gh0strat | f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpsupdate.msi
Size

39.8MB
MD5

0c200d7664b0e178560f7f974e6aff63
SHA1

f3ed74c5aa91de36a4a978d949b8b76752c853b3
SHA256

f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2
SHA512

b26c8dada559121f48ac6f3f15511e26c465c60b9d7b9a9ead4b175e32f32e7a6adbb77ed8cca269a88081a043efc7413b7c1a008e39bf41a36b6a2cbf698920
SSDEEP

786432:dHB67xVCEOhHxvCIEL2qf38CW9M4OGEuU/mH+ng2yI/9b+sKf:/KC9hm7/AXOBuU/mH+g/2y5

Score

10^/10

gh0strat purplefox bootkit discovery persistence privilege_escalation rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2392-73-0x000000002C340000-0x000000002C4FB000-memory.dmp	purplefox_rootkit
behavioral2/memory/2392-75-0x000000002C340000-0x000000002C4FB000-memory.dmp	purplefox_rootkit
behavioral2/memory/2392-78-0x000000002C340000-0x000000002C4FB000-memory.dmp	purplefox_rootkit
behavioral2/memory/2392-80-0x000000002C340000-0x000000002C4FB000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/2392-73-0x000000002C340000-0x000000002C4FB000-memory.dmp	family_gh0strat
behavioral2/memory/2392-75-0x000000002C340000-0x000000002C4FB000-memory.dmp	family_gh0strat
behavioral2/memory/2392-78-0x000000002C340000-0x000000002C4FB000-memory.dmp	family_gh0strat
behavioral2/memory/2392-80-0x000000002C340000-0x000000002C4FB000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	TpuaDVwAtO16.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	TpuaDVwAtO16.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	TpuaDVwAtO16.exe
File opened (read-only)	\??\W:	TpuaDVwAtO16.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	TpuaDVwAtO16.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	TpuaDVwAtO16.exe
File opened (read-only)	\??\M:	TpuaDVwAtO16.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	TpuaDVwAtO16.exe
File opened (read-only)	\??\X:	TpuaDVwAtO16.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	TpuaDVwAtO16.exe
File opened (read-only)	\??\J:	TpuaDVwAtO16.exe
File opened (read-only)	\??\Q:	TpuaDVwAtO16.exe
File opened (read-only)	\??\Y:	TpuaDVwAtO16.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	TpuaDVwAtO16.exe
File opened (read-only)	\??\U:	TpuaDVwAtO16.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	TpuaDVwAtO16.exe
File opened (read-only)	\??\N:	TpuaDVwAtO16.exe
File opened (read-only)	\??\S:	TpuaDVwAtO16.exe
File opened (read-only)	\??\Z:	TpuaDVwAtO16.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	TpuaDVwAtO16.exe
File opened (read-only)	\??\O:	TpuaDVwAtO16.exe
File opened (read-only)	\??\P:	TpuaDVwAtO16.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wpsupdate.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant	TpuaDVwAtO16.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj	msiexec.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log	qzeybRpnzInL.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\MOELauncherSetup_V0TKW.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml	bYqyfBgulGkj.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log	qzeybRpnzInL.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log	qzeybRpnzInL.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe	bYqyfBgulGkj.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57bf68.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BCDF69D5-1EAE-4837-BC02-11FDF7634975}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0DF.tmp	msiexec.exe
File created	C:\Windows\Installer\e57bf6a.msi	msiexec.exe
File created	C:\Windows\Installer\e57bf68.msi	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
1812	bYqyfBgulGkj.exe
3056	TpuaDVwAtO16.exe
4904	wpsupdate.exe
2572	qzeybRpnzInL.exe
3156	qzeybRpnzInL.exe
3060	qzeybRpnzInL.exe
532	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4960	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bYqyfBgulGkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpuaDVwAtO16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpuaDVwAtO16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpuaDVwAtO16.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d6be30f9a4b6bc740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d6be30f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d6be30f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd6be30f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6be30f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TpuaDVwAtO16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TpuaDVwAtO16.