1cd8f56f9213249e555dedda4380add02cbe74fb81a5806ef1eec3935a7f041a

Analysis

max time kernel
291s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08112024_1447_BluetraitAgent381.msi
Size

3.6MB
MD5

0c7d30468c0d5975866b6f10017330d9
SHA1

0f2d7d1d9fa10d46e8d73c75db7509f950578bc6
SHA256

1cd8f56f9213249e555dedda4380add02cbe74fb81a5806ef1eec3935a7f041a
SHA512

6b42376e6c0b69eb5e005a64c1cf6e92a27938ede43badf599c496a508c7d10e5178109e899de79d4aa01b15d982c748f3e5ece657815916f68dcd3fdb2dfd5e
SSDEEP

98304:7JAqhv+JtUaJRWta/Tbs9JVzlgroDWX9Ha:7Jzhv+MaR/c93BW2S9

Score

6^/10

discovery evasion execution lateral_movement persistence privilege_escalation trojan

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2308	msiexec.exe
6	2308	msiexec.exe
8	2308	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4888	powershell.exe
2860	powershell.exe
4432	powershell.exe
4752	powershell.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
876	netsh.exe
980	netsh.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

lateral_movement

SMB/Windows Admin Shares

T1021.002

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	osqueryi.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Bluetrait Agent\BluetraitUserAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Microsoft.Management.Infrastructure.dll	msiexec.exe
File opened for modification	C:\Program Files\Level\level.log	level.exe
File opened for modification	C:\Program Files\Level\level.db-wal	level.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Newtonsoft.Json.dll	msiexec.exe
File opened for modification	C:\Program Files\Level\level.db	level.exe
File created	C:\Program Files (x86)\Bluetrait Agent\config.json	Bluetrait MSP Agent.exe
File opened for modification	C:\Program Files (x86)\Bluetrait Agent\config.db	Bluetrait MSP Agent.exe
File opened for modification	C:\Program Files\Level\level.exe	level-windows-amd64.exe
File created	C:\Program Files (x86)\Bluetrait Agent\HidSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\x64\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Renci.SshNet.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\SharpSnmpLib.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\System.Data.SQLite.Linq.dll	msiexec.exe
File opened for modification	C:\Program Files\Level\winpty-agent.exe	level.exe
File created	C:\Program Files\Level\winpty.dll	level-windows-amd64.exe
File opened for modification	C:\Program Files\Level\level.db-journal	level.exe
File opened for modification	C:\Program Files\Level\level.db-shm	level.exe
File created	C:\Program Files (x86)\Bluetrait Agent\LibreHardwareMonitorLib.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Bluetrait Agent\config.db-journal	Bluetrait MSP Agent.exe
File opened for modification	C:\Program Files\Level\level.log	level-windows-amd64.exe
File created	C:\Program Files\Level\winpty-agent.exe	level-windows-amd64.exe
File created	C:\Program Files (x86)\Bluetrait Agent\System.Management.Automation.dll	msiexec.exe
File opened for modification	C:\Program Files\Level\winpty.dll	level.exe
File created	C:\Program Files\Level\level-remote-control-ffmpeg.exe.download	level-windows-amd64.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Newtonsoft.Json.xml	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\libraries\paexec.exe	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\SharpSnmpLib.pdb	msiexec.exe
File created	C:\Program Files\Level\osqueryi.exe.download	level-windows-amd64.exe
File created	C:\Program Files (x86)\Bluetrait Agent\defaults.json	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57b2c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB827.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB922.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{BB4D0FA4-BF8E-4478-98EC-07A9378FB205}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{BB4D0FA4-BF8E-4478-98EC-07A9378FB205}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB42D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB45D.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6A0.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b2c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE498.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b2c5.msi	msiexec.exe

Executes dropped EXE 12 IoCs

pid	Process
1420	Bluetrait MSP Agent.exe
4428	install_windows.exe
4732	level-windows-amd64.exe
4412	level.exe
3884	osqueryi.exe
4372	osqueryi.exe
4752	osqueryi.exe
3300	osqueryi.exe
4284	osqueryi.exe
3144	osqueryi.exe
2984	osqueryi.exe
3180	osqueryi.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3672	sc.exe
532	sc.exe
5080	sc.exe

