1b9e17bfbd292075956cc2006983f91e17aed94ebbb0fb370bf83d23b14289fa

General

Target

DLPAgent.msi
Size

2.1MB
MD5

d75db138a6519ace7795ba35ea62a498
SHA1

dc8ec40f846dd55be5661d43a80acb4d442f6cd3
SHA256

1b9e17bfbd292075956cc2006983f91e17aed94ebbb0fb370bf83d23b14289fa
SHA512

eeef3b0620cfbd332110b8123e2548b8b6a6b4d2259932463755aae2569440a8807eed7a5b5274b9bb01cde7604bc7aeb560b606609d7fc885cd97621c9106c1
SSDEEP

49152:56s3YhW8zBQSc0ZnSKSZKumZr7AKMLQanYBQDpridgYaU:HYY0ZnQK/AvL8BpgPU

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

rundll32.exe

flow	pid	process
2	3064	rundll32.exe
3	3064	rundll32.exe
4	3064	rundll32.exe
5	3064	rundll32.exe
8	3064	rundll32.exe
9	3064	rundll32.exe
10	3064	rundll32.exe
11	3064	rundll32.exe
12	3064	rundll32.exe
13	3064	rundll32.exe
14	3064	rundll32.exe
15	3064	rundll32.exe
16	3064	rundll32.exe
17	3064	rundll32.exe
18	3064	rundll32.exe
19	3064	rundll32.exe
20	3064	rundll32.exe
21	3064	rundll32.exe
22	3064	rundll32.exe
23	3064	rundll32.exe
24	3064	rundll32.exe
25	3064	rundll32.exe
26	3064	rundll32.exe
28	3064	rundll32.exe
29	3064	rundll32.exe
30	3064	rundll32.exe
31	3064	rundll32.exe
32	3064	rundll32.exe
33	3064	rundll32.exe
35	3064	rundll32.exe
36	3064	rundll32.exe
37	3064	rundll32.exe
38	3064	rundll32.exe
39	3064	rundll32.exe
40	3064	rundll32.exe
41	3064	rundll32.exe
42	3064	rundll32.exe
43	3064	rundll32.exe
44	3064	rundll32.exe
45	3064	rundll32.exe
46	3064	rundll32.exe
47	3064	rundll32.exe
48	3064	rundll32.exe
49	3064	rundll32.exe
50	3064	rundll32.exe
51	3064	rundll32.exe
52	3064	rundll32.exe
54	3064	rundll32.exe
57	3064	rundll32.exe
58	3064	rundll32.exe
59	3064	rundll32.exe
60	3064	rundll32.exe
61	3064	rundll32.exe
62	3064	rundll32.exe
63	3064	rundll32.exe
64	3064	rundll32.exe
65	3064	rundll32.exe
66	3064	rundll32.exe
67	3064	rundll32.exe
68	3064	rundll32.exe
69	3064	rundll32.exe
70	3064	rundll32.exe
71	3064	rundll32.exe
72	3064	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 16 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI852E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8793.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8840.tmp	msiexec.exe
File created	C:\Windows\Installer\e5784df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8648.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{04B236C3-728C-46C2-B8CB-AE96A6F0A71C}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC41C25ABAE7A2195.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1729B43D525F5716.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBE0D05CE8EC1FF41.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCD1C5138E8771739.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5784df.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86E6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSI8840.tmp

pid process

3332 MSI8840.tmp
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exerundll32.exe

pid process

696 MsiExec.exe
696 MsiExec.exe
696 MsiExec.exe
696 MsiExec.exe
3064 rundll32.exe
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

1344 msiexec.exe

pid	process
3332	MSI8840.tmp

pid	process
696	MsiExec.exe
696	MsiExec.exe
696	MsiExec.exe
696	MsiExec.exe
3064	rundll32.exe

pid	process
1344	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeMSI8840.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI8840.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fd384c3a7d3ca1330000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fd384c3a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fd384c3a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfd384c3a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fd384c3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exerundll32.exe

pid	process
1100	msiexec.exe
1100	msiexec.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	1344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1344	msiexec.exe
Token: SeSecurityPrivilege	1100	msiexec.exe
Token: SeCreateTokenPrivilege	1344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1344	msiexec.exe
Token: SeLockMemoryPrivilege	1344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1344	msiexec.exe
Token: SeMachineAccountPrivilege	1344	msiexec.exe
Token: SeTcbPrivilege	1344	msiexec.exe
Token: SeSecurityPrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeLoadDriverPrivilege	1344	msiexec.exe
Token: SeSystemProfilePrivilege	1344	msiexec.exe
Token: SeSystemtimePrivilege	1344	msiexec.exe
Token: SeProfSingleProcessPrivilege	1344	msiexec.exe
Token: SeIncBasePriorityPrivilege	1344	msiexec.exe
Token: SeCreatePagefilePrivilege	1344	msiexec.exe
Token: SeCreatePermanentPrivilege	1344	msiexec.exe
Token: SeBackupPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeShutdownPrivilege	1344	msiexec.exe
Token: SeDebugPrivilege	1344	msiexec.exe
Token: SeAuditPrivilege	1344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1344	msiexec.exe
Token: SeChangeNotifyPrivilege	1344	msiexec.exe
Token: SeRemoteShutdownPrivilege	1344	msiexec.exe
Token: SeUndockPrivilege	1344	msiexec.exe
Token: SeSyncAgentPrivilege	1344	msiexec.exe
Token: SeEnableDelegationPrivilege	1344	msiexec.exe
Token: SeManageVolumePrivilege	1344	msiexec.exe
Token: SeImpersonatePrivilege	1344	msiexec.exe
Token: SeCreateGlobalPrivilege	1344	msiexec.exe
Token: SeBackupPrivilege	4376	vssvc.exe
Token: SeRestorePrivilege	4376	vssvc.exe
Token: SeAuditPrivilege	4376	vssvc.exe
Token: SeBackupPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeRestorePrivilege	1100	msiexec.exe
Token: SeTakeOwnershipPrivilege	1100	msiexec.exe
Token: SeBackupPrivilege	4380	srtasks.exe
Token: SeRestorePrivilege	4380	srtasks.exe
Token: SeSecurityPrivilege	4380	srtasks.exe
Token: SeTakeOwnershipPrivilege	4380	srtasks.exe
Token: SeBackupPrivilege	4380	srtasks.exe
Token: SeRestorePrivilege	4380	srtasks.exe
Token: SeSecurityPrivilege	4380	srtasks.exe
Token: SeTakeOwnershipPrivilege	4380	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1344 msiexec.exe
1344 msiexec.exe

