6fb49f3d58126be5407300fffea3fee7ec5d05ff6e8ecb27457a8ca3c335dfeb

Analysis

max time kernel
150s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17UJJZ15N57GG_19SYPURD17668_windows_x64.msi
Size 3.2MB
Sample260426-w2j5fset9w
SHA256 6fb49f3d58126be5407300fffea3fee7ec5d05ff6e8ecb27457a8ca3c335dfeb
MD5 4016bac634869912d3d8a027daa85472
SHA1 e8361e38322e67caf5bf1b5d801851c019ca90f7
SHA512 1adfa3013e8d079ac1fa69d01bbd2dca8dbfda685054a3738b6403648458f5d72ddd5af2f650eaf0f204d848899f485807f94268af0010271779595733d6913c
SSDEEP 98304:ZBkFzdzZJe6Ueev0ShdIu8t8oaWLb+VCbiLDHs7WZkLneYr0c:ZBqu10STImVwNgbULfr
TLSH
T155F523807AD4017AE9661235CA36B5906B36FC105BF08A5A3785F33D1F3F398D936B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4760	superopssetup.exe
1700	superops.exe
1728	superops.exe
3620	updmgr.exe
4412	updmgr.exe
3436	superops.exe
1084	superops.exe

Loads dropped DLL 9 IoCs

pid	Process
4448	MsiExec.exe
3988	MsiExec.exe
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe
3988	MsiExec.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4500	icacls.exe
2388	icacls.exe
5000	icacls.exe

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4444	msiexec.exe
3	4444	msiexec.exe
4	4444	msiexec.exe
5	4444	msiexec.exe
6	4444	msiexec.exe
7	4444	msiexec.exe
8	4444	msiexec.exe
9	4444	msiexec.exe
10	4444	msiexec.exe
11	4444	msiexec.exe
13	3040	msiexec.exe
14	3040	msiexec.exe
17	3040	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2088	powershell.exe
3180	powershell.exe
4968	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	superops.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7	superopssetup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	superops.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	superops.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	superopssetup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	superops.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67	superops.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7	superopssetup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	superopssetup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67	superops.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files\googlemeet_installerrmm\conf\exeMd5Sum.json	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\conf\serverkey.txt	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\.DS_Store	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\installer.exe	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\sopsnmpwalk.exe	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\superopsticket.exe	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\updmgr_new.exe	superopssetup.exe
File opened for modification	C:\Program Files\googlemeet_installerrmm\conf\assetinfo.conf	superops.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\superopssetup.exe	msiexec.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\osupdater.exe	superopssetup.exe
File opened for modification	C:\Program Files\googlemeet_installerrmm\logs\superops.log	superops.exe
File opened for modification	C:\Program Files\googlemeet_installerrmm\logs\upgrade.log	updmgr.exe
File created	C:\Program Files\googlemeet_installerrmm\cache\last_upgrade.bin	updmgr.exe
File created	C:\Program Files\googlemeet_installerrmm\conf\softwaresInstalled.bin	superops.exe
File created	C:\Program Files\googlemeet_installerrmm\image\banner.png	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\snmpwalk.bat	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\superops.exe	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\bin\superopssetup_new.exe	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\image\icon.ico	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\license\license.rtf	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\script\module\SuperOpsModule.psm1	superopssetup.exe
File created	C:\Program Files\googlemeet_installerrmm\cache\updmgrStatus.conf	updmgr.exe
File created	C:\Program Files\googlemeet_installerrmm\conf\cert\cert.pem	superopssetup.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59386b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBBF1B2D5DD6305F8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66FF.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e59386d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59386b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3BB93941-0FBF-4E6E-CFC2-01C0FA4F9301}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6568.tmp-\InstallerCA_x64.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6568.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI66FF.tmp-\InstallerCA_x64.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{3BB93941-0FBF-4E6E-CFC2-01C0FA4F9301}\icon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA12A14743B85EA48.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6568.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66FF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF53723A3962C82A25.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7BF00C4DD1308D0F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6568.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\{3BB93941-0FBF-4E6E-CFC2-01C0FA4F9301}\icon	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
396	powershell.exe
1648	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4444	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	superops.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	superopssetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	superops.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\ProductName = "GoogleMeet_Installer RMM"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\PackageCode = "6EFBBADEA89DF5E4290B333A8F17E181"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\Version = "33554432"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C7C23217ADD04FA4F95BC5A03E85E981\14939BB3FBF0E6E4FC2C100CAFF43910	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14939BB3FBF0E6E4FC2C100CAFF43910	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C7C23217ADD04FA4F95BC5A03E85E981	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\PackageName = "17UJJZ15N57GG_19SYPURD17668_windows_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\Media\DiskPrompt = "Agent Installation [1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\ProductIcon = "C:\\Windows\\Installer\\{3BB93941-0FBF-4E6E-CFC2-01C0FA4F9301}\\icon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14939BB3FBF0E6E4FC2C100CAFF43910\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14939BB3FBF0E6E4FC2C100CAFF43910\ProductFeature	msiexec.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	superopssetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	superopssetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	superopssetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	updmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	updmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	superopssetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	superopssetup.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3040	msiexec.exe