Loads dropped DLL 6 IoCs

pid	Process
4920	MsiExec.exe
4920	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
1420	Bluetrait MSP Agent.exe
4920	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	osqueryi.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2308	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041ba55ff39bb976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041ba55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090041ba55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41ba55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000041ba55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bluetrait MSP Agent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryi.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryi.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	osqueryi.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Bluetrait MSP Agent.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	install_windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	install_windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	install_windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	install_windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	install_windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	level.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	install_windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	level-windows-amd64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	level.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time"	level-windows-amd64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time"	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	level-windows-amd64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	level-windows-amd64.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AF0D4BBE8FB874489CE709A73F82B50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\PackageCode = "7FB72B44A34AA224E8FB7B282F1F07EA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3D245DC823B08CE4C834E4069DB850C6\4AF0D4BBE8FB874489CE709A73F82B50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\ProductName = "Bluetrait Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\Version = "50855937"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3D245DC823B08CE4C834E4069DB850C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AF0D4BBE8FB874489CE709A73F82B50\SQLite_x64.Interop.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AF0D4BBE8FB874489CE709A73F82B50\SQLite_x86.Interop.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AF0D4BBE8FB874489CE709A73F82B50\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList\PackageName = "08112024_1447_BluetraitAgent381.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AF0D4BBE8FB874489CE709A73F82B50\paexec.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AF0D4BBE8FB874489CE709A73F82B50\Clients = 3a0000000000	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2352	msiexec.exe
2352	msiexec.exe
4920	MsiExec.exe
4920	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
1420	Bluetrait MSP Agent.exe
4732	level-windows-amd64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2308	msiexec.exe
Token: SeSecurityPrivilege	2352	msiexec.exe
Token: SeCreateTokenPrivilege	2308	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2308	msiexec.exe
Token: SeLockMemoryPrivilege	2308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2308	msiexec.exe
Token: SeMachineAccountPrivilege	2308	msiexec.exe
Token: SeTcbPrivilege	2308	msiexec.exe
Token: SeSecurityPrivilege	2308	msiexec.exe
Token: SeTakeOwnershipPrivilege	2308	msiexec.exe
Token: SeLoadDriverPrivilege	2308	msiexec.exe
Token: SeSystemProfilePrivilege	2308	msiexec.exe
Token: SeSystemtimePrivilege	2308	msiexec.exe
Token: SeProfSingleProcessPrivilege	2308	msiexec.exe
Token: SeIncBasePriorityPrivilege	2308	msiexec.exe
Token: SeCreatePagefilePrivilege	2308	msiexec.exe
Token: SeCreatePermanentPrivilege	2308	msiexec.exe
Token: SeBackupPrivilege	2308	msiexec.exe
Token: SeRestorePrivilege	2308	msiexec.exe
Token: SeShutdownPrivilege	2308	msiexec.exe
Token: SeDebugPrivilege	2308	msiexec.exe
Token: SeAuditPrivilege	2308	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2308	msiexec.exe
Token: SeChangeNotifyPrivilege	2308	msiexec.exe
Token: SeRemoteShutdownPrivilege	2308	msiexec.exe
Token: SeUndockPrivilege	2308	msiexec.exe
Token: SeSyncAgentPrivilege	2308	msiexec.exe
Token: SeEnableDelegationPrivilege	2308	msiexec.exe
Token: SeManageVolumePrivilege	2308	msiexec.exe
Token: SeImpersonatePrivilege	2308	msiexec.exe
Token: SeCreateGlobalPrivilege	2308	msiexec.exe
Token: SeBackupPrivilege	456	vssvc.exe
Token: SeRestorePrivilege	456	vssvc.exe
Token: SeAuditPrivilege	456	vssvc.exe
Token: SeBackupPrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeTakeOwnershipPrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeTakeOwnershipPrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeTakeOwnershipPrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeTakeOwnershipPrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeTakeOwnershipPrivilege	2352	msiexec.exe
Token: SeRestorePrivilege	2352	msiexec.exe
Token: SeTakeOwnershipPrivilege	2352	msiexec.exe
Token: SeShutdownPrivilege	4380	MsiExec.exe
