d68edaaebc97db012bf9e89cc0f0ae71ad9f44228bd22d2658fa1a44206df381

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ToDesk (2).exe
Size

107.2MB
MD5

727ef69fd8802a5a9211f1b557674466
SHA1

2aa7bca568a5d9074181d8a52064d77ad5d2c544
SHA256

d68edaaebc97db012bf9e89cc0f0ae71ad9f44228bd22d2658fa1a44206df381
SHA512

74c4649854c268a95d6be9dedcf3882947a27c6c0023a4c918439f1ead577f9ba8972ede00565785f100c4bcf308ced177de5f2bff200dcc23603afb9d267ace
SSDEEP

3145728:EcGbmu6HFehEsw0Zfma2r9N8QfQnJMfQfC64:Vlehdw0Zea2rThfqMfQD4

Score

10^/10

discovery evasion persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000017487-62.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
1784	irsetup.exe
2852	ToDesk (2).exe
900	MSI3104.tmp
2964	VSpeedClient.exe

Loads dropped DLL 17 IoCs

pid	Process
1916	ToDesk (2).exe
1916	ToDesk (2).exe
1916	ToDesk (2).exe
1916	ToDesk (2).exe
1784	irsetup.exe
1784	irsetup.exe
2852	ToDesk (2).exe
2852	ToDesk (2).exe
2852	ToDesk (2).exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
2300	msiexec.exe
2964	VSpeedClient.exe
2964	VSpeedClient.exe
2964	VSpeedClient.exe
2964	VSpeedClient.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000016855-7.dat	upx
behavioral1/memory/1916-14-0x0000000003460000-0x000000000382B000-memory.dmp	upx
behavioral1/memory/1784-21-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral1/memory/1784-56-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral1/files/0x0007000000017487-62.dat	upx
behavioral1/memory/2852-66-0x0000000074910000-0x00000000749CA000-memory.dmp	upx
behavioral1/memory/2852-97-0x0000000074910000-0x00000000749CA000-memory.dmp	upx
behavioral1/memory/2852-174-0x0000000074910000-0x00000000749CA000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\SSD\SSD\cache_18_0	msiexec.exe
File created	C:\Program Files\SSD\SSD\cache_18_1	msiexec.exe
File created	C:\Program Files\SSD\SSD\cache_18_2	msiexec.exe
File created	C:\Program Files\SSD\SSD\cache_18_3	msiexec.exe
File created	C:\Program Files\SSD\SSD\cache_18_4	msiexec.exe
File created	C:\Program Files\SSD\SSD\ddd.exe	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f772cea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E34.tmp	msiexec.exe
File created	C:\Windows\Installer\f772ced.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3009.tmp	msiexec.exe
File created	C:\Windows\Installer\f772cef.msi	msiexec.exe
File created	C:\Windows\Installer\f772cea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3104.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f772ced.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2D86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSpeedClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk (2).exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2808	ipconfig.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	MSI3104.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSI3104.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	MSI3104.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03F481EDAF9460B43B585B8895547A4D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A6436633746B9E645B5569C70BF5CEB5\03F481EDAF9460B43B585B8895547A4D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03F481EDAF9460B43B585B8895547A4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\PackageCode = "4E47E257F74BD9E4E975402B96420C3F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\Net\1 = "C:\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A6436633746B9E645B5569C70BF5CEB5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\PackageName = "SSD-ww.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\Language = "2052"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\SourceList\LastUsedSource = "n;1;C:\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03F481EDAF9460B43B585B8895547A4D\ProductName = "SSD"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2300	msiexec.exe
2300	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	2300	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe
Token: SeLockMemoryPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeMachineAccountPrivilege	2784	msiexec.exe
Token: SeTcbPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeLoadDriverPrivilege	2784	msiexec.exe
Token: SeSystemProfilePrivilege	2784	msiexec.exe
Token: SeSystemtimePrivilege	2784	msiexec.exe
Token: SeProfSingleProcessPrivilege	2784	msiexec.exe
Token: SeIncBasePriorityPrivilege	2784	msiexec.exe
Token: SeCreatePagefilePrivilege	2784	msiexec.exe
Token: SeCreatePermanentPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeDebugPrivilege	2784	msiexec.exe
Token: SeAuditPrivilege	2784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2784	msiexec.exe
Token: SeChangeNotifyPrivilege	2784	msiexec.exe
Token: SeRemoteShutdownPrivilege	2784	msiexec.exe
Token: SeUndockPrivilege	2784	msiexec.exe
Token: SeSyncAgentPrivilege	2784	msiexec.exe
Token: SeEnableDelegationPrivilege	2784	msiexec.exe
Token: SeManageVolumePrivilege	2784	msiexec.exe
Token: SeImpersonatePrivilege	2784	msiexec.exe
Token: SeCreateGlobalPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	1732	vssvc.exe
Token: SeRestorePrivilege	1732	vssvc.exe
Token: SeAuditPrivilege	1732	vssvc.exe
Token: SeBackupPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	852	DrvInst.exe
Token: SeLoadDriverPrivilege	852	DrvInst.exe
Token: SeLoadDriverPrivilege	852	DrvInst.exe
Token: SeLoadDriverPrivilege	852	DrvInst.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2784	msiexec.exe
2784	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1784	irsetup.exe
1784	irsetup.exe
1756	mmc.exe
1756	mmc.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1916 wrote to memory of 1784	1916	ToDesk (2).exe	31
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2784	1784	irsetup.exe	32
PID 1784 wrote to memory of 2852	1784	irsetup.exe	33
PID 1784 wrote to memory of 2852	1784	irsetup.exe	33
PID 1784 wrote to memory of 2852	1784	irsetup.exe	33
PID 1784 wrote to memory of 2852	1784	irsetup.exe	33
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 1300	2300	msiexec.exe	38
PID 2300 wrote to memory of 900	2300	msiexec.exe	39
PID 2300 wrote to memory of 900	2300	msiexec.exe	39
PID 2300 wrote to memory of 900	2300	msiexec.exe	39
PID 900 wrote to memory of 932	900	MSI3104.tmp	40
PID 900 wrote to memory of 932	900	MSI3104.tmp	40
PID 900 wrote to memory of 932	900	MSI3104.tmp	40
PID 932 wrote to memory of 2808	932	cmd.exe	42
PID 932 wrote to memory of 2808	932	cmd.exe	42
PID 932 wrote to memory of 2808	932	cmd.exe	42
PID 900 wrote to memory of 1540	900	MSI3104.tmp	43
PID 900 wrote to memory of 1540	900	MSI3104.tmp	43
PID 900 wrote to memory of 1540	900	MSI3104.tmp	43
PID 900 wrote to memory of 3040	900	MSI3104.tmp	45
PID 900 wrote to memory of 3040	900	MSI3104.tmp	45
PID 900 wrote to memory of 3040	900	MSI3104.tmp	45
PID 3040 wrote to memory of 3020	3040	cmd.exe	47
PID 3040 wrote to memory of 3020	3040	cmd.exe	47
PID 3040 wrote to memory of 3020	3040	cmd.exe	47
PID 3040 wrote to memory of 1760	3040	cmd.exe	48
PID 3040 wrote to memory of 1760	3040	cmd.exe	48
PID 3040 wrote to memory of 1760	3040	cmd.exe	48
PID 3040 wrote to memory of 996	3040	cmd.exe	49
PID 3040 wrote to memory of 996	3040	cmd.exe	49
PID 3040 wrote to memory of 996	3040	cmd.exe	49
PID 900 wrote to memory of 1844	900	MSI3104.tmp	50
PID 900 wrote to memory of 1844	900	MSI3104.tmp	50
PID 900 wrote to memory of 1844	900	MSI3104.tmp	50
PID 1756 wrote to memory of 2964	1756	mmc.exe	53
PID 1756 wrote to memory of 2964	1756	mmc.exe	53
PID 1756 wrote to memory of 2964	1756	mmc.exe	53
PID 1756 wrote to memory of 2964	1756	mmc.exe	53

