gh0strat | 2c12e2073d0b50369b0b10ebbdb8bf8357fbf7cdca3f97b0b84192339b846c25

Resubmissions

19-07-2024 08:22

240719-j929savcmd 6

19-07-2024 08:14

240719-j5fj8a1clk 10

19-07-2024 08:08

240719-j1lknstgpb 6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gooleo.msi
Size

87.8MB
MD5

e651816dd9240300cf9bd9c565e3b869
SHA1

a4bc6e8f6516f3d549195887d7095b9496ae52f9
SHA256

2c12e2073d0b50369b0b10ebbdb8bf8357fbf7cdca3f97b0b84192339b846c25
SHA512

90646a020b0ea67c912f999690382a44f5649c5f3c2a4a7c060aced6a9a71533b92c04d948db8bafd717dd295ad19bb85a71d73ef86a62613e65053323b108b8
SSDEEP

1572864:MKSA0Q9ilL4UxQUoim6casSZrcBsCWpuFg9O/jAaWFFDp+chVF1luEbtYio0z8+U:MbVQ92TQUooc3Uw2F9HHluEbtpoOKd3

Score

10^/10

gh0strat execution persistence privilege_escalation rat upx

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral3/memory/2060-486-0x00000000054B0000-0x0000000005D1F000-memory.dmp	family_gh0strat
behavioral3/memory/4664-663-0x0000000005B90000-0x00000000063FF000-memory.dmp	family_gh0strat
behavioral3/memory/4664-692-0x0000000006400000-0x0000000006C6F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2984-367-0x0000000003350000-0x00000000033DA000-memory.dmp	upx
behavioral3/memory/2060-380-0x00000000031B0000-0x000000000323A000-memory.dmp	upx
behavioral3/memory/2060-382-0x00000000031B0000-0x000000000323A000-memory.dmp	upx
behavioral3/memory/2060-383-0x0000000000F80000-0x0000000000FB3000-memory.dmp	upx
behavioral3/memory/2060-436-0x00000000048D0000-0x000000000513F000-memory.dmp	upx
behavioral3/memory/2060-447-0x00000000054B0000-0x0000000005D1F000-memory.dmp	upx
behavioral3/memory/2060-486-0x00000000054B0000-0x0000000005D1F000-memory.dmp	upx
behavioral3/memory/4664-526-0x00000000021F0000-0x0000000002229000-memory.dmp	upx
behavioral3/memory/4664-529-0x00000000021F0000-0x0000000002229000-memory.dmp	upx
behavioral3/memory/2060-548-0x00000000031B0000-0x000000000323A000-memory.dmp	upx
behavioral3/memory/4664-611-0x00000000021F0000-0x0000000002229000-memory.dmp	upx
behavioral3/memory/4664-613-0x00000000021F0000-0x0000000002229000-memory.dmp	upx
behavioral3/memory/3304-617-0x0000000002150000-0x0000000002189000-memory.dmp	upx
behavioral3/memory/3304-620-0x0000000002150000-0x0000000002189000-memory.dmp	upx
behavioral3/memory/4664-625-0x0000000005B90000-0x00000000063FF000-memory.dmp	upx
behavioral3/memory/4664-626-0x0000000006400000-0x0000000006C6F000-memory.dmp	upx
behavioral3/memory/452-634-0x00000000036E0000-0x000000000376A000-memory.dmp	upx
behavioral3/memory/452-637-0x00000000036E0000-0x000000000376A000-memory.dmp	upx
behavioral3/memory/4664-663-0x0000000005B90000-0x00000000063FF000-memory.dmp	upx
behavioral3/memory/4664-692-0x0000000006400000-0x0000000006C6F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	_QQMusicLW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	_QQMusicLW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	TaskLoad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	_QQMusicLW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	TaskLoad.exe
File opened (read-only)	\??\P:	TaskLoad.exe
File opened (read-only)	\??\L:	TaskLoad.exe
File opened (read-only)	\??\N:	TaskLoad.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	TaskLoad.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	TaskLoad.exe
File opened (read-only)	\??\X:	TaskLoad.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	TaskLoad.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	TaskLoad.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	TaskLoad.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	TaskLoad.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	TaskLoad.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	TaskLoad.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	TaskLoad.exe
File opened (read-only)	\??\O:	TaskLoad.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	TaskLoad.exe
File opened (read-only)	\??\H:	TaskLoad.exe
File opened (read-only)	\??\V:	TaskLoad.exe
File opened (read-only)	\??\K:	TaskLoad.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\xfhUOHW2sb.exe	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\WS_Log.dll	MsiExec.exe
File opened for modification	C:\Program Files\Windows Defenderr\xfhUOHW2sb\WS_Log.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\FourierTransformLib8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\ImageRestoreLib8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\wavelet_3_8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\dll1.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfhUOHW2sb\libcef.dll	MsiExec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58368c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58368c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3824.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AC5.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}	msiexec.exe
File created	C:\Windows\Installer\{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}\PublicDocumentsFolderappR_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}\PublicDocumentsFolderappR_1.exe	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
2984	xfhUOHW2sb.exe
2060	TaskLoad.exe
4664	_QQMusicLW.exe
3304	_QQMusicLW.exe
452	TaskLoad.exe

