8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef.msi
Size 18.0MB
Sample260504-zapseact2y
SHA256 8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef
MD5 b79be30ac6890357694d51291a9c63ca
SHA1 9a59ac3a1fc93b83da5aaec4d2b6b6aec1d1d6b4
SHA512 91e186bdc0c9486499a01a3fc67aa7b5419e0d4a71c3ee3be1717c7ec0bf17a0a2050f21da4c11a53d665050bfd53e65bbdd25aa40f5dfb27874ffbef18afed8
SSDEEP 393216:byMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pGnL:eCj8XUW27YWFlbaAHbhLa
TLSH
T12417339BCE427F76F663DA3F47E1172D54A12D535453C09BA3223A3C0A36B816BE90C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6004	TiService.exe
1828	TiAgent.exe
3084	TiAgent.exe
672	si.exe

Loads dropped DLL 1 IoCs

pid	Process
6004	TiService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TiAgent = "C:\\Program Files (x86)\\TiFLUX\\desktop\\TiAgent.exe"	msiexec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6124	msiexec.exe
3	6124	msiexec.exe
4	6124	msiexec.exe
5	6124	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\uninstall.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\ultravnc.ini	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot.reg.md5.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\license.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\uninstall_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\ldapauth.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\Licence.rtf	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot.reg.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\sas_generation.reg.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\install.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\logging.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\uvnc_settings.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\uvnc_settings.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\ldapauth9x.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\mslogon.log	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\scripts\README	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\desktop\TiAgent.pdb	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\license.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\ldapauthnt4.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\unins000.dat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\logmessages.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\7zip\7z.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\tar\libintl-2.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\uninstall.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\driver\mv2.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\driver\mv2.sys	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\install.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\SCHook64.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\setpasswd.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\authadmin.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\ddengine.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\desktop\es\TiAgent.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\TiUpdateService.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista\driver\mv2.cat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\setcad.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\unins000.msg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\winvnc.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\vncviewer.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\uvnckeyboardhelper.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\Whatsnew.rtf	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\desktop\pt-BR\TiAgent.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\README	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\install_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista\uninstall_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\install_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\certmgr.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\safemode_reboot.reg	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\driver\mv2.inf	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp64\driver\mv2.sys	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista\uninstall.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\ddengine64.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\driver\mv2.cat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\xp\uninstall_silent.bat	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\SCHook.dll	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\vista64\license.txt	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\64\testauth.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\sas_generation.reg.md5.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\sshHostKey.reg.md5.md5	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\ultravnc.ini	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\32\UVNC_Launch.exe	msiexec.exe
File created	C:\Program Files (x86)\TiFLUX\dependencies\tar\libiconv-2.dll	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF6F544997CA4BADC7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5817bb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1D3E31E42A608DF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFB8FC08E617316EF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5817b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5817b9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9978E1CE88CCC6DB.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5126B414-6D57-4AD0-8FE8-D1C517426C4B}	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2764	sc.exe