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ToDesk (2).exe
"C:\Users\Admin\AppData\Local\Temp\ToDesk (2).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\ToDesk (2).exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1846800975-3917212583-2893086201-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\SSD-ww.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2784
- - C:\ToDesk (2).exe
    "C:\ToDesk (2).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1CDBD452CE12A5DBF88174170E1BB6AA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1300
- C:\Windows\Installer\MSI3104.tmp
  "C:\Windows\Installer\MSI3104.tmp"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2808
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" -f C:\Users\Public\Pictures\5o5f8.xml
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies data under HKEY_USERS
    PID:1540
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\Z455H.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:3020
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:1760
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:996
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\MeEp7\58aTU~ww\p+C:\Users\Public\Pictures\MeEp7\58aTU~ww\w C:\Users\Public\Pictures\MeEp7\58aTU~ww\StreamEngine.dll
    3⤵
    PID:1844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002B4" "00000000000002B8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Public\Pictures\MeEp7\58aTU~ww\VSpeedClient.exe
  "C:\Users\Public\Pictures\MeEp7\58aTU~ww\VSpeedClient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f772cee.rbs

Filesize
7KB

MD5
e057bec80f1169295ba9d66483f39e90

SHA1
c8eb491930bf0426234fcdd197555182b79128ff

SHA256
a7897f28eb12faee61d6cef32085a987c4e0f2c7ba08523d44c0a065cd5c1bf9

SHA512
83f2ed2fdf2b25cb6f1a4cfd8b7849ec2a16900bfddc758e24fc8ceaa8fc4ec64eb9dc5fba9af4e7d090aa7b658dbf53215477ecc23e764a8ec7457e8e216229

