Overview
overview
6Static
static
3PingPlotte...FF.exe
windows7-x64
1PingPlotte...FF.exe
windows10-2004-x64
1PingPlotte...ll.exe
windows7-x64
6PingPlotte...ll.exe
windows10-2004-x64
6$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$_4_.msi
windows7-x64
6$_4_.msi
windows10-2004-x64
6Analysis
-
max time kernel
99s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
PingPlotter Professional 5.24.3.8913/KEYGEN-FFF/PingPlotter.v3.30.4_KEYGEN-FFF.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
PingPlotter Professional 5.24.3.8913/KEYGEN-FFF/PingPlotter.v3.30.4_KEYGEN-FFF.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
PingPlotter Professional 5.24.3.8913/pingplotter_install.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
PingPlotter Professional 5.24.3.8913/pingplotter_install.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DotNetChecker.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DotNetChecker.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$_4_.msi
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
$_4_.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
$_4_.msi
-
Size
68.0MB
-
MD5
d338244a4c63c6829ba63a436cd96bca
-
SHA1
cf5b67a36f27990ae89933913b8e09c48360837c
-
SHA256
c04393d32a045faa0940dc56f91d456935060cfa995cf3caee948ef09ab5cd33
-
SHA512
ac5ed089a9ca48a7a997cf6053d7a8dec41b729f1ee456051ffc23373425bf62a2f82df9027176fa614b39c335ca86b4e23633fe50359fc0392a54ff47744b46
-
SSDEEP
393216:wst/V4e0wTkW4rjtNkWbNUz6sdhq1Dzw7RvPm0DMFGwyZyjVhlwdLnoIXXsagvHs:wUqWYXkW5Ujqhzw7RvtYrHs9os
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\symbols\tmp\ResourceCleaner.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\dll\wntdll.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\msi.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\dll\msi.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\msi.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\wkernel32.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\DLL\wkernel32.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\ResourceCleaner.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\tmp\ResourceCleaner.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wntdll.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\version_picker.bundle msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.DiaSymReader.Native.amd64.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Identity.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Win32.Primitives.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.SyntaxEditor.Addons.JavaScript.Wpf.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Hosting.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\no_server_contact.bundle msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Threading.Tasks.Extensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Extensions\MOSColumn\moscolumn.js msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Alert Audio\tibetan-bell.mp3 msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Threading.Tasks.Parallel.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Identity.Stores.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Extensions\AlertAction_LaunchAnExecutable\launchanexecutable.meta.json msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Configuration.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Net.WebSockets.Client.Managed.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.DependencyInjection.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\NAudio.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Text.RegularExpressions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Options.ConfigurationExtensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\trial_banner.bundle msiexec.exe File opened for modification C:\Program Files (x86)\sueoqwysk0.dat PingPlotter.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.SignalR.Core.