3040	msiexec.exe
1728	superops.exe
1728	superops.exe
3180	powershell.exe
3180	powershell.exe
2088	powershell.exe
2088	powershell.exe
4968	powershell.exe
4968	powershell.exe
396	powershell.exe
396	powershell.exe
1728	superops.exe
1728	superops.exe
1728	superops.exe
1728	superops.exe
1648	powershell.exe
1648	powershell.exe
1728	superops.exe
1728	superops.exe
1084	superops.exe
1084	superops.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	3040	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4444	msiexec.exe
Token: SeLockMemoryPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeMachineAccountPrivilege	4444	msiexec.exe
Token: SeTcbPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	4444	msiexec.exe
Token: SeTakeOwnershipPrivilege	4444	msiexec.exe
Token: SeLoadDriverPrivilege	4444	msiexec.exe
Token: SeSystemProfilePrivilege	4444	msiexec.exe
Token: SeSystemtimePrivilege	4444	msiexec.exe
Token: SeProfSingleProcessPrivilege	4444	msiexec.exe
Token: SeIncBasePriorityPrivilege	4444	msiexec.exe
Token: SeCreatePagefilePrivilege	4444	msiexec.exe
Token: SeCreatePermanentPrivilege	4444	msiexec.exe
Token: SeBackupPrivilege	4444	msiexec.exe
Token: SeRestorePrivilege	4444	msiexec.exe
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeDebugPrivilege	4444	msiexec.exe
Token: SeAuditPrivilege	4444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4444	msiexec.exe
Token: SeChangeNotifyPrivilege	4444	msiexec.exe
Token: SeRemoteShutdownPrivilege	4444	msiexec.exe
Token: SeUndockPrivilege	4444	msiexec.exe
Token: SeSyncAgentPrivilege	4444	msiexec.exe
Token: SeEnableDelegationPrivilege	4444	msiexec.exe
Token: SeManageVolumePrivilege	4444	msiexec.exe
Token: SeImpersonatePrivilege	4444	msiexec.exe
Token: SeCreateGlobalPrivilege	4444	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4444	msiexec.exe
Token: SeLockMemoryPrivilege	4444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4444	msiexec.exe
Token: SeMachineAccountPrivilege	4444	msiexec.exe
Token: SeTcbPrivilege	4444	msiexec.exe
Token: SeSecurityPrivilege	4444	msiexec.exe
Token: SeTakeOwnershipPrivilege	4444	msiexec.exe
Token: SeLoadDriverPrivilege	4444	msiexec.exe
Token: SeSystemProfilePrivilege	4444	msiexec.exe
Token: SeSystemtimePrivilege	4444	msiexec.exe
Token: SeProfSingleProcessPrivilege	4444	msiexec.exe
Token: SeIncBasePriorityPrivilege	4444	msiexec.exe
Token: SeCreatePagefilePrivilege	4444	msiexec.exe
Token: SeCreatePermanentPrivilege	4444	msiexec.exe
Token: SeBackupPrivilege	4444	msiexec.exe
Token: SeRestorePrivilege	4444	msiexec.exe
Token: SeShutdownPrivilege	4444	msiexec.exe
Token: SeDebugPrivilege	4444	msiexec.exe
Token: SeAuditPrivilege	4444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4444	msiexec.exe
Token: SeChangeNotifyPrivilege	4444	msiexec.exe
Token: SeRemoteShutdownPrivilege	4444	msiexec.exe
Token: SeUndockPrivilege	4444	msiexec.exe
Token: SeSyncAgentPrivilege	4444	msiexec.exe
Token: SeEnableDelegationPrivilege	4444	msiexec.exe
Token: SeManageVolumePrivilege	4444	msiexec.exe
Token: SeImpersonatePrivilege	4444	msiexec.exe
Token: SeCreateGlobalPrivilege	4444	msiexec.exe
Token: SeCreateTokenPrivilege	4444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4444	msiexec.exe
Token: SeLockMemoryPrivilege	4444	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4444	msiexec.exe
4444	msiexec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4448	3040	msiexec.exe	81
PID 3040 wrote to memory of 3688	3040	msiexec.exe	85
PID 3040 wrote to memory of 3988	3040	msiexec.exe	87
PID 3988 wrote to memory of 816	3988	MsiExec.exe	88
PID 3988 wrote to memory of 1196	3988	MsiExec.exe	89
PID 1196 wrote to memory of 4760	1196	rundll32.exe	90
PID 4760 wrote to memory of 1700	4760	superopssetup.exe	92
PID 1700 wrote to memory of 2060	1700	superops.exe	94
PID 4760 wrote to memory of 3620	4760	superopssetup.exe	96
PID 1728 wrote to memory of 2388	1728	superops.exe	99
PID 1728 wrote to memory of 3436	1728	superops.exe	101
PID 1728 wrote to memory of 3180	1728	superops.exe	102
PID 1728 wrote to memory of 1084	1728	superops.exe	104
PID 1728 wrote to memory of 2088	1728	superops.exe	106
PID 1728 wrote to memory of 4968	1728	superops.exe	108
PID 1728 wrote to memory of 396	1728	superops.exe	110
PID 1728 wrote to memory of 1648	1728	superops.exe	112
PID 1728 wrote to memory of 3388	1728	superops.exe	115
PID 1084 wrote to memory of 5000	1084	superops.exe	119
PID 1084 wrote to memory of 4500	1084	superops.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\17UJJZ15N57GG_19SYPURD17668_windows_x64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F1F700DCB4BD941D3783EE1B9DDD8B7F C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4448
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3688
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2352D5C77D682A828FB4AD54D1A260D5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6568.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739750 2 InstallerCA_x64!WixInstallerDll.InstallService.RemoveOldDatabase
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:816
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI66FF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740093 6 InstallerCA_x64!WixInstallerDll.InstallService.InstallWinService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Program Files\googlemeet_installerrmm\bin\superopssetup.exe
      "C:\Program Files\googlemeet_installerrmm\bin\superopssetup.exe" --serverType "PROD" --serverLoc "US" --fileName "17UJJZ15N57GG_19SYPURD17668_windows_x64.msi" --AcceptLicense "yes" --installDir "C:\Program Files\googlemeet_installerrmm" --agentService "googlemeet_installer" --updmgrService "googlemeet_installer Updater"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Program Files\googlemeet_installerrmm\bin\superops.exe
        