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft	wpsupdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD3Verify_C = 32003000320034002d0039002d00320032007c00570044004300200032002e0035002b00320033003200310033003800380030003400310036003500200020002000200020002000200020007c00460032002d00430045002d00360037002d00330044002d00360034002d00380039000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD3_C = "08db60ef0bac22f8056f3b8abaa027b9"	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo\InfoHDModifiedType = "hdidRecalByOldHdidFromRegIsEmpty\|2024-9-22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD3t = "22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHD = "08db60ef0bac22f8056f3b8abaa027b9"	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\InfoHDt = "22"	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo\InfoLastHardInfo	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo\InfoCurHardInfo = "29a56b8a14940c3acb7a4a6443907c56\|42ac1d6d4f60b60f41566a978871a376"	wpsupdate.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\PackageName = "wpsupdate.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D96FDCBEAE17384CB2011DF7F369457\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\PackageCode = "FEF599A3F1DEFE84B9E7C80AEEBFA710"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Version = "67305477"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B5AC0212DF0BDEC44B3DF387D448EF64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\ProductName = "IntegrateAdvisorVibrant"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B5AC0212DF0BDEC44B3DF387D448EF64\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3064	msiexec.exe
3064	msiexec.exe
3056	TpuaDVwAtO16.exe
3056	TpuaDVwAtO16.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
3060	qzeybRpnzInL.exe
3060	qzeybRpnzInL.exe
532	TpuaDVwAtO16.exe
532	TpuaDVwAtO16.exe
532	TpuaDVwAtO16.exe
532	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe
2392	TpuaDVwAtO16.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4960	msiexec.exe
Token: SeSecurityPrivilege	3064	msiexec.exe
Token: SeCreateTokenPrivilege	4960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4960	msiexec.exe
Token: SeLockMemoryPrivilege	4960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4960	msiexec.exe
Token: SeMachineAccountPrivilege	4960	msiexec.exe
Token: SeTcbPrivilege	4960	msiexec.exe
Token: SeSecurityPrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe
Token: SeLoadDriverPrivilege	4960	msiexec.exe
Token: SeSystemProfilePrivilege	4960	msiexec.exe
Token: SeSystemtimePrivilege	4960	msiexec.exe
Token: SeProfSingleProcessPrivilege	4960	msiexec.exe
Token: SeIncBasePriorityPrivilege	4960	msiexec.exe
Token: SeCreatePagefilePrivilege	4960	msiexec.exe
Token: SeCreatePermanentPrivilege	4960	msiexec.exe
Token: SeBackupPrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeShutdownPrivilege	4960	msiexec.exe
Token: SeDebugPrivilege	4960	msiexec.exe
Token: SeAuditPrivilege	4960	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4960	msiexec.exe
Token: SeChangeNotifyPrivilege	4960	msiexec.exe
Token: SeRemoteShutdownPrivilege	4960	msiexec.exe
Token: SeUndockPrivilege	4960	msiexec.exe
Token: SeSyncAgentPrivilege	4960	msiexec.exe
Token: SeEnableDelegationPrivilege	4960	msiexec.exe
Token: SeManageVolumePrivilege	4960	msiexec.exe
Token: SeImpersonatePrivilege	4960	msiexec.exe
Token: SeCreateGlobalPrivilege	4960	msiexec.exe
Token: SeBackupPrivilege	724	vssvc.exe
Token: SeRestorePrivilege	724	vssvc.exe
Token: SeAuditPrivilege	724	vssvc.exe
Token: SeBackupPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4960	msiexec.exe
4960	msiexec.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe
4904	wpsupdate.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4028	3064	msiexec.exe	94
PID 3064 wrote to memory of 4028	3064	msiexec.exe	94
PID 3064 wrote to memory of 3344	3064	msiexec.exe	96
PID 3064 wrote to memory of 3344	3064	msiexec.exe	96
PID 3064 wrote to memory of 3344	3064	msiexec.exe	96
PID 3344 wrote to memory of 1812	3344	MsiExec.exe	97
PID 3344 wrote to memory of 1812	3344	MsiExec.exe	97
PID 3344 wrote to memory of 1812	3344	MsiExec.exe	97
PID 3344 wrote to memory of 3056	3344	MsiExec.exe	99
PID 3344 wrote to memory of 3056	3344	MsiExec.exe	99
PID 3344 wrote to memory of 3056	3344	MsiExec.exe	99
PID 3344 wrote to memory of 4904	3344	MsiExec.exe	100
PID 3344 wrote to memory of 4904	3344	MsiExec.exe	100
PID 3344 wrote to memory of 4904	3344	MsiExec.exe	100
PID 3060 wrote to memory of 532	3060	qzeybRpnzInL.exe	106
PID 3060 wrote to memory of 532	3060	qzeybRpnzInL.exe	106
PID 3060 wrote to memory of 532	3060	qzeybRpnzInL.exe	106
PID 532 wrote to memory of 2392	532	TpuaDVwAtO16.exe	107
PID 532 wrote to memory of 2392	532	TpuaDVwAtO16.exe	107
PID 532 wrote to memory of 2392	532	TpuaDVwAtO16.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wpsupdate.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4960