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Cors.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Security.Cryptography.Cng.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Numerics.Vectors.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Net.Sockets.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Resources.Reader.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.IO.FileSystem.DriveInfo.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Drawing.Primitives.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Net.NameResolution.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Diagnostics.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\core.bundle msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\maintenance.bundle msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Globalization.Extensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.ComponentModel.EventBasedAsync.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.IO.UnmanagedMemoryStream.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\cloud_agent.bundle msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\ScreenResources.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\NGraphics.Net.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Extensions\AlertAction_LaunchAnExecutable\package.json msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Identity.EntityFrameworkCore.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Nito.AsyncEx.Interop.WaitHandles.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Html.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Diagnostics.StackTrace.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Extensions\RemoteAgentScript\default_settings.json msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Resources\Fonts\Roboto\Roboto-Medium.ttf msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Memory.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.ApiExplorer.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Text.Encoding.Extensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.StaticFiles.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\SelfHostedWebMigrations.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Reflection.Metadata.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.EntityFrameworkCore.Proxies.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Runtime.Extensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Hosting.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Configuration.FileExtensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Collections.Immutable.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Reflection.Extensions.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Authorization.Policy.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\Microsoft.Data.Sqlite.dll msiexec.exe File created C:\Program Files (x86)\PingPlotter 5\System.Security.Cryptography.Algorithms.dll msiexec.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI16B9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A26.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI11E0.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CBAA9826-6D34-44FF-AEBF-E880F91CADCE} msiexec.exe File opened for modification C:\Windows\Installer\e580dc6.msi msiexec.exe File opened for modification C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\ext.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1821.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\Installer\e580dc6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1404.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DB3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D83.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI150F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI165A.tmp msiexec.exe File created C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\ext.exe msiexec.exe File created C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI2207.