Loads dropped DLL 25 IoCs

pid	Process
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
4040	MsiExec.exe
4040	MsiExec.exe
4040	MsiExec.exe
2984	xfhUOHW2sb.exe
2984	xfhUOHW2sb.exe
2984	xfhUOHW2sb.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
4664	_QQMusicLW.exe
4664	_QQMusicLW.exe
4664	_QQMusicLW.exe
3304	_QQMusicLW.exe
3304	_QQMusicLW.exe
3304	_QQMusicLW.exe
452	TaskLoad.exe
452	TaskLoad.exe
452	TaskLoad.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2676	Powershell.exe
2408	Powershell.exe
1356	Powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
4108	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	2984	WerFault.exe	108

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000016567182641f7ceb0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000165671820000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090016567182000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d16567182000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001656718200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TaskLoad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TaskLoad.exe

Kills process with taskkill 35 IoCs

evasion

pid	Process
1224	taskkill.exe
2504	taskkill.exe
2004	taskkill.exe
5036	taskkill.exe
3080	taskkill.exe
1764	taskkill.exe
3880	taskkill.exe
4576	taskkill.exe
2372	taskkill.exe
556	taskkill.exe
2248	taskkill.exe
2540	taskkill.exe
3520	taskkill.exe
3000	taskkill.exe
1224	taskkill.exe
4484	taskkill.exe
3288	taskkill.exe
2172	taskkill.exe
1948	taskkill.exe
4196	taskkill.exe
3644	taskkill.exe
4560	taskkill.exe
468	taskkill.exe
3556	taskkill.exe
3308	taskkill.exe
3804	taskkill.exe
3288	taskkill.exe
4916	taskkill.exe
3520	taskkill.exe
840	taskkill.exe
720	taskkill.exe
2576	taskkill.exe
3896	taskkill.exe
2432	taskkill.exe
4144	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	_QQMusicLW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\V\ver = "C:\\Testoutput\\TestMove"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000063b196db4d9da01	_QQMusicLW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Wskcmqgamuikkc	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\S	TaskLoad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 5d54a9a2c2a0b4429708a0b2badd77c87d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	_QQMusicLW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 5d54a9a2c2a0b4429708a0b2badd77c87d0000006024b221ea3a6910a2dc08002b30309dbc0000000114020000000000c0000000000000463302000000000000000000000000000000000000000000000000000000000000000000000000000000000000	_QQMusicLW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	_QQMusicLW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\V\sion = "Main"	_QQMusicLW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\KeyNamereg = "KeyValue"	TaskLoad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	_QQMusicLW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000063b196db4d9da01	_QQMusicLW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\S\sion = "Main"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\KeyName = "KeyValue"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop	_QQMusicLW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1856	msiexec.exe
1856	msiexec.exe
2984	xfhUOHW2sb.exe
2984	xfhUOHW2sb.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe
2060	TaskLoad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4108	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4108	msiexec.exe
Token: SeSecurityPrivilege	1856	msiexec.exe
Token: SeCreateTokenPrivilege	4108	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4108	msiexec.exe
Token: SeLockMemoryPrivilege	4108	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4108	msiexec.exe
Token: SeMachineAccountPrivilege	4108	msiexec.exe
Token: SeTcbPrivilege	4108	msiexec.exe
Token: SeSecurityPrivilege	4108	msiexec.exe
Token: SeTakeOwnershipPrivilege	4108	msiexec.exe
Token: SeLoadDriverPrivilege	4108	msiexec.exe
Token: SeSystemProfilePrivilege	4108	msiexec.exe
Token: SeSystemtimePrivilege	4108	msiexec.exe
Token: SeProfSingleProcessPrivilege	4108	msiexec.exe
Token: SeIncBasePriorityPrivilege	4108	msiexec.exe
Token: SeCreatePagefilePrivilege	4108	msiexec.exe
Token: SeCreatePermanentPrivilege	4108	msiexec.exe
Token: SeBackupPrivilege	4108	msiexec.exe
Token: SeRestorePrivilege	4108	msiexec.exe
Token: SeShutdownPrivilege	4108	msiexec.exe
Token: SeDebugPrivilege	4108	msiexec.exe
Token: SeAuditPrivilege	4108	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4108	msiexec.exe
Token: SeChangeNotifyPrivilege	4108	msiexec.exe
Token: SeRemoteShutdownPrivilege	4108	msiexec.exe
Token: SeUndockPrivilege	4108	msiexec.exe
Token: SeSyncAgentPrivilege	4108	msiexec.exe
Token: SeEnableDelegationPrivilege	4108	msiexec.exe
Token: SeManageVolumePrivilege	4108	msiexec.exe
Token: SeImpersonatePrivilege	4108	msiexec.exe
Token: SeCreateGlobalPrivilege	4108	msiexec.exe
Token: SeCreateTokenPrivilege	4108	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4108	msiexec.exe
Token: SeLockMemoryPrivilege	4108	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4108	msiexec.exe
Token: SeMachineAccountPrivilege	4108	msiexec.exe
Token: SeTcbPrivilege	4108	msiexec.exe
Token: SeSecurityPrivilege	4108	msiexec.exe
Token: SeTakeOwnershipPrivilege	4108	msiexec.exe
Token: SeLoadDriverPrivilege	4108	msiexec.exe
Token: SeSystemProfilePrivilege	4108	msiexec.exe
Token: SeSystemtimePrivilege	4108	msiexec.exe
Token: SeProfSingleProcessPrivilege	4108	msiexec.exe
