgramData\MoCo\zlib1.dll

Filesize
62KB

MD5
37163aacc5534fbab012fb505be8d647

SHA1
73de6343e52180a24c74f4629e38a62ed8ad5f81

SHA256
0a6357a8852daaafe7aed300e2f7e69d993cac4156e882baa8a3a56b583255ba

SHA512
c3bed1c9bc58652ed16b162ed16a93cf7479a0492db7e6ea577001dbe859affc0b20387d93d23e06e73f49f395e4c9a5a07680f000ebb82d32269742c16a5242

Download Submit
\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.7MB

MD5
65f65aec786ed55df88e4d6e9fabcf46

SHA1
50d6644b9ce2fb1e440374ddf1b0dd7d0107525a

SHA256
5563f6c85a682e9b5328688cf8a90d56e7b5d638fd105ce00edf3327426fc66d

SHA512
7d0cb68983d0a4f30baa7922fb9a224a1a4cc250c9fc88b3552a0d60a250889343a40c7f426515d48a6c33a483dc50763882a95210c75c1c16086bc08cea92cf

Download Submit
\Users\Admin\AppData\Local\exodus\app-24.11.5\Exodus.exe

Filesize
164.9MB

MD5
f6d4e758fbe9a809cc3ea660a08eb434

SHA1
e1208716fb7946e103d30e1a52ab141922c2f8b3

SHA256
0ad05d51b266d580eb96209ac8ca98745a2c692079741a2aed82570a2f52eeb0

SHA512
3da6910d71cf1e60670aa6bcbc23b68bb48b91e7fe68540090f7351647e93e2f53b7e6e4ea0b160458e7ff188a3f46e687f86ce5c988cbfd49819a41d9640bba

Download Submit
\Users\Admin\AppData\Local\exodus\app-24.11.5\ffmpeg.dll

Filesize
2.8MB

MD5
acbb07fe6d0da0b2a2916abadc9d11ab

SHA1
f344e555c7b6ab2c6526401c4a2ef15948270a47

SHA256
1c594f48b92af590e42e0690df8e4a98dcef0958f9a970025ee681b42004bb08

SHA512
238e806168b7e37203079d8cb804c2baabe7ca4d9248f1dc08d5a72e785c1e92b23c621cef3591c3fe7a7d034058a61fa88631322715f0723ee04f2fd94857be

Download Submit
\Users\Admin\AppData\Local\exodus\app-24.11.5\squirrel.exe

Filesize
2.1MB

MD5
81577702159b227ec72e45f2b4b210cb

SHA1
76f97e0e25444833c302ad54a2271635f5d96198

SHA256
7cf439d3c4d4073dbf041e1a0c3e1ba0c93ce47a5b8f63f1718d6a67c30dff61

SHA512
0757924f3d6490af06c34ee6ee1a4d633063f6100f230cedecbefbf002909f2a663c0a688b8ee62143cbfa5eee436c2d141185df0392bdfa814dfd6c8a52cde8

Download Submit
memory/1648-465-0x0000000073100000-0x00000000737EE000-memory.dmp

Filesize
6.9MB

Download
memory/1648-457-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/1648-377-0x0000000073100000-0x00000000737EE000-memory.dmp

Filesize
6.9MB

Download
memory/1648-375-0x0000000000A60000-0x0000000000C7C000-memory.dmp

Filesize
2.1MB

Download
memory/1648-381-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/1648-452-0x0000000073100000-0x00000000737EE000-memory.dmp

Filesize
6.9MB

Download
memory/1748-239-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/2688-446-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2688-401-0x0000000073100000-0x00000000737EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-447-0x0000000073100000-0x00000000737EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-259-0x0000000073100000-0x00000000737EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-262-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2688-346-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/2688-258-0x0000000000FB0000-0x0000000001174000-memory.dmp

Filesize
1.8MB

Download
memory/2708-476-0x0000000000410000-0x0000000000518000-memory.dmp

Filesize
1.0MB

Download
memory/2708-490-0x0000000000990000-0x00000000009BA000-memory.dmp

Filesize
168KB

Download
memory/2708-491-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/2708-489-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/2708-484-0x00000000009C0000-0x00000000009ED000-memory.dmp

Filesize
180KB

Download
memory/2708-482-0x0000000000560000-0x000000000059F000-memory.dmp

Filesize
252KB

Download
memory/2708-480-0x0000000000520000-0x0000000000555000-memory.dmp

Filesize
212KB

Download
memory/2988-245-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/2988-395-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download