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2218.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI10D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI15EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI160B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1F66.tmp msiexec.exe File created C:\Windows\Installer\e580dc8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFAB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1019.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2692 PingPlotter.exe 4604 PingPlotter.exe -
Loads dropped DLL 24 IoCs
pid Process 1904 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 1904 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 5040 MsiExec.exe 1944 MsiExec.exe 1944 MsiExec.exe 1944 MsiExec.exe 1944 MsiExec.exe 1944 MsiExec.exe 5040 MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b1010511f65dd1c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005b1010510000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005b101051000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5b101051000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005b10105100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software PingPlotter.exe Key created \REGISTRY\USER\.DEFAULT\Software\Pingman Tools PingPlotter.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Pingman Tools\PingPlotter 5\License = 77f7461c8520291db508ffb18ab4f4a8ca6be2a05f72467104c4470df3654378073fb29338b92527facbe806983055fb PingPlotter.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Pingman Tools\PingPlotter 5 PingPlotter.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\ = "&Open PingPlotter workspace" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\ = "open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\WebInterface = "PingPlotter5Main" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BDE4C0E5F8F1D9E448B630CA83009281\6289AABC43D6FF44EAFB8E089FC1DAEC msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Version = "85458947" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pp2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" /url \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\PackageName = "$_4_.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\DefaultIcon\ = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\Scripts = "PingPlotter5Main" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\ = "PingPlotter Workspace" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\WindowsService = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ppws msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\ = "&Open PingPlotter Sample Set" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\Pingman Tools.PingPlotter 5.pp2\ShellNew msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\pingplotter\DefaultIcon msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command\command = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ppws\Pingman Tools.PingPlotter 5.ppws msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\DefaultIcon\ = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe,0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\pingplotter\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command\command = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d002000220025003100220000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\ = "Pingman Tools.PingPlotter 5.pp2" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\ProductIcon = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ppws\Pingman Tools.PingPlotter 5.ppws\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\ = "PingPlotter Sample Set" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\DefaultIcon\ = "C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe,1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|PingPlotter 