Token: SeIncBasePriorityPrivilege	4108	msiexec.exe
Token: SeCreatePagefilePrivilege	4108	msiexec.exe
Token: SeCreatePermanentPrivilege	4108	msiexec.exe
Token: SeBackupPrivilege	4108	msiexec.exe
Token: SeRestorePrivilege	4108	msiexec.exe
Token: SeShutdownPrivilege	4108	msiexec.exe
Token: SeDebugPrivilege	4108	msiexec.exe
Token: SeAuditPrivilege	4108	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4108	msiexec.exe
Token: SeChangeNotifyPrivilege	4108	msiexec.exe
Token: SeRemoteShutdownPrivilege	4108	msiexec.exe
Token: SeUndockPrivilege	4108	msiexec.exe
Token: SeSyncAgentPrivilege	4108	msiexec.exe
Token: SeEnableDelegationPrivilege	4108	msiexec.exe
Token: SeManageVolumePrivilege	4108	msiexec.exe
Token: SeImpersonatePrivilege	4108	msiexec.exe
Token: SeCreateGlobalPrivilege	4108	msiexec.exe
Token: SeCreateTokenPrivilege	4108	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4108	msiexec.exe
Token: SeLockMemoryPrivilege	4108	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4108	msiexec.exe
4108	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2412	1856	msiexec.exe	85
PID 1856 wrote to memory of 2412	1856	msiexec.exe	85
PID 1856 wrote to memory of 2412	1856	msiexec.exe	85
PID 1856 wrote to memory of 3876	1856	msiexec.exe	103
PID 1856 wrote to memory of 3876	1856	msiexec.exe	103
PID 1856 wrote to memory of 4040	1856	msiexec.exe	105
PID 1856 wrote to memory of 4040	1856	msiexec.exe	105
PID 1856 wrote to memory of 4040	1856	msiexec.exe	105
PID 1856 wrote to memory of 1292	1856	msiexec.exe	106
PID 1856 wrote to memory of 1292	1856	msiexec.exe	106
PID 1856 wrote to memory of 1292	1856	msiexec.exe	106
PID 1292 wrote to memory of 2984	1292	MsiExec.exe	108
PID 1292 wrote to memory of 2984	1292	MsiExec.exe	108
PID 1292 wrote to memory of 2984	1292	MsiExec.exe	108
PID 2984 wrote to memory of 2060	2984	xfhUOHW2sb.exe	109
PID 2984 wrote to memory of 2060	2984	xfhUOHW2sb.exe	109
PID 2984 wrote to memory of 2060	2984	xfhUOHW2sb.exe	109
PID 2060 wrote to memory of 2676	2060	TaskLoad.exe	114
PID 2060 wrote to memory of 2676	2060	TaskLoad.exe	114
PID 2060 wrote to memory of 2676	2060	TaskLoad.exe	114
PID 2060 wrote to memory of 4664	2060	TaskLoad.exe	116
PID 2060 wrote to memory of 4664	2060	TaskLoad.exe	116
PID 2060 wrote to memory of 4664	2060	TaskLoad.exe	116
PID 4664 wrote to memory of 3304	4664	_QQMusicLW.exe	117
PID 4664 wrote to memory of 3304	4664	_QQMusicLW.exe	117
PID 4664 wrote to memory of 3304	4664	_QQMusicLW.exe	117
PID 2060 wrote to memory of 452	2060	TaskLoad.exe	118
PID 2060 wrote to memory of 452	2060	TaskLoad.exe	118
PID 2060 wrote to memory of 452	2060	TaskLoad.exe	118
PID 4664 wrote to memory of 1244	4664	_QQMusicLW.exe	119
PID 4664 wrote to memory of 1244	4664	_QQMusicLW.exe	119
PID 4664 wrote to memory of 1244	4664	_QQMusicLW.exe	119
PID 4664 wrote to memory of 1400	4664	_QQMusicLW.exe	120
PID 4664 wrote to memory of 1400	4664	_QQMusicLW.exe	120
PID 4664 wrote to memory of 1400	4664	_QQMusicLW.exe	120
PID 4664 wrote to memory of 4576	4664	_QQMusicLW.exe	121
PID 4664 wrote to memory of 4576	4664	_QQMusicLW.exe	121
PID 4664 wrote to memory of 4576	4664	_QQMusicLW.exe	121
PID 4664 wrote to memory of 2984	4664	_QQMusicLW.exe	122
PID 4664 wrote to memory of 2984	4664	_QQMusicLW.exe	122
PID 4664 wrote to memory of 2984	4664	_QQMusicLW.exe	122
PID 4664 wrote to memory of 2004	4664	_QQMusicLW.exe	123
PID 4664 wrote to memory of 2004	4664	_QQMusicLW.exe	123
PID 4664 wrote to memory of 2004	4664	_QQMusicLW.exe	123
PID 4664 wrote to memory of 1356	4664	_QQMusicLW.exe	125
PID 4664 wrote to memory of 1356	4664	_QQMusicLW.exe	125
PID 4664 wrote to memory of 1356	4664	_QQMusicLW.exe	125
PID 4664 wrote to memory of 2408	4664	_QQMusicLW.exe	127
PID 4664 wrote to memory of 2408	4664	_QQMusicLW.exe	127
PID 4664 wrote to memory of 2408	4664	_QQMusicLW.exe	127
PID 4664 wrote to memory of 2172	4664	_QQMusicLW.exe	129
PID 4664 wrote to memory of 2172	4664	_QQMusicLW.exe	129
PID 4664 wrote to memory of 2172	4664	_QQMusicLW.exe	129
PID 4664 wrote to memory of 5036	4664	_QQMusicLW.exe	131
PID 4664 wrote to memory of 5036	4664	_QQMusicLW.exe	131
PID 4664 wrote to memory of 5036	4664	_QQMusicLW.exe	131
PID 4664 wrote to memory of 3080	4664	_QQMusicLW.exe	133
PID 4664 wrote to memory of 3080	4664	_QQMusicLW.exe	133
PID 4664 wrote to memory of 3080	4664	_QQMusicLW.exe	133
PID 4664 wrote to memory of 2248	4664	_QQMusicLW.exe	135
PID 4664 wrote to memory of 2248	4664	_QQMusicLW.exe	135
PID 4664 wrote to memory of 2248	4664	_QQMusicLW.exe	135
PID 4664 wrote to memory of 3880	4664	_QQMusicLW.exe	137
PID 4664 wrote to memory of 3880	4664	_QQMusicLW.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gooleo.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8632C8B255610776B7D44C2135189544 C
  2⤵
  - Loads dropped DLL
  PID:2412
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BDF4F736FEB1716E9167258097437739
  2⤵
  - Loads dropped DLL
  PID:4040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7A4A1A2FCF6F59B2CE829A531BEDE1EE E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Program Files\Windows Defenderr\xfhUOHW2sb\xfhUOHW2sb.exe
    "C:\Program Files\Windows Defenderr\xfhUOHW2sb\xfhUOHW2sb.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Public\Documents\TaskLoad.exe
      C:\Users\Public\Documents\TaskLoad.exe
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        
        PID:2676
    - - C:\ProgramData\{23E67W23C87Q-3Q7C3L7Z-2P6L3B8G-3Z7D2G7I}\_QQMusicLW.exe
        
