8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef.msi
Size 18.0MB
Sample260504-zapseact2y
SHA256 8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef
MD5 b79be30ac6890357694d51291a9c63ca
SHA1 9a59ac3a1fc93b83da5aaec4d2b6b6aec1d1d6b4
SHA512 91e186bdc0c9486499a01a3fc67aa7b5419e0d4a71c3ee3be1717c7ec0bf17a0a2050f21da4c11a53d665050bfd53e65bbdd25aa40f5dfb27874ffbef18afed8
SSDEEP 393216:byMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pGnL:eCj8XUW27YWFlbaAHbhLa
TLSH
T12417339BCE427F76F663DA3F47E1172D54A12D535453C09BA3223A3C0A36B816BE90C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1588	TiService.exe
3932	TiAgent.exe
4244	TiAgent.exe
4536	si.exe
3460	TiAgent.exe

Loads dropped DLL 1 IoCs

pid	Process
1588	TiService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TiAgent = "C:\\Program Files (x86)\\TiFLUX\\desktop\\TiAgent.exe"	msiexec.exe

Badlisted process makes network request 16 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2204	msiexec.exe
7	2204	msiexec.exe
16	2204	msiexec.exe
18	2204	msiexec.exe
21	2204	msiexec.exe
22	2204	msiexec.exe
23	2204	msiexec.exe
25	2204	msiexec.exe
26	2204	msiexec.exe
31	2204	msiexec.exe
32	3476	msiexec.exe
36	2204	msiexec.exe
37	2204	msiexec.exe
38	3476	msiexec.exe
59	3476	msiexec.exe
64	3476	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\uvnc.cer	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\setcad.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\vnchooks.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\setpasswd.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\options.vnc	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\sas_registry.reg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\unins000.msg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\unins000.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\workgrpdomnt4.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\setcad.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\install.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\vncviewer.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\UVNC_Launch.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\winvnc.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\sas_registry.reg.md5.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot.reg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\driver\mv2.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\uninstall.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\driver\mv2.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista\install.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\SCHook.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\driver\mv2.inf	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\unins000.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\logging.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\tar\tar.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\install.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\license.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\devcon.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\si.pdb	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\TiService.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\uvnc_settings.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\logmessages.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot.reg.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\uvnckeyboardhelper.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\certmgr.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\mslogon.log	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\unins000.msg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\sshHostKey.reg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\uninstall_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\TiService.pdb	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot_xp.reg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\ddengine64.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\MSLogonACL.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot.reg.md5.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\uninstall_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista\license.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\vncviewer.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\winvnc.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\authadmin.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\ddengine.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\driver\mv2.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\license.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\uvnckeyboardhelper.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\TiUpdateService.exe.config	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\driver\mv2.cat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista\uninstall.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\Whatsnew.rtf	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\desktop\es\TiAgent.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\install.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\uninstall.bat	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5126B414-6D57-4AD0-8FE8-D1C517426C4B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BAC.tmp	msiexec.exe