        "C:\Program Files\googlemeet_installerrmm\bin\superops" --register true --service installstart --service-name googlemeet_installer --updmgr-service-name "googlemeet_installer Updater" --fileName 17UJJZ15N57GG_19SYPURD17668_windows_x64.msi --install_args ""
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1700
      - C:\Windows\system32\route.exe
        
        route print 0.0.0.0
        6⤵
        
        PID:2060
    - - C:\Program Files\googlemeet_installerrmm\bin\updmgr.exe
        
        "C:\Program Files\googlemeet_installerrmm\bin\updmgr" --service install
        5⤵
        Executes dropped EXE
        
        PID:3620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3588

C:\Program Files\googlemeet_installerrmm\bin\superops.exe
"C:\Program Files\googlemeet_installerrmm\bin\superops.exe" --config-directory "C:\Program Files\googlemeet_installerrmm\bin\..\conf\\" --service-name googlemeet_installer
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\Superops /deny Users:(OI)(CI)(AD)
  2⤵
  - Modifies file permissions
  PID:2388
- C:\Program Files\googlemeet_installerrmm\bin\superops.exe
  "C:\Program Files\googlemeet_installerrmm\bin\superops.exe" --systemTray true
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Continue' # Optional: Makes errors non-terminating for smoother flow $schedulerName='googlemeet_installerrmm Upgrade Scheduler' $commonScriptBlock=@' $arguments='--checkUpgradeService \"yes\" --upgradeServiceName \"googlemeet_installer Updater\"' $logPath='C:\Program Files\googlemeet_installerrmm\logs\upgradeScheduler.log' $exePath='C:\Program Files\googlemeet_installerrmm\bin\updmgr.exe' Add-Content -Path $logPath -Value \"==== Script started: $(Get-Date) ====\" try { # Set up the process start info $psi = New-Object System.Diagnostics.ProcessStartInfo $psi.FileName = $exePath $psi.Arguments = $arguments $psi.RedirectStandardOutput = $true $psi.RedirectStandardError = $true $psi.UseShellExecute = $false $psi.CreateNoWindow = $true # Start the process $process = New-Object System.Diagnostics.Process $process.StartInfo = $psi $process.Start() | Out-Null # Read the output $stdout = $process.StandardOutput.ReadToEnd() $stderr = $process.StandardError.ReadToEnd() # Wait for it to exit $process.WaitForExit() $exitCode = $process.ExitCode # Log outputs Add-Content -Path $logPath -Value \"--- Standard Output ---\" Add-Content -Path $logPath -Value \"$stdout\" Add-Content -Path $logPath -Value \"--- Standard Error ---\" Add-Content -Path $logPath -Value \"$stderr\" Add-Content -Path $logPath -Value \"Process exited with code: $exitCode\" } catch { # Log exceptions Add-Content -Path $logPath -Value \"--- Exception ---\" Add-Content -Path $logPath -Value $_.Exception.Message } finally { Add-Content -Path $logPath -Value \"==== Script ended: $(Get-Date) ====\" } '@ $encodedExpectedScript = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($commonScriptBlock)) $schArguement = \"-NoProfile -ExecutionPolicy Bypass -EncodedCommand $encodedExpectedScript\" $timeInterval='240' try { $task = Get-ScheduledTask -TaskName \"$schedulerName\" } catch { Write-Host \"Error retrieving task: $($_.Exception.Message)\" Write-Host \"<UPDATE>\" return } if ($task -eq $null) { Write-Host \"Task not found\" Write-Host \"<UPDATE>\" return } try { if ($task.State -ne \"ready\"){ Write-Host \"Change in state\" Write-Host $task.State Write-Host \"<UPDATE>\" } if ($task.Triggers -and $task.Triggers.Repetition -and $task.Triggers.Repetition.Interval -and [Xml.XmlConvert]::ToTimeSpan($task.Triggers.Repetition.Interval).TotalMinutes -ne $timeInterval ){ write-Host \"Change in repetition interval \" Write-Host $task.Triggers.Repetition.Interval Write-Host \"<UPDATE>\" } if ($task.Triggers -and $task.Triggers.Repetition -and $task.Triggers.Repetition.Duration -and [Xml.XmlConvert]::ToTimeSpan($task.Triggers.Repetition.Duration).TotalDays -ne 3650){ Write-Host \"change in repetition Duration \" Write-Host $task.Triggers.Repetition.Duration Write-Host \"<UPDATE>\" } if ($task.Settings -and $task.Settings.StopIfGoingOnBatteries -ne $false){ Write-Host \"change in StopIfGoingOnBatteries \" Write-Host $task.Settings.StopIfGoingOnBatteries Write-Host \"<UPDATE>\" } if ($task.Settings -and $task.Settings.RunOnlyIfNetworkAvailable -ne $true){ Write-Host \"change in RunOnlyIfNetworkAvailable \" Write-Host $task.Settings.RunOnlyIfNetworkAvailable Write-Host \"<UPDATE>\" } if ($task.Settings -and $task.Settings.ExecutionTimeLimit -and [Xml.XmlConvert]::ToTimeSpan($task.Settings.ExecutionTimeLimit).TotalMinutes -ne 30){ Write-Host \"change in ExecutionTimeLimit\" Write-Host $task.Settings.ExecutionTimeLimit Write-Host \"<UPDATE>\" } if ($task.Actions -and $task.Actions.Arguments -ne $schArguement){ Write-Host \"change in Arguements \" Write-Host $task.Actions.Arguments Write-Host \"<UPDATE>\" } } catch { Write-Host \"<UPDATE>\" Write-Host \"Error in task checks: $($_.Exception.Message)\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files\googlemeet_installerrmm\bin\superops.exe
  "C:\Program Files\googlemeet_installerrmm\bin\superops.exe" --systemTray true
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\icacls.exe
    icacls C:\ProgramData\Superops\tray /deny Users:(OI)(CI)(AD)
    3⤵
    - Modifies file permissions
    PID:5000
- - C:\Windows\system32\icacls.exe
    icacls C:\ProgramData\Superops\tray\Scripts /deny Users:(OI)(CI)(AD)
    3⤵
    - Modifies file permissions
    PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $taskName ='googlemeet_installerrmm Upgrade Scheduler' try { $task = Get-ScheduledTask -TaskName $taskName -ErrorAction Stop Write-Host \"Task '$taskName' exists.\" } catch { Write-Host \"Task '$taskName' does NOT exist.\" exit(0) } try{ Unregister-ScheduledTask -TaskName $taskName -Confirm:$false } catch { Write-Host \"Error in task delete: $($_.Exception.Message)\" exit(1) } Write-Output \"Task '$taskName' has been successfully removed.\" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $taskName ='googlemeet_installerrmm Upgrade Scheduler' $timeInterval='240' $startTime='04/26/2026 19:30:55' $scriptBlock = @' $arguments='--checkUpgradeService \"yes\" --upgradeServiceName \"googlemeet_installer Updater\"' $logPath='C:\Program Files\googlemeet_installerrmm\logs\upgradeScheduler.log' $exePath='C:\Program Files\googlemeet_installerrmm\bin\updmgr.exe' Add-Content -Path $logPath -Value \"==== Script started: $(Get-Date) ====\" try { # Set up the process start info $psi = New-Object System.Diagnostics.ProcessStartInfo $psi.FileName = $exePath $psi.Arguments = $arguments $psi.RedirectStandardOutput = $true $psi.RedirectStandardError = $true $psi.UseShellExecute = $false $psi.CreateNoWindow = $true # Start the process $process = New-Object System.Diagnostics.Process $process.StartInfo = $psi $process.Start() | Out-Null # Read the output $stdout = $process.StandardOutput.ReadToEnd() $stderr = $process.StandardError.ReadToEnd() # Wait for it to exit $process.WaitForExit() $exitCode = $process.ExitCode # Log outputs Add-Content -Path $logPath -Value \"--- Standard Output ---\" Add-Content -Path $logPath -Value \"$stdout\" Add-Content -Path $logPath -Value \"--- Standard Error ---\" Add-Content -Path $logPath -Value \"$stderr\" Add-Content -Path $logPath -Value \"Process exited with code: $exitCode\" } catch { # Log exceptions Add-Content -Path $logPath -Value \"--- Exception ---\" Add-Content -Path $logPath -Value $_.Exception.Message } finally { Add-Content -Path $logPath -Value \"==== Script ended: $(Get-Date) ====\" } '@ $trigger = New-ScheduledTaskTrigger -Once -At \"$startTime\" -RepetitionInterval (New-TimeSpan -Minutes $timeInterval) -RepetitionDuration (New-TimeSpan -Days 3650) $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries:$true -DontStopIfGoingOnBatteries:$true -StartWhenAvailable:$true -RunOnlyIfNetworkAvailable:$true -ExecutionTimeLimit (New-TimeSpan -Minutes 30) -MultipleInstances IgnoreNew # Define the action to start the service $encodedScript = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($scriptBlock)) $action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-NoProfile -ExecutionPolicy Bypass -EncodedCommand $encodedScript\" Register-ScheduledTask -TaskName $taskName -Trigger $trigger -Action $action -Description \"Restart service \" -User \"SYSTEM\" -RunLevel Highest -Settings $settings -Force Write-Host \"Scheduled task '$taskName' created successfully\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe "Get-WinEvent -ListLog * -ErrorAction 'SilentlyContinue'| Select -ExpandProperty 'LogName' |ConvertTo-Json"
  2⤵
  - Drops file in System32 directory
  - Hide Artifacts: Ignore Process Interrupts
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe "Get-WinEvent -ListLog * -ErrorAction 'SilentlyContinue'| Select -ExpandProperty 'LogName' |ConvertTo-Json"
  2⤵
  - Drops file in System32 directory
  - Hide Artifacts: Ignore Process Interrupts
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Windows\system32\route.exe
  route print 0.0.0.0
  2⤵
  PID:3388

C:\Program Files\googlemeet_installerrmm\bin\updmgr.exe
"C:\Program Files\googlemeet_installerrmm\bin\updmgr.exe" --service-name "googlemeet_installer Updater"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59386c.rbs

Path C:\Config.Msi\e59386c.rbs
Size 286KB
SHA256 08295e3e8c0a12713fc5041b80bd5b2f8d748a9e798c5f68e3ca76ba7421998d
MD5 8355336e99a8060d066344c787a5aba9
SHA1 8236469efa3d41013671ceef96f720201d4e6bff
SHA512 4b94c837bda8e919bb9decf1dbb8e30e27270374e27b87c26ec7041ed23b1593d7193d6ab67cc11039db064a96e3eab886eb660fbcf6cd470e3918ff7f91af22
SSDEEP 6144:afj8XqvLwHL0otXjsfsqCGhzsj3IzDKfjk/:AwHL0D02hAjFfjq
TLSH
T181549D0577E901A9FC778638C9230A15F6B2BC561B70D71F03944229EF3F791AA39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Program Files\googlemeet_installerrmm\bin\installer.exe
Size 4.4MB
SHA256 049fc03175e13bee1db1c9c08b2c86e7380d1106e107a218f8814110a75f287b
MD5 7ee13edd870165400e052ca37d924d32
SHA1 ebea95e2ab42db53ffd658a47e70f403c1b16c05
SHA512 3e17b911b6ae615a6c8728c46b8d3c806a982fecec7d59ea816ddd71d77f38e2a5a1410614c928b00d716b9a85eb65d501fc863c5da5149d871a404654c5417b
SSDEEP 49152:yy/+D/PRbrXz0Orb/TKvO90d7HjmAFd4A64nsfJjYuKsuGyOQqFtddd8e5/yRzox:1or/RLMOB54zoCE2I3H
TLSH
T190263807F85144E9D4EEE2308A669262BA717C881B3023D72F60F7B83B76BD45E79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osupdater.exe

Path C:\Program Files\googlemeet_installerrmm\bin\osupdater.exe
Size 6.2MB
SHA256 d719c70dfc72a9b7b9d85e977ca227639340bf8a410ba6da2fadee1e0fc99dd5
MD5 d2fc3fa579c2f726cc6f88a66a7c2eec
SHA1 6b71181e37da3d985a9f95e9614b50f6e696b426
SHA512 827623180d2d704a08a79f77241aca22b95f3166b4b22d3afe680261ac0d64348c776a6926c7a3f855d0d7bc3fedb7132833125f61b3c804a0f0d7e3d9f04aef
SSDEEP 49152:g25lBCuvsQxOtFrb/TJvO90d7HjmAFd4A64nsfJoGm2pMBCt8l3DNwYMFwQaPJJb:f++Fi3DmkAANbpEC+TW5
TLSH
T162662947F89141E9C1EAE130C6669262BA717C890B3173D32F60F7B92F72BD46A79314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmpwalk.bat

Path C:\Program Files\googlemeet_installerrmm\bin\snmpwalk.bat
Size 4KB
SHA256 4bfefc51488636305d1b4c26932fb26b67d0ba88ace698c5cc69755d47816cdd
MD5 f38ee6faa218dd068faef8e098106917
SHA1 099e2728d5d31734865b7731d8b8e0ddcb08e146
SHA512 5da1d2a07776299e4ccfc311303cd3722d337ee7b4c120cbe68663c599dd59711a631f210b03216e88c2d59754e53cda8f56d4b73a8c49120fedd62c881c05a8
SSDEEP 48:h56XJmvowcij05hj6rHkbobpi+0R6QI9fv4rczdoBrgzdoiZAlpzdoi33dYC:hwXRPi0516r90Mphsshp+lphp33dYC
TLSH
T15B916BE17029660466B117D22DB191AEF376E6EB4F2168EDB8CFD0204F353DA321B58C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sopsnmpwalk.exe

Path C:\Program Files\googlemeet_installerrmm\bin\sopsnmpwalk.exe
Size 3.4MB
SHA256 200e9ad3d05975dc6157199e6e28230650c70314ab93a2ec6e1fcb24f4d4d5f5
MD5 cf2d78b299833fd4cd0628338b3e398a
SHA1 253c8e18d283b97b39f6b614e92946eeb1c8086e
SHA512 65ff9bbd88a4c162dc522aab011327bbff444aa97d536c8d1e71b14a2e0af69df51f6881f3e10a2e626438669f4dd65c1261e071849961aa5e411c37d1ba432a
SSDEEP 49152:m8fc8P25erb/TrvO90d7HjmAFd4A64nsfJxIq1EVqYa8CiagiBKpHu5EaJ5gPXQF:J25h6angiBKaESe
TLSH
T153F53907F85144E9C5AAE2348A6A8252BB317C980F3163D73B60F7B92F72BD45E78354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

superops.exe

Path C:\Program Files\googlemeet_installerrmm\bin\superops.exe
Size 19.0MB
SHA256 ca702bb72647ad87c5a89909dee6e2ff2b287598a287a0084a2383cdd54d52b1
MD5 63beda9f90808802e8fbe34b9b3eb648
SHA1 f9429eac8ee7aed0c23e5540e6ab4925984755db
SHA512 aeeaf68591fa87b77fb3d8b0a0d3d4e7d49170b234c54ef2750532166e3459b3d3b1b8d5ee212282773f6c01f4a68de20f08c378bc83b23fa85ff19eccf065e5
SSDEEP 98304:mhyVKDa/0i+ceMEILl91moyrbrKBCU69xnKj6PiEUTJzTm3J0:mA6aGceI3q3F9xKj6nMJuZ0
TLSH
T14F173983F66544A4C6ADD270C6265223BB7078885B3033E33B69F6742F767D85BBA314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