Token: SeDebugPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeBackupPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeBackupPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeBackupPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeBackupPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeSecurityPrivilege	1420	Bluetrait MSP Agent.exe
Token: SeBackupPrivilege	1420	Bluetrait MSP Agent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2308	msiexec.exe
2308	msiexec.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4808	2352	msiexec.exe	98
PID 2352 wrote to memory of 4808	2352	msiexec.exe	98
PID 2352 wrote to memory of 4920	2352	msiexec.exe	100
PID 2352 wrote to memory of 4920	2352	msiexec.exe	100
PID 2352 wrote to memory of 4920	2352	msiexec.exe	100
PID 2352 wrote to memory of 4380	2352	msiexec.exe	101
PID 2352 wrote to memory of 4380	2352	msiexec.exe	101
PID 2352 wrote to memory of 4380	2352	msiexec.exe	101
PID 1420 wrote to memory of 4428	1420	Bluetrait MSP Agent.exe	109
PID 1420 wrote to memory of 4428	1420	Bluetrait MSP Agent.exe	109
PID 4428 wrote to memory of 3672	4428	install_windows.exe	110
PID 4428 wrote to memory of 3672	4428	install_windows.exe	110
PID 4428 wrote to memory of 4480	4428	install_windows.exe	111
PID 4428 wrote to memory of 4480	4428	install_windows.exe	111
PID 4428 wrote to memory of 4732	4428	install_windows.exe	112
PID 4428 wrote to memory of 4732	4428	install_windows.exe	112
PID 4732 wrote to memory of 3684	4732	level-windows-amd64.exe	113
PID 4732 wrote to memory of 3684	4732	level-windows-amd64.exe	113
PID 4732 wrote to memory of 2016	4732	level-windows-amd64.exe	114
PID 4732 wrote to memory of 2016	4732	level-windows-amd64.exe	114
PID 2016 wrote to memory of 876	2016	cmd.exe	115
PID 2016 wrote to memory of 876	2016	cmd.exe	115
PID 4732 wrote to memory of 1272	4732	level-windows-amd64.exe	116
PID 4732 wrote to memory of 1272	4732	level-windows-amd64.exe	116
PID 1272 wrote to memory of 980	1272	cmd.exe	117
PID 1272 wrote to memory of 980	1272	cmd.exe	117
PID 4412 wrote to memory of 532	4412	level.exe	119
PID 4412 wrote to memory of 532	4412	level.exe	119
PID 4732 wrote to memory of 5080	4732	level-windows-amd64.exe	121
PID 4732 wrote to memory of 5080	4732	level-windows-amd64.exe	121
PID 4412 wrote to memory of 4888	4412	level.exe	122
PID 4412 wrote to memory of 4888	4412	level.exe	122
PID 4412 wrote to memory of 2188	4412	level.exe	124
PID 4412 wrote to memory of 2188	4412	level.exe	124
PID 4412 wrote to memory of 3884	4412	level.exe	126
PID 4412 wrote to memory of 3884	4412	level.exe	126
PID 4412 wrote to memory of 4372	4412	level.exe	128
PID 4412 wrote to memory of 4372	4412	level.exe	128
PID 4412 wrote to memory of 4752	4412	level.exe	130
PID 4412 wrote to memory of 4752	4412	level.exe	130
PID 4412 wrote to memory of 3300	4412	level.exe	134
PID 4412 wrote to memory of 3300	4412	level.exe	134
PID 4412 wrote to memory of 4284	4412	level.exe	136
PID 4412 wrote to memory of 4284	4412	level.exe	136
PID 4412 wrote to memory of 2860	4412	level.exe	138
PID 4412 wrote to memory of 2860	4412	level.exe	138
PID 4412 wrote to memory of 3144	4412	level.exe	140
PID 4412 wrote to memory of 3144	4412	level.exe	140
PID 4412 wrote to memory of 2984	4412	level.exe	142
PID 4412 wrote to memory of 2984	4412	level.exe	142
PID 4412 wrote to memory of 3180	4412	level.exe	144
PID 4412 wrote to memory of 3180	4412	level.exe	144
PID 4412 wrote to memory of 4432	4412	level.exe	146
PID 4412 wrote to memory of 4432	4412	level.exe	146
PID 4412 wrote to memory of 4752	4412	level.exe	148
PID 4412 wrote to memory of 4752	4412	level.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\08112024_1447_BluetraitAgent381.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4808
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F56BCCB6B9023C2F543F42ABB20FD72
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BF2C3160C1F3995535882577CDD892F8 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\TEMP\install_windows.exe
  "C:\Windows\TEMP\install_windows.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\sc.exe
    sc.exe query Level
    3⤵
    - Launches sc.exe
    PID:3672
- - C:\Windows\System32\Wbem\wmic.exe
    wmic.exe os get osarchitecture
    3⤵
    PID:4480
- - C:\Windows\TEMP\level-windows-amd64.exe
    C:\Windows\TEMP\level-windows-amd64.exe /action install /key eMA9cVei2hbmCCxMWWRWKi4w
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /F /TN "Level\Level Watchdog"
      4⤵
      PID:3684
  - - C:\Windows\system32\cmd.exe
      cmd /C "netsh advfirewall firewall delete rule name=\"Level Agent\" dir=in"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name=\"Level Agent\" dir=in
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:876
  - - C:\Windows\system32\cmd.exe
      cmd /C "netsh advfirewall firewall add rule name=\"Level Agent\" description=\"Remote device management - https://level.io\" dir=in action=allow program=\"C:\Program Files\Level\level.exe\" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name=\"Level Agent\" description=\"Remote device management - https://level.io\" dir=in action=allow program=\"C:\Program Files\Level\level.exe\" enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:980
  - - C:\windows\system32\sc.exe
      C:\windows\system32\sc.exe failureflag Level 1
      4⤵
      Launches sc.exe
      PID:5080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3680