pid	process
1344	msiexec.exe
1344	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 1100 wrote to memory of 4380	1100	msiexec.exe	srtasks.exe
PID 1100 wrote to memory of 4380	1100	msiexec.exe	srtasks.exe
PID 1100 wrote to memory of 696	1100	msiexec.exe	MsiExec.exe
PID 1100 wrote to memory of 696	1100	msiexec.exe	MsiExec.exe
PID 1100 wrote to memory of 696	1100	msiexec.exe	MsiExec.exe
PID 1100 wrote to memory of 3332	1100	msiexec.exe	MSI8840.tmp
PID 1100 wrote to memory of 3332	1100	msiexec.exe	MSI8840.tmp
PID 1100 wrote to memory of 3332	1100	msiexec.exe	MSI8840.tmp

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DLPAgent.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5BD10D860F5B53B663EC673694507500
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:696
- C:\Windows\Installer\MSI8840.tmp
  "C:\Windows\Installer\MSI8840.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5784e2.rbs

Filesize
1KB

MD5
4f6833fcc66ecade16a4594f4163e4aa

SHA1
1ed4565c88d4e90399b1b1f4f1108c9e7adbeaa7

SHA256
386f21286f38b1eddc17027d0650908ee2ed4c15e8353bfe4233f3d330e41acf

SHA512
c35e2b130bd641533c684f4405aa12cfe35994dd0c7f864dc9523679fa7f2cc32db87d45cbd8c59ae1bab05096e566e36ea99570ac638529f364af7b87b00f4e

Download Submit
C:\Users\Admin\AppData\Roaming\x64_stealth.dll

Filesize
1.7MB

MD5
4d343ce28a572f1bca64473232a039a9

SHA1
aaf14040d4ee2a03d48d961f7d70970d4513237f

SHA256
5c7a3bd2baa8303354d8098b8d5961f111e467002bb0c6fee120825b32798228

SHA512
bd723a89aef1778fff3af72459b59aa2316cb010b290e9d5679c8e72959db70086d65ee0ef16e8cb45349be04b3ae9daeb53b63defbebfac8452a97ce46da814

Download Submit
C:\Windows\Installer\MSI852E.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI8840.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
cbf3a467fedc9352d1f3d8aeb2b639fa

SHA1
7b1e2674c974e5682d2f570ef8e1ca454d268eb4

SHA256
cfd1046655c9262af072d441b5440e7eee4c8a9453600f188fe0c5a9b7eec13d

SHA512
92dbba9ece32270a45ffd88b805c96fc83ed4d7fef787e8a3243783abff1890714ebc96becdb2047e70eb2a1e12a01085d64583278eb8a0ef8ff72fc829898d5

Download Submit
\??\Volume{3a4c38fd-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{63bac0db-e474-4f23-a037-aed101e71683}_OnDiskSnapshotProp

Filesize
6KB

MD5
bcec90dc38253f373db85ed47fe81a98

SHA1
65a99fddb492f2e5ad2dd37108dd9b7d3f0b9e70

SHA256
b31c74cbd854716d093aee4a2e02014c7930f12ffad948a105f474c5b9bb4051

SHA512
9f6b5e9a0c72bee8560ec65b21b49a493a0b39215304b398524ea223ad665f61c1b4254a6723a4831858aad8fbd88d2fd9d98af40945fd58288edf0cb77b96aa

Download Submit
memory/3064-48-0x00007FFA939B0000-0x00007FFA93A6D000-memory.dmp

Filesize
756KB

Download
memory/3064-47-0x00007FFA94EE0000-0x00007FFA950E9000-memory.dmp

Filesize
2.0MB

Download
memory/3064-52-0x0000012C27B90000-0x0000012C27BDC000-memory.dmp

Filesize
304KB

Download
memory/3064-50-0x00007FFA92680000-0x00007FFA929F4000-memory.dmp

Filesize
3.5MB

Download
memory/3064-61-0x00000002E4D10000-0x00000002E4D5B000-memory.dmp

Filesize
300KB

Download
memory/3064-70-0x0000012C27B90000-0x0000012C27BDC000-memory.dmp

Filesize
304KB

Download
memory/3064-44-0x00000002E4D10000-0x00000002E4D5B000-memory.dmp

Filesize
300KB

Download
memory/3064-45-0x00000002E4D10000-0x00000002E4D5B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads