9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
Size 4.5MB
Sample260422-pp46jae18j
SHA256 9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5
MD5 431eefd1b99b2f4d6f5c1e61a82aa7cd
SHA1 78bbde10ad06f75bf0d730c6398ba43cc6629ee5
SHA512 be73ca70a5979122b635171c309c4f27c115ae61df5eeb5186591f425e78509871e13222c02786d9703ba83e5756e65adfa05576722800adb399d43e47f31c4b
SSDEEP 98304:JvXC2LSFllRCYyOzP8Kr5hkczq27KVG5P5wVVwsx33ijLXLYEUENuyB1+82P4Wmm:Ri9Pfz2P4Wof6b/M3UOVE5
TLSH
T12D26DF11F6A4023AD0528A7FD5939A69D6B23C5627318BCF1302F7BA0D375D68636F32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3008	MsiExec.exe
2844	MsiExec.exe
2312	MsiExec.exe
2844	MsiExec.exe

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	576	msiexec.exe
3	576	msiexec.exe
4	576	msiexec.exe
5	576	msiexec.exe
6	576	msiexec.exe
7	576	msiexec.exe
8	576	msiexec.exe
9	3840	msiexec.exe
10	3840	msiexec.exe
11	3840	msiexec.exe
12	3840	msiexec.exe
13	3840	msiexec.exe
14	3840	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File created	C:\Windows\system32\axaltocm.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E9D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E9D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\axaltocm64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\Gemalto.MiniDriver.IDPrime.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E9F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\axaltocm.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\Gemalto.MiniDriver.IDPrime.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\axaltocm.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E9E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\delta.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\delta.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\Gemalto.MiniDriver.IDPrime.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\axaltocm64.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E9E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{368079ed-d0c6-8840-ad1a-0822daae1154}\SET7E9F.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\axaltocm.dll	msiexec.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\axaltocm.dll	msiexec.exe
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\axaltocm64.dll	msiexec.exe
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\delta.cat	msiexec.exe
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\Gemalto.MiniDriver.IDPrime.inf	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C9A.tmp	msiexec.exe
File created	C:\Windows\Installer\e593485.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\Installer\e593483.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e593483.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E5093A2F-2B39-4863-83AE-379D8923A1AC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DE3.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI80A3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD6B64974E73FFDE5.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF80F9769823D7947A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF242711895A464DBD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5093A2F-2B39-4863-83AE-379D8923A1AC}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF301A8C208B918234.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BAE.tmp	msiexec.exe
File created	C:\Windows\Installer\{E5093A2F-2B39-4863-83AE-379D8923A1AC}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
576	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\PackageCode = "403DC097E7A88C946A444EB1C7E3D1C5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\ProductIcon = "C:\\Windows\\Installer\\{E5093A2F-2B39-4863-83AE-379D8923A1AC}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\PackageName = "IDGo800_Minidriver_64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA\INSTALL_32 = "MinidriverIDGo800_Files"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA\INSTALL_64 = "MinidriverIDGo800_Files"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Version = "16908297"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\22C8EB0044E0F694683A3C70EBCAB13E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\22C8EB0044E0F694683A3C70EBCAB13E\F2A3905E93B2368438EA73D998321ACA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDGo800_Minidriver_v129\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IDGo800_Minidriver_v129\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA\MinidriverIDGo800_Files	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\ProductName = "IDGo 800 Minidriver v1.2.9 for 64 bits"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3840	msiexec.exe
3840	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	576	msiexec.exe
Token: SeSecurityPrivilege	3840	msiexec.exe
Token: SeCreateTokenPrivilege	576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	576	msiexec.exe
Token: SeLockMemoryPrivilege	576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	576	msiexec.exe
Token: SeMachineAccountPrivilege	576	msiexec.exe
Token: SeTcbPrivilege	576	msiexec.exe
Token: SeSecurityPrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeLoadDriverPrivilege	576	msiexec.exe
Token: SeSystemProfilePrivilege	576	msiexec.exe
Token: SeSystemtimePrivilege	576	msiexec.exe
Token: SeProfSingleProcessPrivilege	576	msiexec.exe
Token: SeIncBasePriorityPrivilege	576	msiexec.exe
Token: SeCreatePagefilePrivilege	576	msiexec.exe
Token: SeCreatePermanentPrivilege	576	msiexec.exe
Token: SeBackupPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeShutdownPrivilege	576	msiexec.exe
Token: SeDebugPrivilege	576	msiexec.exe
Token: SeAuditPrivilege	576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	576	msiexec.exe
Token: SeChangeNotifyPrivilege	576	msiexec.exe
Token: SeRemoteShutdownPrivilege	576	msiexec.exe
Token: SeUndockPrivilege	576	msiexec.exe
Token: SeSyncAgentPrivilege	576	msiexec.exe
Token: SeEnableDelegationPrivilege	576	msiexec.exe
Token: SeManageVolumePrivilege	576	msiexec.exe
Token: SeImpersonatePrivilege	576	msiexec.exe
Token: SeCreateGlobalPrivilege	576	msiexec.exe
Token: SeCreateTokenPrivilege	576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	576	msiexec.exe
Token: SeLockMemoryPrivilege	576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	576	msiexec.exe
Token: SeMachineAccountPrivilege	576	msiexec.exe
Token: SeTcbPrivilege	576	msiexec.exe
Token: SeSecurityPrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeLoadDriverPrivilege	576	msiexec.exe
Token: SeSystemProfilePrivilege	576	msiexec.exe
Token: SeSystemtimePrivilege	576	msiexec.exe
Token: SeProfSingleProcessPrivilege	576	msiexec.exe
Token: SeIncBasePriorityPrivilege	576	msiexec.exe
Token: SeCreatePagefilePrivilege	576	msiexec.exe
Token: SeCreatePermanentPrivilege	576	msiexec.exe
Token: SeBackupPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeShutdownPrivilege	576	msiexec.exe
Token: SeDebugPrivilege	576	msiexec.exe
Token: SeAuditPrivilege	576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	576	msiexec.exe
Token: SeChangeNotifyPrivilege	576	msiexec.exe
Token: SeRemoteShutdownPrivilege	576	msiexec.exe
Token: SeUndockPrivilege	576	msiexec.exe
Token: SeSyncAgentPrivilege	576	msiexec.exe
Token: SeEnableDelegationPrivilege	576	msiexec.exe
Token: SeManageVolumePrivilege	576	msiexec.exe
Token: SeImpersonatePrivilege	576	msiexec.exe
Token: SeCreateGlobalPrivilege	576	msiexec.exe
Token: SeCreateTokenPrivilege	576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	576	msiexec.exe
Token: SeLockMemoryPrivilege	576	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
576	msiexec.exe
576	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3008	3840	msiexec.exe	81
PID 3840 wrote to memory of 2028	3840	msiexec.exe	85
PID 3840 wrote to memory of 2844	3840	msiexec.exe	87
PID 3840 wrote to memory of 2312	3840	msiexec.exe	88
PID 1072 wrote to memory of 1684	1072	svchost.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\IDGo800_Minidriver_v129\IDGo800_Minidriver_64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 14F61396B3380D56BE5840C82DE8A7EF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3008
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2028
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1BC6014215F93A6FC6B28C4E3F55EFD9
  2⤵
  - Loads dropped DLL
  PID:2844
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 626F14F5B5C819BB62AE282C9F890D62 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\Gemalto.MiniDriver.IDPrime.inf" "9" "41bd40ceb" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593484.rbs

