hxxps://drive[.]google[.]com/file/d/1izFwLy36KaJbhGLUUDZmcBIjsUn27oY1/view

Resubmissions

28-09-2024 16:20

240928-ttbr1avdnn 7

28-09-2024 16:19

240928-tsqvjaxenc 6

Analysis

max time kernel
699s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1izFwLy36KaJbhGLUUDZmcBIjsUn27oY1/view

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Install Resolve 19.0b.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
5092	Install Resolve 19.0b.exe
2992	SetupResolve.exe
3132	vcredist_x64_vc12.exe
2256	vcredist_x64_vc12.exe
4496	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
1932	vcredist_x86_vc12.exe
1468	vcredist_x86_vc12.exe
3724	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe

Loads dropped DLL 17 IoCs

pid	Process
2256	vcredist_x64_vc12.exe
4496	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
4596	vcredist_x64.exe
1468	vcredist_x86_vc12.exe
2092	vcredist_x86.exe
4384	MsiExec.exe
1872	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4576	MsiExec.exe
4404	MsiExec.exe
3204	MsiExec.exe
1872	MsiExec.exe
1060	regsvr32.exe
4860	regsvr32.exe
3580	MsiExec.exe
3724	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64_vc12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} = "\"C:\\ProgramData\\Package Cache\\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86_vc12.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
149	3540	msiexec.exe
150	3540	msiexec.exe
152	2524	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
13	drive.google.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{ca40c09f-1bcd-fa48-98fc-59aa888785e0}\SET788B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\SET7AED.tmp	DrvInst.exe
File created	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\davincipanels.inf_amd64_66a4cb7e2ba2bb0c\DaVinciPanels.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\DaVinciKeyboards.cat	DrvInst.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File created	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca40c09f-1bcd-fa48-98fc-59aa888785e0}\SET789B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\SET7AEE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\davincikeyboards.inf_amd64_f35b77cd5821e0e8\DaVinciKeyboards.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\davincipanels.inf_amd64_66a4cb7e2ba2bb0c\DaVinciPanels.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7e64d3a1-48ed-c44c-9c00-86d269ac9e2e}\FairlightPanels.inf	DrvInst.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fairlightpanels.inf_amd64_9224ba1890805180\FairlightPanels.cat	DrvInst.exe
File created	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\DaVinciKeyboards.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\SET7AEE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7e64d3a1-48ed-c44c-9c00-86d269ac9e2e}\FairlightPanels.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\davincipanels.inf_amd64_66a4cb7e2ba2bb0c\DaVinciPanels.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fairlightpanels.inf_amd64_9224ba1890805180\FairlightPanels.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File created	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\SET7AED.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\DialogButtonBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQml\XmlListModel\plugins.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Player\PlugIns\imageformats\qtga.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\Qt6WebEngineCore.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\PlugIns\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\AdminUtility\PlugIns\Fairlight Panels\Resources\data-be0b.bin	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Timeline\plugins.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\TreeViewDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Player\BlackmagicRawAPI\InstructionSetServicesAVX.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\HorizontalHeaderView.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\ApplicationWindow.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\tls\qopensslbackend.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\tooling\Method.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qtquickdialogs2quickimplplugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\RangeSlider.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\Qt6WebEngineWidgets.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\impl\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\RoundButton.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\TabButton.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\Qt\labs\platform\qtlabsplatformplugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\plugins.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Windows\TextArea.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\ActionGroup.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\BusyIndicator.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Material\FolderDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Layouts\qquicklayoutsplugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQml\Models\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Material\ColorDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciPanels\DaVinciPanels.sys	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\FairlightPanels\FairlightPanels.sys	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\qtwebengine_resources.pak	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\NativeStyle\controls\DefaultProgressBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\ItemDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\PickerHandle.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\tooling\Component.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\Qt6QuickDialogs2QuickImpl.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Speed Test\Qt5Svg.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\impl\CursorDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\ApplicationWindow.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\NativeStyle\controls\DefaultScrollBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Fusion\Drawer.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\Label.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\CheckBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\MenuSeparator.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\GroupBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\SplitView.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\ItemDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\imageformats\qjpeg.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\Qt6Svg.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQml\Base\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\RadioButton.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Speed Test\PlugIns\imageformats\qwbmp.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\NativeStyle\controls\DefaultGroupBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\DelayButton.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Fusion\ColorDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\imageformats\qwbmp.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Player\PlugIns\imageformats\qtiff.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\AdminUtility\PlugIns\Fairlight Panels\Resources\data-be7d.bin	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Imagine\FolderBreadcrumbBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\SpinBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQml\Models\plugins.qmltypes	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{3739CA49-792F-4F1F-9B76-42DFBBBED27E}\Icon.ico	msiexec.exe
File created	C:\Windows\Installer\SourceHash{853720AF-81BE-4B04-9700-F32A053917B6}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120ita_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e6102f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120cht_x86	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3739CA49-792F-4F1F-9B76-42DFBBBED27E}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120enu_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120kor_x86	msiexec.exe
File created	C:\Windows\Installer\e6102cd.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140_codecvt_ids.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfc140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI301D.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfc140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120rus_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120u_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120enu_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120ita_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\e610270.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120enu_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120jpn_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120u_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfc140u.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120u_x86	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e6102e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77DA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660	msiexec.exe
File created	C:\Windows\Installer\e610295.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120chs_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120esn_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_msvcp120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vccorlib120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120jpn_x86	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupResolve.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9aa8484b1ca68e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9aa84840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9aa8484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9aa8484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9aa848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D401961D-3A20-3AC7-943B-6139D5BD490A}v12.0.40664\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEFBE8A0-A809-460D-9230-1BBCBFDA8CCC}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\ProductName = "Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0 = 60003100000000000259586510004d594e4f54457e310000480009000400efbe02595765025958652e0000002f29020000000100000000000000000000000000000041ecf0004d00790020004e006f007400650062006f006f006b00000018000000	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7972974E-8597-4386-9CEC-017AA8474AF2}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Blackmagic Design\\DaVinci Control Panels\\API"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlackmagicRaw.Clip	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}	vcredist_x86_vc12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB297010A1550CA37AFEF0BA14653C28\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0A6CCD2-5FC9-4574-84E3-733E3C6D8DA6}\InprocServer32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BAD2218D4DE6763BBA0AC63186945E3\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\DisplayName = "Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\NodeSlot = "7"	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Version = "12.0.40664"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AB297010A1550CA37AFEF0BA14653C28\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1FB5F95B8C762083E895C25E153AF95C	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\ProductName = "Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94AC9373F297F1F4B96724FDBBEB2DE7\VCRedist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7972974E-8597-4386-9CEC-017AA8474AF2}\1.0\0\win64\ = "C:\\Program Files (x86)\\Blackmagic Design\\DaVinci Control Panels\\API\\DaVinciPanelAPI64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{49d8e8e4-e896-4fec-8140-ae66de13be7a}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0A6CCD2-5FC9-4574-84E3-733E3C6D8DA6}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94AC9373F297F1F4B96724FDBBEB2DE7\VCRedist64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF65F25473B7B6A4FB95A2F66DF0C320\94AC9373F297F1F4B96724FDBBEB2DE7	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEFBE8A0-A809-460D-9230-1BBCBFDA8CCC}\InprocServer32\ = "C:\\Program Files (x86)\\Blackmagic Design\\DaVinci Control Panels\\API\\DaVinciPanelAPI64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7972974E-8597-4386-9CEC-017AA8474AF2}\1.0\0\win64	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\ProductName = "Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\PackageCode = "82C7CC9682E1077408579187FC5DC13E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\Version = "201367256"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
232	msedge.exe
232	msedge.exe
3436	identity_helper.exe
3436	identity_helper.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
3028	msedge.exe
3028	msedge.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe
3540	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4496	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
2524	msiexec.exe
3724	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3128	7zG.exe
Token: 35	3128	7zG.exe
Token: SeSecurityPrivilege	3128	7zG.exe
Token: SeSecurityPrivilege	3128	7zG.exe
Token: SeBackupPrivilege	684	vssvc.exe
Token: SeRestorePrivilege	684	vssvc.exe
Token: SeAuditPrivilege	684	vssvc.exe
Token: SeShutdownPrivilege	3132	vcredist_x64_vc12.exe
Token: SeIncreaseQuotaPrivilege	3132	vcredist_x64_vc12.exe
Token: SeSecurityPrivilege	3540	msiexec.exe
Token: SeCreateTokenPrivilege	3132	vcredist_x64_vc12.exe
Token: SeAssignPrimaryTokenPrivilege	3132	vcredist_x64_vc12.exe
Token: SeLockMemoryPrivilege	3132	vcredist_x64_vc12.exe
Token: SeIncreaseQuotaPrivilege	3132	vcredist_x64_vc12.exe
Token: SeMachineAccountPrivilege	3132	vcredist_x64_vc12.exe
Token: SeTcbPrivilege	3132	vcredist_x64_vc12.exe
Token: SeSecurityPrivilege	3132	vcredist_x64_vc12.exe
Token: SeTakeOwnershipPrivilege	3132	vcredist_x64_vc12.exe
Token: SeLoadDriverPrivilege	3132	vcredist_x64_vc12.exe
Token: SeSystemProfilePrivilege	3132	vcredist_x64_vc12.exe
Token: SeSystemtimePrivilege	3132	vcredist_x64_vc12.exe
Token: SeProfSingleProcessPrivilege	3132	vcredist_x64_vc12.exe
Token: SeIncBasePriorityPrivilege	3132	vcredist_x64_vc12.exe
Token: SeCreatePagefilePrivilege	3132	vcredist_x64_vc12.exe
Token: SeCreatePermanentPrivilege	3132	vcredist_x64_vc12.exe
Token: SeBackupPrivilege	3132	vcredist_x64_vc12.exe
Token: SeRestorePrivilege	3132	vcredist_x64_vc12.exe
Token: SeShutdownPrivilege	3132	vcredist_x64_vc12.exe
Token: SeDebugPrivilege	3132	vcredist_x64_vc12.exe
Token: SeAuditPrivilege	3132	vcredist_x64_vc12.exe
Token: SeSystemEnvironmentPrivilege	3132	vcredist_x64_vc12.exe
Token: SeChangeNotifyPrivilege	3132	vcredist_x64_vc12.exe
Token: SeRemoteShutdownPrivilege	3132	vcredist_x64_vc12.exe
Token: SeUndockPrivilege	3132	vcredist_x64_vc12.exe
Token: SeSyncAgentPrivilege	3132	vcredist_x64_vc12.exe
Token: SeEnableDelegationPrivilege	3132	vcredist_x64_vc12.exe
Token: SeManageVolumePrivilege	3132	vcredist_x64_vc12.exe
Token: SeImpersonatePrivilege	3132	vcredist_x64_vc12.exe
Token: SeCreateGlobalPrivilege	3132	vcredist_x64_vc12.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe
Token: SeTakeOwnershipPrivilege	3540	msiexec.exe
Token: SeRestorePrivilege	3540	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
4496	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
4496	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
2992	SetupResolve.exe
3724	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
3724	blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3948	232	msedge.exe	82
PID 232 wrote to memory of 3948	232	msedge.exe	82
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 1452	232	msedge.exe	83
PID 232 wrote to memory of 3656	232	msedge.exe	84
PID 232 wrote to memory of 3656	232	msedge.exe	84
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85
PID 232 wrote to memory of 1956	232	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1izFwLy36KaJbhGLUUDZmcBIjsUn27oY1/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81fe546f8,0x7ff81fe54708,0x7ff81fe54718
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,3788836124205111297,3094440987561348286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2852

