50b817a59adb7320afe3d3ee6889b95ae1f93f097b04ad80970e4814cdfd0009

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

529c119d77f942f4b40478de71153b31_JaffaCakes118.exe
Size

6.2MB
MD5

529c119d77f942f4b40478de71153b31
SHA1

7fe9ef6b3697370597a051cfd9e3f1fbd495b6f2
SHA256

50b817a59adb7320afe3d3ee6889b95ae1f93f097b04ad80970e4814cdfd0009
SHA512

c20934a25de5cf118a622f26fe910a4c122493cb1a3fbfed89ab9e7fdda77e006e3acf10c10c41072c43819205bd4fafed86e395c94f1f7b1572b6b65914fb5d
SSDEEP

98304:Bzyhh5OoQGVSreXLqdxygFEJbrTv6qk6d6CgRThIdby7vryufkFTmaSn:BzytBQte58EJb+CQTC47TyufYjSn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4056	langinstall.exe

Loads dropped DLL 1 IoCs

pid	Process
4544	MsiExec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
24	2432	MSIEXEC.EXE
26	2432	MSIEXEC.EXE
28	2432	MSIEXEC.EXE
57	3256	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscomct2.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\RMLanguage\LangInstall.exe	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\msvcr71.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\System\ole db\vfpoledb.dll	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\TurningUpdater.exe	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\MailWebService.dll	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\ContextWebService.dll	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\RMLanguage\lang_en	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\RMHelp\ResultsManager_en.chm	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\ResultsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\Turning Technologies\ResultsManager\ChilkatDotNet.dll	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{DAF232B7-5749-4F36-A7E5-C7094062778D}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\e58676f.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A7D.tmp	msiexec.exe
File created	C:\Windows\Installer\e586771.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B	msiexec.exe
File opened for modification	C:\Windows\Installer\{DAF232B7-5749-4F36-A7E5-C7094062778D}\NewShortcut2_8B715E8750104B859B8DD71D0E1CC99C.exe	msiexec.exe
File created	C:\Windows\Installer\{DAF232B7-5749-4F36-A7E5-C7094062778D}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\{DAF232B7-5749-4F36-A7E5-C7094062778D}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{DAF232B7-5749-4F36-A7E5-C7094062778D}\NewShortcut2_8B715E8750104B859B8DD71D0E1CC99C.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\e58676f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\{DAF232B7-5749-4F36-A7E5-C7094062778D}\NewShortcut1_BE0652EAB38041C7961216DDB7DAF048.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{DAF232B7-5749-4F36-A7E5-C7094062778D}\NewShortcut1_BE0652EAB38041C7961216DDB7DAF048.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7B232FAD947563F47A5E7C90042677D8\1.2.3\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	529c119d77f942f4b40478de71153b31_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	langinstall.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fc5eef0dbaffe7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fc5eef00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009fc5eef0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fc5eef0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fc5eef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Turning Technologies\|ResultsManager\|MailWebService.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\MiscStatus\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\ = "IButton"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ = "DImageComboEvents"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50BAEED9-ED25-11D2-B97B-000000000000}\OLEDB_SERVICES = "4294967295"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{66833FE5-8583-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\ = "Microsoft ImageList Control 6.0 (SP4)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{50BAEEDB-ED25-11D2-B97B-000000000000}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32\InprocServer32 = 31002500470047006f004e0040007e004e0041002c0032003500300026007b00700064004f0055003e00640062004b0078002d006c0062006d006600280047006e002c004c005b005b0051007e0043004e0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FE387539-44A3-11D1-B5B7-0000C09000C4}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\ = "IButtonMenu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B232FAD947563F47A5E7C90042677D8\ProductIcon = "C:\\Windows\\Installer\\{DAF232B7-5749-4F36-A7E5-C7094062778D}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\MiscStatus\1\ = "131473"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{586A6355-87C8-11D1-8BE3-0000F8754DA1}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Version\ = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscomct2.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "131473"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "237969"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F049-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComCtl2.DTPicker.2\CLSID\ = "{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscomctl.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20DD1B9B-87C4-11D1-8BE3-0000F8754DA1}\TypeLib\ = "{86CF1D34-0C5F-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\ = "Microsoft Date and Time Picker Control 6.0 (SP4)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FE387538-44A3-11D1-B5B7-0000C09000C4}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\ToolboxBitmap32	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3256	msiexec.exe