File created	C:\Windows\Installer\e58de57.msi	msiexec.exe
File created	C:\Windows\Installer\e58de55.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58de55.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3224	sc.exe
760	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2204	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000550aa4e2285040970000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000550aa4e20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900550aa4e2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a550aa4e2000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d550aa4e2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4580	taskkill.exe
1328	taskkill.exe
3808	taskkill.exe
1112	taskkill.exe
2564	taskkill.exe
4644	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	TiService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1a68854ec6303b24f8030c922155e768	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1a68854ec6303b24f8030c922155e768\414B621575D60DA4F88E1D5C7124C6B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\414B621575D60DA4F88E1D5C7124C6B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\414B621575D60DA4F88E1D5C7124C6B4\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\ProductName = "Ti Service And Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\PackageCode = "B1130945283725541B35E0692F4ADFD3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Version = "33554432"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\PackageName = "_8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msiexec.exe
3476	msiexec.exe
3932	TiAgent.exe
4244	TiAgent.exe
4244	TiAgent.exe
4244	TiAgent.exe
1588	TiService.exe
1588	TiService.exe
1588	TiService.exe
3460	TiAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	3476	msiexec.exe
Token: SeCreateTokenPrivilege	2204	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2204	msiexec.exe
Token: SeLockMemoryPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeMachineAccountPrivilege	2204	msiexec.exe
Token: SeTcbPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeLoadDriverPrivilege	2204	msiexec.exe
Token: SeSystemProfilePrivilege	2204	msiexec.exe
Token: SeSystemtimePrivilege	2204	msiexec.exe
Token: SeProfSingleProcessPrivilege	2204	msiexec.exe
Token: SeIncBasePriorityPrivilege	2204	msiexec.exe
Token: SeCreatePagefilePrivilege	2204	msiexec.exe
Token: SeCreatePermanentPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeDebugPrivilege	2204	msiexec.exe
Token: SeAuditPrivilege	2204	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2204	msiexec.exe
Token: SeChangeNotifyPrivilege	2204	msiexec.exe
Token: SeRemoteShutdownPrivilege	2204	msiexec.exe
Token: SeUndockPrivilege	2204	msiexec.exe
Token: SeSyncAgentPrivilege	2204	msiexec.exe
Token: SeEnableDelegationPrivilege	2204	msiexec.exe
Token: SeManageVolumePrivilege	2204	msiexec.exe
Token: SeImpersonatePrivilege	2204	msiexec.exe
Token: SeCreateGlobalPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	4916	vssvc.exe
Token: SeRestorePrivilege	4916	vssvc.exe
Token: SeAuditPrivilege	4916	vssvc.exe
Token: SeBackupPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeBackupPrivilege	560	srtasks.exe
Token: SeRestorePrivilege	560	srtasks.exe
Token: SeSecurityPrivilege	560	srtasks.exe
Token: SeTakeOwnershipPrivilege	560	srtasks.exe
Token: SeBackupPrivilege	560	srtasks.exe
Token: SeRestorePrivilege	560	srtasks.exe
Token: SeSecurityPrivilege	560	srtasks.exe
Token: SeTakeOwnershipPrivilege	560	srtasks.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeDebugPrivilege	1588	TiService.exe
Token: SeDebugPrivilege	3932	TiAgent.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe
Token: SeTakeOwnershipPrivilege	3476	msiexec.exe
Token: SeRestorePrivilege	3476	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2204	msiexec.exe
3932	TiAgent.exe
4244	TiAgent.exe
2204	msiexec.exe
3460	TiAgent.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3932	TiAgent.exe
4244	TiAgent.exe
3460	TiAgent.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 560	3476	msiexec.exe	97
PID 1588 wrote to memory of 2168	1588	TiService.exe	101
PID 2168 wrote to memory of 760	2168	cmd.exe	103
PID 3476 wrote to memory of 3364	3476	msiexec.exe	105
PID 3364 wrote to memory of 4244	3364	cmd.exe	107
PID 3476 wrote to memory of 1752	3476	msiexec.exe	108
PID 1752 wrote to memory of 4536	1752	cmd.exe	110
PID 3476 wrote to memory of 1104	3476	msiexec.exe	111
PID 1104 wrote to memory of 3224	1104	cmd.exe	113
PID 1588 wrote to memory of 3808	1588	TiService.exe	115
PID 1588 wrote to memory of 1328	1588	TiService.exe	116
PID 1588 wrote to memory of 1112	1588	TiService.exe	119
PID 1588 wrote to memory of 3460	1588	TiService.exe	121
PID 1588 wrote to memory of 2564	1588	TiService.exe	122
PID 1588 wrote to memory of 4644	1588	TiService.exe	124
PID 1588 wrote to memory of 4580	1588	TiService.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2204