Path C:\Config.Msi\e593484.rbs
Size 674KB
SHA256 99567c79542d84b15ba1a28e85e26dfda6e7b365ebf64d6d7094a1dd2328be36
MD5 9956ffb5d22a90da433cc3b3d8fef161
SHA1 e8ef412162df7378f2ccc42f80a477a2e785e957
SHA512 00af50c82be76f5c3c5dc6f09cff29855a683f6cbf2b2d0aca989af32eb53d13a7c430563a143368ff8b1590d55bea07b077cc2a1c169874047b9be1b3078391
SSDEEP 6144:u11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QB:55cceNKt7zRy/zCyas8ROUOVq
TLSH
T19EE46614F9B80521E163997FA6A2AE5DD17239861731CACF0302DBF61D3B5D68632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axaltocm.dll

Path C:\PROGRA~2\Gemalto\IDGO80~1\axaltocm.dll
Size 1.1MB
SHA256 0d6264f1ede0306eb100f3a9453833c331f04349e5f9ea748a1143658bdd5bb6
MD5 005d09aa627a0a1ad3198ce79247bd7c
SHA1 a16c2e7d38abe16f3108ab0b28dbf92f63c35138
SHA512 efb437801d03bd988f5ff9adc0642ce177f58c2b2d36ab72cc1b826f91234cabf4883e9b3554744b5a62981efd4ae5124c93ac6a7128121f7cd8ddc0040a9cb0
SSDEEP 24576:OXTGsdMqa1ey3XiQm+M8e5jVgYrDfeN1PEZ29e1IgZ2mkQYsi6Nm:5grzjIeDZjkf0Nm
TLSH
T1B8459E22B740C132EA9E12704578B76B187E7A71276584C3F7D6BED9AE701E2763430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axaltocm64.dll