C:\Program Files\Level\level.exe
"C:\Program Files\Level\level.exe" --key eMA9cVei2hbmCCxMWWRWKi4w --action=run
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4412
- C:\windows\system32\sc.exe
  C:\windows\system32\sc.exe failureflag Level 1
  2⤵
  - Launches sc.exe
  PID:532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {param ( [string]$CommandName, [string]$CommandArguments, [int]$IntervalMinutes, [string]$TaskPath, [string]$RunAsUser, [string]$Description ) $action = New-ScheduledTaskAction -Execute $CommandName -Argument $CommandArguments $trigger=$null if ([Environment]::OSVersion.Version -ge (new-object 'Version' 10,0)) { $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) } else { # Windows 8/Windows Server 2012 or older $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) -RepetitionDuration ([System.TimeSpan]::MaxValue) } $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries $task = New-ScheduledTask -Action $action -Description $Description -Trigger $trigger -Settings $settings Register-ScheduledTask -Force -TaskName $TaskPath -InputObject $task -User $RunAsUser }" -CommandName "'C:\Program Files\Level\level.exe'" -CommandArguments '--check-service' -IntervalMinutes 10 -TaskPath "'Level\Level Watchdog'" -RunAsUser 'system' -Description "'Ensures the Level service is always running. For more details, see https://docs.level.io/1.0/admin-guides/level-watchdog-task.'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell /c "(New-Object -ComObject \"Microsoft.Update.SystemInfo\").RebootRequired"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2188
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT address, mask FROM interface_addresses "
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT si.cpu_brand, si.cpu_physical_cores, ut.total_seconds, (SELECT gateway FROM routes WHERE destination = '0.0.0.0' limit 1) AS gateway, oi.version, ov.name AS os_name, ov.platform_like AS os_platform_like, ov.version AS os_version, ov.arch AS os_arch, ov.install_date AS os_install_date, si.hardware_vendor, si.hardware_model, si.physical_memory, (SELECT COUNT(*) FROM memory_devices) AS memory_slots, si.hardware_serial, si.board_vendor, si.board_model, si.board_version, si.board_serial, pi.version AS board_bios_version, pi.date AS board_release_date FROM (SELECT 1) LEFT JOIN system_info si ON 1 = 1 LEFT JOIN uptime ut ON 1 = 1 LEFT JOIN osquery_info oi ON 1 = 1 LEFT JOIN os_version ov ON 1 = 1 LEFT JOIN platform_info pi ON 1 = 1; "
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4372
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT id.description, id.interface, id.mac, id.dns_domain, id.dhcp_server, id.dns_server_search_order, json_group_array(DISTINCT ia.address || '/' || ia.mask) AS ip_addresses, json_group_array(DISTINCT r.gateway) AS gateways FROM interface_details id JOIN interface_addresses ia ON ia.interface = id.interface, routes r ON r.destination = ia.address GROUP BY id.description, id.interface, id.mac, id.dns_domain, id.dhcp_server, id.dns_server_search_order "
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT device_id, model, current_clock_speed, number_of_cores FROM cpu_info"
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT bank_locator, manufacturer, memory_type, configured_clock_speed, SIZE, serial_number, part_number, form_factor FROM memory_devices "
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Class Win32_PhysicalMemoryArray).MemoryDevices"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2860
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT type, hardware_model, serial, disk_size FROM disk_info "
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT ld.device_id AS mount_point, coalesce(bi.protection_status, 0) AS encrypted, ld.size, ld.free_space, ld.file_system, ld.description AS label, ld.boot_partition AS \"primary\" FROM logical_drives ld LEFT JOIN bitlocker_info bi ON bi.drive_letter = ld.device_id "
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " WITH admin_user_count AS (SELECT count(*) AS admin_accounts_count FROM users u JOIN groups g ON u.gid = g.gid WHERE g.group_sid = 'S-1-5-32-544'), uac AS (SELECT data AS enabled FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA') SELECT IIF(wsc.firewall IN ('Good', 'Poor'), wsc.firewall, '') AS firewall_state, fp.name AS firewall_provider, wsc.antivirus AS antivirus_state, avp.name AS antivirus_provider, wsc.autoupdate AS auto_update, wsc.internet_settings, uac.enabled AS user_account_control_enabled, wsc.windows_security_center_service, auc.admin_accounts_count FROM windows_security_center AS wsc LEFT JOIN windows_security_products AS fp ON fp.type = 'Firewall' AND fp.state = 'On' LEFT JOIN windows_security_products AS avp ON avp.type = 'Antivirus' AND avp.state = 'On' LEFT JOIN admin_user_count auc ON 1 = 1 LEFT JOIN uac ON 1 = 1 LIMIT 1 "
  2⤵
  - Remote Services: SMB/Windows Admin Shares
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:3180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-NetFirewallProfile -PolicyStore ActiveStore | Measure-Object -Property Enabled -Sum).Sum"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-LocalGroupMember -SID \"S-1-5-32-544\" | Measure-Object).Count"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4752