        "C:\ProgramData\{23E67W23C87Q-3Q7C3L7Z-2P6L3B8G-3Z7D2G7I}\_QQMusicLW.exe"
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - C:\ProgramData\{23E67W23C87Q-3Q7C3L7Z-2P6L3B8G-3Z7D2G7I}\_QQMusicLW.exe
        
        "C:\ProgramData\{23E67W23C87Q-3Q7C3L7Z-2P6L3B8G-3Z7D2G7I}\_QQMusicLW.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3304
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Modifies data under HKEY_USERS
        
        PID:1244
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        
        PID:1400
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Modifies data under HKEY_USERS
        
        PID:4576
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        
        PID:2984
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2004
      - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        
        PID:1356
      - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        
        PID:2408
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2172
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:5036
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3080
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2248
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3880
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3556
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4576
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4560
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2540
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1948
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3308
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4196
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2576
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3644
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1224
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3804
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3896
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1764
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2372
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3520
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3288
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2432
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4144
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4916
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:4484
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:840
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1224
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:468
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3520
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3288
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:720
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2504
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:3000
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:556
    - - C:\Users\Public\Documents\TaskLoad.exe
        
        "C:\Users\Public\Documents\TaskLoad.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 636
      4⤵
      Program crash
      PID:4560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2984 -ip 2984
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58368d.rbs

Filesize
52KB

MD5
c8558f23daceffe45024cac2a0f3a783

SHA1
498acca5641fa77afff1bd6e99fb7ac60bfcf26f

SHA256
722c36ab0a9405b9e735dd122b28a5182d7bbbcb1dd796bc73d30001e2623c9b

SHA512
ac6ea4c8431a732b3a703fe50c8dfb344612801da89b9e63d265ba51d9fd71e0afbfbee574dd2ed4b1252a3e7af1b55b75d8bd21cecfcd6874dfc5d8c8a58cd7

Download Submit
C:\Config.Msi\e58368e.rbf

Filesize
2KB

MD5
946f1eb75182d5df6ff55aa7fe628205

SHA1
c6cd8849bf97e9f90770a9b5a9339e8a336bdba7

SHA256
1c3f570cdafc7ece099def2c768a21419d2d8b100e87b10be77affa4600f54ca

SHA512
74ef4405c41ed35b82bdc4cd39a1f6e8af83370c1534bb4073d7a2696718a3bc91b6c3a71de58f9670834a2683086f2d8a9a1ae30d165e1b6d02482bc5ef0ded