Download Submit
C:\SSD-ww.msi

Filesize
21.9MB

MD5
322ed0425777bdd9a0622802c1cb4817

SHA1
b1034dab33ad2a2baf5874fc42a619cd8c6a834e

SHA256
89ae59ac9e6e54f2597759d01132c6071300e2ee6a0fcc6a9b2b0c8e4855a531

SHA512
863427741f74f633bee93cf4ad1be7c62b258e8e3a8d754369dd1122605d6c5b2ba63b04d85346e8a95a883585dabee240d998fa5cac8aa45c6ee56ce4e2468d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7BF.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7BF.tmp\skin.zip

Filesize
733KB

MD5
121c40b2f8f3407211a14efec60088d3

SHA1
36bb7a0d4132f10cb165eb2b388489d7b9b3057c

SHA256
6c979c5efd4bca0ea050f24c2a063ce88d3fc02dfa4bc11f3bdb169da6e0875b

SHA512
23efc5b5c0ccc25ec568557f9e7a9a8237fbc86a9ccec7214b7e68482171c6a8077a8a1ffc123ce0078ec2771b00b0494a713289a2215919625e1911a5608266

Download Submit
C:\Users\Admin\AppData\Roaming\Z455H.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\MeEp7\58aTU~ww\ClientShell.dll

Filesize
212KB

MD5
911b261f1597897a78be05166c847dae

SHA1
65fab80c1da705b710551b36a8c44111b10c98d9

SHA256
a70b05531f955a577560ef08a500dc405e35d7a31180c3fcabfd56657e47f510

SHA512
a79e3f8affd25d0925574bcf382657308cb86bed80fcc51a84a135b7ed53637aaf80fbba4b900b115e4c8042d2aa5a720625410e9cbf258bbd68cf9f51dbe487

Download Submit
C:\Users\Public\Pictures\MeEp7\58aTU~ww\NH.txt

Filesize
179KB

MD5
01bcb4d28321f659cc9254be39535b98

SHA1
31e8be201441d8d8ab0edde11b0cd2160e03841d

SHA256
28e2a38278d91320ecffdcad84ae94b878f18ee01756432abbb9d568a12926be

SHA512
aaa978445fd45e25d472de2f5e49a179eded6553894527f66efef0862a5da5886c6b93f1a31f0c46e4f42753d4d8a12bc8d6998be5a32def355dd4ae7455af71

Download Submit
C:\Users\Public\Pictures\MeEp7\58aTU~ww\VSpeedClient.exe

Filesize
1.2MB

MD5
e3c674e4d894a0b1b53121e79d35bc87

SHA1
a15c7f16e019ee3b8895048e10194ffdd6e4215d

SHA256
0c1438dfa2c863b95b7546b5820c69dabfa7f479190be5e74462ce259cd5fd70

SHA512
d256551af0068b3ffc726613893206715f32656d4722c67106acf0c125ad5dc54086038399a72941a4cd8b175caa4b0f0106cb875c0ca9601b8110ee699e6366

Download Submit
C:\Users\Public\Pictures\MeEp7\58aTU~ww\p

Filesize
888KB

MD5
7a35e73367a2d8c0dbdd3f5edf04dc80

SHA1
cb287efeea8c269d4627d9998d344b9874ccd76e

SHA256
e371d248fa2e2e825e72a41f1132ed6e608730583a6ba93c3882994912db0bc1

SHA512
9f039c1834522bafd0399d18e548fd4730c72842de28acb5a839e68b2de2f8440d7f0adb3b0324a60bc1158acab95fdcdf6168d2f57788c257620d15e5214395

Download Submit
C:\Users\Public\Pictures\MeEp7\58aTU~ww\w

Filesize
888KB

MD5
64f63170cd52ee26b8a0d27f6f00bea0

SHA1
7a51b15031606a70cfa7235b2beed5a2096e92aa

SHA256
78d10f5700d729a62ed5f6d0446b5b04d110300988b0a86787590ee635fb274f

SHA512
96c347e9f3075c69f3ef3ffb436645b18dec13c7791f90373c3382cc0d8dbdb017a459aaef4043336d0f467fdb61320af7a7b58dd0f8234662fb940c93edda94

Download Submit
C:\Windows\Installer\MSI2D86.tmp

Filesize
557KB

MD5
db7612f0fd6408d664185cfc81bef0cb

SHA1
19a6334ec00365b4f4e57d387ed885b32aa7c9aa

SHA256
e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

SHA512
25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
8588009f37c0775b2ca08c70da61a12b