superopssetup.exe

Path C:\Program Files\googlemeet_installerrmm\bin\superopssetup.exe
Size 6.3MB
SHA256 3d989b8af3ec64675fa48d3cb1c1afccbd87d432a5d0310ff7c64635e245e727
MD5 76b6be9af7d1bb89ecb8e89b874e6cf3
SHA1 fdba45a981ab69f0e7620cfbc7ad0368cc63c8c2
SHA512 71d51ba7fc775d2e0ea3b0486d86c3d14dfc2f6f94d4de618b96d69a3be4bf1ab41b05b16fc755fe1a86ee6766abfe2cc4e3d5b402c8046c4c5b432e65c6ec0a
SSDEEP 49152:oAlglNMvMrb/T8vO90d7HjmAFd4A64nsfJNj3wwRa3iz+Jw5Hp5xD3HoTzNnXJc3:fvQzui+W+9ZEqHYE9GE8X
TLSH
T10A663943F85142E8C1EDE634CA669212BA707C894F3073D72B60F7B82B76BD46A79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

superopssetup_new.exe

Path C:\Program Files\googlemeet_installerrmm\bin\superopssetup_new.exe
Size 6.3MB
SHA256 a59e7a49144118258bd5c5e1d4070c283448c731b6c60d7623d76f40b627a6b6
MD5 eceab6290a20680e5fe7af36ea951bdf
SHA1 abb49f228e011c13c64902652d3f06663b936ac2
SHA512 2df02cde562b475b96c87d5e2e2a080d559654e1286e4d304d030ab30321224478f9543306ea46ed4f37344b220b1647a29003812a4889d846c81ddbe35c2610
SSDEEP 49152:uAlglNMvMrb/T8vO90d7HjmAFd4A64nsfJNj3wwRa3iz+Jw5Hp5xD3HoTzNnXJc8:hvQzui+W+9ZEqHYE9GE8c
TLSH
T15E663943F85142E8C1EDE634CA669212BA707C894F3073D72B60F7B82B76BD46A79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

superopsticket.exe

Path C:\Program Files\googlemeet_installerrmm\bin\superopsticket.exe
Size 10.2MB
SHA256 e97abab04eee276f1e3607f004aac13495a0f0fef2f26409667f5bbd77e925bf
MD5 2117d6c8e1ffd71c7cb1f98a8afa49a7
SHA1 e92b9ae1ec11ece55cadaa29e4db227327761e9a
SHA512 d791c690141eb825c0df33711bb2cad9c3f2aa782f09fe035d8ed02f53307428c000f111696ce66124b8df138e24fa91140ff8aa677e4c00eed858d6ae76e50f
SSDEEP 49152:tcUDwqZOwpdDrb/T9vO90d7HjmAFd4A64nsfJa0ss8lWlbgEsXyuAObrQpRvJV/y:1df0LEy4WUO/U5GkHE2nTGRTjyb
TLSH
T16AB64A47F85181E8C5EDD274CA664222BA703C895B2433D72B64F6B83F73BD46A7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updmgr.exe

Path C:\Program Files\googlemeet_installerrmm\bin\updmgr.exe
Size 6.3MB
SHA256 907ca43ec630c183f44e4905800148077ef57b58c278e84a9a2b20010c3be2c6
MD5 13d67e3c2f4b7a8efca34c8e964828e6
SHA1 6f96374f09bd6f00ec90276e80ba1e1e6890c3d4
SHA512 1327366a19b5efaa66e1619e57f49291429c4732dcf3b068aab1a1321e86d0da77a7029dad91b16c4d6ba19c61253006e95a22ab7a87022431ff2ea7da4e55a7
SSDEEP 49152:jwtzB5hOp2k2UDKGrb/TBvO90d7HjmAFd4A64nsfJaqCfmPRVN+sXGlMZQXAFHTS:uLODK4c5ORlM4jrwBEEpeN
TLSH
T1AD663847F85141E8C1EDE270C6269262BA717C894B3167D32F60F7B92F32BD4AA79350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assetinfo.conf

Path C:\Program Files\googlemeet_installerrmm\conf\assetinfo.conf
Size 795B
SHA256 c84ab7ae552c8abdb4a0bf431cfd92c7d47a5cbfd2c15d95ebe906e6b1df358c
MD5 b37bca15f6cba970b431f16a9503fd67
SHA1 a8452fc05c02b37f4f9510eae767f7dd0549f612
SHA512 54cb7a330d9e0b4f93731c350d48ce284294666a9288de831978f75aed83bd48343b167fd4e8e1d1d914eecd752e3421600838bd25930a63f7677c64d4c828f9
TLSH
T1C001CE19ED40483EA65EA9CF8AD7E6331C0CC841C18A7120B7F1408871E7CAAA4DF4CB
MD5 SHA1 SHA512 TLSH

Submit Download

exeMd5Sum.json

Path C:\Program Files\googlemeet_installerrmm\conf\exeMd5Sum.json
Size 1KB
SHA256 4afe194984730cd70457cf387929930d97317b2dcbeb8666ef4a03411fd761d0
MD5 5851e020131e675dc67d83503061e8de
SHA1 6e35fee3366dca132aacfb937051449d693f6aa2
SHA512 a5eb86652498a487041f1d40422fe13db384752e15455fb3e3772e2f60007fbdd3ba7ece400c8ab120e0421106702da1001d99715b075c916afca2dd13b0618e
TLSH
T175217725E59B0891E1B603620040255EF1DFA71740CACEAB79B6C3ED1F3B82D554FCA7
MD5 SHA1 SHA512 TLSH

Submit Download

serverkey.txt

Path C:\Program Files\googlemeet_installerrmm\conf\serverkey.txt
Size 67B
SHA256 a06bb5d99b3cd46c5d5a2969a54551a0bad6fd72d6e6a9e0576d377b0cefd03f
MD5 02513c5bc395c0f40a7f069f2c029f79
SHA1 c0be4493f0ed152b7126d38dd0e09fd49d258e50
SHA512 e998a7e170b946083a3148822c941165e24d15ff49c370ab57c5d599f7053a49d976744341c2652a17e4af3f015bc137c592168222e386c2363a87dba27c6720
TLSH
T10FA0220300803C020BC00CC328C02A200820F3A230A30C00B382F00020C300C8F0E80C
MD5 SHA1 SHA512 TLSH