3256	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2432	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2432	MSIEXEC.EXE
Token: SeSecurityPrivilege	3256	msiexec.exe
Token: SeCreateTokenPrivilege	2432	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2432	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2432	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2432	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2432	MSIEXEC.EXE
Token: SeTcbPrivilege	2432	MSIEXEC.EXE
Token: SeSecurityPrivilege	2432	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2432	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2432	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2432	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2432	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2432	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2432	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2432	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2432	MSIEXEC.EXE
Token: SeBackupPrivilege	2432	MSIEXEC.EXE
Token: SeRestorePrivilege	2432	MSIEXEC.EXE
Token: SeShutdownPrivilege	2432	MSIEXEC.EXE
Token: SeDebugPrivilege	2432	MSIEXEC.EXE
Token: SeAuditPrivilege	2432	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2432	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2432	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2432	MSIEXEC.EXE
Token: SeUndockPrivilege	2432	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2432	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2432	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2432	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2432	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2432	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2432	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2432	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2432	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2432	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2432	MSIEXEC.EXE
Token: SeTcbPrivilege	2432	MSIEXEC.EXE
Token: SeSecurityPrivilege	2432	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2432	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2432	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2432	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2432	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2432	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2432	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2432	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2432	MSIEXEC.EXE
Token: SeBackupPrivilege	2432	MSIEXEC.EXE
Token: SeRestorePrivilege	2432	MSIEXEC.EXE
Token: SeShutdownPrivilege	2432	MSIEXEC.EXE
Token: SeDebugPrivilege	2432	MSIEXEC.EXE
Token: SeAuditPrivilege	2432	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2432	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2432	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2432	MSIEXEC.EXE
Token: SeUndockPrivilege	2432	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2432	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2432	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2432	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2432	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2432	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2432	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2432	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2432	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2432	MSIEXEC.EXE
2432	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2432	5064	529c119d77f942f4b40478de71153b31_JaffaCakes118.exe	91
PID 5064 wrote to memory of 2432	5064	529c119d77f942f4b40478de71153b31_JaffaCakes118.exe	91
PID 5064 wrote to memory of 2432	5064	529c119d77f942f4b40478de71153b31_JaffaCakes118.exe	91
PID 3256 wrote to memory of 4544	3256	msiexec.exe	95
PID 3256 wrote to memory of 4544	3256	msiexec.exe	95
PID 3256 wrote to memory of 4544	3256	msiexec.exe	95
PID 3256 wrote to memory of 3332	3256	msiexec.exe	104
PID 3256 wrote to memory of 3332	3256	msiexec.exe	104
PID 3256 wrote to memory of 4056	3256	msiexec.exe	107
PID 3256 wrote to memory of 4056	3256	msiexec.exe	107
PID 3256 wrote to memory of 4056	3256	msiexec.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\529c119d77f942f4b40478de71153b31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\529c119d77f942f4b40478de71153b31_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\ProgramData\Turning Technologies\{02A4197B-9014-40F0-B6BB-09102159EED0}\ResultsManager.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="529c119d77f942f4b40478de71153b31_JaffaCakes118.exe"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 466F6E2321C5B1FA39A806D0D6144786 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4544
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Turning Technologies\ResultsManager\RMLanguage\langinstall.exe
  "C:\Program Files (x86)\Turning Technologies\ResultsManager\RMLanguage\langinstall.exe" 1 AllUsers "C:\Program Files (x86)\Turning Technologies\ResultsManager\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e586770.rbs