Download Submit
C:\ProgramData\1

Filesize
2.0MB

MD5
faf4a129b091a57c3ff694dc721d4f3b

SHA1
7430935f501164b46b99766ed9ab68da0db50c24

SHA256
b1d13ed7409ca47f47d200f6b26d8da6a07e645ef49ddc9a28486f46bb8c41e7

SHA512
0103d9bfa27c809f978a2ac805e5eb59e07f0f0eef8aecf2713d8af1bff0d54fbc24043435cb67f550d5afdd6f0a2bc5c0026b6e920efe2ad21b619bbfbb0583

Download Submit
C:\ProgramData\11

Filesize
84KB

MD5
97a2b445c8eac7f3b1edd94d67d2e768

SHA1
6c1ec795b0abf5fc8b9e4189f87a425624a28dc5

SHA256
452b3537cc4fc77acd5821ecdd33ae372e460a7b571f708fd91a6258d69c0149

SHA512
3d1eb3d8b1c56ae5b8d5c82380af4544457bc40c9fc6d6fbbdafc8b4f3d53fda2cbddad5aa983a207a708c596da2f00c1c7305093d3b575f6405d8dd064600a5

Download Submit
C:\ProgramData\12

Filesize
92KB

MD5
e61e00f904f561ec9e6574ddec3bb65a

SHA1
6458b901d065848b44988bff89b8e7933a43d7fc

SHA256
25bff93e68ed9086a8effd7c79e01fca7d3ab228b158acd57ebf583d0054e364

SHA512
06ee9b0b36de98cceafa938cab3f6523be42a869d4e28ffbb1dcbdcee363eeedbf320923653cc90450d0fb8d14cbaf74768acbe78c7177747f2a637103d043ac

Download Submit
C:\ProgramData\15

Filesize
978KB

MD5
8e945aaf7128bb3db83e51f3c2356637

SHA1
bcc64335efc63cb46e14cc330e105520391e2b00

SHA256
4fcf6394b14e24d830b04209a0ede1dcc911d199740a55d12c8ab8aeabb84073

SHA512
150636eea0cab3e738f5e94ae910d189622fa3221aca1cecc05bf0f5a80f2fab055adeafd99eab7a2a1d3911ff2784cf521a2681e5ddf7737f4363b915b8c2a8

Download Submit
C:\ProgramData\2

Filesize
80KB

MD5
b874ff17621f408640d95b411e573e55

SHA1
9abd7ec752fabc0b2266ca8b80ba8750a235e910

SHA256
3aee565192cd07dde0f38bcde06bad6de492049bcfd2c99e0fcb8cc3fc9b23ac

SHA512
62f81ebd60e134c95612d9dfa5e222a1bdd258d21a33f6ab3e02d7de7bba82b8b5b0177e44592748a3b0e262a18b8c74f50e5e8e6f3772e858843456d9d1469b

Download Submit
C:\ProgramData\4

Filesize
340KB

MD5
7daf9edc6f8f2b2b69bb9367cb99abbd

SHA1
ad05e73f713758350db5f7d6a283f0132a7fd47c

SHA256
2f3c6b44e994efb2f4e8edf5801580df5c74c7984287b62e0602af3c6818e81b

SHA512
dd48bd1a2578239b3820e32cf64fe50181b0e3ac75d8aa881d44424104c1ea251d1f996299f5a651bc58caed40f54c91d318a926e37c17655f592315ac56f16b

Download Submit
C:\ProgramData\YYcecccccdbe.ini

Filesize
56B

MD5
7ce2216b4527ad40a5c9e8b9cfab454b

SHA1
9f2cf1df7eef763bc1194a833f713ade077e35e9

SHA256
149d6fda62fe7fc624d959a8794ff5e6cc1fdbb720d4d2280a810e8067ccfcb0

SHA512
148a2c38c5ea7f229692a57783a70930a97ec4b006048d5cb45accf78e13b7318477b1b3c798d2db6cb194e88e2c9f9c61eaa6cec155d07632e0302be1d8a647

Download Submit
C:\ProgramData\a10

Filesize
36KB

MD5
f0284892937a97caa61afcd3b6ddb6d4

SHA1
f3c308e7e4aaa96919882994cdd21cc9f939cabd

SHA256
2514913f8a6f4671a058304651289b0babe47d81c044212b3140ed1c1b643b09

SHA512
058845e0a9a5892a69f24f3a77086e3f9546493ad40a0e5359aed05cf8882a9f3d7aee0449648d5cb76e51530af3e46af59a9b196cc92318334116c92dde4171

Download Submit
C:\ProgramData\a3

Filesize
14B

MD5
0d59c87827537cdd7727d1f0e4d6cce4

SHA1
6067300c20740cf2899d519382f36c453d9b7fca

SHA256
270a9ca2cc8d07c58e43466e95a8aedc7bde468b7b5c0c37845cad5f0d2ab6d2

SHA512
324aca54d36574f1a3d7ade872bc5d4bca8b6ae78817cefcf6fe74af51e90f67a808757eb3c84d65c2a8c8e0322cad8b30c83f29e0011c374fd114122ae92d7a