Submit Download

banner.png

Path C:\Program Files\googlemeet_installerrmm\image\banner.png
Size 5KB
SHA256 56ee83a953af4996de88df6306e01a4008a2675498679ee74808d9480bceb5bd
MD5 3425b94f180c52822f87216b35df1e56
SHA1 bfcf997df6ef1a2e2706400f96628a8ef31ddab5
SHA512 0f540d638aaed077e6a408d86caaf4ad354f9c934879f9d4cf13da61cad390ad4567f062a734b1ded91e777c99b2dfbc5d1d400d0cbc5b4218b441bbd793e300
SSDEEP 96:ShzokYq1CzLlfUVMINi8fVeuGEpuwt6tzvKbPvMo8rgZDXCbm0Y4f:o8flTMieeu+wt6tz+3Mo8kgi94f
TLSH
T198B19E5E2C5658AF97FAE421EFEF313439002A2D01DD42ACB1717C413E163EC59116D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Program Files\googlemeet_installerrmm\image\icon.ico
Size 4KB
SHA256 33a0c1fb84ced2e0bbe810f43789acf0e559c3abf77c8f7f5f87562b94e9657e
MD5 8badddff54e13444f5aae92849b622fb
SHA1 9b6518cf5cbd6a6a036d17a8db6eb5cb5d701e00
SHA512 7b23c0e1fced14a9c4bf4e6d37905c0e53e0472fe1df7fdba1e70e0f50576e2848ba13091033bcb42a39078cc3832a392ddf93daf9d9d6881d2febdc481da150
SSDEEP 48:yhJH8WLy7M0DNKf4+MPgYX3QeNUpMJwHpqrMsg39iF:kLyg3SvX3HgHpqvg39iF
TLSH
T12E91EF3EF97EE054E83F6C75C686D1FD46282CC11E0101AF29AA39EFEC624118E5B096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

superops.log

Path C:\Program Files\googlemeet_installerrmm\logs\superops.log
Size 5KB
SHA256 c778c6982190971d1507b2083020a851ac4de9c641d50f3cf0ba5d33819c0a1f
MD5 bfc24d0fb5a56cf06165e59d8ab5d7e3
SHA1 6d231c7d5f7c7e8a925de08502bb6ca363dd28ce
SHA512 02f6d75297469b4473b3c927bf09cc557e82bab3e9860363db8b4626de36137591420b160c8998e1fe0bded5a0a6de7fefef0e54d794be7e73803e886d0a7851
SSDEEP 96:KJJNdiU0v09L0PcP9cNCb7aL4JOLJLJLCLaCFjLbUE3vnC:mJNdiUuWLgcECbM42BBwaCFjLbUE3/C
TLSH
T1C7C17BA39EB0A8B6AE138D44C77FBD624749B42571DC812AB3CED4FB915234338A5D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SopRegistry.conf

Path C:\ProgramData\Superops\SopRegistry.conf
Size 150B
SHA256 312c9412215c51883fab462726a91926d492aae1e532401c6d1be3313fa02eef
MD5 76093fee8f1df4ade066b35779298456
SHA1 774e7305709d245ed19a71992f75dce2153b6b9a
SHA512 f55a885d73e5d62ee0c6b47ed9678f48ba389c8fc1069a4443994923582580084d611c08d9bddf1021e037713b2ff8181c68758c5a0d75b05856404e08287db6
TLSH
T164C09B31BF44D1BD7924DF8E49935A324108D1B5951C5539B3C9111D63D2E25307B1C7
MD5 SHA1 SHA512 TLSH

Submit Download

sysTrayConf.txt

Path C:\ProgramData\Superops\logs\sysTrayConf.txt
Size 65B
SHA256 2e9742c7bd5f2a3384582ce1f66b755d54e56cdc557b806046ab16d5fd70de76
MD5 0c6a3a3980bbe687071872a16327e9d6
SHA1 f08a55a6e2ea7622772efca027fb4d816b4e5ed7
SHA512 db8708140b00ab0eeff740c21ba2c31d951b42f65f6062f30bd095f0dcd5cee830a673d8ef11ec05cd7f4c86d26704974d76fb1a5ccf25d8a04dbe2953cd7244
TLSH
T19CA0220000002A3288C0C0A038A82C0200288B3B0A00B22EC80B083C0828A0E2208C33
MD5 SHA1 SHA512 TLSH

Submit Download

systemtray_1084.log

Path C:\ProgramData\Superops\logs\systemtray_1084.log
Size 2KB
SHA256 6e9f4dba572c28f83cd1ebc1fb979fb3207b7839b0d7869f245a5a7a2d326f23
MD5 1cdb46a3f2c679284a84ed6066ff91e2
SHA1 dc7e4e0147476cf43eff499ca17604a6c0b358e4
SHA512 7fe8bfcc7fcfc5d0265e432ca61d57acd78b6a4d254d652f06b472665bbe29e6c1d90af2b42b7dada5eb15f707dfadfccd7f8b644edf92c24ebd6689adf0aeb4
TLSH
T10D51247187FF28BB5907CE4493B93DD24761792D329CA92BF3CAD489A19335018FAE11
MD5 SHA1 SHA512 TLSH

Submit Download

systemtray_1084.log

Path C:\ProgramData\Superops\logs\systemtray_1084.log
Size 3KB
SHA256 29c38e8e832971667c9d2a46be9522d867b42a8b1198b85e48c95f4df0411085
MD5 a3f98ebc953103506ef493aca7eda58c
SHA1 5823aed3c2e58e5e01b03de6ef67814a61aed977
SHA512 4b0fc761f55c916abc9c1a57cee10afdee59d65cade5eb859b3f862081823793108ddab2bd7d348dd99aabd0ba202f0f9bac24d81b592812a754968f080a1d7c
TLSH
T100615571C7FF28BA5907CE44D3B83D964BA1352D329CA86BF3CAE548A19335018F9D15
MD5 SHA1 SHA512 TLSH

Submit Download

1D3A6ADE28D2362383293C423AFF660E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1D3A6ADE28D2362383293C423AFF660E
Size 751B
SHA256 4260aac442ddfa6960a9cd2750a8a9197be711a5f6148af9e5ab5ec9d29f8384
MD5 5b53faf57e7daf356777bd44f3506e32
SHA1 39265e1ffbebd56a9341a84be01b94917eaa14e3
SHA512 ffdca62905aafb04e3911c6737c133e03c2b9daa0938f14dcaeae8b8da8b0cef1be6583ca2f66d7833051260879dc728d367cc6492015402313513de16667e05
TLSH
T17C01BAC0ED541435CF3436C803E4DA11283571F2698212EE3423506E8D5A790B37B02F
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67
Size 637B
SHA256 8692e95d9da25c9c4bae7aee26c27a61f1d02592989145b95a449e175d3ae7e1
MD5 c4782cef7d85eb382d0038645d7c8940
SHA1 16fda34f12e4f1f46ca9ab1996960f7e053732a6
SHA512 02471c7acf72ebd11f8810344807c5b0a82b83a1661cc4cb74a7840104272b450111778c555b5a0063a51b2696cec6c972730b9848002d4b26cf139fa717e345
TLSH
T10FF068D19CB62804D5A572E0C4FEF382A550285A08DC875753756286099DF380FEC044
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 1c4632b4f658f93fb9e2ff9098b061cff8dbb2b84d7c4c4fb0053b75dda0a5e5
MD5 3a018c328f5fc7fa3a522742bef0d94e
SHA1 8d8e2a7589db114c28efe332d400aa8d1ea37bd0
SHA512 694c7933bf53f7fd3a76f5eebffca7575fae89778c45a3d11afbb681617fe5fa816aa224590ebb27185d857fe4210c9bf6abbec610007007b421bd5365f69959
TLSH
T1EF31E6D3AB78BA205E194E50A8AD4B62BCF470F6FAA408753CB8001BA0A6FD0180980D
MD5 SHA1 SHA512 TLSH