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Password Policy Discovery

T1201

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b2c6.rbs

Filesize
223KB

MD5
01c201fc189728af6fca671d9fbbc596

SHA1
f0f3b06ad7d4d8f266972c3f84d789d11928b2f1

SHA256
ea7604615bd8512a24d2dce643712199111853f7bd72d11c407f5a04926d53e8

SHA512
6c0292e1df17df9fa1d7feae62b5c4b752fe3dff27b5df7adc95c6a35b4e46b58ded8b1f517559c5d15d01d219d989478dd3343ffb1193f761c18dddd0617ed9

Download Submit
C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe

Filesize
144KB

MD5
0bf209e4007d441249ae049c623f6544

SHA1
52c4d547190f60ba2f9a69764365a6f9bb1d78f1

SHA256
53313cd27befc363c5d49ff70de54ef0dace6e6470b9b53875f40b67980ea263

SHA512
afc05675331082d8242cdfa187533b152dfdcd7ed78bcb3169f46c75a349e3688e89ae6c88194287f33ae1cd62aa95b6d96c53bd024a36b5ec3ad6e675d6ea7e

Download Submit
C:\Program Files (x86)\Bluetrait Agent\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Program Files (x86)\Bluetrait Agent\System.Data.SQLite.dll

Filesize
421KB

MD5
edd007cf3fcb18ccef985f58004b1aee

SHA1
c3a697e0552ab600132f8fd4635f78517d4cb4e4

SHA256
9b0581b003161d1605405ab4ae2a31e03bf3287673c148f4a1d90253aaad2c30

SHA512
f848b4c4ba2f95ab9e8f90b5de8d169013b6c0ed7465c24f378c3df44d5bcc52e44c15e05973392e4d53c5b53007c8122ce4fd632d0ac203040fed10abb0b75f

Download Submit
C:\Program Files (x86)\Bluetrait Agent\defaults.json

Filesize
150B

MD5
c5e8ee5b64c5c90671d9f622c44d961f

SHA1
cb0e5bf2d02c786010a4a90b7472a33bec9993d8

SHA256
bda80f52fe54822967f104e46bc300d4c8f07365ad1c446b5995e02493560354

SHA512
6cacc76e49b9df5becce19a7337a7b6b361a52387a0c17f812e2e194137455d1e0e4a9b5ec137d178715261597bacaf399377107ab37bcc6cb113fd52b78acfa

Download Submit
C:\Program Files (x86)\Bluetrait Agent\x64\SQLite.Interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Program Files\Level\level.log

Filesize
1009B

MD5
692817800e0f0dd5edd3c4b45add9a13

SHA1
4eb2c94d61ed185724ae044fb28ffbd526c06674

SHA256
ff3f1807dd3fe5bba539c9098222d13e7a5d08f27909c9b6ba684c12f08ebea3

SHA512
f4e1c033ac01924be2e53bdc65f440d8b9e5a467744c90c2e500017864fb414565f26195fd2f223f4652343a33b5758df758b9f2796a60783e56bbd4d399b395