Filesize
332KB

MD5
c3a3e302a9e03199834017864323a002

SHA1
8e3e478219ca45a2aad91d84da10b52983f85f81

SHA256
f723619640f1b29faf6a32a67ca722a46fbd48c5a7c9990f433dc47516af1dc9

SHA512
68fc59aaf41f7f241cd3398a4c0d86f496bf74bdac482544b469cc39d7d214efb0fb6a21125beb4985f89baf6df353b2a702810049340aa237dce6e4d73a6db1

Download Submit
C:\Program Files (x86)\Turning Technologies\ResultsManager\RMLanguage\LangInstall.exe

Filesize
32KB

MD5
779ca48477ecf5ec91db153cc7b11710

SHA1
b974fa7a0de497929efe13fb87ddc55c06c0463b

SHA256
410c7a65524c5923ed492fe26966cd940ad967782e955417e81fe5b2135722c2

SHA512
92c710451e062397fed23fb209fba6ee4aaf8feac7dde2cf85511b67fe6f18c286834be0a1fb94d3792d378c0e2daabf7a029372b8a5589790f0cb35ef665f79

Download Submit
C:\Program Files (x86)\Turning Technologies\ResultsManager\ResultsManager.exe

Filesize
5.7MB

MD5
654cc593b156e041cf060cbf7e3d19bd

SHA1
b7005acb30e92f215aef7a8e6f5d133b281d7def

SHA256
347c85b5b7f77f11012f154eaf1d67aac0e73ba0718ea70deeae2348ac1077cf

SHA512
85821dfcedb06ee2a739b1c0ee908a674cdbd4442e9d2f0ffa497c2468a5b38943bf49697461635cb35a0f2038ef676a26a51c75cc2ac4addf44f02779c11de0

Download Submit
C:\ProgramData\Turning Technologies\{02A4197B-9014-40F0-B6BB-09102159EED0}\ResultsManager.msi

Filesize
6.7MB

MD5
496aa443001133bbf1711aba0d1304bf

SHA1
7d6f5fdbe335460bc7a79764ee4e1d88b7c3da41

SHA256
7152a694ba403656297f52839cff86948f1ff69170e9a84d26b289069c68af71

SHA512
5d462cad818344ee3accbf474bd975656650dae7bec3e1265a4421dd8cf471804b34986ceb04f6dca90a964fa9cacf7136fcf5200d3b056b26a8aaf7dc876f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1

Filesize
306B

MD5
7ff11e99671f6f44dcf19f098a8e07d3

SHA1
10a36cb46f4923731166484c440402d4525a36f1

SHA256
58a67ff3b5d2c7436faa796b1aaa355bb2f6fa1ea15514103f53199e69f6b65e

SHA512
92796b3c433c5be886598bddb6f6024c65cd09149f8464697e2b4e8933a1a74bbd6bcc5d4fc4e874baa77bcfdab0b6c7a2ef60a8b8cb06c59593d16cdc684cd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019

Filesize
466B

MD5
7be3a290648de1cbc263285b1fcca644

SHA1
da4dfbc6d47a07090f48f60879d0168291ebfff2

SHA256
3a12922397153c58dd7e4ae96251b006b4dcbc84163e23a2cd8b6a111d6c3723

SHA512
4464b303a95ecc35188cd10f6eb89e696d1288c152a51eac1832a5dbdc5d6c8f8ab7e5ae82948233515d53a5fe04887fbb11fd897a5165541250c473848a5b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E7B158B31D45761A93C56C441E33DD68_75199AA9D5EF05805982F56A43B8D77D

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1

Filesize
208B

MD5
b657f07dccc82c8a65df883deb8f69ad

SHA1
d051c85afaae19d6eb2c91de454167fe34c860be

SHA256
be85881a8c37925e65125ff9093995ee95d619b72a4026bf644dce021debe676

SHA512
a136703b0dc97f9d06f011bba2a55cbaa910d75b72d49d7e5e00f37c40c5593891fc1e800a319a91da372771f302ba211b1212ba5f4a1561097e39e9cecfd30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019