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap7370:154:7zEvent24208
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\Install Resolve 19.0b.exe
"C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\Install Resolve 19.0b.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5092
- C:\Users\Admin\AppData\Local\Temp\7zS4E38FAEF\SetupResolve.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4E38FAEF\SetupResolve.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x64_vc12.exe
    C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x64_vc12.exe /passive /norestart
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x64_vc12.exe
      "C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x64_vc12.exe" /passive /norestart -burn.unelevated BurnPipe.{7740D62A-A6D0-4128-8AD4-7702573E9C1D} {EC0ED539-55B7-4B0F-A2F5-921E19368FE2} 3132
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2256
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{435DB441-CF65-4EFB-AA4A-BCA858FC3BA3} {FEEA7E63-B496-48A0-8767-DDC4467E2354} 3132
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4408
    - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{435DB441-CF65-4EFB-AA4A-BCA858FC3BA3} {FEEA7E63-B496-48A0-8767-DDC4467E2354} 3132 -burn.unelevated BurnPipe.{F831FD6B-17FD-4CF7-8201-CA06931E33EC} {359BC748-A28F-430A-9306-2636244F5FDD} 4408
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4596
- - C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x86_vc12.exe
    C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x86_vc12.exe /passive /norestart
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x86_vc12.exe
      "C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x86_vc12.exe" /passive /norestart -burn.unelevated BurnPipe.{3E1CB7DF-8FA4-4FB8-8438-40EDAB118D55} {A8F0BCDA-5787-48E0-A0A9-C0A5D8C31BD1} 1932
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1468
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{0528AAD8-A9AE-471B-90A5-4DFD035C2076} {BC8A7482-22EE-4E85-B651-E55D72BEFC53} 1932
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1264
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{0528AAD8-A9AE-471B-90A5-4DFD035C2076} {BC8A7482-22EE-4E85-B651-E55D72BEFC53} 1932 -burn.unelevated BurnPipe.{A7F2689E-D121-4641-93CE-A009C8C9DDB2} {18B73CF6-95DF-4021-8EDF-3A70DB3BDA0C} 1264
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2092
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\DaVinci Resolve Panels Installer v2.3.0.msi" /quiet /qn /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\Blackmagic RAW Player v4.2.0.msi" /quiet /qn /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\7zS4E38FAEF\ResolveInstaller.msi" /log "C:\Users\Admin\AppData\Local\Temp\ResolvePackage.log"
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
"C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4364

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBE29A1863EB92203CA0C1E81C9B1839
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DF5249E1F79D01D51963BB74B338C40E
  2⤵
  - Loads dropped DLL
  PID:1872
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4C128856EF3857F431806F6D0FE96586 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  PID:4576
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\API\DaVinciPanelAPI64.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4404
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\API\FairlightPanelAPI.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:3204
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s /u BlackmagicRawAPI.dll
  2⤵
  - Loads dropped DLL
  PID:1060
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s BlackmagicRawShellExtension.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CD965B9540FFBBC758394068E5570AA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
PID:3708
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciPanels\DaVinciPanels.inf" "9" "4c6adc413" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciPanels"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:864
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciKeyboards\DaVinciKeyboards.inf" "9" "4e024879f" "0000000000000164" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciKeyboards"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4844
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\FairlightPanels\FairlightPanels.inf" "9" "4e10e6fd7" "0000000000000160" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\FairlightPanels"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4264

C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe
"C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e610273.rbs

Filesize
18KB

MD5
16dd2a404758b51424070e8c7dd16972

SHA1
5d0de24af522a933be81a7b2f548d33a19ef2821

SHA256
54e146e0de7eec1dd9ccb7ff088e7743e4cad02d76789c1ae7ca1c2ed32ceec6

SHA512
1d5db70b6dba54ec5192fcbd0f8b1c78c7f08a6cbe5fab79a4a38322358316801bfe469b0cd2546618ffca76a932335ef95c4b4f062912076cde40d93e7364e2

Download Submit
C:\Config.Msi\e61027c.rbs

Filesize
14KB

MD5
1ed36331fdb72fad531ebead53e61e24

SHA1
704f9e8bc055bd0154689c6064090e67db6c8305

SHA256
3d2e4e2db4b013d4a6c6a4e83f2c998c82a7af38470445078591e8efeb52aff1

SHA512
fde230980db2de8ade907e7fee1c41a54769afa0bee7d455dc5451bdbd0600c190d7d253c1e8546a86d1d6f36ffee0842dd6e77efbf70c5e29b4a633341ee8de