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start /MIN "" "C:\Program Files (x86)\TiFLUX\\desktop\TiAgent.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
    "C:\Program Files (x86)\TiFLUX\\desktop\TiAgent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4244
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start /MIN "" "C:\Program Files (x86)\TiFLUX\\si.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Program Files (x86)\TiFLUX\si.exe
    "C:\Program Files (x86)\TiFLUX\\si.exe"
    3⤵
    - Executes dropped EXE
    PID:4536
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c sc failure TiService reset= 86400 actions= restart/30000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\sc.exe
    sc failure TiService reset= 86400 actions= restart/30000
    3⤵
    - Launches sc.exe
    PID:3224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Program Files (x86)\TiFLUX\TiService.exe
"C:\Program Files (x86)\TiFLUX\TiService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc failure TiService reset= 86400 actions= restart/30000"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\system32\sc.exe
    sc failure TiService reset= 86400 actions= restart/30000
    3⤵
    - Launches sc.exe
    PID:760
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /T /im TiAgent.exe
  2⤵
  - Kills process with taskkill
  PID:3808
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /T /im TiAgent.vshost.exe
  2⤵
  - Kills process with taskkill
  PID:1328
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /T /im TiAgent.exe
  2⤵
  - Kills process with taskkill
  PID:1112
- C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
  "C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3460
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /T /im screenshot.exe
  2⤵
  - Kills process with taskkill
  PID:2564
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /T /im tidown.exe
  2⤵
  - Kills process with taskkill
  PID:4644
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /T /im ticonfirm.exe
  2⤵
  - Kills process with taskkill
  PID:4580

C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
"C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58de56.rbs

Path C:\Config.Msi\e58de56.rbs
Size 37KB
SHA256 f6463ab7d15c9536a1759518bad4e51d3bbe068eadb7269590a5186c5bfd43e0
MD5 e3afabf2018af2387c9215d605fae185
SHA1 362e6a34309b1ea6ead45de51bac3383cd4ed9b3
SHA512 829933d1ba20d798f28728a08ab0241d0aa97d9f2f041189dcc5a0b61aa064a9e8d21f3eb2af2e706f8c897ea65d9a8b915171d4762b1c5e5b174f6aa66da1b1
SSDEEP 768:C+Cv0QqJiV13p0RKjHO9OXBGnJAbtyzHKBLZoOc:5Cck13YqBs
TLSH
T1D3033F4DE865C1D1FD117AFBA3DA2E2C226B5C1DEFA5081E01C98F0ED497DA04EBC496
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiService.exe

Path C:\Program Files (x86)\TiFLUX\TiService.exe
Size 7.8MB
SHA256 feb96b1d11ea4b62a65a22981c1875c6e802c437c229e861fec4c6e601761f97
MD5 7f0cd2cab576e6c15c83aa5327c3c96c
SHA1 0a5ac38660c6fa66be2845004a0bd116d718dee5
SHA512 0de6b576ef046be552b391342bc42271c5d58181d1e14a839378768ebd2100ceb4254ecb2f0016cbe1145ea814a655ae1397b21f08b6aa69b8660304ac4107fe
SSDEEP 196608:ftp3tmIEW+CroZXXg840Q5QPsvCLR7Udsv38x:ftRXE7Oohw84FdC7Ueve
TLSH
T1FE86F113B7E581B9E5E74279867A1767D97171060B30D6CF21C04E982F63AE3A63F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiService.exe.config

Path C:\Program Files (x86)\TiFLUX\TiService.exe.config
Size 773B
SHA256 31807bdb4d25fa4f410073209c248550fe8eb6f18673797c0fd1f0c2b7d726e7
MD5 a7f9c13ca7f6e8d0b484704d0982fc5f
SHA1 4d6856cb15af074700e13c76f038c01d406083cb
SHA512 3d6a2be1faf2a43c57577e0dc92969165def4487b71266f36767f1c0f6c35cf720353b781b20a9cae383fa80961bc3f6f965155e35922b35f5b31bbfadd75597
TLSH
T1B101701251C86FA58F714AB23B67A478DBBD0373294C014DB0AE6BDF8F2561A4307276
MD5 SHA1 SHA512 TLSH

Submit Download

install.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\install.bat
Size 16B
SHA256 8402e0c9189fa6ef6ef8e955606c5a20f880f1106ea5f81304e42a0864f078f8
MD5 903b157dca56861c845179d4d1c5e930
SHA1 e6b5ed1511f1f14f0436ca474ff457cb340e7c60
SHA512 53f5be22fd9b12ff9d084a65be63bfa7a9b5489a5d95263343ee0db3ce749b1b6d0999ac3cc34b23a4a970f3f02dd7ed1199269c12c8b59313ff58b225774006
MD5 SHA1 SHA512