5|PingPlotter.exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\FirewallICMPforUDP = "PingPlotter5Main" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\Pingman Tools.PingPlotter 5.pp2 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\pingplotter msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\ = "URL:PingPlotter Protocol Handler" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\ = "open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\ProductName = "PingPlotter 5" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\PackageCode = "D9266175463576C49929C4305A953AF8" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\PingPlotter5Main msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\InstanceType = "0" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4528 msiexec.exe 4528 msiexec.exe 5040 MsiExec.exe 5040 MsiExec.exe 1944 MsiExec.exe 1944 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4388 msiexec.exe Token: SeIncreaseQuotaPrivilege 4388 msiexec.exe Token: SeSecurityPrivilege 4528 msiexec.exe Token: SeCreateTokenPrivilege 4388 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4388 msiexec.exe Token: SeLockMemoryPrivilege 4388 msiexec.exe Token: SeIncreaseQuotaPrivilege 4388 msiexec.exe Token: SeMachineAccountPrivilege 4388 msiexec.exe Token: SeTcbPrivilege 4388 msiexec.exe Token: SeSecurityPrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeLoadDriverPrivilege 4388 msiexec.exe Token: SeSystemProfilePrivilege 4388 msiexec.exe Token: SeSystemtimePrivilege 4388 msiexec.exe Token: SeProfSingleProcessPrivilege 4388 msiexec.exe Token: SeIncBasePriorityPrivilege 4388 msiexec.exe Token: SeCreatePagefilePrivilege 4388 msiexec.exe Token: SeCreatePermanentPrivilege 4388 msiexec.exe Token: SeBackupPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeShutdownPrivilege 4388 msiexec.exe Token: SeDebugPrivilege 4388 msiexec.exe Token: SeAuditPrivilege 4388 msiexec.exe Token: SeSystemEnvironmentPrivilege 4388 msiexec.exe Token: SeChangeNotifyPrivilege 4388 msiexec.exe Token: SeRemoteShutdownPrivilege 4388 msiexec.exe Token: SeUndockPrivilege 4388 msiexec.exe Token: SeSyncAgentPrivilege 4388 msiexec.exe Token: SeEnableDelegationPrivilege 4388 msiexec.exe Token: SeManageVolumePrivilege 4388 msiexec.exe Token: SeImpersonatePrivilege 4388 msiexec.exe Token: SeCreateGlobalPrivilege 4388 msiexec.exe Token: SeCreateTokenPrivilege 4388 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4388 msiexec.exe Token: SeLockMemoryPrivilege 4388 msiexec.exe Token: SeIncreaseQuotaPrivilege 4388 msiexec.exe Token: SeMachineAccountPrivilege 4388 msiexec.exe Token: SeTcbPrivilege 4388 msiexec.exe Token: SeSecurityPrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeLoadDriverPrivilege 4388 msiexec.exe Token: SeSystemProfilePrivilege 4388 msiexec.exe Token: SeSystemtimePrivilege 4388 msiexec.exe Token: SeProfSingleProcessPrivilege 4388 msiexec.exe Token: SeIncBasePriorityPrivilege 4388 msiexec.exe Token: SeCreatePagefilePrivilege 4388 msiexec.exe Token: SeCreatePermanentPrivilege 4388 msiexec.exe Token: SeBackupPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeShutdownPrivilege 4388 msiexec.exe Token: SeDebugPrivilege 4388 msiexec.exe Token: SeAuditPrivilege 4388 msiexec.exe Token: SeSystemEnvironmentPrivilege 4388 msiexec.exe Token: SeChangeNotifyPrivilege 4388 msiexec.exe Token: SeRemoteShutdownPrivilege 4388 msiexec.exe Token: SeUndockPrivilege 4388 msiexec.exe Token: SeSyncAgentPrivilege 4388 msiexec.exe Token: SeEnableDelegationPrivilege 4388 msiexec.exe Token: SeManageVolumePrivilege 4388 msiexec.exe Token: SeImpersonatePrivilege 4388 msiexec.exe Token: SeCreateGlobalPrivilege 4388 msiexec.exe Token: SeCreateTokenPrivilege 4388 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4388 msiexec.exe Token: SeLockMemoryPrivilege 4388 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4388 msiexec.