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 07296C39242CD86CB1553DDDF47B4B36 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe
    "C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe" x "C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj" -o"C:\Program Files\IntegrateAdvisorVibrant\" -pcwgpBxJASqrNthJgehkM -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1812
- - C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe
    "C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe" -number 262 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3056
- - C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe
    "C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe
"C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe" install
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2572

C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe
"C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:3156

C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe
"C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe
  "C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe" -number 166 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe
    "C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe" -number 362 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57bf69.rbs

Filesize
7KB

MD5
b54fd121259adfcb74853a8d463b37da

SHA1
6d6ab2528ccb2aa9d919e47356bb98a49f48a6ea

SHA256
c772264a566ae0d44ba2f5aa6dae818338e63d14f4799e03e4623a76aa7e4903

SHA512
7c6df6b52c430a01d7d8eaff6a70f5ead0757191ec44180c70d470608545206d5f024754a4b5a1025ffcb9ddac3e4f4b6385cd03faf7f6498f4d40c8833fd58f

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\MOELauncherSetup_V0TKW.exe

Filesize
35.6MB

MD5
f0b4afeb9a9582a84c04d33b4f9c93e5

SHA1
0b9229e8e3879fc4d1310ba493280894cac1f259

SHA256
d71c5c27f6e68be09e40921321a2c6d3b95f65787c33dcc2d66e6939a798a3c9

SHA512
d4c3593590a5574bbfc1270d3aca3b419ea5126735206b5e2104e42fda961844ba90073ebacd917b9b0152c103670d1a64b88c76b03b358feae73794418abe51

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe

Filesize
2.9MB

MD5
57d2f881bb7b9cf36a6c0ea46173c927

SHA1
2f12e389f828b77f93922b3643c2d8697bf64f0c

SHA256
4c9394ae6e91f94c57f904cd1ccd8df55566cff95b9a99fa7cd5ab9657e981a6

SHA512
84099bae1544e90418882d1da8d34f79c995623f8479558f621a89c7f04984f3ef99d56add81d9d240b3a3411ad671fc0bf9b24fb3cd8e030e36c12eb745e568

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj

Filesize
1.7MB

MD5
166813a640fbff9bc9c5a8829b77d604

SHA1
9a6439822765bb23d6b6b6926855f8cde67fa213

SHA256
6b2ca55715af12bca876efb3509ed93d79a220da577f72b7f0b03d413a41841b

SHA512
320eb8181155330c85782037f9530ae16c8a5b5e20cd8beab7b5c62ed9539350165bdfcad5f862256818d39cd9a6667326a2ecb5d01be0083b40ca98b69dfd75

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log

Filesize
270B

MD5
2298c55dbcebc054eb4f7ded0c695c0b

SHA1
7c54b2963b1dafb5451f11bde7a8cedf84ea7702

SHA256
fea07fd9c8c05ad81eab8cd7d6adb02f5654caa2243607def6dc6dbbfe3c0f42

SHA512
9e2da7f723ec3fba66068ad1fd0cc9be4eecb55886ee255630dbe6e29fc714ed8cb7b24730b5a2272c8bb478e279bc7e0d15e583a21fc273456eeab0d3f12377

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log

Filesize
428B

MD5
095fb40ef3d3bc6feea6d490c2a82ff6

SHA1
a2e0358e0c934dc0171570cedd8799216d03a757

SHA256
ad9cbda7d7b0d352e1480632ad8d0110e15e3b786480179dd060a93f8808c833

SHA512
6a30609271087d05cbf7ad7fe77e09671cbe4a99b00db9756e3e34348c91bb72c9653e2f74f1850c41815a46090704fe886d5a153f15b5829c227cd019577875

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log

Filesize
492B

MD5
79a08a52ffa1f0da92d60f4878c3f9f9

SHA1
f3fe8f7f030553ed5d66001942d1b6f37c1cad6c

SHA256
8885a2abe745156ac462695fb3be101b7359e1fb2d63b9f6be0c3717ae0b5d08

SHA512
a3be00ca8f1f063717ed6d9f1ef41641156b61b7e10bb420a11db8a64c46f83ab076ec1b9314737d8be3a8273040ba4e863b2245b60bf23981751de47b1953af