Download Submit
C:\ProgramData\a5

Filesize
56B

MD5
6f10d76e583b39191028ab57f8edbed9

SHA1
fbaa6e99f3a88d1e4cd606ca45debed661135c1d

SHA256
847f6e3577892365fadc94648eabdde48b9660590ba109e8387a9cb984aee476

SHA512
17a2f133b321fb9ac992e03da4ada3b3e5f1e507c7656d287ea00efddc50885c9ea9f337dd6b8cd52015060b4f0f4fc7832a7a3603ed5a3b498d8da47916743c

Download Submit
C:\ProgramData\a6

Filesize
200KB

MD5
078c21b8c91b86999427aa349cf5decf

SHA1
b939376eaebcf6994890db24ddcb2380c1925188

SHA256
ed2c6bc3e77a404b8cf61176844ad19c1fdcae19881206631e3f0831a4bd919a

SHA512
a006a36fdcaf4c2403238475163553ba2fe7783fea200f28df46ea980a3907d2b24c854153b45b730195a133fcb28f60c157f33c865ea286ad8c354981cf5885

Download Submit
C:\ProgramData\a7

Filesize
497KB

MD5
c8cf4eb512fadb813f69c3184e4bf44d

SHA1
492576912c7c0a224881ea45035a4a9270cd44f2

SHA256
678b89a2ca82b0b7803e36601bd6216c7687c4102de7071676390f2c252cb1fb

SHA512
006665dcf7cd8ad83f8b5c06c2ec9367ee8caa01c3c1cb9502bd540ac9940d103b84f6620ef8b5aa8e78fbe268994c0d8da5fa7ba550e1c8bd038fd1e43d39dc

Download Submit
C:\ProgramData\a8

Filesize
21KB

MD5
da08e194f9a7045dbb19f6e5d5d7f609

SHA1
7884062382bf1e7911f7e74198ca9fecec159c61

SHA256
9bd52ec7e7750500de33df995fcc7e68ed1da70d125579cf76ae8f787577ef75

SHA512
46720cd0677064b00a9e253953b8b6cd5141a99d0090ff0d7c4a24b830ca621878bcdfec3c56880f940662bd78f408782231bdd3cb370e06dadfee71e3e2b2b0

Download Submit
C:\ProgramData\a9

Filesize
13KB

MD5
37aa892a6f35bcbe9b01f0a424f5d4f6

SHA1
e5d60e43a8e0a4b7371bd736e21b1a59546774af

SHA256
6feeb95115d7d8a51403996fee1ad219a52151662d3a01a2d17cfb77dbd51f3b

SHA512
a5d5ac494cba18bb5b2582310416dc2e146732ba4f2eddab6611393d61ac0ae839bacae0da1e85f0965575e6d6284b1180e2e3adb924f1e19d2d7586d2abbd83

Download Submit
C:\ProgramData\{23E67W23C87Q-3Q7C3L7Z-2P6L3B8G-3Z7D2G7I}\QQMusic.dll

Filesize
92KB

MD5
3c99d99f288e5a9268f433993d17b235

SHA1
4e35aa2f729d1d1d82a75793a8d68e0ff5f2b180

SHA256
87772b03954d1d77c2667646a7a77d83719b714479df4e436b454192015eddb1

SHA512
239b4d0657c0fc631200a2a27f0f63e15af3823b39c3f14c2ca45e4e92c32ba998b334eee557466a1122e982fa104ce449ae946c4c1734b685c3c671473e6283

Download Submit
C:\ProgramData\{23E67W23C87Q-3Q7C3L7Z-2P6L3B8G-3Z7D2G7I}\vcruntime140.dll

Filesize
78KB

MD5
1b171f9a428c44acf85f89989007c328

SHA1
6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

SHA256
9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

SHA512
99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9F1E.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j11qnfjx.osd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\_2

Filesize
362KB

MD5
1b6bc40c6c5fbd9032ee3779057efe86

SHA1
9fa7737b2c1d792ee76b587cece5b7831e684b11

SHA256
b163b5e667bcaac3c682940889abd56280983ee2c5936924e1182aa80f867f87

SHA512
295603b80684fee2b646048392398fc3a4f4f58f6fbbcbc1dbe76819bd5a4cc5cdc0f2ed9374334babf23928448fc38b154c115a07646fe278481cb921028703

Download Submit
C:\Users\Admin\AppData\Local\_2.DLL

Filesize
344KB

MD5
27bfaff47dce732f5e1bada41b756612

SHA1
33efd88e7ce656e01939b48ad2ff513fa29b9699

SHA256
ab27ae2fa1ee803f1d7269b674a4825ef7f70badfe8b9e7456b2ce6235fe9b56

SHA512
057ce5a8e47a59ec2d98581bb5e6568c2968709c87adcb7aa761cfa0ff07ea1706ca74f4c0fffef0eb92cdfdadf6dafa8664e3c69ed9d94deb423a1b0b6c1da1