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4528 wrote to memory of 1904 4528 msiexec.exe 85 PID 4528 wrote to memory of 1904 4528 msiexec.exe 85 PID 4528 wrote to memory of 1904 4528 msiexec.exe 85 PID 4528 wrote to memory of 5056 4528 msiexec.exe 94 PID 4528 wrote to memory of 5056 4528 msiexec.exe 94 PID 4528 wrote to memory of 5040 4528 msiexec.exe 97 PID 4528 wrote to memory of 5040 4528 msiexec.exe 97 PID 4528 wrote to memory of 5040 4528 msiexec.exe 97 PID 4528 wrote to memory of 1944 4528 msiexec.exe 98 PID 4528 wrote to memory of 1944 4528 msiexec.exe 98 PID 4528 wrote to memory of 1944 4528 msiexec.exe 98 PID 1944 wrote to memory of 4524 1944 MsiExec.exe 99 PID 1944 wrote to memory of 4524 1944 MsiExec.exe 99 PID 1944 wrote to memory of 4524 1944 MsiExec.exe 99 PID 4524 wrote to memory of 3612 4524 cmd.exe 101 PID 4524 wrote to memory of 3612 4524 cmd.exe 101 PID 4524 wrote to memory of 3612 4524 cmd.exe 101 PID 1944 wrote to memory of 3508 1944 MsiExec.exe 102 PID 1944 wrote to memory of 3508 1944 MsiExec.exe 102 PID 1944 wrote to memory of 3508 1944 MsiExec.exe 102 PID 1944 wrote to memory of 3600 1944 MsiExec.exe 105 PID 1944 wrote to memory of 3600 1944 MsiExec.exe 105 PID 1944 wrote to memory of 3600 1944 MsiExec.exe 105 PID 1944 wrote to memory of 2176 1944 MsiExec.exe 108 PID 1944 wrote to memory of 2176 1944 MsiExec.exe 108 PID 1944 wrote to memory of 2176 1944 MsiExec.exe 108 PID 4528 wrote to memory of 2692 4528 msiexec.exe 110 PID 4528 wrote to memory of 2692 4528 msiexec.exe 110 PID 4528 wrote to memory of 4604 4528 msiexec.exe 112 PID 4528 wrote to memory of 4604 4528 msiexec.exe 112 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$_4_.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4388
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 229E85BDCF4A479A5157BBB5AA7CA71F C2⤵
- Loads dropped DLL
PID:1904
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5056
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 120E497ABD831F06BAA1A5650E48BE512⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5040
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6FF82C47790083E5B4F9D7D38A0B8DB5 E Global\MSI00002⤵
- Drops file in System32 directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{F15FE46E-B401-471F-9E73-A2C9C69A2237}.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:3612
-
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{F15FE46E-B401-471F-9E73-A2C9C69A2237}.bat"3⤵PID:3508
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{F15FE46E-B401-471F-9E73-A2C9C69A2237}.bat"3⤵PID:3600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" /queue:13⤵PID:2176
-
-
-
C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe"C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver initializeprofile quiet2⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2692
-
-
C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe"C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver quiet2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4604
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2416
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵PID:1628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54d15a454ca70a711f702cf8fccb2e430
SHA1117a26cf97f122dfb4afbe7234a2729d8a5bd14e
SHA2561a3ab4281aa7ceb45dd6a1bcd133a9654f371e9905a464d6ac698629362f6da2
SHA5123589d2f89e3fc5fe0c71276de17af3f38e912b548f532d1be1beac165522e4ef07ec99130c712545b67dfb814dab24e02155f8a6606283783010d3c94201ac35
-
Filesize
87KB
MD59c43eb18df357b00aaf31b6684e57a53
SHA16de6fc5c23b5ef38eb2faab1eb643c3161c2e9f6
SHA256abf2ec51aff791bee7580e77502a90b28aa034d2e729580e0d2b10d7ee296fd6
SHA512fea50d9884aef63e24546d0947608fee8fb3aad6b0f8b5a02fdf5fead5564c2d8f16828fae1c182f1350b209a8a9b2e99201822957c36787b6ff36d266412309
-
Filesize
677KB
MD5b9d27fbdd161b1879aa1b5bf390b8114