Download Submit
C:\Program Files\Level\osqueryi.exe

Filesize
22.5MB

MD5
f00336eb98e75d8dfdd778bdeb32be17

SHA1
be6846a2c3ab3625205e9735655fff36f2989649

SHA256
8ec09ad5f7f3de91ce710d46a91da0b2ccc1ad3c48042f07348c3ec20022ef71

SHA512
e4ce69174d0c3c1b2e31b040afcaa9073fdf27caf6c46f522425a2983b7fb995b34c29525af24a4d864b84d409e515fdcc07db927ce19248cb1ac737daeda36c

Download Submit
C:\Program Files\Level\winpty-agent.exe

Filesize
880KB

MD5
2168ce2a9157fc88d111627c51a98d9f

SHA1
860b0a50ecd8c3fba9cb21bf8a272a137c3b39f4

SHA256
1a896301784758c59722d1e61a0dd20a8269c460ed739277aeb4c98ca11b28a4

SHA512
def5973d20ea154c93f3e73c78d70b8b3c31390b5433f2b925d9898c56b6d4e1bef81b75cd50954c9b2c3f51af239926b7ec6d8fc0ae5bde47d12e3e8ffdb68d

Download Submit
C:\Program Files\Level\winpty.dll

Filesize
762KB

MD5
05dc60e6432b6ebd19f83d51a5d85b4b

SHA1
84c587869b7717e9c8cd0a2a1aea9f53a9cc51fd

SHA256
9a94e986f2b7c1b1ae22a7d5545329e1fbb89447f8f1348f280dcf49c40b2c88

SHA512
1cc719f4e24452e4360d93fd27417dad9cc4466a1901d05298607fa5190e23d596aa5686ec924fbe29e7ac1bfa400a0eb2698ffa3688dfbea348cc8eb196fe9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
765B

MD5
7a5523670eb6edef99a7e8c68a08f72f

SHA1
78dad216bdbe5eae1bc353a81163018b994d500a

SHA256
c2008c47d97a33763379c33a710ef7ebf95e1b8668382997a8eee5c7aa51cf59

SHA512
b40ac448bbc2d4ae3807c2efb799895cdb8e10dac2df5889ed19e2dafe1598abcfd379162f403861a322580ce83e55ea8ed7434855054d22cf01a31c5b7099ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_5001C7BC78598D0B752119C0FACA0CDE

Filesize
637B

MD5
af38f50bd1cc3aa82102915cf617fac0

SHA1
06187fd77a0e6ef81f7650ba96631c973c7b8e69

SHA256
18700357e0bfbb69c6a6da4d61d7b3fdfaa0642efaef5698b316c18017462a76

SHA512
4e932f82b33c93221f4e91a4d4db5d88359dbd2ccc685c75861a05cea63847262a08d5344aa699a27e1df9bffa824f89a11bd7efa86dedb77209979cc9d77f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
a49813a199dca7806e0d9e75afccf1ed

SHA1
509ff362730afd40ea482c760fb6a561af75e3f4

SHA256
fb0dc1baaa57ec867bd9332adec22afcf205192d60e923d63a152b9ee5379bd1

SHA512
686b7df717e7f247c682a072fd047d8acca25609d119a75e6ebdf750d66622e848aeee4605c7523c62611ca3184870bd5b6a3bb26d05ba259d6d89cd774e5706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
484B

MD5
b5e95e0e5230c71fea754c709270af8a

SHA1
a03de9427881b61d6aa2ca005866b49e2c342700

SHA256
18808d5fe3e40e8d583534a08b044d23598a5cffd6a672a43532c4f8b3f1f910

SHA512
653ffd7d906f1b81df28d98575fce64480c982d53f20babc61cbd0b6519e142aa25f297ba90f94ec0a33ff45dcff5226f1fa9a6847a3b52b0334abeb11501bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_5001C7BC78598D0B752119C0FACA0CDE

Filesize
488B

MD5
be6f67f470f8f6368806875ccaadf30a

SHA1
7e364b43f5592abe7cee59bf2bdf90126b556aa4

SHA256
f74c62464ab778c76aa7345f766bc14d13cacaa1383f09a2a814854dd86b16a5

SHA512
8d82fa711b1e5353ca11897b4002443f5c52d860138081a878456aff375392a8490d80735aeef43b90e741760719ffe586bef1b38f98502763cce7728c3ddbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
2cc772a911b933930074d4e6cdac3daa