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.wrapper.log

Filesize
744B

MD5
b18884f3cf5236ad0d6b4423c09e45c1

SHA1
253db98affa170585ebb3017046863276c46532d

SHA256
26956f891e763a21a5811070f13e520a08477be632751cea3a77d73bfdcc211a

SHA512
8a157f5cb4741052d03baac4ab0cc61ca54e6448053c028d85b4d2961cdfb37cf451dd544a71c25638319964b0459d4dcb58e7c08914aa498fe36ebd27ee3c39

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml

Filesize
445B

MD5
d4bf6c3873594772779852f1ad463e73

SHA1
c45e3413d2216b90bc41a2b5f36132ca63c93b52

SHA256
811f4c379ff1b8690d4c3481ec57aebde7824b4f7341ffb0594d5b83e61599ed

SHA512
03d272eaf47313c2269fa7d739e37be9c138228dac5fe483b8f78955196aa838cb0d9b29a570b4d975b75ff206d8ecaf55b11b601ee8577661121dc0f0dd0b7e

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe

Filesize
6.0MB

MD5
57dadd6a929f64c2b1efe2d52c1c4985

SHA1
962cb227f81f885f23826c3e040aa9dbc97659cf

SHA256
996b5d59cce7955b4374bd00d83c422d3a1d9ffebba59c66074c37ab28cfaeb5

SHA512
3f64c35e72698ea6a7e708a4367277f3ab62c27f0652e0c55bab6e02239ee37c4f0a21503c0688301fb77bbf8e59e3c5c8aa2df8d62a4ab8a9b9cdf6f0a775cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\qzeybRpnzInL.exe.log

Filesize
1KB

MD5
122cf3c4f3452a55a92edee78316e071

SHA1
f2caa36d483076c92d17224cf92e260516b3cbbf

SHA256
42f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0

SHA512
c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2024_09_22.log

Filesize
2KB

MD5
2bca99545e41bea54b61a663c5256528

SHA1
91330062bb3bd35e7153690a0bf13a8ef10d2c0c

SHA256
e2bb3c64d7a77b9b551e6308d4ffff3651b725c10abade749635bdbe07f2f214

SHA512
306b82b60d59499050aeb35803223039bad0a35a97f40c4a532bf9339994d6f275e3521434545d167da2e27aba99878039903ef2c13ccb69b64e8022b6790ae9

Download Submit
C:\Windows\Installer\e57bf68.msi

Filesize
39.8MB

MD5
0c200d7664b0e178560f7f974e6aff63

SHA1
f3ed74c5aa91de36a4a978d949b8b76752c853b3

SHA256
f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2

SHA512
b26c8dada559121f48ac6f3f15511e26c465c60b9d7b9a9ead4b175e32f32e7a6adbb77ed8cca269a88081a043efc7413b7c1a008e39bf41a36b6a2cbf698920

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
3fa7688e9b29bbaacdf69eb1756226d1

SHA1
5c5d177a2d4257667c9d2f95b2de007130bbe02b

SHA256
a22a36c1373abdffaf272cf729a7dbb0651e3110b0111ed9775ac962f7a51de8

SHA512
1e81030bc8facb9608a452f21589f2d9454f933e396c82876a2c2700b61b74a1d9bc70fdf0237e8d5805fbc7ac557a1680e49be61d655d57c3533002945c4020

Download Submit
\??\Volume{f930bed6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8c74d602-45a8-4f19-ae8c-dcaffbfcdfdf}_OnDiskSnapshotProp

Filesize
6KB

MD5
cbdda73d2e117ab561093d4293bdbfc4

SHA1
f2be94413be16a6e59be9d00b7c4b85da6114975

SHA256
368cba41324d46a5dbeae7156b73e2896b3918f197ed623bf03b62ada1b8de3e

SHA512
a8e6837c5453247111b4181ff43f20eb5a26902917f8e0949fa0bc6610b51a5cbbc4604b5f164899d40a52e565dc6a9531836c9a0ea8216f4e1b3a960438295b

Download Submit
memory/2392-73-0x000000002C340000-0x000000002C4FB000-memory.dmp

Filesize
1.7MB

Download
memory/2392-75-0x000000002C340000-0x000000002C4FB000-memory.dmp

Filesize
1.7MB

Download
memory/2392-78-0x000000002C340000-0x000000002C4FB000-memory.dmp

Filesize
1.7MB

Download
memory/2392-80-0x000000002C340000-0x000000002C4FB000-memory.dmp

Filesize
1.7MB

Download
memory/2572-45-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/3056-25-0x000000002A640000-0x000000002A66A000-memory.dmp

Filesize
168KB

Download