Submit Download

install_silent.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\install_silent.bat
Size 17B
SHA256 15af5763e85b2250dd1d00ed3ab051a69f3dd00cd679f7646ff34f18ed867476
MD5 262b5c4496a902ebe2e5659b763766c4
SHA1 2dfcbd32ec44e0e15628cfeda38d9d5ca4df0ab8
SHA512 c7ff7eba5a3e9c49cadaefb7f1c608871dcfca2b38e0befbe6335eb0559043ba901331337282e3fbf318135fc9a22ed7100f645e0185327e01fc2fb1fd783795
MD5 SHA1 SHA512

Submit Download

license.txt

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\license.txt
Size 1KB
SHA256 18d357c3792c89e9a8fc127e65a81be919bec7166e537eca080478e0370e61c6
MD5 624a16979822ca9e244602ef815e4fcf
SHA1 ff39fd4a7ee12c5190144e2f28ab5d7db2a3f435
SHA512 491eb3288f3753fb18df1e1f634c07eca7ff6970c6ce6778e0eb0c4fb1ec0a8e490c1273a0183cac221db8750b03fcde5b7b03fbf8a98a5c43048523c7ce37c3
TLSH
T1342103B6D16E877A28C242DB22544CC4F69E61DC711B5DC1794B713C235E972413F8ED
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\uninstall.bat
Size 18B
SHA256 010287946e1c4d4f95451ae3fe6168ae03fe91e040c5d86ce78d2f38b3973ee1
MD5 227a2799ad2fd1209b0bfbd2a965aee2
SHA1 a877de613e709d3eae661bb3bf1399e7150a60b5
SHA512 f726d3639f0d685a61ba83113e47312ee9e73248d8ffdda24fa5221c4e277ff273bdd1ac4f99363ba5bcbd13967e1ccc55b9d809a0f594edc6b327226350ccf9
MD5 SHA1 SHA512

Submit Download

uninstall_silent.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\uninstall_silent.bat
Size 19B
SHA256 749527f0ed65353004a9a988029e38e89f1ec97fb400a3f26ec705280a95333f
MD5 a883f2e3804f157892c5a2a2c4fc1bcb
SHA1 5bedc101311e87d9798b75e3a54c95a84e168d14
SHA512 6fe1b2facae0bd50c23294547512d2f4ced56d4541d26053ef68ea1d5d98862ae5aab81c77a8601fa05945e3d608241e68e2b867bf88d3dad86fe80bbe403465
MD5 SHA1 SHA512

Submit Download

TiAgent.exe

Path C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
Size 739KB
SHA256 17e6f123a698e7fe5ed2968b5e5adfb560b680b25693ff08499f57d30434f96f
MD5 f7a2f2e85bdbe7608ca08cb34193d109
SHA1 aa8c8c92afa4dd9dbab5bb810a48445a1451905e
SHA512 5e17800282af6bd4dc2cb17fbce936f4f57f263205cec8e8fe826b9c98a9da0b582d2a097bf902316c85e118af7ca460dd5e3196ed7c383b60612e8fe77237da
SSDEEP 12288:OceEzVEIPuyTEJcqxGWRh7WzvIjVQSsequ/3xnYuhAp1wxNWN1z4vJYSFu:lZhLPuUWHWcxQSseftYkxcUvKSFu
TLSH
T197F42329335BA240D6DC4F3719925B853BB2B6869C00C1EE99A80EAD7FD77134B52723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiAgent.exe

Path C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
Size 740KB
SHA256 a4b72ad3d3fad382d85745ef47b4be63aa469c8def9e409a404bef65c3470e19
MD5 5fa938a62a13ae63a8158313c45d5416
SHA1 aebd67655021d2ea2674ce62e8b2bc449c835985
SHA512 667845550d4814f6b8f8f600b042878f85bcf024f25fba2300bd997eeafec5780e8f14f2ce1d6818158fdcc5984bc18eeb0811c73200708ac5279f47354dc7ad
SSDEEP 12288:gneEzVEIPuyTEJcqxGWRh7WzvIjVQSsequ/3xnYuhAp1wxNW334Yfsm1z4vJAHn8:YZhLPuUWHWcxQSseftYkxbYhUvmHn8
TLSH
T16AF42335335BA341D5DD4E7718929BC53BB2B6869C00C1EE98A80EAD7FDA3174B61323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiAgent.exe.config