SHA11e9ffc3fcefc25581fd726087c74d257c713ffe4
SHA2563866414e85e128dd761a894b63befed29fded32788ab79087d0abc79335f17a4
SHA5124af0057663f74f65af501ec45bed8cc75e225395b1acbd318220cd97eb28123b3b7290c34b865129edc20255c6876c58c25308ae1a458a97f5df285f5a2444c6
-
Filesize
929KB
MD56f0e2870c72222d5989e9842d7d9e275
SHA19a847f1d5efe181c945c60bcfeeb43132db3f599
SHA256b637f6e4c87ac32276f92c609ee71bb3d482b36d5516e383e5c52d8f615359e8
SHA512ff99918d8a8510d70d250695a583deb91953f6db2abf2a71069a2d67932532977529d3a50ec012cd4547a03601cf8f5367592187768fe4d8aa5a80d8dacfda0d
-
Filesize
315KB
MD53e50933e28b0ac08f7158e3a783f6bf4
SHA12178728de734670785b749499e4cfda7e1e30f60
SHA2567d0ee0f0aad53788758a43ccf295cad4b8e6afae6815f2a2800033b29b81c14a
SHA5123324d40fdc9a82915b8323f5386d00361bea8ae42aa79fc85b4d9d95a087fbadfc557d9f77e34938ef4fdc8b04d0e6a9f24bbfca6569d981cf404626fb2eb7f6
-
Filesize
1.9MB
MD5674447f18caace5e1163fb227e4cf08d
SHA162082108201e8be712cd52806a66503cf51fe714
SHA25656dfde9007145d5f6ed21730ecbb5ac04e7c6bc1370fb317acb0e29bffaf5c84
SHA51289fcdc36bd040a554a3bf8be205541914a00e0eed741eed066831d7564fa0f2ede717fb21d1e85e9503d9d262145d2fef837e37ed40087bb7386159fa5411bb8
-
Filesize
1.1MB
MD5855914201fde2285b71d87c05c4bbcc2
SHA18bc1bdbb97c2775c0399e9d0e90a036f41357a4c
SHA256580a06e4ff57218280a92877d2b5def390b563c86a16366882cfee5d30951bd6
SHA5127040fcb1fa29171f10e9a6400deae3283a078899eb21c969d9fde51136ab5002d2cc95ef9b37ea1647fd28c18df1f1776bd80d12b16703a9b15f2776d97b7fbb
-
Filesize
2.2MB
MD54f79b56c4bebf4683f731c2fa68126ce
SHA1be502d11260c83f3bdb67279f796b137094248b6
SHA25628130a2c33fd8ac4a915bd2a695b1160e61ad179136860675b42bbebc878bb63
SHA5123384c07d2378e87d9e7e85f5db6af6bbfe804b559057339b04fda64e744344255da4d309a75efed9ec3246afbb852d4b4dde9baa7d2a783230f25a56d5f6294f
-
Filesize
24KB
MD550f77484e5ebbab4178d226457277f61
SHA1f9ce26a5dac69bc620481e76ff4bcaa44610b4f1
SHA25676a4ee07ad63c27d6d95b9e0cc9a903563514e9b8fb51744646a19e00c3175a5
SHA512f094291b6097608443d168d7cc5cd6a288f98f6bdb418e22d6f606ea2f54a6c6c166f13fedd827a79e8812d598e4fca1d59f50af17264f80e8dd3621856c77da
-
Filesize
25KB
MD5c15a90b02588f3c2e92086d729268d9a
SHA1f3917545b0d2f1784d6c677940e184a8bdf199d7
SHA25664c10c0c8c7e80b8697d395f4c89622f5323d89a1b5ae5bb5c2436d2b614667e
SHA512821986403f4c2d96413f3b2f81ff570198d4445f6cbb5fca38dc43ce4f2f6d7fd571cec70ef047e93e24f32b2069695435344523ff3390d40a6a400e71144407
-
Filesize
100KB
MD536896e5b8ff559857c870c8d60470d79
SHA18abe9941ec44d19b2f079fa66c118d60ecd75141
SHA25657f963ae4825b02214ccae01276708613cdda30d74c50289972f4a16bea3d823
SHA512ddbd19c34fe0b38958778cb8e01ec0daf22882a5db774f24d5fbaf3f18938f71f48b55d6b8ed1d31ac31086d416c65f3e410168c891295412a3d67cbbf781793
-
Filesize
693KB
MD59ef8fb5c101ca8cdcb20af7e2188496f
SHA1a4f3566d20fe9003a092ab1bced77f12016b9022
SHA256ae8b84a5e656c0df5a58e365cf91c6eedcd85ff31f93bd5f21db6f1fe025ccd0
SHA512271198207f107f29b374e188efa318c052827d696e2296dfb58120608edfd7110272338f3effbcb7d3db6e45e72dbb168e5ca90b59836436d9e50276756ae72e
-
Filesize
2.9MB
MD5aea6964efb6bfc8723f85e191c6db9b0
SHA1f213e8ae0088838ae76d9d5841f9e9a2376c78a9
SHA25689a3e51a67ef4684952ab912be4e9fd379b4cf46991d6c17c6e59d34f6ec5eac
SHA51284a8587ccc35cdb2392f2de20a7323bf626bfdef0cc1ba6957273921aa8336086edd58689fac446e342d3ecb9f0a00e7dd2dbb2e5de223a5b6a42e75d845ab8a
-
Filesize
27KB
MD5928b8e104bc50973bad9150c577aaa64
SHA133eb7ed6547d26bbb8dbb087a45baf41292d01d2
SHA256b42eb2bb81f89946449c5b27315afec9c87070ac01a6d0d1df91bd9d46702629
SHA5123b8ac3ce5365b27c8156dfb1ccfeff4f8a0e3b10360c2e5639d3516f2b5aa3c2dc524ddbbd6e3d1941ae0d15f8867eb2e19a0df1c31d1872d25f7758c481cff2
-
Filesize
15KB
MD5ba3845f4986d242d62641e1f6e14caba
SHA19278fe4d60ed3462835a90c56bf187cadc35ddda
SHA256ab5d0fa375fd11f411293552ffa7b127a62ecc7bef74c5c3a49cad629413e38b
SHA5124ccc206b30208cf1ceef1e7341cf7f28e36f3ba90daff5051ee706841a1f30d49d654399c33b2d336d330789b76e5d3fac39d22d6d45d6d76a3ef643750a70cf
-
Filesize