SHA1
de9c08dc5f9cf6000890aba7d44b16dbcf13611b

SHA256
8df67537885297d0c81f4f9c70120968e835b53556e184e7d3e9a7f00ef08ec7

SHA512
38b2244abcb797e263e66b8a8fb27a3be9ac7436dc88083e85de7dd4331721f1ef579f5f5a656b3858295bec8d9a40800b43b24d70316b9ea07fb10ce6d15c6a

Download Submit
C:\Windows\Installer\MSIB45D.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\e57b2c5.msi

Filesize
3.6MB

MD5
0c7d30468c0d5975866b6f10017330d9

SHA1
0f2d7d1d9fa10d46e8d73c75db7509f950578bc6

SHA256
1cd8f56f9213249e555dedda4380add02cbe74fb81a5806ef1eec3935a7f041a

SHA512
6b42376e6c0b69eb5e005a64c1cf6e92a27938ede43badf599c496a508c7d10e5178109e899de79d4aa01b15d982c748f3e5ece657815916f68dcd3fdb2dfd5e

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_mpjyvpuh.olj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\etilqs_jXTQMeUBXYEWZWS

Filesize
28KB

MD5
a69b39cf6b1660640c5b53002fef6be5

SHA1
b0335f365e590a62a257c9db5ee64458e75cf578

SHA256
0ec7e401046b48b2228fd23cf661214d3e24df63b1ce1147667200f6f7eb937a

SHA512
b2a9b0ab7a35a179f7b39464de61c73818d55e0256570f16c3f5d9559e88be4b2ae51571e6159ae758f7d5c7434ec17a127cc3d0511864a68e1f9adf1f0b6e2c

Download Submit
C:\Windows\Temp\install_windows.exe

Filesize
5.1MB

MD5
09b927941115bb4868a3ea65d02cd0ee

SHA1
455d01519053a1edc680ab236982b0acd1144d56

SHA256
f20b9d5fb7f603b8a794ccfb50f15b47d8a97fd2c88162d40a605012ebaa4558

SHA512
cacf08a7f2e3a3347b7cfd97a7ce231ec8bcaa387f2bfca6fdb527b615043440f65be888797251c3e50293aaa1b0f464e2f662571e476447ad7ab0a6e5801d91

Download Submit
C:\Windows\Temp\level-windows-amd64.exe

Filesize
25.0MB

MD5
0afe7a1c460bb2d1e593cb9665fe1fb6

SHA1
d9e12e3a4313ad621b6f39bf332d6768e1d23c3e

SHA256
1b0a5522679161c1af577d0c5cef4c65fbb714b4cd0b3960df87dcab53cd95d5

SHA512
1341b081f5e290ad4d3921c33d490cde16b67fd19ed4893115ae25a5c81ca266e75dd3d7f7691b6b54d412b281ef435d0a126031b7fce3b6c5f2078e9da05636

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
68c7431c8860466ed80f766b0741cee6

SHA1
701c5575207dd378e0c6050072fe2ed1d2b0f1a5

SHA256
bc4849c014cb53e50d04eb72319b2e4f9a09cb3acc7663110dac72caf47874c4

SHA512
40a88954a126edf37a7cb8406e40283316262c0ae7f1a375008ae1776c41cf76324d38fdfd336c88b50e35f8089e62a080c9eab784476347fc774edf3b8db6fd

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4af092e31db1384ca141f50e2754eeea

SHA1
5e6e8c987ed9df9c9bb373227c2c8dcfde24ccef

SHA256
60e3e9177b248839a957af720477f1389a10334123eb6cb12ae347e40ab53f53

SHA512
a4ac31719fcb1b0b594806b5d56fc2c335de7901538542aeffe0f78b9710aa5aecc78146ab5d131d32b56405df59c4f2be50bcafb7494d4996c154b39f8bf4fd

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fa24af941b5a8418afa6a477a19a684f

SHA1
d1ca7920c5e083edabf61fc4ce6b2b1ecb3b6d61

SHA256
c819b8cd67efb52f7bf5a97401d76b29ed54d17e22f4da742667860a9e31fbcd

SHA512
545e2d7a8366ac1a334e3c0d069da291f89ef19fad7164ae7d2b47b951b02c5f3f8d578ed64d354981514eea82ddbb35187a10b759e24c81b9ca40929bd6bc0b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
89ccaaee38ad3fb1eacf956da51553d9