3372	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6124	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a09cc7b9ddbd1cc00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a09cc7b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a09cc7b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa09cc7b9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da09cc7b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\ElfBeacon	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\ElfBeacon\version = "139.0.3405.125"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	TiService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\414B621575D60DA4F88E1D5C7124C6B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\414B621575D60DA4F88E1D5C7124C6B4\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\ProductName = "Ti Service And Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\PackageCode = "B1130945283725541B35E0692F4ADFD3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1a68854ec6303b24f8030c922155e768\414B621575D60DA4F88E1D5C7124C6B4	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1a68854ec6303b24f8030c922155e768	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\PackageName = "_8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\Version = "33554432"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\414B621575D60DA4F88E1D5C7124C6B4\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5556	msiexec.exe
5556	msiexec.exe
1828	TiAgent.exe
3084	TiAgent.exe
6004	TiService.exe
6004	TiService.exe
3084	TiAgent.exe
3084	TiAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6124	msiexec.exe
Token: SeSecurityPrivilege	5556	msiexec.exe
Token: SeCreateTokenPrivilege	6124	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6124	msiexec.exe
Token: SeLockMemoryPrivilege	6124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6124	msiexec.exe
Token: SeMachineAccountPrivilege	6124	msiexec.exe
Token: SeTcbPrivilege	6124	msiexec.exe
Token: SeSecurityPrivilege	6124	msiexec.exe
Token: SeTakeOwnershipPrivilege	6124	msiexec.exe
Token: SeLoadDriverPrivilege	6124	msiexec.exe
Token: SeSystemProfilePrivilege	6124	msiexec.exe
Token: SeSystemtimePrivilege	6124	msiexec.exe
Token: SeProfSingleProcessPrivilege	6124	msiexec.exe
Token: SeIncBasePriorityPrivilege	6124	msiexec.exe
Token: SeCreatePagefilePrivilege	6124	msiexec.exe
Token: SeCreatePermanentPrivilege	6124	msiexec.exe
Token: SeBackupPrivilege	6124	msiexec.exe
Token: SeRestorePrivilege	6124	msiexec.exe
Token: SeShutdownPrivilege	6124	msiexec.exe
Token: SeDebugPrivilege	6124	msiexec.exe
Token: SeAuditPrivilege	6124	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6124	msiexec.exe
Token: SeChangeNotifyPrivilege	6124	msiexec.exe
Token: SeRemoteShutdownPrivilege	6124	msiexec.exe
Token: SeUndockPrivilege	6124	msiexec.exe
Token: SeSyncAgentPrivilege	6124	msiexec.exe
Token: SeEnableDelegationPrivilege	6124	msiexec.exe
Token: SeManageVolumePrivilege	6124	msiexec.exe
Token: SeImpersonatePrivilege	6124	msiexec.exe
Token: SeCreateGlobalPrivilege	6124	msiexec.exe
Token: SeBackupPrivilege	1148	vssvc.exe
Token: SeRestorePrivilege	1148	vssvc.exe
Token: SeAuditPrivilege	1148	vssvc.exe
Token: SeBackupPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeDebugPrivilege	6004	TiService.exe
Token: SeDebugPrivilege	1828	TiAgent.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6124	msiexec.exe
1828	TiAgent.exe
3084	TiAgent.exe
6124	msiexec.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1828	TiAgent.exe
3084	TiAgent.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 1352	5556	msiexec.exe	82
PID 6004 wrote to memory of 5904	6004	TiService.exe	85
PID 5904 wrote to memory of 3372	5904	cmd.exe	87
PID 5556 wrote to memory of 4920	5556	msiexec.exe	90
PID 4920 wrote to memory of 3084	4920	cmd.exe	92
PID 5556 wrote to memory of 5412	5556	msiexec.exe	93
PID 5412 wrote to memory of 672	5412	cmd.exe	95
PID 5556 wrote to memory of 3940	5556	msiexec.exe	96
PID 3940 wrote to memory of 2764	3940	cmd.exe	98
PID 6004 wrote to memory of 5652	6004	TiService.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1352
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start /MIN "" "C:\Program Files (x86)\TiFLUX\\desktop\TiAgent.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
    "C:\Program Files (x86)\TiFLUX\\desktop\TiAgent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3084
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start /MIN "" "C:\Program Files (x86)\TiFLUX\\si.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Program Files (x86)\TiFLUX\si.exe
    "C:\Program Files (x86)\TiFLUX\\si.exe"
    3⤵
    - Executes dropped EXE
    PID:672
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c sc failure TiService reset= 86400 actions= restart/30000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\sc.exe
    sc failure TiService reset= 86400 actions= restart/30000
    3⤵
    - Launches sc.exe
    PID:2764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Program Files (x86)\TiFLUX\TiService.exe
"C:\Program Files (x86)\TiFLUX\TiService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc failure TiService reset= 86400 actions= restart/30000"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\sc.exe
    sc failure TiService reset= 86400 actions= restart/30000
    3⤵
    - Launches sc.exe
    PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://agent.tiflux.com:443/r/equipment/install_error/90cf0887-991f-4fae-b29f-74c8b652a766/2249443
  2⤵
  - Modifies data under HKEY_USERS
  PID:5652