Path C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe.config
Size 777B
SHA256 c86bdb089ada86ae84305a9f86d9fddacbd195d75f69723dd035eb83b2a4ec7f
MD5 9b87d12794196fe40f5e8a6eff18e3a7
SHA1 6d481d4b3f89d6c39dba858715a95d6e8d102634
SHA512 5365196d7e3f3309c2f62d51a5cdba4247dbcea188466b3bf4ddfc2cc60ecf971358a115d2e2754a99cafbd5d087ce2014b811de484a720fc1f333179650a41c
TLSH
T1C901901251C87FA58B724AB23A575474DBED0373284C004DB0AE6BCF8F35A1A420B276
MD5 SHA1 SHA512 TLSH

Submit Download

TiAgent.exe.config

Path C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe.config
Size 774B
SHA256 b0420caa4f26b6c4b792c37ae580955e654c1e4a7abc11f32fd44f2f59f8df67
MD5 a47d9e42e639cd9061d195c3d0e91c6c
SHA1 2695fdebb89678930bf4d7ba1a0deb34b026cb5d
SHA512 8197bd607abbcf87a53087b5536d2c6ebb86ad3c581d552f2d2a0cbc35b8d5273b8ac8bd3bbe14083cd469aa9e2b631d09b2434a3af32347ea182f41b66c6049
TLSH
T18E019C1251C8BFA58B724AB23A975474DBE90373284C004DB0AE6BCF8F35A1A420B276
MD5 SHA1 SHA512 TLSH

Submit Download

TiAgent.resources.dll

Path C:\Program Files (x86)\TiFLUX\desktop\en\TiAgent.resources.dll
Size 3KB
SHA256 9dc3efe5099ce2b6469b1315eaf923e7dbfe659d6aeac11fe2eafb914f01a0c4
MD5 3af95b45a975db84c4784e461e0d7c3e
SHA1 da529fe01333a5527ba872e1fdaf15d52bd11bce
SHA512 2b93305bcb78cd99463bddce419079cf2f5bb3183f714c63100e8f5492f8894d9596c5e1b56f4b560d465edf5892a94cf7a46fac750cdbc37ae52073c224a927
TLSH
T1DC71DD1657E4073BF9B70B726C73A7466235F920DE628B2D1494232E6C627A05E72F32
MD5 SHA1 SHA512 TLSH

Submit Download

si.exe

Path C:\Program Files (x86)\TiFLUX\si.exe
Size 26KB
SHA256 d6f3beaae7762c21cdef000082e32ed1d28be6d3f3e1cd3c98240a80e1e7f64d
MD5 e57a2a7ac24df0fa3b2446f69be9f48a
SHA1 f1d33d8c2ef40cc7e06940bf080fbccdf2246966
SHA512 636b06e6100089d192f1175c7e8708b0cddc66851ab6f48337f1943e0ce28f4ed59e5317fb7470accff08422d516b96c8faf9512163d33245cbd593aba33af8e
SSDEEP 768:vGY/NVgbB1yT7pdEVKRtY7pllX8UXGEab5z2i7:+kVgzKY7pllX8UWEab5z2i7
TLSH
T117C29FA23B74C033D9B74E706BF722812E72B181AE64C16E59CF404E4ED1F91676276B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiflux.db