Download Submit
C:\Config.Msi\e61027d.rbf

Filesize
644KB

MD5
edef53778eaafe476ee523be5c2ab67f

SHA1
58c416508913045f99cdf559f31e71f88626f6de

SHA256
92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

SHA512
7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

Download Submit
C:\Config.Msi\e61027e.rbf

Filesize
940KB

MD5
aeb29ccc27e16c4fd223a00189b44524

SHA1
45a6671c64f353c79c0060bdafea0ceb5ad889be

SHA256
d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

SHA512
2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

Download Submit
C:\Config.Msi\e61027f.rbf

Filesize
470KB

MD5
f0ec8a3ddf8e0534983a05a52bce8924

SHA1
5f6d0265273f00ffe8e30cf507f0d05d330ff296

SHA256
88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b

SHA512
d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb

Download Submit
C:\Config.Msi\e610280.rbf

Filesize
348KB

MD5
ea1e99dec990691d41f938085f68bcc7

SHA1
5fdcbcd777e10e765d593994dc66f930c1377b0e

SHA256
1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc

SHA512
e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8

Download Submit
C:\Config.Msi\e610281.rbf

Filesize
134KB

MD5
d7dbc7c92177837431ae2fd7fb569e2c

SHA1
c26140204a6db421842ad36599326a5369fd1b5d

SHA256
22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70

SHA512
4f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8

Download Submit
C:\Config.Msi\e610282.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e610286.rbs

Filesize
27KB

MD5
0a5647d0e2463791f87cb056b521225e

SHA1
6bfcbc6798e56e0c9d86ddbfb80e961e05a28636

SHA256
00afd5bd524d17899c37f6d5859d2ff8fc7bc7735d2d6ee7be9ebd780d3c3cbd

SHA512
3750a007f3204a728343102e53f6b024c64528e7bf5c8ef63349c5079c5388a5728db6c3f442fb941b9a937c0ebd784b743f728f96ec2d2abb53de68bf84de30

Download Submit
C:\Config.Msi\e610298.rbs

Filesize
22KB

MD5
50edfa2eca416917f2ea72e7cceac64a

SHA1
129eb087b445fb2e4aaaede4a2ae8440c82816b7

SHA256
ef811d5fa7368e263363e9ef69f71c9d2b1a5cb2424642f3453b6c3de542ba3c

SHA512
c584c3ab7492e0fcb8fb508bc7c0d2fc04319300f20354bd5f3473bb3f0ebff61c0bafd77428ae08a8bc26e2a3f3b47efbef8af761975612902cd9b5bae8c25d

Download Submit
C:\Config.Msi\e610299.rbf

Filesize
45KB

MD5
f96a9a88487a27de7b3e15c733cf1fe1

SHA1
0a4157f064349b0370b8ee3f244f44debd04b4c0

SHA256
cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61

SHA512
df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b

Download Submit
C:\Config.Msi\e61029a.rbf

Filesize
45KB

MD5
6a5e17d5a4b24e5c2b947a343a182949

SHA1
ddf5ed505953e073f09b17e8e2bdecf2766c6a4b

SHA256
0301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e

SHA512
8a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97

Download Submit
C:\Config.Msi\e61029b.rbf

Filesize
73KB

MD5
bfc853c578252e29698ff6b770794e6a

SHA1
1091dced7b18bdd7eda2be4d095ac43cfd342b7d

SHA256
80e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6

SHA512
306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb

Download Submit
C:\Config.Msi\e61029c.rbf

Filesize
63KB

MD5
19b7b852ac2dec695e6a52801e59c421

SHA1
cd72265e1a6a64c761984980895d92cb93bc61b7

SHA256
e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6

SHA512
d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017

Download Submit
C:\Config.Msi\e61029d.rbf

Filesize
72KB

MD5
9ef2dc352d20b615a556be53b449b17c

SHA1
933b2a39f3d730c6b5d437558d0db68c5d2c22b7

SHA256
db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120

SHA512
8031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91

Download Submit
C:\Config.Msi\e61029e.rbf

Filesize
73KB

MD5
06473191b67c8b3d1a26b76474c5daeb

SHA1
94c72bb597c365cb77f621e6e2cf3920954df2d7

SHA256
e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7

SHA512
237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb

Download Submit
C:\Config.Msi\e61029f.rbf

Filesize
71KB

MD5
713e30e13c1998e035cf4ace66b03230

SHA1
2d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5

SHA256
9cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10

SHA512
8a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a

Download Submit
C:\Config.Msi\e6102a0.rbf

Filesize
52KB

MD5
689b5f0061a67ac95f59a64744702186

SHA1
52227dd2c8a66c0528bff28475846faf7036340f

SHA256
83fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b

SHA512
30b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42

Download Submit
C:\Config.Msi\e6102a1.rbf

Filesize
52KB

MD5
7d03ffc6a8fb686abd660efdc3aaf223

SHA1
3d04c53971a525cc3255ff1eab05ff0cbad75bb7

SHA256
b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9

SHA512
b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1

Download Submit
C:\Config.Msi\e6102a2.rbf

Filesize
69KB

MD5
a99ad214ccd1e7bc1f609b972467b0ca

SHA1
9ee79954fdb2338026c3c81da00ab6e7e6c2e1ff

SHA256
3238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983

SHA512
da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083

Download Submit
C:\Config.Msi\e6102a3.rbf

Filesize
5.4MB

MD5
ee4af4ceb4b7fded7cdda37faef69704

SHA1
5ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2

SHA256
75497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c

SHA512
4f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece

Download Submit
C:\Config.Msi\e6102a4.rbf

Filesize
5.3MB

MD5
a6d08e8e290c80822842015cd877d405

SHA1
2ee9d28e20a73facff20be87092e482b562dad41

SHA256
950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906

SHA512
b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2

Download Submit
C:\Config.Msi\e6102a5.rbf

Filesize
89KB

MD5
43aae7bfb0c911e7e98003e2b45667e6

SHA1
0c6c7d96cd0eca734e425b1ddef178c3ab6c31ce

SHA256
a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476

SHA512
33d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9

Download Submit
C:\Config.Msi\e6102a6.rbf

Filesize
89KB

MD5
0d5451a0050f7acc970ca02459c63d9a

SHA1
2de9febca0b1d48014081907e835237c832c65b0

SHA256
864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e

SHA512
4d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8

Download Submit
C:\Config.Msi\e6102ab.rbs

Filesize
17KB

MD5
ee2b271da82ff3411ae82e70d7920394

SHA1
e31493d01baa5d820943bfe1d11d10a468238f47

SHA256
c1a1740160e93e9c5e79eec21a4d2dda1b3e437fa55465119e82efa4e4b7b80f

SHA512
dd53e6cd34da229eddb09b313dbba0bffc84dca7f958c9ed696a4f16dc4eaa9a440913f0f4f67c0b68e73d063bd2bcf2f3696873bd9b9759dad9b826773de690

Download Submit
C:\Config.Msi\e6102b4.rbs

Filesize
13KB

MD5
793c127fcac865b9b110f1f006e65032

SHA1
6113f383d4eaba1b08ad69bf45d649519ba57e66

SHA256
144689bce70d5abb63a627811a807460afbbb818ec47631a6f320c9cafca9e9a

SHA512
67e4ad697ebbd6c58d15abf5b933bb58be7e32b0dde61b9df4ffcf3befe582b7c9bce2eb8ca6f832122353fed0d00ad77313317a4fabf4880cb548fe8b69f4d3