23KB
MD5351865b759999ab60da018c38878662d
SHA12c6d09dfe7a95f78af5b27d0ffab491ca47dc2e5
SHA256cfc8576cd3f50e93ead20e4a08cb1623e95cd928e5afcbaab9ad8ec1eba2528d
SHA5127e329b5072fe7eb47871368a357643a4ec59576c0c7dfd2a48b671a33c9fb2fdf24198540ca283797ec2b274946c33f99d10d6b5aa5174872369aa5b58677f3b
-
Filesize
16KB
MD5e7120b5779730efb615235cf0107e386
SHA1455ea9f216bbfcd1876f142d7a1b634fd85ef819
SHA256ace34e85a2e954ed07ec11390cbdea7097ae4e56efd8b1bcef35788ce08c6777
SHA51291f893b93d771eb1ac9b9f666561375da5c9a282bf778bca76489306f8aa398fd31bfa59eaeca2f1b1b16a598dc0f5cfa9d3f3d98b0a4cd2ec9fd5539bc3efb3
-
Filesize
364KB
MD5ca95f207ec70ba34b46c785f7bcb5570
SHA125c0d45cb9f94892e2877033d06fe8909e5b9972
SHA2568ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb
SHA512c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831
-
Filesize
561KB
MD55576bf4d22dc695564e49a68cbc98bc2
SHA180e0e045162a65d84939e22a821ecbbbde3f31d6
SHA25620f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801
SHA5124b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972
-
Filesize
48B
MD5d9d2e53e224c2cb063dc6f175e0191af
SHA120efb5a69a2ce00bec8879d0219b2f61b386528e
SHA25626c36b2c02b1ca68b0056c57b00844a5df9b4169f54eeb9f5e3cdba8735fa62d
SHA5125771bf5b08669c1eb8ef21b14e3e05766183b63c5c9bf1e35fe5eb9433e8e7eca2a17af8406912321a983e5b1ed68d1e4493685b7ea76f13544464a53b22fbd2
-
Filesize
48B
MD5eb09dea8b414628f3b0831ff2e129920
SHA19f6f36319e5e8e39a7b5c416f0bfa500335daeea
SHA25624cc00a02df6367bb0f51eef278954c774926c0f3c260b5b301a277e5b630540
SHA51217b639a6e5e657ab1e069fa8c4ba6677dcb38452d7d740092b6d92dc61ed527daf71f63b1a3b5d57e6d0051c0b75fb8668fa07daf790d0d1d6de9110c95e96f5
-
Filesize
104B
MD53f57bb8c61586094b89d49c46a36d765
SHA16d8e833563f5e6af3ed36c7950aa2511eba8a640
SHA256713c628e2662a1ae5ce2aba2255e053590fad2a0a0df95169c41fb92af9dc5ae
SHA51242a19fff375d31da37e16e1bd65f60860ccdf08ac8a73e4ccdaf72c9581f52c4d46d75222ded52c0cc6f4d97c29335323e7f7a53cd8b9136785cfaf4a38dd894
-
Filesize
195KB
MD571c143221c4d2f06e495ee3f9e51a7f0
SHA144a3aa0ca190243d6f21becbd5b0c5e923426135
SHA2568d245ef042215b0e9211692c7deaef442f4d46bd5323d74aa1bf25d676525bd9
SHA51298a97a4f45cb70eb671ddc3c8d26a9a4c3d34745f0d1b6ee052a2080e1b4b3dac11303eb9a0c8d38e34df624edc28864e52f13e4d79bc16fe9223c5663372445
-
Filesize
196KB
MD594fa9ff9c26724e0b8ac910c1e7c40aa
SHA10cf47957200dec349d6b6da432e24165afd590eb
SHA256adae076f90908818d67777c050c5b1b6cc94be728017bab6c638dfc7763d4d09
SHA512becb8229e8ef77a673829c547d2520d6fec94218abf2a21e2948ae5c156bf4a1eb64bfec38653b49902bb31708d9cf770c38f042c1f869d4d4695313b2acfefb
-
Filesize
849KB
MD599dc199a4a390a86f2728f5232a2f9a6
SHA121b03b2dacbc5e19f3334054703ce53c8ba4a15f
SHA25612b9deeb6e80129593bae1439bcbc491c6f602bfff255f72eba627100a54e2f9
SHA5128ba930b0fb37257bbb0d5ea97bbb581ec7d545b737bdce03a78e713b3ad95a2f4b2b6d101817102763100edfe8e46f4532946a7bd3ac24d2142358ac26ec45db
-
Filesize
409KB
MD5e34827bf55cae867e83cc6122d25154a
SHA1e513c23028532a6997692965765e235d42d96efa
SHA2567f8ce80c53a7a4c3cecfbf497ee443538fd126a6e369b9930a3b021db548b55a
SHA512506143a220f58c4236e4736f404c9421b9d5e0caaa21eff950953258ccf783de3534ea702e476acf565719964da6aeaeed787fca2d66c2b8ef5aa51c9b6e38d2
-
Filesize
23.7MB
MD5bd854128d23a6898c8d5fa6a24648442
SHA15ed4822c298e5c1d0c259fe5d59c605f9e7de12b
SHA256de82a963b0debf73a7579e68476b37180e8dbdda20eb7d922711d4001d55e2fb
SHA51298adf491dc448e3d4dfe6e83364038765ab24b65d7c39d5417d803cadc8b7e06f9628b41439f480eb7d79208342e41db098aaf8b869ca7f3f6d6827bb77fdb95
-
\??\Volume{5110105b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{46b6d514-d64a-421a-89bd-fa916e7e7f36}_OnDiskSnapshotProp
Filesize6KB
MD58c7dfdd2d602681e1a8ace99b9542f75
SHA13298de7002e204e7ae9ce495707372ab4af13e02
SHA25616e93499887fb166f06f14fe86ba2b1139ac5e813c7442218a8614b513d210ac
SHA51255d258a94134d62734fa297a9e21c9a208ea9abdf5527dab69d68e2a2ea1b5058a5907db62ee48f60adc5854020fea8eb939fbbf39311e231b1db2d04ef16ea3