Submit Download

1D3A6ADE28D2362383293C423AFF660E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1D3A6ADE28D2362383293C423AFF660E
Size 320B
SHA256 200d055c4a1f2c97dc1d236337692937e9aef47c0d8eec53ebbefb498088ea88
MD5 dd6bfb317b2a0a012965f107a9e31a10
SHA1 d06db843c5ae6c8fdcfeaa2dea808fc9d87a1798
SHA512 2612a378da72d16f78bb622a31ea981ff8fdb4afdd552b2e84e74149dba5f5ac94edb85534623d623274645f5ad38df4c5d0b9eef8cade2fec7d144ea47c1ebd
TLSH
T114E02B1446F8013FF0AA9F7EACF002C0FB72BD663D93C21E0662110E1140F008E22A2F
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67
Size 484B
SHA256 cdbfb0c7729b49cbfb0277cdca34fff068b7236b59759e382e0e6088f932d383
MD5 7b295d4f23c50fd38423cb653fc90bd9
SHA1 90e19c4a5e7d374d286d6d87162ed8506d1acf6c
SHA512 f6d5ff106d6dbbbca2d0c7531eda6b832801f03de0f6ba8510e972f331ba1a0afce2dec18461c582d16bce0a29ddf245c9b27c7503fae908ffe66be1373ec5ef
TLSH
T156F0AB2C2CFF413EF0B7F9F943E0D56A9D69F25238245BAC35A0434A2501F401C9382C
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_739E3FCC721F3B6F15D4B13045D0CC67
Size 484B
SHA256 9908f2e6d180732831bc35ec64d02313459450ed71288464f605d6ea39facaef
MD5 5ed7970a577dc92ad94694cdb4a33aec
SHA1 d60be78746bb9f8ff02ac9da1b75ac9de66755da
SHA512 1f68b188a437c0e36bb286dfb14f91c8efcb06e2d72c17ef4a86f64d8bce990497936f7e43b1c2ce9c0cc97a167e2258cfea8d2cf66aa4319dd7a4122ce0a941
TLSH
T111F0F82C2CFE813EF0B3F97A83E094266C1AF11238144BAC3890430B1902F000CD393C
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 3a4e2f970420a41e477bca20f2ffc6cbd248d2d36f72b63bf433ad3d4123debb
MD5 af6a542efe0a54ff2fc392453f33e995
SHA1 8b848a57499a53475eb461be553243aefea0fc60
SHA512 a1a3a892fa57a90b0484c4ce6c5e500525e4e7f6388063d8229139757bfff23e0ea7deaf0441b78e2db4e7c33050b42ae46b7a441d4422001f188d3dde8eeacb
TLSH
T1B3F0A3346EFA606DF0779E74C5D8F51758BCF3220415119701721606AE476834E95137
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 651B
SHA256 4c0cac895c138615c44f674f0a92304ec664e87fbd3721eb9f403cc03f2fea34
MD5 79dd9d574bf7da4d10dee390db653a12
SHA1 ddb3e64a2e79b01101cbd6d553eda0659451bc84
SHA512 f08b39971a8cc77761dea295906bead275aac4011821a3ea1c0a78ae1162bbbb1cf51cc93fbbb7c72cc4ac1bd2cb7d69cdd27ef6ff93d31ef66be8f97615e4b7
TLSH
T1B1F078722361B1D588163F43194C66885BBF43187A50ED0CB9A9724EE82902B6F223E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSIEF7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIEF7C.tmp
Size 113KB
SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
MD5 4fdd16752561cf585fed1506914d73e0
SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
TLSH
T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6568.tmp

Path C:\Windows\Installer\MSI6568.tmp
Size 277KB
SHA256 03378ee337a79b28a6e41fdc6c44ea293e3da3b970036f792b84b848933b9f9a
MD5 da8393ef10b79724e97bd84cc43dc653
SHA1 9297a483bdd60b9b078b0b71cf6699ca9a202d73
SHA512 4aaca1bc5886a81a110d0a314ee154c5bb384d5630ee752a6ebe3564566effe4a434b3c25cd4fa5f3dbffb40ea91fb52d885ef90e7d22c4b938c3efdd6440707
SSDEEP 6144:g8XqvLwHL0otXjsfsqCGhzsj3IzDKfjkX:OwHL0D02hAjFfjo
TLSH
T1B3549E1677E90179FC77863989230A55E6B2BC111B74D72F0390422ADF3F791AA39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerCA_x64.dll

Path C:\Windows\Installer\MSI6568.tmp-\InstallerCA_x64.dll
Size 26KB
SHA256 382625fd347cef2d3d421ad7c6a22178423bfb61fa9b5c756e024823d688ee4b
MD5 9077124861362b4971c22f4bc3b0edb7
SHA1 1f49f72cc1f08c811f37381e0b424d472f6a00b3
SHA512 11a5761d3d535574a3e9a065f54a906077bf1313281d8ec272bcc7f39bdb43ff41441f2481c2cdf486f49da15c945793d5536aeb23402c43a43ef18d43502ba3
SSDEEP 384:nI2PuFvG6HraI5TvyTl8pwKNsoJ79vldei2WSx7bLVRF:nI2P2vp7vyRpoJgAmbLd
TLSH
T17EC209473FF41602E9BEAB3065B057224F72B9871E71CA1D2CD118CC4DF5A809B65EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI66FF.tmp-\CustomAction.config
Size 178B
SHA256 314a0308a4740050817d54de1908fbdd5ddae944f8a7784c8f7d39cd71e8ed56
MD5 fc8719073d5cef80b9a2a6915c475f0a
SHA1 cc0df8e468999927fa89037e5afc23dd390b57a9
SHA512 4789cf74853f61b7f5c66017590d85610cabc049d44d378ea676cae330f5a92ca62d34d6e7b2d721ccf2e0b44b38f206f975046d30554a2ffca6810f67a1d818
TLSH
T1F8C08C998554FE2B8E031B137BA08A16AFB4B1E1B0584008E4BF7EA00A5508D474332B
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI66FF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59386b.msi