Download Submit
C:\Config.Msi\e6102b5.rbf

Filesize
444KB

MD5
a883c95684eff25e71c3b644912c73a5

SHA1
3f541023690680d002a22f64153ea4e000e5561b

SHA256
d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb

SHA512
5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52

Download Submit
C:\Config.Msi\e6102b6.rbf

Filesize
948KB

MD5
2fb20c782c237f8b23df112326048479

SHA1
b2d5a8b5c0fd735038267914b5080aab57b78243

SHA256
e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa

SHA512
4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0

Download Submit
C:\Config.Msi\e6102b7.rbf

Filesize
331KB

MD5
69004e08c1eb19fcf709908103c002fd

SHA1
d59459f9a18b2e9a06e5af2b88f4fecb0ce690d5

SHA256
c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad

SHA512
3fc67a5fccb252a67285e19d62057fb4e3c63e702f4be91e552f93d9827cc746b8fb43b4a3b24b7fd5c48832d18a1dae26c1bd237f40b7b88618d402fdac1a76

Download Submit
C:\Config.Msi\e6102b8.rbf

Filesize
242KB

MD5
c7739dd4212d084d299df68f0a0debc3

SHA1
cba81d847d91bfea5c03279c0ca03fb1aacd4ae9

SHA256
1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153

SHA512
5b8e98e6764460f9afbfa6dd34c12ad59284003eea99997c9e1db9b4a85ba30ac8b6a699b2888388dc424c547918137d42984bf040ac3d292e612bc433368fb3

Download Submit
C:\Config.Msi\e6102b9.rbf

Filesize
117KB

MD5
90419039c035404fb1dc38c3fb406f65

SHA1
67884b612d143aa08a307110cee7069bddb989a0

SHA256
62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317

SHA512
e632c78c941861e61fbec68e333e6549cd4bec683593db92c2522e162176bd64160dba37d4226c1599cfe1d77b36d5d4c452dd2f453c291a15310dfb607f3414

Download Submit
C:\Config.Msi\e6102be.rbs

Filesize
26KB

MD5
b7ea5899954f5d553db0ac89e8af778c

SHA1
35c3afe749658411ffce0af36077766f82547ece

SHA256
24b820276822f5df51fb600efbea383e785627c6122148de572ac5d646014848

SHA512
3bdfcb8cf5ce35fe6c528a5c1baed320fc809db258d6f78bb76e8058987c11bd75e0a2bc900fa4da2c7f0892134c160426442c4cc1968f726edc0123df17ca2a

Download Submit
C:\Config.Msi\e6102d0.rbs

Filesize
22KB

MD5
2d8d4c71c238fffba3c5ab82b23dcf2f

SHA1
730ca954c9dd60521da402a539a5059230c64d29

SHA256
daae61e50a8ea1160f5cbe40495252f069f47431d2f3dab68fa2a7233c4cb801

SHA512
32f26792f05420dbb952aafeb7c39f36c51ad1dac5dded6f898eac9e7cd294fba21efab21a69e60fcff5cf92d4100f68d9ca7429256a872559efe6ebcd015d79

Download Submit
C:\Config.Msi\e6102d1.rbf

Filesize
45KB

MD5
2f7c88c43a8966882ca89ce4981e3cde

SHA1
588bdeae6eab1f447771bd6963b5b3329196e686

SHA256
5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76

SHA512
3f2eca126fc821e36aaf4430a0f41af1a060396f52cfb2efd1c3be2ab9d69cfac870121c646776c8b15e8561938ac30367bc5687bb9a79f0c19156c3b56249a7

Download Submit
C:\Config.Msi\e6102d2.rbf

Filesize
45KB

MD5
70bbafa7c8b0aeba0e25e27c440a6038

SHA1
44a5e06229ae4f6ce6d3b2b57cb3b6050667def2

SHA256
9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe

SHA512
2e9b8696c1b4ab8e721fa07b6c81fe30613f0d188250991c573af95263688b7db6e25ebc4c030825724248c9713d9c5b772f199369785ac615ad2d2fdf527f8a

Download Submit
C:\Config.Msi\e6102d3.rbf

Filesize
73KB

MD5
09936f1f2ad5ae9d0663b6e8709527c7

SHA1
f0e5945663e65405d94c394db83880f713295104

SHA256
550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8

SHA512
3e95e1e3f2043e1f0a4baf1267e82f912bcd5830ae6c5abc750a38a0666b1a6b9e1169dadb58bc2eafae00a2e11bcf574ea805f3a1f07f77d5450d1265e8e7f6

Download Submit
C:\Config.Msi\e6102d4.rbf

Filesize
63KB

MD5
9becefa155c8c9f5ef5bf9d537c0a258

SHA1
4f33f6d08685d50ce799df6369cb5efc51673e12

SHA256
d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613

SHA512
5e9972cfe26c0fc6a0ea38643c644b5ac33e4ddfc1cff5b25017c81f3121ec7732565554f43c1916e9f8e2b1d84226aacd2cc4d6805425c2f1f1e7683e506ff4

Download Submit
C:\Config.Msi\e6102d5.rbf

Filesize
72KB

MD5
30281f2891b6deae8c0deb122b5906c7

SHA1
43ed0c7bf45839ba07501c1013ba74c97b4d0beb

SHA256
87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a

SHA512
cb0e3f3cf89af55e4b849b3f4f883d8348fc8f806690db4fff238ee54bc5f80a34e53c7e8a22dd9d1dc57c1a60c69d3e25ad9cc52ac66628613cdf358e7aa537

Download Submit
C:\Config.Msi\e6102d6.rbf

Filesize
73KB

MD5
b41aa9a167ac3d6c11b5c2e1e183c11b

SHA1
ac8efa5f7b8211e4dc0d0d0e6bc7717f88d2c0ac

SHA256
b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2

SHA512
de667f1fe0bcb0ddf8f59054a2d5c516ec47ab59f7e78e29ec8a2cc756c72aae65bb73ea03701c67c978166649d69278fb0269e9588d968f630165bcfa6f40f8

Download Submit
C:\Config.Msi\e6102d7.rbf

Filesize
71KB

MD5
2bcf9a28e5fe7a3fefd16a9c03d35dbb

SHA1
7c1446d8ca4d2c6890d62c02308daccb8be5475f

SHA256
271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289

SHA512
445ef027eeecda4361834334706079053ce9a735cbeeadaec37f28c4f9a485b07ba156178c2cdb1f012d1760d0495d041deceb6372921eb94d18241eb304eafa

Download Submit
C:\Config.Msi\e6102d8.rbf

Filesize
52KB

MD5
34b5ae129703de4a4bb5f52f4306fdf6

SHA1
601ba6cc73cbbe6d7014519a885fde2c9e9c2fba

SHA256
43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407

SHA512
016dae93356e42a19f4fb4d34efa04e93f802e5de3157c29ce940d9637d697d2b7a4f61b705b5b5df271b97d942cb81265d0fe7c9561c0ef3c46c249b8b7fb9c

Download Submit
C:\Config.Msi\e6102d9.rbf

Filesize
52KB

MD5
f89147c034de186e3ab79326523888b8

SHA1
d3e6c00363a429eae066953f7c187e33c687ec6b

SHA256
32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d

SHA512
d7842681f67b46f67233ad0f7c57c7155f152dc25ef546a08fb91914ee54984b87f9ccbd8da3e40d012b251fffade838f2d779681afa84c383ea7982f0ad1cfe

Download Submit
C:\Config.Msi\e6102da.rbf

Filesize
69KB

MD5
d7f2e87512d19d01328840187fc7cb04

SHA1
7a312b677b76d7303e01da6064f1a5e0fb26c604

SHA256
1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67

SHA512
8a00cae2dc0d59e530cd43bf84f33301f53ccdd96477787805b487ffdf6869223621414cf180a1aafb6b8910ba19684c02c60226a651d051eacc4cac1fbd8c2b

Download Submit
C:\Config.Msi\e6102db.rbf

Filesize
4.2MB

MD5
293002e4332f01c74c2a843b5c638a90

SHA1
2e412f945ac4353b4908c87e31b847415b3ec19b

SHA256
6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15

SHA512
49eaf5633debad535ffc6584c8383e21c99f7a3a81a0b3496943af0e79853399649706ceda9da9990c259d605ab163c22c08f641b91e80c8a14d519837a595ce