Download Submit
C:\Users\Admin\AppData\Roaming\Consys21.png

Filesize
319KB

MD5
059afc1c343329409574a6e7a2952246

SHA1
9a5c2c1e8ef822907a58732d674194e2ae89d52c

SHA256
6cb8d7f52b605312920ef6dd7cc17e72a291d924a967b924ccf81dd118d7f8e4

SHA512
bc847cf20d009a5e7560f040978447817b3c6ca4a94e255c824b0820ab4fbcc1edca818b19d754a5b062236a25966fabb5d52f11abf5cbe5bc5936d9abe8fd06

Download Submit
C:\Users\Admin\AppData\Roaming\apple\Runlnk.lnk

Filesize
854B

MD5
a2bfeb3ba4879bd61b20ac5d9865dc79

SHA1
395aa3a98634ceab03e37d30a7ab84a54623c78f

SHA256
a05185740c597b99fc3768a02a095c97cfc4a52ebe892d9d8b61493959ad1951

SHA512
1016222486c08c28b555473a1276b684dcb1355274722e42d6c3427893167792283b151e3d4687422eec9b9895e3cf2a2a02c547714748b36831eb785ba74133

Download Submit
C:\Users\Admin\AppData\Roaming\chormeui\chomeui.exe

Filesize
1.3MB

MD5
84ba3c0d3d383c2676810494a7b5d4d4

SHA1
51dc4edee8e6d061dddf557861655079bb568308

SHA256
1dce1e3cef651f20cad4f096997407db5b5837b60a52b0abb8ad4c087b6a02e0

SHA512
6246e29c25c45258a2f244cb31991202d1b57e9309521296787b90d1662b3e9dd14d27cdd5557fbab39b66e18bbb63c9bf346091d0bf2dcfc798745ce030d079

Download Submit
C:\Users\Admin\AppData\Roaming\install.ini

Filesize
47B

MD5
c6b92dd6631be4719db3e258fc834151

SHA1
17e2de7b48bb373705e44c50c0e70f435743860e

SHA256
1e170289b158d70bff755b7d4f842833dd139afce297ae581b11a93cc2c52681

SHA512
841d7aae253d7efa8db7e1ce210aa1a4cfc55e251b5905ef08f0a64a68f643558e69f10a7a95bdb0124483056a676d7a2536a32c491169e78f32f7e8819be227

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\dataimporter.dll

Filesize
108KB

MD5
32c4e9c809fd633ce8e661c003e4cbec

SHA1
1b9b6c7d78bf69397648ef30697366a7d83af487

SHA256
2af34e5ddf1c38783ab319e1320a7f40f526d66c45e910a0f906fab6c2eb7dba

SHA512
dffd43ca0326b4e501ee0586ab795e7196e2f11c3bbf212a367477174c4877b32a1677b5240976c93f45a065df77989f686597bda6a3bc414931617f4729419c

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

Filesize
623KB

MD5
d9746c8d55bed7b372ccef704f96ddda

SHA1
61c6b8ba9108fc7617264bb7d58e163457946e5b

SHA256
afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd

SHA512
e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

Download Submit
C:\Verifier\YaKGYE

Filesize
96KB

MD5
6103dbe823a015788397731babc5e4ee

SHA1
2cecbdaff319322365fa2b0a87d191e185d73e4a

SHA256
37e0a8caa6c3b65799690bd9f655ede1eb476f00410f6021c14d1138e01aa7b7

SHA512
62d5bf0481a69c7403290b0b37d6a36dd9645a659b7c00e50fc494b2fad99fb06fa2dfb93a9e716271b156f2f3c27bbbe84d4e95a59a8071cfbfa3e44b31ba5d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
ecd98f710ebb76db957efbcb58a96c6e

SHA1
6635dd5e5583dc6fcb4c28a900b6a5899f7b694e

SHA256
a422f329f19a80846e0180491028f540ac97ef3bf199669bf7967d5014315818

SHA512
72ccd1a34037501a37c031c7977432810ff862eac8ebf316a866ae7be9aa2d484b93d35f95455ffcb0f8e9716b3c9d1752bca1f1c906c9597a6a9f93b814a54f

Download Submit
\??\Volume{82715616-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{37d18af0-b7ab-41d4-912e-5dc97acc3b9e}_OnDiskSnapshotProp

Filesize
6KB

MD5
8b8b03fa842bea368b9d50cbe836fa8a

SHA1
be6ff0982655cb6a48b64266b22ea0a9027fa506

SHA256
61963d902ca30e68373b946da97c6b23957b9408d938e5e673231a54b137525d

SHA512
898161efdee36f890373d2e091c5452147683d56e1fb86178e759e342f43f0c9f7b4ccb9cd3b30d68bb01cb9458d84f32f9f158ebd75853f6854b064303c6416