C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
"C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5817ba.rbs

Path C:\Config.Msi\e5817ba.rbs
Size 37KB
SHA256 e9d617dbda418a0a8dcaa01ec09a6367398f0797f8f17cc6ec20ab37fea974bd
MD5 de28dcce28c27701e0b81c8e72521628
SHA1 73efbe881a1866ce29f1a1e2aac8c935e282fd3d
SHA512 89b7c1510e2213bc616f7379aa6d66e1fe9ade56ae20039c5c7f0c9fbc948e1b51d75c3e0311791e4d396f88a68d74a7145e14c6eb1259643b3aa1c33ba97c88
SSDEEP 768:i7Cv0QqJiV13psRKjHO9OXBQndCytSzHKBLZoOc:8Cck13JqBs
TLSH
T14A034F4DE865C1D1FD117AFBA3DA2E2C226B5C1DEFA5081E01C98F0ED497DA04EBC496
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiService.exe

Path C:\Program Files (x86)\TiFLUX\TiService.exe
Size 7.8MB
SHA256 feb96b1d11ea4b62a65a22981c1875c6e802c437c229e861fec4c6e601761f97
MD5 7f0cd2cab576e6c15c83aa5327c3c96c
SHA1 0a5ac38660c6fa66be2845004a0bd116d718dee5
SHA512 0de6b576ef046be552b391342bc42271c5d58181d1e14a839378768ebd2100ceb4254ecb2f0016cbe1145ea814a655ae1397b21f08b6aa69b8660304ac4107fe
SSDEEP 196608:ftp3tmIEW+CroZXXg840Q5QPsvCLR7Udsv38x:ftRXE7Oohw84FdC7Ueve
TLSH
T1FE86F113B7E581B9E5E74279867A1767D97171060B30D6CF21C04E982F63AE3A63F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiService.exe.config

Path C:\Program Files (x86)\TiFLUX\TiService.exe.config
Size 773B
SHA256 31807bdb4d25fa4f410073209c248550fe8eb6f18673797c0fd1f0c2b7d726e7
MD5 a7f9c13ca7f6e8d0b484704d0982fc5f
SHA1 4d6856cb15af074700e13c76f038c01d406083cb
SHA512 3d6a2be1faf2a43c57577e0dc92969165def4487b71266f36767f1c0f6c35cf720353b781b20a9cae383fa80961bc3f6f965155e35922b35f5b31bbfadd75597
TLSH
T1B101701251C86FA58F714AB23B67A478DBBD0373294C014DB0AE6BDF8F2561A4307276
MD5 SHA1 SHA512 TLSH

Submit Download

install.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\install.bat
Size 16B
SHA256 8402e0c9189fa6ef6ef8e955606c5a20f880f1106ea5f81304e42a0864f078f8
MD5 903b157dca56861c845179d4d1c5e930
SHA1 e6b5ed1511f1f14f0436ca474ff457cb340e7c60
SHA512 53f5be22fd9b12ff9d084a65be63bfa7a9b5489a5d95263343ee0db3ce749b1b6d0999ac3cc34b23a4a970f3f02dd7ed1199269c12c8b59313ff58b225774006
MD5 SHA1 SHA512

Submit Download

install_silent.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\install_silent.bat
Size 17B
SHA256 15af5763e85b2250dd1d00ed3ab051a69f3dd00cd679f7646ff34f18ed867476
MD5 262b5c4496a902ebe2e5659b763766c4
SHA1 2dfcbd32ec44e0e15628cfeda38d9d5ca4df0ab8
SHA512 c7ff7eba5a3e9c49cadaefb7f1c608871dcfca2b38e0befbe6335eb0559043ba901331337282e3fbf318135fc9a22ed7100f645e0185327e01fc2fb1fd783795
MD5 SHA1 SHA512

Submit Download

license.txt

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\license.txt
Size 1KB
SHA256 18d357c3792c89e9a8fc127e65a81be919bec7166e537eca080478e0370e61c6
MD5 624a16979822ca9e244602ef815e4fcf
SHA1 ff39fd4a7ee12c5190144e2f28ab5d7db2a3f435
SHA512 491eb3288f3753fb18df1e1f634c07eca7ff6970c6ce6778e0eb0c4fb1ec0a8e490c1273a0183cac221db8750b03fcde5b7b03fbf8a98a5c43048523c7ce37c3
TLSH
T1342103B6D16E877A28C242DB22544CC4F69E61DC711B5DC1794B713C235E972413F8ED
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\uninstall.bat
Size 18B
SHA256 010287946e1c4d4f95451ae3fe6168ae03fe91e040c5d86ce78d2f38b3973ee1
MD5 227a2799ad2fd1209b0bfbd2a965aee2
SHA1 a877de613e709d3eae661bb3bf1399e7150a60b5
SHA512 f726d3639f0d685a61ba83113e47312ee9e73248d8ffdda24fa5221c4e277ff273bdd1ac4f99363ba5bcbd13967e1ccc55b9d809a0f594edc6b327226350ccf9
MD5 SHA1 SHA512

Submit Download

uninstall_silent.bat

Path C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\driver\w2K\uninstall_silent.bat
Size 19B
SHA256 749527f0ed65353004a9a988029e38e89f1ec97fb400a3f26ec705280a95333f
MD5 a883f2e3804f157892c5a2a2c4fc1bcb
SHA1 5bedc101311e87d9798b75e3a54c95a84e168d14
SHA512 6fe1b2facae0bd50c23294547512d2f4ced56d4541d26053ef68ea1d5d98862ae5aab81c77a8601fa05945e3d608241e68e2b867bf88d3dad86fe80bbe403465
MD5 SHA1 SHA512