Download Submit
C:\Config.Msi\e6102dc.rbf

Filesize
4.2MB

MD5
e1629a36f15824346bb54a9ebe9b622f

SHA1
ee5d55315ffb351e24b7c918c82e6ce4ec17a645

SHA256
68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d

SHA512
0301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb

Download Submit
C:\Config.Msi\e6102dd.rbf

Filesize
81KB

MD5
36ca9bc41425660ad80f23933e6e9f1f

SHA1
3206186f932cd5948062a837b5fc2094ddb1c8b7

SHA256
8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187

SHA512
a58eee2824bad90ea0790bdf55c5b58a6eec5f3e87bebf5a941a6dbcb8106c6d96b7eee0a022c4a16f35d80e38501fed54d88127f30de0e9fdd22e4df8fa2ea5

Download Submit
C:\Config.Msi\e6102de.rbf

Filesize
81KB

MD5
9b73043d5646be7b544e3ac3d49b7744

SHA1
a3eecb1a85c244d5428a012041eee947462e7a09

SHA256
d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a

SHA512
8f339c23f8d1e8eed1bd055a31c027e5da03d916769468394ba1befe7b4f2586e67e8dcf29326ff40abb0d879a45f886398d5d733c988c507860d1ece16ed83a

Download Submit
C:\Config.Msi\e6102e3.rbs

Filesize
2.2MB

MD5
57ba3466fd3882f85043b91a52ce3c0e

SHA1
f9b7957e00b923be403ba230fc7dc43d314d873d

SHA256
8e1d01bc1d12faba949905c594ec510750de86661c8c35cc80769151d5c4f088

SHA512
70bd5d92aef992f7b38f4ab0543e7bf679a4e9c2db5fcf291fa900a26792f2aec6c139f7bfd008a0ab44d197efc6be3ba3de7746543ca8baf3ddeb505a90bbb5

Download Submit
C:\Config.Msi\e6102e8.rbs

Filesize
35KB

MD5
bc62046194d022656995f7c2a2828145

SHA1
2db6ad8c5e9ef3352e6bceff043c9445b1d8fb68

SHA256
9f13acd2e85d0e9f0afa7d2a9486ee41672a2162093a06d3b725ae3e04384615

SHA512
ec6c4504c639da0c05c280ed97a40f6507d32ec4a84078477d4ed758d829ce9c475f7a3c405cd4ba30dae476f179acb9c2ad77e4aa12686c770382cea6206a2f

Download Submit
C:\PROGRA~2\BLACKM~1\DAVINC~1\DRIVER~1\DAVINC~2\DaVinciPanels.cat

Filesize
12KB

MD5
93352995bbe1f4349e1077a791d38044

SHA1
6e9ecb554e4bec96a5f498ff05b5502bc3780343

SHA256
24eb024f4cf56562017115db454972b21e1295f763e081499b8cec51d40d7366

SHA512
7d0d26d9cdbab0a74662a3d8062b5758bc4dc8463cf4c47322b5d7aef5d1d02bbad5013c97e38a24dced97a1cc0f3546a1ca5b35ea5d0dee8496a54ccbc1f9dd

Download Submit
C:\PROGRA~2\BLACKM~1\DAVINC~1\DRIVER~1\DAVINC~2\DaVinciPanels.sys

Filesize
27KB

MD5
894704d5727b53a30c96e35d17c46618

SHA1
2ffa87a39688a214bf472c497a63c226c079dc5b

SHA256
4b41bca637fbc269a9191dbcbc6c8981684fdf0532168606b614ae1281f2db0b

SHA512
eab1af572ebdc8ea02f42fd97e1ad2d054b55feb7afc10e75075e951b8e581e4e4a631df5161a0ff0d23db4c3441f96510ea6474d1e6671a6b4f2fe5b8f61a38

Download Submit
C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciPanels\DaVinciPanels.inf

Filesize
2KB

MD5
f025f7d6bb5364a543e90f00bca73902

SHA1
5815aa7e5aa6c84c0f35cffb2a3002de6d37cea6

SHA256
df6521d4335614cc289aa27777dbae8b4ef45a4950b9ebdbccab7fddd38f867a

SHA512
979622cc906e0e03b32925eb0358f262ec454e44bf37d584728e1178ea7ab9c51f9389f194d8c23005e160fdb8e3836323b8125bbe0917a955c98797383fc7ad

Download Submit
C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.qmltypes

Filesize
215B

MD5
2006d4b7d0da455aa4c7414653c0018a

SHA1
6685b8360b97799aa4d6b18789bf84a343e9e891

SHA256
a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a

SHA512
703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84

Download Submit
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm

Filesize
792B

MD5
71088fbd77c1e0301308cd4dfde5ba1a

SHA1
cf711abc8b39a17fe38fa46e63efecd4a02d361a

SHA256
bb3b18bc70284800d4d97f3f462bf0b00a819025ffb9f1cce1ac72e05ca420eb

SHA512
00b2f51cc880730a66b06de1931d6900851ffb6e2594f3237c86af69594d04968c2700c2e3996c89e4f4ac5f9e165a1bb1798a3ffc65939e57261d1969e4f867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a155964-287a-46a5-9f0f-d5cd4368d16f.tmp

Filesize
3KB

MD5
de71b343800dfd891fff6fc6eb197949

SHA1
264369f6714c57f787e495cd6d0300f109a47bed

SHA256
8e38a671b36cc80ae915c33156221cae72602c7544122773caff22e97d836585

SHA512
1830448e50a4a5942831f6adf306537124a720f228e6badb441a69ea6743a51c3e96d1084b5bebb722d1c5592d1d9fb06deed2a47cdd6518a9869fff53537baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
b8e91be2ad0beb3211dd10889f773238

SHA1
cba7a34f124073ac72d1c445d438b9bc1952914f

SHA256
f0b3b53a57eb1094109500ca50233203694e725d711b56f9d23b30c4c523ff4b

SHA512
666569bec0696d3151cc40c05b87ee2e2b185e63b5abb6bbd75f1ceb843aa26d5c0d2ae427f417d3d72553df6b812a46d89f2f901a7268afaf22301ab6ceaad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0bd0c7f9f3199b762fe9991528c858e6

SHA1
bd54fc99e04d467149f6b2125550afa8e2f510f5

SHA256
f06ef0022dfcb8af2ba7f9fa5d80a9a85f5f53931e56cd1c3a061e87c5531729

SHA512
9c0e7d92c725f398efdda8ce3cd50ab280e527c69c757fcabfe70db3ea01deb34292c5fb880dfa98e2fba67b85a5996130978ad10689fd384b03bca763b9e733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
40fccd459f8837de6c1776c30c110b8d

SHA1
a8294210574199d76e66758da6eb948537cebd44

SHA256
9c1292d9f742b0d77af6171db3cd459a456d632218e0e36c36d6e9d0eeb1fba3

SHA512
5216de2a45c10b7223d1722f47fcf8c1aff1af4249067c5eaec6a45e1b076d36dcc767d4ee64803e6a0d3ae248811c3226ca5af76251265f73224d4ac08f33f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ef408661fe33351d678bda2c9e1a1a35

SHA1
985cb8191e1c3e8e1dd0851c0770c5d8bbed9e28

SHA256
4179543035a4d0750c4ff3000d811e4c240cc2b54c899cec55355e319885f0e8

SHA512
ea9081922cc6ce0ea5447f1d6d31ed36ad84fe7c328ca8ec181eac72b2103ba2bb051a7af7f247dd5d6fb60b8f9c7cbbb5cc3fe7e914c3b6a5156e6d7f8aef0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
02bba0110dc01ad3fd4ea46407435056