Path C:\Windows\Installer\e59386b.msi
Size 3.2MB
SHA256 6fb49f3d58126be5407300fffea3fee7ec5d05ff6e8ecb27457a8ca3c335dfeb
MD5 4016bac634869912d3d8a027daa85472
SHA1 e8361e38322e67caf5bf1b5d801851c019ca90f7
SHA512 1adfa3013e8d079ac1fa69d01bbd2dca8dbfda685054a3738b6403648458f5d72ddd5af2f650eaf0f204d848899f485807f94268af0010271779595733d6913c
SSDEEP 98304:ZBkFzdzZJe6Ueev0ShdIu8t8oaWLb+VCbiLDHs7WZkLneYr0c:ZBqu10STImVwNgbULfr
TLSH
T155F523807AD4017AE9661235CA36B5906B36FC105BF08A5A3785F33D1F3F398D936B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lhk1cz4n.y30.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_lhk1cz4n.y30.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9867fa7163926ac803241990d7d7305fe77c8362ca5565116b2233857a5de0cd
MD5 c60cf815a21969ef13f6eaa230031183
SHA1 d1f5b9c4f55166bb985acfc94c038a21efa48121
SHA512 43d23f738a159e6f469acae74b936a707ce1033fe3b115cfce0c999210dcedb566de4a546a557eed6242f68a76dcd85b48555f085505665724ea49bc4ceede1f
TLSH
T163216533B3ECC125C8D9117A208CAD00B2B5C3C7449E8F8B6A84C619957FADADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7fd7a6b02ce501498c0e43ec5a003141a0be3eff6ca2e2d13408a070f30d2ab6
MD5 89c8865aac93fba1ae72a0654e267c36
SHA1 32f97e4a7f6b39db14464aecbb70145a2c52af4d
SHA512 b363bce782ee5ce8b10af7b0832397343756466e9620bf5c8c8fffff084b86e41e94336a80179416eac9a575730c3a2164b3c9aba273ace3ba20412d01f81cf7
TLSH
T1F3216533B39CC565C8D911BA209CAD00B2B6C3C7449ECFCB7A84C529967F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af1d8142b3915aad93207491c36aaaec5c7fa6f98049c1058592a4cf2f3bd8b9
MD5 c3b63137929bf4a60fe426b70494610b
SHA1 7e30be64a91f9d40f47f9dd1c44058bba6464663
SHA512 7fa80d7dedf3bc4bbd567db371b1106bb2017d7faf3d26fefa6ce85308ed5fce7915001e261db31fef1d0fbc23aa993de9cbf1052f16260f9a675e9e23488015
TLSH
T13731033F77ACC169C886057A10D9AD00B279C2C7409DCEC77684C518F5AF5D9CBA83D4
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 ea7c4b532a8eb9774cb6001ca088fa1c7274ae246907f456a6722a1c7b7ef648
MD5 e1e901121bc6633c0f5f1f741c648170
SHA1 284175a49f2e7fd769b834f1915e240bf9467d0f
SHA512 dcb0db8c5008d9cb37d3fa49e1202fadc782302dd2a74c27f081ab28754a43e82c9722756d0de1d8f759b3fbc95c08ccb2b9345fea88cde796c33113ddc93f87
SSDEEP 24576:m2gmSp1+doO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:t
TLSH
T17347C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2bbb4665-ca72-4323-9d51-1ef2a70ef5a7}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2bbb4665-ca72-4323-9d51-1ef2a70ef5a7}_OnDiskSnapshotProp
Size 6KB
SHA256 6213e67aa05a41b6a79b62d8e38ed064e52a57a2bcb694ba235ebe856ff475ee
MD5 8872706404bfd90b2f0b23da2c20851f
SHA1 52c9db8e1eac51e18815384d698ee7fcdf830172
SHA512 c6d9c3f65111f5f16bb38bffea2dabc9c5d0d266edb4b3be900a6ae357452e8203c77c621e811b465fb35308419d8c87e9fd1cd50f7cf53e03baee88562e1170
SSDEEP 96:F4thLVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:6/V2b++ZVmN
TLSH
T120D188085AE54711E2B3AB3129F18557A877B911EF33CB8E0198238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-287-0x0000021975380000-0x000002197538C000-memory.dmp

Download

memory/396-288-0x0000021975420000-0x0000021975432000-memory.dmp

Download

memory/396-283-0x0000021976D20000-0x0000021977248000-memory.dmp

Download

memory/396-267-0x0000021976220000-0x00000219763E2000-memory.dmp

Download

memory/816-67-0x0000018A511D0000-0x0000018A511DC000-memory.dmp

Download

memory/816-58-0x0000018A51220000-0x0000018A5124E000-memory.dmp

Download

memory/816-62-0x0000018A51200000-0x0000018A51208000-memory.dmp

Download

memory/816-66-0x0000018A50E80000-0x0000018A50F9E000-memory.dmp

Download

memory/1196-137-0x00000299C3660000-0x00000299C377E000-memory.dmp

Download

memory/1196-95-0x00000299C38C0000-0x00000299C38CC000-memory.dmp

Download

memory/1196-138-0x00000299C38C0000-0x00000299C38CC000-memory.dmp

Download

memory/1196-94-0x00000299C3660000-0x00000299C377E000-memory.dmp

Download

memory/1648-313-0x0000029DA41D0000-0x0000029DA41E2000-memory.dmp

Download

memory/1648-306-0x0000029DBCAD0000-0x0000029DBCB83000-memory.dmp

Download

memory/1648-312-0x0000029DA4090000-0x0000029DA409C000-memory.dmp

Download

memory/2088-237-0x000001C928F50000-0x000001C928F62000-memory.dmp

Download

memory/2088-236-0x000001C928990000-0x000001C92899C000-memory.dmp

Download

memory/3040-34-0x0000018E687D0000-0x0000018E687DC000-memory.dmp

Download

memory/3180-202-0x00000180A5190000-0x00000180A51AC000-memory.dmp

Download

memory/3180-192-0x00000180A4DE0000-0x00000180A4E02000-memory.dmp

Download

memory/3180-203-0x00000180A51B0000-0x00000180A5263000-memory.dmp

Download

memory/3180-214-0x00000180A4BF0000-0x00000180A4C02000-memory.dmp

Download

memory/3180-213-0x000001808C9A0000-0x000001808C9AC000-memory.dmp

Download

memory/3180-206-0x00000180A5410000-0x00000180A542C000-memory.dmp

Download

memory/3180-204-0x00000180A5180000-0x00000180A518A000-memory.dmp

Download

memory/4444-157-0x000001D72F7C0000-0x000001D72F7CC000-memory.dmp

Download

memory/4444-8-0x000001D72F7C0000-0x000001D72F7CC000-memory.dmp

Download

memory/4444-156-0x000001D72DB60000-0x000001D72DC7E000-memory.dmp

Download

memory/4444-7-0x000001D72DB60000-0x000001D72DC7E000-memory.dmp

Download

memory/4968-272-0x00000141F5C10000-0x00000141F5C22000-memory.dmp

Download

memory/4968-271-0x00000141DD870000-0x00000141DD87C000-memory.dmp

Download