Filesize
242B

MD5
fdc7825d2b7d87c88d17fe039f393340

SHA1
466693d3319c1a5fe59caaa02997641dd0d13738

SHA256
080148dedd0453c43af77cd2fa6697e9e6daaa0a865522526ec6a6baa1a4286c

SHA512
2541270d65afdeae35cca9eb42a6ea1c23e4abc45bb9f6ba011104decf777c64eb9448163967f553287cc4363403b5aab1bd36a0048869597488fc8ff745df18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E7B158B31D45761A93C56C441E33DD68_75199AA9D5EF05805982F56A43B8D77D

Filesize
408B

MD5
9851f7a320828349f16ab7600e989e77

SHA1
4d19698067be8544da2754ea352d7e9d01f8681d

SHA256
bb5649ceb2f0a9f99dfbab281040670adef5cc9ac9981e8cfeccb3870abebd90

SHA512
024dc4b66f3b8273c32ee6b8e026460250dcf7a7066d6d58c49a34985a004af6b481ae844e8577a96c31e2c95a5684795fd02868d662da002e105042e6a20ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICA84.tmp

Filesize
122KB

MD5
2c65cc2f1516e8eed2f01ee5efa60c93

SHA1
fa8ace92bdf6cb522357384b352389d08b0464de

SHA256
1af4d7548834c516d02c04e13f446dfb528e01f3352eabe8a6c7528e4caffeca

SHA512
f5a55023883795a0c27020ffcf6b4a33c37faefa808e45afbeea1f1b8eb07c4b6a82ef4dfc729d66d8cf93f8f7ffaf3f36e0c7c1cd7cddd76934b23380567f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_isB1C1.tmp

Filesize
1KB

MD5
05a53902617b8389ebe59526b29c4727

SHA1
5f3601007600400114e123e6921ba17d42bd4458

SHA256
510965c3acfc11d5544377fc014e6a45125daf21c0b215f1ec190d04116bcce5

SHA512
377b6a275fc5f3a2d49dea98421388ec4989d9529ae51d1778def1467e2cc600f8f28bdbde755e2a12b31b60fb80c972ebec15a78539f4aa53e7d166311ead6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2DDE27BF-D05A-4BFC-90F5-99DD3080F993}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2DDE27BF-D05A-4BFC-90F5-99DD3080F993}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~B1BE.tmp

Filesize
5KB

MD5
417ca8c81188b97bae37f583ff96204e

SHA1
9a0224380f6c4b2b93ab3a9b53b3497ddc2071da

SHA256
70ed121b453afb372a84fb141ddb63795cd3a3738e46dd4300e4d2554adf597d

SHA512
87aea8084c0fce3184a833ecc0b26af7548aa98f7241d7eb84f6d799f782321d9efbdbb614eeccbf8c4a015a0105bd4f3bd4228efb7d507deab104cf228c4aa7

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
e466583a91fb676a4d53d78ab81626a3

SHA1
684ea3b84e391aa2fa23faa8053cb1a296ce4204

SHA256
4a970b8812a87154456293ef9a5a506792797816566cec0b9a6950620b1b546f

SHA512
83a9a91764d60f1ccdbfeefe82f8445737ccc6e2ec34c5b0c9d853dc8fce618cf2d63aa4e614358bf7db330f8163856b515de7415b5349515365d99239964ba6

Download Submit
\??\Volume{f0eec59f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8c941140-4426-491c-b052-64116bd4c0ed}_OnDiskSnapshotProp

Filesize
6KB

MD5
4a039f5e70fbf7c8445a91a0a6dd0e0a

SHA1
087a153ed84f4a66d2085b1810892ed9f44d8c5c

SHA256
72b2af44f67c9851542f53ddb268b0c1a86e4e72389727b376036fad3a575e07

SHA512
929dec51f6ff1c0d31cbe6723bf00c6264ae54bb17c07969a50e164177c0bbcfb6bb34edb124afe8e497ff4e756eb4817e7c5569baadcc5bb4ea4ff43e5e150d

Download Submit