SHA1
c92d8253f302092ac956ccf2fc612d5ebf813839

SHA256
ba7dcbe085fd069f843f71dff5f220cf196c41ee14c7da5ac6c944b7ba98621f

SHA512
fb1b4242b47d4e34ec8d47d8567505258353172a7a44ab34154372df39868980d74a3376e05c5405b56ff9a808caad62c4bf6fedb8ad142c252b0a681a91e40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6fb97583bc86a9fce83ba54564103a37

SHA1
a412cb2a21b6b70afe141951b94edc056acf80f8

SHA256
2bde0eb97281d2e512e502eee3f925b4939bbb910336dbea4cc1d2ba4c7cd0c2

SHA512
1a6444e9fef539e665087489de3798cd8ffd88e35e9a8a60970289c7c5972cfb0a27cf477498baf50fd2cbbee51916f7f27d10dcd302e9b9d602df7950c67c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f0bdc7642178bc56720ad6bd0346d220

SHA1
4fc20d3b74f27089f05bd4740cadfc6dc8af1ccb

SHA256
48a174eb824e76b3fcaebd95c6cf49771f9032777cdb740e3f660285b0c62613

SHA512
d22e1afbbf114ef993d13b75f4209abdca26d75fd2b2cf0ffbf702dd3f09720076e8d9810e245a6aca4dbbd2e218dc56cc3a15265d144590368459c52d4afe5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
931439a7bbb1a23fbd398a23b7f66ae7

SHA1
1e09492749fdb7bdd776e4892dd5975f8b919fb8

SHA256
ca21ce55f8f8dcd796c2e55ab996a5b5bda8e64f878a9f5b78566898d3380634

SHA512
9015a11831b4bc49d630b8eda2c3e14d7627be7e3ce226f120db25de26f74548e3e7596957bf3f783feaa581448cdf4bf0c86194ca2d888b70b29b2c5498b0be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12f025c17b38b675e1640641e39ecdc4

SHA1
ec744af91f34882b9be2402362982977be019af7

SHA256
8fe42da2e3546eb314214430e422ae3bdbbf3310e9c4b30c0dd9f63691f6c084

SHA512
ff6018b6c702e503789e3928c415ed0ad3e616c9f4564a51d3d0c6b0d4c87dafbf8c62f542b4dbc4bd7a0e74cc7dc13d1827f31a988337e795d133c2dca1c715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc13dc66602c3f590542aea1f0e06522

SHA1
f14eba9e3769ba06f3c33ca921cc201e57484557

SHA256
0278062e54ae3faa2d2c78c6f2ded5b2bc3b11b4c296daae2a513ef0a3415851

SHA512
a7155bf1e165c99072ac22a9dadcaab05eeb8c8f9c0bfdd665bfcd95a4c53ff80f17bc906b135393c023c49b4a0d6f1dd5fd70f6f269ee8b745b25309f833dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13e42170dbe18ee7dce8e893f3d0c479

SHA1
d8914df122678e0a5c017c4c44265902d4294346

SHA256
7a5d59fcafe00b0375ab3ca736338dd7ccf477111459b274c0c2c66665257f95

SHA512
6d58b81851ad92d84f44e878b7948aebb95d3561699a8c445eef28af16345a96a9588147254ae2de2ba238129a8108d137823e657166cc5aed3605fba952e9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1f1fe88d67356a544c3258533ec44f7

SHA1
1a264861f6e46c591476e49e6e8da2f30ccd18a4

SHA256
309f418668b5ae519b79a91aed8252db10e4f88bbfe24ac36f08944f2c57fdbd

SHA512
1217557572127c2fda707e53fbfbf46488329d830df3ee2d9aee32203603a962b21ac18fc8802dd2d3eab282e0affd1410d15868da22d45b6c3878f51afb02fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240928163044_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
58b28c8726f2f02340e47cdfc89f98e9

SHA1
38be8e8bebd703669d4d8f243c93b231dbda06e3

SHA256
81bdfa456af711ace6a4caca2405e488cb5f950fe634ef9448a92830add4660c

SHA512
948255ef737142e734ff73cd88cf67abe396be252e9cfd37734a5da015ea8441ed19aee5592540f81edb628fea9237636fbb88bd157e86e286b1809fb1fad596

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240928163044_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
e17067a4f2d854f4608322c67869a839

SHA1
d617c8c491b66568c7284e7d02ba0f032ed9a6f9

SHA256
ea2d98b4e624f35180de3f6e983715e57494df99d05ed938754ceffff9d56e0e

SHA512
13e0dc6f29339e71d2f0af921b1c2b2bf522d628963cc49e66df423675832dc6a0ca9ce786e94fefa9ca02c4f979b6ed3debfd1decc32e02b77d1b5966e3be9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240928163104_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
0166589b5cd33d6522dc1666d0f20489

SHA1
dc62357ed5001df5c983ad47055f811f17b0049c

SHA256
7cee9944770a5ee9f07681831c3b7431670558f63cdd14d9d6c4edce119c761d

SHA512
752cc12e6be7a7e06f02117e61906689c515cc3c369d9dae2e1b5063c61c3d9207746464039afde41026ed2cf6351024e4d624c64bc7cd6965873ca38aee0c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240928163104_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
4dc181af5d4232487194020a1007744b

SHA1
22eee068cafad9a2276de6aeae19fd34363dc1fd

SHA256
5b6ca7fdd1f165e00c449a7ee9d6002708e68e237ed597077a05a35b01609b75

SHA512
d320fe81e05e4460dd709ba7a4a115e92debf8312e6a1f2195ced1df71b0ec942fd55f92a609271cdeae21531397be10880008cc71b3020bb32f51fed8e9b525

Download Submit
C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
57KB

MD5
2e02ef3721bfaa2c7bfd490170913a3e

SHA1
3a68a23751d58f3455c6fc172f939012fcc986dc

SHA256
08e37896657b120c966244cc6d23b2395fa8d2f0858e70bf5bbab6d0e4af634a

SHA512
b70599277556cb180628f59f0b461fb6cb9471ee517f044a3449eb3cc6b9448ea213cd43b12682f49acea77c0ff7e4537409f3f2d26ef93da25f7f817f318b76

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe

Filesize
455KB

MD5
3284088a2d414d65e865004fdb641936

SHA1
7f3e9180d9025fc14c8a7868b763b0c3e7a900b4

SHA256
102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6

SHA512
6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.3MB

MD5
f5879f5f3ffa839a280ab853338de872

SHA1
3b4366abb2da245416531925ebd8c76adc3e90ef

SHA256
1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174

SHA512
96a88601cedf859c9fcd388d9e8d2fd6139f6e69ab6b05b0e044d1a598cd1a066d27a0f7a7c71bd77576dcdd083dec7a55f2cd9de52ff95aac23171c9f9670de

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503

Filesize
1010KB

MD5
361903c5ff86511786d7b450301dd640

SHA1
c9fc04a718a388294658590f1240d8c7e9ee4f82

SHA256
e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433

SHA512
78ceaaaa7f3e1a40ac2528e2f169416d6ebfaba54301754035f2a62f845421c8cddaed84770182e51794c9fb32720aec998d453de2bef621de7a7e2b3b35af20

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64

Filesize
140KB

MD5
4f782799f84cd006f7f1c750afb04d8c

SHA1
0cd219d326fd40665d2f1b22569e2517792edfd9

SHA256
8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc

SHA512
cfddad551aa5a35b032b7006b167fd322aff46ec8a2934632c087882b24404ee48083ee38b9110add9846880b1ae0bed136bb21ae751e1d3cde9dc27eaed5915

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64

Filesize
140KB

MD5
87b74c694f295830ffe516ba20de0b93

SHA1
e6996d47bb76ad25954b793f73211524490f55a9

SHA256
e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816

SHA512
d0fd7f8c8964a99ce7a9d187640acdbff4ca3d16f02e44696706d6107b58890e763a18857bec2b94f92ca559510fea0ae5515ce3de20aa4371aebb38006c05eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x64_vc12.exe