Download Submit
memory/452-634-0x00000000036E0000-0x000000000376A000-memory.dmp

Filesize
552KB

Download
memory/452-637-0x00000000036E0000-0x000000000376A000-memory.dmp

Filesize
552KB

Download
memory/1356-723-0x0000000006F10000-0x0000000006FB3000-memory.dmp

Filesize
652KB

Download
memory/1356-735-0x0000000007240000-0x0000000007254000-memory.dmp

Filesize
80KB

Download
memory/1356-734-0x0000000007200000-0x0000000007211000-memory.dmp

Filesize
68KB

Download
memory/1356-702-0x0000000005780000-0x0000000005AD4000-memory.dmp

Filesize
3.3MB

Download
memory/1356-713-0x00000000737B0000-0x00000000737FC000-memory.dmp

Filesize
304KB

Download
memory/1356-712-0x0000000005D10000-0x0000000005D5C000-memory.dmp

Filesize
304KB

Download
memory/2060-380-0x00000000031B0000-0x000000000323A000-memory.dmp

Filesize
552KB

Download
memory/2060-382-0x00000000031B0000-0x000000000323A000-memory.dmp

Filesize
552KB

Download
memory/2060-447-0x00000000054B0000-0x0000000005D1F000-memory.dmp

Filesize
8.4MB

Download
memory/2060-383-0x0000000000F80000-0x0000000000FB3000-memory.dmp

Filesize
204KB

Download
memory/2060-436-0x00000000048D0000-0x000000000513F000-memory.dmp

Filesize
8.4MB

Download
memory/2060-486-0x00000000054B0000-0x0000000005D1F000-memory.dmp

Filesize
8.4MB

Download
memory/2060-548-0x00000000031B0000-0x000000000323A000-memory.dmp

Filesize
552KB

Download
memory/2408-724-0x00000000737B0000-0x00000000737FC000-memory.dmp

Filesize
304KB

Download
memory/2676-512-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/2676-623-0x00000000073D0000-0x00000000073EA000-memory.dmp

Filesize
104KB

Download
memory/2676-551-0x0000000073340000-0x000000007338C000-memory.dmp

Filesize
304KB

Download
memory/2676-561-0x0000000006330000-0x000000000634E000-memory.dmp

Filesize
120KB

Download
memory/2676-550-0x0000000006D60000-0x0000000006D92000-memory.dmp

Filesize
200KB

Download
memory/2676-562-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Filesize
652KB

Download
memory/2676-564-0x00000000076D0000-0x0000000007D4A000-memory.dmp

Filesize
6.5MB

Download
memory/2676-565-0x0000000007090000-0x00000000070AA000-memory.dmp

Filesize
104KB

Download
memory/2676-566-0x0000000007100000-0x000000000710A000-memory.dmp

Filesize
40KB

Download
memory/2676-595-0x0000000007310000-0x00000000073A6000-memory.dmp

Filesize
600KB

Download
memory/2676-596-0x0000000007290000-0x00000000072A1000-memory.dmp

Filesize
68KB

Download
memory/2676-509-0x0000000002790000-0x00000000027C6000-memory.dmp

Filesize
216KB

Download
memory/2676-510-0x0000000004EC0000-0x00000000054E8000-memory.dmp

Filesize
6.2MB

Download
memory/2676-511-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

Filesize
136KB

Download
memory/2676-513-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download
memory/2676-621-0x00000000072C0000-0x00000000072CE000-memory.dmp

Filesize
56KB

Download
memory/2676-622-0x00000000072D0000-0x00000000072E4000-memory.dmp

Filesize
80KB

Download
memory/2676-523-0x0000000005780000-0x0000000005AD4000-memory.dmp

Filesize
3.3MB

Download
memory/2676-624-0x00000000073B0000-0x00000000073B8000-memory.dmp

Filesize
32KB

Download
memory/2676-525-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/2676-524-0x0000000005D70000-0x0000000005D8E000-memory.dmp

Filesize
120KB

Download
memory/2984-367-0x0000000003350000-0x00000000033DA000-memory.dmp

Filesize
552KB

Download
memory/3304-535-0x00000000020B0000-0x0000000002106000-memory.dmp

Filesize
344KB

Download
memory/3304-617-0x0000000002150000-0x0000000002189000-memory.dmp

Filesize
228KB

Download
memory/3304-620-0x0000000002150000-0x0000000002189000-memory.dmp

Filesize
228KB

Download
memory/4664-626-0x0000000006400000-0x0000000006C6F000-memory.dmp

Filesize
8.4MB

Download
memory/4664-692-0x0000000006400000-0x0000000006C6F000-memory.dmp

Filesize
8.4MB

Download
memory/4664-625-0x0000000005B90000-0x00000000063FF000-memory.dmp

Filesize
8.4MB

Download
memory/4664-529-0x00000000021F0000-0x0000000002229000-memory.dmp

Filesize
228KB

Download
memory/4664-663-0x0000000005B90000-0x00000000063FF000-memory.dmp

Filesize
8.4MB

Download
memory/4664-613-0x00000000021F0000-0x0000000002229000-memory.dmp

Filesize
228KB

Download
memory/4664-611-0x00000000021F0000-0x0000000002229000-memory.dmp

Filesize
228KB

Download
memory/4664-507-0x0000000002240000-0x0000000002296000-memory.dmp

Filesize
344KB

Download
memory/4664-526-0x00000000021F0000-0x0000000002229000-memory.dmp

Filesize
228KB

Download