Path C:\ProgramData\TiFlux\tiflux.db
Size 20KB
SHA256 f773625813d840f37b1d5c7eb25dfde90ed50fbc12d3155166ab0fd473168cbf
MD5 e5547193b1ff55521c9cf35e1c87b313
SHA1 5087bde346c7ddd2677a438e5fef741c4e750abf
SHA512 21c88e9a5d7a766a5a6e1ddc5404ec5183acd9c4108defcc00517914174fd5d9c59440c13acce962bd4b67562f8ee5b1731929d7daf497d709b21934201f23a4
SSDEEP 12:TLvlAv6qF9i42B2/yMinS6HTOtEJEA2EXoIkHaqF9iSBeQ:TLNAv6qbi0HiJCtEJENEXnkHaqbimeQ
TLSH
T177922D733F1AB139DEAB46B15FA301670F3CF2E9459298E229F10811DDE59434D6EE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4
Size 2KB
SHA256 7c67584f88160463161d5594bed15127df391d76c8b19e2526160361a71d8435
MD5 ee152c581f6d89bc356b5dcf2487c4bb
SHA1 18e1d8b4eb12a9157a4b317d582bfe6ab28d10e7
SHA512 0b34448e77095a60f605bd8ba87ba50c297e5dcb28a13f401e96db4feb3948db05bcf5656bb34aa50d1728451f82ced18d799ab71e70399cdc0582b96702bc19
TLSH
T16B4119C28C6D30348A4659933FE8E17278BAB45005C16163A8C9F59A1D8ADE9794980C
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 faa86f6ab504d67d96ed5f51a6c0c615dddfa81ee4541c21652d514f9a781b88
MD5 b784cb18eae2a40ca533a136237bfa60
SHA1 cc834042ec832300c4b9b4a0be0bb99f6300e848
SHA512 5cf3dc118ea94b5931bcce02554c2743211abb9235636e6e3a4131b32a83ad983982fb609146bd44bef1baf43de1cce546b74b61ba25aa64e4c0762bceede0e0
TLSH
T10301200A0D56CA5DAB601AE087D4EC6734613A09F8891F42BA363A990661F7CE70BC4D
MD5 SHA1 SHA512 TLSH

Submit Download

43B41D246473AA455DCC6019A9AF9545

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\43B41D246473AA455DCC6019A9AF9545
Size 96KB
SHA256 f8e7c1e53b83a44cbf104dbeafc64e3503341f28e9c5590a797312c9d6708355
MD5 9db3015d8ddeebbc90a678644334bbb0
SHA1 0eaaee22f8e25a5bba44629e4d536b6382e58c61
SHA512 86a2871748162cc2238731e95bf4b6ecb055570bf3dcd06405e8f252c66f454c48efaf0e6b38b5ca713ffa9f1fdf89d6612c989adffb0eb97e7b4e0ff89b6e43
SSDEEP 1536:h0vA1qD8aSN5uSpx7lOVuIPbIIyF83C/etTmmqJPYl:4UqQaa5uSb7lIu4SWtUPYl
TLSH
T111A30C084D702006D5D6ED7399DDFE9A8D7134C7BAD7A1120B501A801AE3F8DADB7AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 5d2bd1a88fa067b2c8c5797878d8ff9b8ac511da7affe60f9058759cb667dd66
MD5 53828ad897a5d613c5fc0016d17f2530
SHA1 e3362ba78a56f670563d734a3e9a85c71ff72641
SHA512 caa90bffd3150409fdadea0a98d82ee8a3d61e7437cc8eea2381f18ba9719ec8c68ecd75633cf720fca6207eb34423e9cf1e5180be057ed0bca53f195935824b
TLSH
T1B431C9E77FA879109F064D91CCADDB713CF239E175984CF53824849BA863FA41416C2D
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4
Size 492B
SHA256 5bcf901346d86a89d094a12d0836a495f1716eda32a0f4f9f8300ac6e8e555b0
MD5 ab087be1736933ee6c509e6f525c0774
SHA1 351eb37825803e1ca3cf336316194cd34193e069
SHA512 028a08cbad85863d3eeefc6c730d71cf7317386aac4f61436a4eb6d582d79f64bb590ea21572d516acba40ce5b4150c3ea8f89bfc2265d5ccef2e9d9251597bb
TLSH
T105F05C18B2FE412FE572EC3AC6E4E9A66456F2113C014479079245457D13F02CD22C2D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 6b867d144bdcf5c645487e8cca2eb297213d23200cc43f2d71c151d2e4dfa350
MD5 8be7f73f21b55ebe05e13f5c8fd2ce1e
SHA1 0e46bbf9b58222827637ef22f50d75db428cfb80
SHA512 6c8c8762fa9c01578270a9d52dd16ffdfebea6f02de8f7f6e078791bbcd3582c2e1d4f95172097dd3e0e889995e288bf6a466b27aecb6c21b0d049e2f740f5d6
TLSH
T12FF068282AF7003FF1AA8DB99BD5B1F74C49F223345598B801A423095A07E4A2C61672
MD5 SHA1 SHA512 TLSH