Filesize
6.9MB

MD5
49b1164f8e95ec6409ea83cdb352d8da

SHA1
1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

SHA256
a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

SHA512
29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2B99B15F-67AF-4355-807B-ED4878149FE8}\vcredist_x86_vc12.exe

Filesize
6.2MB

MD5
38a1b890ce847167d16567cf7b7a5642

SHA1
0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

SHA256
53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

SHA512
907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\license.rtf

Filesize
6KB

MD5
1e47ee7b71b22488068343df4ce30534

SHA1
deaee13f21ab70b57f44f0aa3128ec7ad9e3816a

SHA256
8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13

SHA512
c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\thm.xml

Filesize
5KB

MD5
0056f10a42638ea8b4befc614741ddd6

SHA1
61d488cfbea063e028a947cb1610ee372d873c9f

SHA256
6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87

SHA512
5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.be\vcredist_x86.exe

Filesize
455KB

MD5
0ce624d3a5a586c2bdda26b748da78d7

SHA1
b9ed0a86eae645ba19ed08327888a4474c95e34a

SHA256
fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d

SHA512
e5bc577bd319eb3ac70c527acfb313fac817e63f5184e6581f6d813491ca0f1a0f80583c14c2b9f2b8fa1df5938c2ae3318a91bda41171c63cd1670c55a85b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
973KB

MD5
258b65eb9fed187051d5fcec7ce65dc5

SHA1
b9afc5fcd8c6ca2ee3dfe9507e9adabdd9ded039

SHA256
80a29d5ce27c6794b9a38e5d5b98d535f877ac3363f450ee7ac0be9394426e49

SHA512
8d5b4c14deb07cc1bf70abfd6e04573822eff3b3937fb3867f5300d97c46f900f2446f923334d1cf5b51b17eeef063d6d59e8540456f310edecd98d223125bb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.7MB

MD5
7fe64755ed8427ee4512760b69cfaee1

SHA1
30b8c69a5eb83a1804975f04fd0e701e2e9d98cc

SHA256
e12efc1bc0c61a7b9ba10a07502ef6833297d028368760da26e63218b744da79

SHA512
dc6c9dc1cb0502be87281ad5bae3ed54c5cfc7cbc4434880f1ba7a33599fc5503d8192ce6afbcf8ffcc142955f593e9830e49e72c0d5c9a7aac5f91024eac38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeAdditional_x86

Filesize
140KB

MD5
b547a22dcdcf3d035a56f52f1b16c2b5

SHA1
ec9e2fbee0a5c43c021365a35d1d6d04eea335b3

SHA256
7cef0419f52c47f41b9546065e6788f20de07a7f1e647589ab52d88f6c7e50a5

SHA512
6d49cd8266575f3a9cac205425f1fc11b70a58b0a657ba3e4ebafab43cc37ccaf54f551cbf367c8c08b2a6710f82a18ccffb3870683a9b922c91cff19ea7b65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeMinimum_x86

Filesize
140KB

MD5
89d36fccb34b319b60d1850863e0560b

SHA1
f356410e3946063b85750f54998582510b9672c8

SHA256
60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf

SHA512
24e167d0305811409e433c8d78716e9b3af4bce4b3f372276f4730ae7c802b8be8f193a70ac0d44ad6e083a35f03fcfdb2faaae4a9975c9e2ef1254285b0309f

Download Submit
C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\Install Resolve 19.0b.exe

Filesize
2.2MB

MD5
2bcaa33e4d9123ebc9c5bb80b19754ed

SHA1
07d261fe90ae440625f0c2c86b01a7c4109c5f7b

SHA256
a37baa2ab6b8fde0bb291864e738c67f4f8aa799fc35ce9ffadb346a841c590f

SHA512
c4240be23e2d5cc0609637abc7e6ad490c2ae1e59b490c8b7ad50fe80647a8121acbe2313c327d22f1a9dcc0357b02b7b0d7c8829947e5eb8efda73e60da3931

Download Submit
C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\blackmagic.design.davinci.resolve.studio.19.0.0.59-patch.exe

Filesize
63KB

MD5
c1a2dfdfee24ff2cec5f1bb76d990642

SHA1
91b3ab03577f82fc847a8ff503e9fe61cd5fd8fc

SHA256
6d70fac767fbee3a30859fbf408b4f7dbfa1eff280543c473547cebe44016b73

SHA512
5fc0de7ee9c27939ad85682f892b5cd58413bfcf80d65a2cf7305e41ad87690610ca18a9d6edca0007809ce492d8620f8948582f5b094690513c375614632a1f

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
308KB

MD5
c4fe3f03efd3188252caa101f954ffeb

SHA1
98b613aee45c71aed9d2be0d61d7ace323929e9c

SHA256
95bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a

SHA512
80018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
5.4MB

MD5
e540e32dc0f1de104489ebb8d121c557

SHA1
4fa413bef6062f4c3dcd43d54c48120ad61fcfa7

SHA256
c918ce99e262420c2a7414bc019f38ce8c991622bebc0c0b2b5e582e3b26cfcc

SHA512
ff4e68ba7f702ed5453abd735584f02a876f744f16723d94c110db411d9f648fe1f18efd8a17b3f95277e73c7f2668b12cfaba71897041533be092669a4c2c09

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
5.4MB

MD5
bda662edbcc09f3b816ff2d1563500cf

SHA1
7c240310894e18558427c49b7e1bf13c397f9be3

SHA256
4720008617433038006b89031fafe459b4e1f7246c537ebd6df72ea386704f7a

SHA512
1b91d015e3fbd703e8bc8568b8cb5173b4120e5bd56e1843dda8353d1744253e468e467fe8a8d14634028ea87df856d062af2594865f255d1f83f160622e10ca

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
82KB

MD5
9ab741143a580e76755dbcef800563d3

SHA1
541bba78a3b01252fdecb60ddd0a7d5fc5da4301

SHA256
f15b4252eb211a1082d33498502bc69f2243a3d09cda5136dc798067b7ba752f

SHA512
aeeb37beb264cc870ee48abef80afe48dcf4fc9999e08009e52760a29949fb941dbc2039af217f06a60e09a83581b633095728499df275b4bd9bc811561a9352

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
82KB

MD5
648732592bc02cfc7d6482e0629f365c

SHA1
f9e9e40fa494ea6502e6137db4f9ffcf3040c1d3

SHA256
12dcbd0b01544354c95a6ec78c87ef2873d4d8a5743a73dc085cc6a65ddae160

SHA512
7b26ab4db00f408d790a7616ee0d4ee8d9175f13ca811deeb5be83f1633538df0fd9a4883ae2da676102856fb7e78c81de76d382bedc8a89b354e4a6b15c8d4b

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
552KB

MD5
cd0c37f1875b704f8eb08e397381ac16

SHA1
249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b

SHA256
d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a

SHA512
d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
23KB

MD5
8ad9c7cffbb2413f4d5ff9f3aaa1a69b

SHA1
2b5116e49ac5913ef8a512a7299e9a459dab4778

SHA256
18aef42187072c35b537be80e3b2da7ce4919b2c9574add19409d98e3026d916

SHA512
d489b82ce896a06cd37905bc5b2fe9620f4e7feb2a9b77fc93f94e0270b67e7a2f3879afba6b546ad44f2ee96f050e83bfc93830010a707126667857be79028a

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
181KB

MD5
84269806dce633e56e492ef060fa8f88

SHA1
a1e71cb750d25e7a63e0c9d0b01063df421f1938

SHA256
5fca695ed2cefec010d546310699226eef4b305df38cbe3dea2fdf9494abc163

SHA512
b25d25a35e6e431bacaf4d5fea0e40f3fe49cca14895c64ddbd78c212a2ef0b09b56616154a3d26813e9faaf3db1f6bb24a300b5f39b8ce286a41a12f6920ef1