SHA1
b46b012936c50e74c92cdef6a3f2818a76235a37

SHA256
5ba9ee2908a357e83f6bb222928ad86ee6bd9f7ce233276935ff883aca6b9b38

SHA512
95e107f16687ce0a905a34611286ad3eb9c30f188db34f49582f9bb468f7b99d96877ea98ffd356508ca48b29f91bf8a67b134ab2e74d146f6cda961a044f184

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
\Users\Admin\AppData\Local\Temp\nso7BF.tmp\nsNiuniuSkin.dll

Filesize
287KB

MD5
bb0cdff5ac2d64723007a0b4f7962a02

SHA1
410889522ee8ea7308b054f71bc4cab078295e06

SHA256
33e460a080a621cda7896e96b6f1beee802b485cf99e18b27463cd362c484b08

SHA512
b4dc2614f01f5f01d5dec9e6a41e072d01e924d8a94ac0dc1050399fd1dc3cc8d53d7ccf162d750d166fca200771b0850191b30c7caada8edea9ba6d686e2402

Download Submit
\Users\Public\Pictures\MeEp7\58aTU~ww\P2PNet.dll

Filesize
248KB

MD5
0129d9ec5e0631b6801e01dd1eb18337

SHA1
42684e0de84bb6930f69c690f467795f9bd41f94

SHA256
599b515a62b92d53008fecfab80096f6d9ff24727037c7549bfa34ec18cdb1b2

SHA512
0a2da208614e2dc003356f41b99be6192925f6817870d735e13522b78d8d9368a2c4e2c32adca8294da3c5498666a012c490e1a662b83bc04adc46e1b148200a

Download Submit
\Users\Public\Pictures\MeEp7\58aTU~ww\RoomShell.dll

Filesize
160KB

MD5
1a28e9ee25ad1a0058673ff4d649a78a

SHA1
0e2737769faefeac7cff1f1cd244af142de8344d

SHA256
e56d815d0be4bd7d076d9c4374db535b1dcd044513f7a7f8d9150f598aab01f8

SHA512
783afaefeb6230157f1ece22dfd52615b1e696ca9c64308dfc7d1e4e939fbebe1ddb051593c1b00a182599ea41f91212cb945baf05bfb7fb1fc5ea2234ba2450

Download Submit
\Users\Public\Pictures\MeEp7\58aTU~ww\StreamEngine.dll

Filesize
1.7MB

MD5
a1ce0c5e873696cd30fb2ac2b95538d3

SHA1
e066cdb8be29f30b2ebd9b994aa568e466cc2e44

SHA256
b7b4d032a25481b286eb2678c702f69cf92f94ea5798469b51646906464b48ee

SHA512
4e2389b52e2c25ffeadd2be47ce452f62291d94fc0e6d689436f9a5e4a1c7cc7b369afb4e08a4a13a7bd392536e61d4f3599045506eb41b28feea4e05a6391a1

Download Submit
\Windows\Installer\MSI3104.tmp

Filesize
14.2MB

MD5
31514994bb708a57092ee814043e74b5

SHA1
89f3041396b6dc5ec41fe0e774806a7d4ea2a7b1

SHA256
9d065d74419fa9b28f10026fdc27b12b5eb14d33c73b2aaf17a2c75f960cb7d0

SHA512
2e6b0819d9da2a44e7d65faf2ba24075a3b39d918d0a60d8bdfb42a6d8b9f59e3183ab2d1b14aab49624b21b6ae4fdd4a6f625185234ca569e4f5d8c31e8aa4b

Download Submit
memory/900-127-0x0000000180000000-0x000000018023A000-memory.dmp

Filesize
2.2MB

Download
memory/900-128-0x0000000180000000-0x000000018023A000-memory.dmp

Filesize
2.2MB

Download
memory/900-129-0x0000000180000000-0x000000018023A000-memory.dmp

Filesize
2.2MB

Download
memory/1784-21-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/1784-36-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/1784-56-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/1916-15-0x0000000003460000-0x000000000382B000-memory.dmp

Filesize
3.8MB

Download
memory/1916-14-0x0000000003460000-0x000000000382B000-memory.dmp

Filesize
3.8MB

Download
memory/2852-66-0x0000000074910000-0x00000000749CA000-memory.dmp

Filesize
744KB

Download
memory/2852-97-0x0000000074910000-0x00000000749CA000-memory.dmp

Filesize
744KB

Download
memory/2852-174-0x0000000074910000-0x00000000749CA000-memory.dmp

Filesize
744KB

Download
memory/2964-160-0x0000000001FD0000-0x0000000002039000-memory.dmp

Filesize
420KB

Download
memory/2964-157-0x0000000000260000-0x00000000002A5000-memory.dmp

Filesize
276KB

Download
memory/2964-151-0x0000000000230000-0x000000000025C000-memory.dmp

Filesize
176KB

Download