Path C:\PROGRA~2\Gemalto\IDGO80~1\axaltocm64.dll
Size 1.5MB
SHA256 6984ed0b9ea0e68597fd037783fbd067627b4f47c99207e29a92af8bffbe34f7
MD5 957c575464fd9301333bf68a954b52e7
SHA1 09f0b9ef841270e9675e0a50aed4b7f031d9db01
SHA512 a41b08f337767db3cc205bcaef8cc8e2ef65fd7f85511d097471c5adcc7206f06ffe2ae2a6d8f19fd4bfbc7111d4f779a428f865d9b9d84505928f8db14c9e48
SSDEEP 24576:TRtbl/FbNZZXkzs6uYkZXCd4uvMjd3YJNOXikgj6gNI5SETmDtQoZgqkJL:Tb/bxXkzs6uYkZXCd4uvMj8NOykgpI5X
TLSH
T114758D16F71C40B9C077C178C9979607E6B178185B706BDF4A85AF9D1E23BE8AA3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delta.cat

Path C:\PROGRA~2\Gemalto\IDGO80~1\delta.cat
Size 8KB
SHA256 10685c1bec6ad2c884887727f3be07681b6f1d0da4af72f2d6cd06dd0c362c84
MD5 c073c9928fa25a6f50bd99449d5fb123
SHA1 18c9593e0e2ed682916e3f42e43577cc59f6c019
SHA512 8d2c01fa5e63749483a5e5507f98d1ee94dba80aff0d98362836389f15bebdb128fdddeafbdd7932b768b7fa8b049449ad60ba4841ff37a8be53467931fbe3e3
SSDEEP 192:shETvT20TR2SwdRivT1D6LJT+wa+3Ef5KYpBjSgUd:p72O1wdIvT1DS+x+3Ef5dpBjB4
TLSH
T13712D8A58EBC1183F983C97193F5EA93BC39EBD3EC40462D50AFA79848923C5B74851D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gemalto.MiniDriver.IDPrime.inf

Path C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\Gemalto.MiniDriver.IDPrime.inf
Size 25KB
SHA256 8df8580a8a484b5648f0b03bfdc9ead2aa70c3a93d8154ca753213e629fb04d6
MD5 9fa2baa4d109a3d1403cdedeb5c752d4
SHA1 1f699a90767d9648dcfecb92597f40f73a6c98ff
SHA512 51f86009dcfe182aad609b2b0dbb14a7c6fc06a0164d9e7749cb5ff4239e5d3bb852dd122a37bb78f964fa0727694a1fad216f55803f669486ce2124bcf36c95
SSDEEP 768:V3rOCWGWdNLNiiniEItTySbcPY4YmN3NvGL8Tqu8haFs0BObB86wPOkdx6+4iMTX:hrOCWGWdNLNiiniEItTySbcPY4YmN3Nw
TLSH
T138C2F0B28391C937E1202796BB107E63E2B5F60731E5BE2FA5B281358947DD50E097CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICDF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICDF9.tmp
Size 141KB
SHA256 4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
MD5 edb88affffd67bca3523b41d3e2e4810
SHA1 0055b93907665fed56d22a7614a581a87d060ead
SHA512 2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf
SSDEEP 3072:Biaf8jGZY0WHkCKblNnRNE/I6CQQAMllgKtf5nY+M:L8jWY0WTcRNEw5QQpX9m
TLSH
T138E359117BE0C032E4AA2938193597755A3FB930AF74C6CB77650A6E4E70BD19E3A307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7C9A.tmp

Path C:\Windows\Installer\MSI7C9A.tmp
Size 107KB
SHA256 16c4cf37242385f27d2625ee8b660b745342ef8340541e6c7e4673522ed13956
MD5 cf6354b5789cb6b9691b8896e255a378
SHA1 e9429ffa42b00f45073fa1989f92c2c27d7aad86
SHA512 7ba049a5ec80d94763d44c7cdc85d2e94b4edfe5db2ce575d594e4914f321bbb730f60b33f2ff9f58f359ce4f4b35dd5efbaad670c30c31dd836735110776202
SSDEEP 1536:zCDvWcAQcnkygLVSA10DUXqUWqJ76Yjfx6Luy/ViX:DkyASA1CUdRLTy/QX
TLSH
T115B3F915BFBC0029F1716A3E95E25528E1753D822B3187EF2D02A7DA1E37AD58436F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7DE3.tmp