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
54KB

MD5
1d2a0d23e35b93464bb5b09e5e4c02b2

SHA1
04d1a1eed3868433c5b7652ecae0fdcd29e1ef39

SHA256
a577b5fc4e3a14ae141657c30a38d11ff8593135e51e55485b252eb821d47e75

SHA512
18a0db760e4c4d9c4e014cff5ee0f433b298b65fdeca95b8f5f172b9bc534a1c7f64a1b2751b90e89cf76f41ee1ab468415466d2a657905eca9835e41cae264e

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
19KB

MD5
4266e7bb9bfce998083d2f4f938b11c9

SHA1
23fc9c4c9de9fd3e71941df86e26c4dd44f2a95b

SHA256
e1ee6d29e30708ad5812035626bbc1058ea12fd5503d5a79d28c9cb67fab4a14

SHA512
5dc1e769f973aec3f0f766ad7c2364a184b9f71c1266f5e5a874c3e63ca7082e9a2c38346d387aa516e2f23acaaf62979434819697b2695644883ce07bbfd867

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
326KB

MD5
7ef7eab654df53e087ac4703c9ea0b16

SHA1
743dc76d168326b60f09347945fe1342a6effc4c

SHA256
13e568fdcde1b7b7f2d1c97a474bdb8858f5ab761157f0fea7201ccecf84b9b8

SHA512
0b860f10c03acb3866e82fd6044c29d63a2c6a1d5f6628f3d31f1cd1e44d7144e3660df3446b7a0b76b7811b261675e5aa39fb27efeec060d287fde3e630edd2

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
36KB

MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Windows\Installer\MSI575F.tmp

Filesize
125KB

MD5
b2df81087dff189f36a83632d1c10881

SHA1
7a6d9196db3fc1bc6cba61d275345cecab94c090

SHA256
10cb5ecc9192fd12a779f198a0eb32681091293395a1e4c9b9d35ac0a8947f3f

SHA512
815878ec9e3691bb1f843b8e47896a422c9615de927eb97b5f99d9db90007aa6db152280ddfa56c76b86c2d7545679a115e2eb54d6abe068f416aea34f7273f3

Download Submit
C:\Windows\Installer\MSI628C.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI77DA.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\e6102e5.msi

Filesize
30.4MB

MD5
178947d0985da76f86f47457e8b665b4

SHA1
5b7bed37cbae69033f14687ce5bfc736ffd42053

SHA256
fffdbcfa7b513c0de0bda5fa2fdcfa9e84f9af4213fc275916275b54df1f981c

SHA512
df255776faa2fcc534f8a126c44bfc5da236758296e755f4f1d6fc806a1c7a436e93847df3460d09c3afd6de0cd2f006c668340e1fac4216662265eb76ed8ef2

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
19KB

MD5
1dabcf165886963d3afb1dc872057f81

SHA1
1307557466452b8a82cf4c233806e078d6e73ce9

SHA256
487142818709581b923789156efcdc5bf020e78c18d34d8dd6b1e19ec0babf16

SHA512
0136992c3d59d7035a439c95247b05f2531f88203115c62649bce37e4e2237436812592f5de8879a1ff1367a4c7604ef43d3116306fafb36c6c4b0974496855f

Download Submit
C:\Windows\System32\DriverStore\Temp\{7e64d3a1-48ed-c44c-9c00-86d269ac9e2e}\FairlightPanels.cat

Filesize
12KB

MD5
95dc4bb3186e8482b8616ea6cee69f62

SHA1
726695e911382ddad3552f4521dc04ff550cae53

SHA256
1a34bb0f8f48f470e3b9e07b432b46b2d8b1d5842786ee7ed8f9bc18c5a743db

SHA512
f02d94a6e5cadb80a0e0c106f91444d32e50a879ba5ee391cf94e33672fb388551a3d58ddaafe63ca8b6db47538946ff4d90d13f544f584ace01258875d0b822

Download Submit
C:\Windows\System32\DriverStore\Temp\{7e64d3a1-48ed-c44c-9c00-86d269ac9e2e}\FairlightPanels.inf

Filesize
2KB

MD5
181cb91bc4770186e9f50311067a2a50

SHA1
d767704478d3253b57dd224f239e418825668291

SHA256
49df39f50f382b8054dd54474801a2a334d00d655fe35b0b2127b685ec176bdc

SHA512
d2028055e23611c2f70abaaad7cb2798612ed1096bb337336da828423730da13ee04bf4d866e96085579a846ea6afe3e033931d64fa559b8cdd803a8247712f0

Download Submit
C:\Windows\System32\DriverStore\Temp\{7e64d3a1-48ed-c44c-9c00-86d269ac9e2e}\FairlightPanels.sys

Filesize
27KB

MD5
1de9bd0c69af971178c089a325502110

SHA1
3032fdb4f702d87fac872c1b24eee2b09f4290b9

SHA256
01dbc5e4c32773ddab6447dc54651fc2bbeb0b03586d061ad43b239d19cbc5f6

SHA512
eeefaee8157ccbc9f47416c0d827b409f9069787ebde7762330102d4cf58a5ebf2a7d8da3f842f91629b112f5245f6489168575128fc3a2e666975aaa5f72155

Download Submit
C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\DaVinciKeyboards.cat

Filesize
11KB

MD5
b902fd25f64157c7f9bd844d19e1e495

SHA1
7a42275995a5cd2937694a1525dccefd9f2af1cd

SHA256
a5deb1647ebee14f8df7ff16c72b8787af9d6a6eb4649d30048b2cfc718dcd0c

SHA512
759a944910c4c011b9e02acc4cf97095212db7e0101636d9b273cfbda35d49513332413333ef8b15701ff47319086162082be8228e032107d04b9757a8bbd218

Download Submit
C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\DaVinciKeyboards.inf

Filesize
1KB

MD5
78c694624641443a8a1dd8aef72a356f

SHA1
97e4f69e1ae0e9109f67231e5452e1bfa5302000

SHA256
1a16f18d9c0512f60ef0bbaa99e2ca72f0970333093673783f1ee1c14a79bd2a

SHA512
d40c13f03ea7eb51f7763b10b4fa9a48688c675f79cd4470e1b64fed52120059c081b34777d280906bcbc94a63a1e4fe6b3f85ca477da8f70a28c08ad4d9c8a4

Download Submit
C:\Windows\System32\DriverStore\Temp\{af012030-feb5-6e4d-bf1d-1be8b680f55d}\DaVinciKeyboards.sys

Filesize
27KB

MD5
3d2d254e23aba6fe3349953f3d7bec3d

SHA1
4d31565cbb013cbca3a2a89be7f06e03a6433e0e

SHA256
416d6c6ace773ca544d0fd997a898d91224c66f65778e9add1f30a493b4d76ce

SHA512
4ccee6ddefc3c3d59881d601f463c1d00cb714e27303fba391cae247950040a31901398acdb5c0531e6395220ec27ecc0d3069c90c55d28e7c8b972760737a1d

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
19KB

MD5
b7669ff0fb7229535f06669092da06b2

SHA1
7aef254b013f907fc576415d82e89c4531ad03a2

SHA256
f29f5132f60b8299d7d79a8e53004de5786d1eeffaeb64b7cdc786714a01c4aa

SHA512
715b2d681d3876f0b9b622bc274b67dad0d7b3dd48880e46209d9c2a97f9f0f2c227f1e68e32c35c91873d825074a7527dffee363038c7f2f48a7f514cd60b9e

Download Submit
memory/1264-1092-0x0000000000810000-0x0000000000875000-memory.dmp

Filesize
404KB

Download
memory/2092-1091-0x0000000000810000-0x0000000000875000-memory.dmp

Filesize
404KB

Download
memory/3724-2106-0x0000000075610000-0x0000000075637000-memory.dmp

Filesize
156KB

Download
memory/4408-697-0x0000000000DD0000-0x0000000000E35000-memory.dmp

Filesize
404KB

Download
memory/4496-348-0x00000000730E0000-0x0000000073107000-memory.dmp

Filesize
156KB

Download
memory/4596-696-0x0000000000DD0000-0x0000000000E35000-memory.dmp

Filesize
404KB

Download