Submit Download

43B41D246473AA455DCC6019A9AF9545

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\43B41D246473AA455DCC6019A9AF9545
Size 316B
SHA256 650e31dc30cc4192c402124be318cd4a640c1e5fb717e2ff7500c45cedc6fec4
MD5 45e2195b89d6f9ed59f6f7494ef371cf
SHA1 e01e24240add94f947772acab7cd13f0e68f597e
SHA512 58b391dcc05deffd73803688f05406777847d093ae5f3bd477229ac6e1090e5a11c6e8e21a9637a8dceaa3a80f6c5ecb321048c4dbf843ec0b3a65eb0ce3224e
TLSH
T13DE0C21807DC522EE5AAAABDECB40640FD23B83E7212C50D03A3060D2411B811D6170B
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 10795dc0292902a6d32b742c695aecc021236d02ed58a13eaa7676b5a75c17b0
MD5 5a8724c28772ef69d88870ff45f34324
SHA1 df6da594dc1fd0ca1021173922690ae0e74c5e3f
SHA512 2437bee6bb1e9956687ef550ca4d5693917f00851fa67057965ab48de2b2731f3903716efc96e0aa7c4f5a5ea25e085fd1ebcf9559af57bc17b8bd3218a31eb6
TLSH
T124F0A33425F9106DD0374E38CFD9F515BC7CF7122001577316910A0A760A7425DD1137
MD5 SHA1 SHA512 TLSH

Submit Download

e58de55.msi

Path C:\Windows\Installer\e58de55.msi
Size 18.0MB
SHA256 8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef
MD5 b79be30ac6890357694d51291a9c63ca
SHA1 9a59ac3a1fc93b83da5aaec4d2b6b6aec1d1d6b4
SHA512 91e186bdc0c9486499a01a3fc67aa7b5419e0d4a71c3ee3be1717c7ec0bf17a0a2050f21da4c11a53d665050bfd53e65bbdd25aa40f5dfb27874ffbef18afed8
SSDEEP 393216:byMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pGnL:eCj8XUW27YWFlbaAHbhLa
TLSH
T12417339BCE427F76F663DA3F47E1172D54A12D535453C09BA3223A3C0A36B816BE90C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite.interop.dll

Path C:\Windows\Temp\Costura\370AC3D2F4BDCF180A9B67A95B28C0DC\64\sqlite.interop.dll
Size 1.6MB
SHA256 96c952efa25720eec63437df20e20b8959dde5230c6f1d5c30be68cf72665532
MD5 df5c214d9a436a6a96c93cb8927194e4
SHA1 70110af5cd1600ca5552c3ba69a0ac58e33750e4
SHA512 2207725c056f109dffa95f2ac2bd2ffb8131232ce558173c1ef608d715922e5166f2974ce3a2e132cf405317d1502a14a71fbe895334707fd96b9350825d3b86
SSDEEP 24576:NGOu/gMGBbocBpflBQO8wgLGYS/YxwFtXBCtt2Ry0X76AQKKf:cGBBrQO8R6YS/YxeBCO
TLSH
T12A757B47F2B801ACD5ABC2B88A575607E7B134451B70A7DF50A48BA62F13FF6167E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 0510ab4e3d80a80b9fc339b210452d43f58f0aa974b4d0ca5b5cf70d5ff74bb7
MD5 6f2584214bcf185cbd6ba6e912889625
SHA1 8b9076f35a89419538367ec28abe46d9764c7742
SHA512 c360110e88959efa3dd0549d68b64cb39beb36c6db5a2284935900ca5d3a76ad5253a51bb1d2aba265f7662eba9fbee969385f1884e353a5d372537c29e8134d
SSDEEP 24576:mu8m+1z6doO/vvTLLWO+bGaKvX0T21eiCYGNshfFG06fOZ3TIPVX2oFx7:H
TLSH
T1ED47D52436FD2110E7F79E3C78F46A23893A7D5B9C15DE8D05461B4E0A21BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f53f9fe0-af81-4a4e-b8e4-7ecabe3d47ad}_OnDiskSnapshotProp