SHA1
8453bf830857618859887973a0f9fe45ce21a8ad

SHA256
793e3fb8d5ea498bab147f1aaca8e84c84dd2fcb7a247448c20e472f68b73948

SHA512
6cb430bf0cc4d4253205e9963ed62492c4d5f2695a2453cd76600341d998011fd0c0295b761aa8b53982570ed4237f2a01e6fd06f2a389971324ea8431155802

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c1ed183b8f31d0632c0b2bfde044722c

SHA1
61c6589c36c42e2401cb5d6b6683640a41d88472

SHA256
17d8d6879642e97d6cd1268be7410cfc1de44e8761797fde9769b60feee5cf61

SHA512
e91826d2bb2438f0674a66ae55d03a50839144c6b31a8ba4b99465e035de7efc771b926d1c7251ef762ec9e48fba829c1de4a8a53c30fa290f21089133ee2b5a

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
e907292c381da512932dfaef8d46fd36

SHA1
d5a7cc75faf6f63cbb1f7bf574695e374ca4300f

SHA256
33f7170642f151f1fd5971efd624b35c62ccfd31e8263e75045cf009567316c1

SHA512
d9532363d988b1c33efe0943fa28c3cdac754b0caea5c6ad33d7714d3152753ff5dc30d06ac5e7be5241e591cd00ca629f9d59fe1a5a43939d68218f87c9e70e

Download Submit
\??\Volume{ff55ba41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{87340863-313b-48df-b1f7-2b6bae15a861}_OnDiskSnapshotProp

Filesize
6KB

MD5
7cf4d45f5571ca32a3bcdc1bc2e64c07

SHA1
8a58fddace688ad0c22aee4a274290e0a250f447

SHA256
ae318afb14daf1adc9e9f21c0de4b3289435c894d84ba814069b0fdca83ad01b

SHA512
6cd77e9e0ecd6919e1f818c4bb939b3a28f097690437044ba92b3400e6c2ae56e2b96babd158588d361c3696bc5cce8b3f74ba462570f03126441ed54e635ddc

Download Submit
memory/1420-225-0x0000024C7D6D0000-0x0000024C7D6E2000-memory.dmp

Filesize
72KB

Download
memory/1420-63-0x0000024C63D60000-0x0000024C63D88000-memory.dmp

Filesize
160KB

Download
memory/1420-73-0x0000024C7D500000-0x0000024C7D56A000-memory.dmp

Filesize
424KB

Download
memory/1420-65-0x0000024C7CE60000-0x0000024C7CF12000-memory.dmp

Filesize
712KB

Download
memory/1420-78-0x0000024C7D570000-0x0000024C7D5AA000-memory.dmp

Filesize
232KB

Download
memory/1420-79-0x0000024C7D490000-0x0000024C7D4B6000-memory.dmp

Filesize
152KB

Download
memory/1420-71-0x0000024C7CE40000-0x0000024C7CE5E000-memory.dmp

Filesize
120KB

Download
memory/1420-67-0x0000024C7CDF0000-0x0000024C7CE12000-memory.dmp

Filesize
136KB

Download
memory/1420-70-0x0000024C7D210000-0x0000024C7D286000-memory.dmp

Filesize
472KB

Download
memory/4432-246-0x000001BEB5180000-0x000001BEB5235000-memory.dmp

Filesize
724KB

Download
memory/4432-247-0x000001BE9C5A0000-0x000001BE9C5AE000-memory.dmp

Filesize
56KB

Download
memory/4432-248-0x000001BEB53C0000-0x000001BEB53DA000-memory.dmp

Filesize
104KB

Download
memory/4732-156-0x0000000000A10000-0x000000000238E000-memory.dmp

Filesize
25.5MB

Download
memory/4752-269-0x000001A146540000-0x000001A1465F5000-memory.dmp

Filesize
724KB

Download
memory/4888-178-0x0000024C6C8A0000-0x0000024C6C8BC000-memory.dmp

Filesize
112KB

Download
memory/4888-177-0x0000024C6C730000-0x0000024C6C73A000-memory.dmp

Filesize
40KB

Download
memory/4888-176-0x0000024C6C670000-0x0000024C6C725000-memory.dmp

Filesize
724KB

Download
memory/4888-175-0x0000024C6C650000-0x0000024C6C66C000-memory.dmp

Filesize
112KB

Download