Path C:\Windows\Installer\MSI7DE3.tmp
Size 650KB
SHA256 07694439a93f220f5e9f46ac3ceb0b22fe1dadb3ed9bf18a9f2835be7a5c3bc6
MD5 6aa987dbea3f424fa44cd541dbae7368
SHA1 47ba276719f0a3e25e24fb546ecad8b97b6ebe67
SHA512 c5c5901bcdfdb413cb679d39c90a4fa64e96ad10d25476c62e2d2276bdc1cf8a5b4d987f881acb701ffaaa22662b64442e399f1aa8cb6ff5c761e03c474756a2
SSDEEP 6144:R11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QE:w5cceNKt7zRy/zCyas8ROUOVb
TLSH
T185E46514F9B80525E163997FA2A29E5DD17239861731CACF0302DBF61D3B5DA8632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593483.msi

Path C:\Windows\Installer\e593483.msi
Size 4.5MB
SHA256 9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5
MD5 431eefd1b99b2f4d6f5c1e61a82aa7cd
SHA1 78bbde10ad06f75bf0d730c6398ba43cc6629ee5
SHA512 be73ca70a5979122b635171c309c4f27c115ae61df5eeb5186591f425e78509871e13222c02786d9703ba83e5756e65adfa05576722800adb399d43e47f31c4b
SSDEEP 98304:JvXC2LSFllRCYyOzP8Kr5hkczq27KVG5P5wVVwsx33ijLXLYEUENuyB1+82P4Wmm:Ri9Pfz2P4Wof6b/M3UOVE5
TLSH
T12D26DF11F6A4023AD0528A7FD5939A69D6B23C5627318BCF1302F7BA0D375D68636F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 104KB
SHA256 fa4c60166dc2de9dfff18a3453089ed607fd799daeff9921154758029990a6ec
MD5 40110102ec10ff59db2bc807cebc737f
SHA1 df76268778ac1e276da568d3fecbafdfbbbb9194
SHA512 870ec3a6af17dcfe75f34dac9a6a6f7a395820d8ddac8abf5fa2bcd5e6d4bd0e84a856348f5b787874c8254026776d63f5dfa1c368d3883198be1e7aa3a31bbc
SSDEEP 1536:S30liopWMM0Ed+fOvzmJACdjkOc3/KZrFCGFwLvBeYimtsy0bd37k0V+P+7gvQzc:S3xsi
TLSH
T182A34505C0D84699C5B50A72725AEFF0C5AE658B730B2EF930FC62019AC3B157FBA45E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 f606cef45f3904da6a4d7f454085983cd55b50c9685a470ec360ebf125eefb4b
MD5 54fcf7126aab6f5baf8199734b315ae9
SHA1 bdfbf5ea6b54dcc949f0e65e3c6a733b133b1b4a
SHA512 3d21a7b14ecb37ceacb65f39f1d73406ba21f737f07f125aa32a86b00bd872d00993c780f4550dcf7f95fab7b6ad973ac9b902d9918d8fd9cffd56eea0de00c5
SSDEEP 24576:m2gmSp17doO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:c
TLSH
T13747C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b345b3eb-b3a3-418a-8af9-a6ab53fd82c9}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b345b3eb-b3a3-418a-8af9-a6ab53fd82c9}_OnDiskSnapshotProp
Size 6KB
SHA256 3916370baac478c13e4efcf9c61058821f54beb19c04437d623d042fccb23028
MD5 b313013d13657d06407c85534b2466d3
SHA1 8c68edde3900f64287b4d635e3611d7cf5f6c5a3
SHA512 23601394d86fc175ed48c66a71c787ea8c746bd59d71ac2f2618ea10f9ff84b353359894e2d2ce06404c42b22b8c27bdf555dd2a7f38b95484f5b979a094f788
SSDEEP 96:FBRhiVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:PyV2b++ZVm
TLSH
T18BD188085AE54311E2B3AB3129F14557A877B911FF33CB8E0198278E6670A10F936F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-0-0x000001CA543A0000-0x000001CA543AC000-memory.dmp

Download

memory/576-11-0x00007FF8BFC6E000-0x00007FF8BFC6F000-memory.dmp

Download

memory/576-5-0x00007FF8BFC6E000-0x00007FF8BFC6F000-memory.dmp

Download

memory/576-138-0x000001CA543A0000-0x000001CA543AC000-memory.dmp

Download

memory/1684-118-0x00000261D3690000-0x00000261D369C000-memory.dmp

Download

memory/3008-12-0x0000000002490000-0x0000000002512000-memory.dmp

Download

memory/3008-137-0x0000000002490000-0x0000000002512000-memory.dmp

Download

memory/3840-21-0x000001DC4F750000-0x000001DC4F75C000-memory.dmp

Download