Path \??\Volume{e2a40a55-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f53f9fe0-af81-4a4e-b8e4-7ecabe3d47ad}_OnDiskSnapshotProp
Size 6KB
SHA256 361d4720f4f11722ac556961566f180d52efb2567488562b0e3c4e79208aded8
MD5 c9ce90d4108e1d9ae012a7ad5668712d
SHA1 6d13e3d980fa5ff394211d29ddd76ef83f69e39f
SHA512 5e0d1d6e5730650891b2c1bb36a2ec2142ceb26b1bf392f47a781294e46ebc69d742da1eb9bad8a7ef020007272f39ffae717e7af47cf52864618ca659ae8381
SSDEEP 96:Fosc5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:axb++ZVmN
TLSH
T1A7D189085AF54711E2B3AB7129F18557A877B911EF33CB8E0198238E2670910F975F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1588-230-0x00000258AE0A0000-0x00000258AE0BE000-memory.dmp

Download

memory/1588-206-0x00000258ADD90000-0x00000258ADDCA000-memory.dmp

Download

memory/1588-200-0x00000258ACF60000-0x00000258ACFC0000-memory.dmp

Download

memory/1588-203-0x00000258AD000000-0x00000258AD048000-memory.dmp

Download

memory/1588-214-0x00000258ADDD0000-0x00000258ADE60000-memory.dmp

Download

memory/1588-215-0x00000258ADEE0000-0x00000258ADF56000-memory.dmp

Download

memory/1588-243-0x00000258ADE60000-0x00000258ADE76000-memory.dmp

Download

memory/1588-197-0x00000258ACE50000-0x00000258ACE68000-memory.dmp

Download

memory/1588-237-0x00000258AE2C0000-0x00000258AE310000-memory.dmp

Download

memory/1588-242-0x00000258ACE70000-0x00000258ACE7C000-memory.dmp

Download

memory/1588-207-0x00000258AD050000-0x00000258AD076000-memory.dmp

Download

memory/1588-192-0x0000025893680000-0x0000025893E5A000-memory.dmp

Download

memory/1588-229-0x00000258ADEB0000-0x00000258ADED2000-memory.dmp

Download

memory/1588-198-0x00000258ACEA0000-0x00000258ACEAE000-memory.dmp

Download

memory/2204-238-0x0000018DD7180000-0x0000018DD718C000-memory.dmp

Download

memory/2204-7-0x0000018DD7180000-0x0000018DD718C000-memory.dmp

Download

memory/3460-320-0x000002A065090000-0x000002A06514C000-memory.dmp

Download

memory/3460-327-0x000002A000040000-0x000002A000056000-memory.dmp

Download

memory/3460-326-0x000002A065570000-0x000002A06557C000-memory.dmp

Download

memory/3460-321-0x000002A065550000-0x000002A065562000-memory.dmp

Download

memory/3476-28-0x000001E2EA640000-0x000001E2EA64C000-memory.dmp

Download

memory/3932-218-0x000001C331B60000-0x000001C331B68000-memory.dmp

Download

memory/3932-216-0x000001C331E90000-0x000001C331F0E000-memory.dmp

Download

memory/3932-245-0x000001C317AC0000-0x000001C317ACC000-memory.dmp

Download

memory/3932-246-0x000001C331B20000-0x000001C331B36000-memory.dmp

Download

memory/3932-209-0x000001C317A90000-0x000001C317AA2000-memory.dmp

Download

memory/3932-208-0x000001C3175D0000-0x000001C31768C000-memory.dmp

Download

memory/4244-224-0x0000016A8DB70000-0x0000016A8DB82000-memory.dmp

Download

memory/4244-248-0x0000016A8F510000-0x0000016A8F526000-memory.dmp

Download

memory/4244-247-0x0000016A8DB90000-0x0000016A8DB9C000-memory.dmp

Download

memory/4536-228-0x0000000000050000-0x000000000005C000-memory.dmp

Download

memory/4536-240-0x0000000000810000-0x000000000081C000-memory.dmp

Download