Submit Download

TiAgent.exe

Path C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe
Size 739KB
SHA256 17e6f123a698e7fe5ed2968b5e5adfb560b680b25693ff08499f57d30434f96f
MD5 f7a2f2e85bdbe7608ca08cb34193d109
SHA1 aa8c8c92afa4dd9dbab5bb810a48445a1451905e
SHA512 5e17800282af6bd4dc2cb17fbce936f4f57f263205cec8e8fe826b9c98a9da0b582d2a097bf902316c85e118af7ca460dd5e3196ed7c383b60612e8fe77237da
SSDEEP 12288:OceEzVEIPuyTEJcqxGWRh7WzvIjVQSsequ/3xnYuhAp1wxNWN1z4vJYSFu:lZhLPuUWHWcxQSseftYkxcUvKSFu
TLSH
T197F42329335BA240D6DC4F3719925B853BB2B6869C00C1EE99A80EAD7FD77134B52723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TiAgent.exe.config

Path C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe.config
Size 777B
SHA256 c86bdb089ada86ae84305a9f86d9fddacbd195d75f69723dd035eb83b2a4ec7f
MD5 9b87d12794196fe40f5e8a6eff18e3a7
SHA1 6d481d4b3f89d6c39dba858715a95d6e8d102634
SHA512 5365196d7e3f3309c2f62d51a5cdba4247dbcea188466b3bf4ddfc2cc60ecf971358a115d2e2754a99cafbd5d087ce2014b811de484a720fc1f333179650a41c
TLSH
T1C901901251C87FA58B724AB23A575474DBED0373284C004DB0AE6BCF8F35A1A420B276
MD5 SHA1 SHA512 TLSH

Submit Download

TiAgent.resources.dll

Path C:\Program Files (x86)\TiFLUX\desktop\en\TiAgent.resources.dll
Size 3KB
SHA256 9dc3efe5099ce2b6469b1315eaf923e7dbfe659d6aeac11fe2eafb914f01a0c4
MD5 3af95b45a975db84c4784e461e0d7c3e
SHA1 da529fe01333a5527ba872e1fdaf15d52bd11bce
SHA512 2b93305bcb78cd99463bddce419079cf2f5bb3183f714c63100e8f5492f8894d9596c5e1b56f4b560d465edf5892a94cf7a46fac750cdbc37ae52073c224a927
TLSH
T1DC71DD1657E4073BF9B70B726C73A7466235F920DE628B2D1494232E6C627A05E72F32
MD5 SHA1 SHA512 TLSH

Submit Download

si.exe

Path C:\Program Files (x86)\TiFLUX\si.exe
Size 26KB
SHA256 d6f3beaae7762c21cdef000082e32ed1d28be6d3f3e1cd3c98240a80e1e7f64d
MD5 e57a2a7ac24df0fa3b2446f69be9f48a
SHA1 f1d33d8c2ef40cc7e06940bf080fbccdf2246966
SHA512 636b06e6100089d192f1175c7e8708b0cddc66851ab6f48337f1943e0ce28f4ed59e5317fb7470accff08422d516b96c8faf9512163d33245cbd593aba33af8e
SSDEEP 768:vGY/NVgbB1yT7pdEVKRtY7pllX8UXGEab5z2i7:+kVgzKY7pllX8UWEab5z2i7
TLSH
T117C29FA23B74C033D9B74E706BF722812E72B181AE64C16E59CF404E4ED1F91676276B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4
Size 2KB
SHA256 7c67584f88160463161d5594bed15127df391d76c8b19e2526160361a71d8435
MD5 ee152c581f6d89bc356b5dcf2487c4bb
SHA1 18e1d8b4eb12a9157a4b317d582bfe6ab28d10e7
SHA512 0b34448e77095a60f605bd8ba87ba50c297e5dcb28a13f401e96db4feb3948db05bcf5656bb34aa50d1728451f82ced18d799ab71e70399cdc0582b96702bc19
TLSH
T16B4119C28C6D30348A4659933FE8E17278BAB45005C16163A8C9F59A1D8ADE9794980C
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 faa86f6ab504d67d96ed5f51a6c0c615dddfa81ee4541c21652d514f9a781b88
MD5 b784cb18eae2a40ca533a136237bfa60
SHA1 cc834042ec832300c4b9b4a0be0bb99f6300e848
SHA512 5cf3dc118ea94b5931bcce02554c2743211abb9235636e6e3a4131b32a83ad983982fb609146bd44bef1baf43de1cce546b74b61ba25aa64e4c0762bceede0e0
TLSH
T10301200A0D56CA5DAB601AE087D4EC6734613A09F8891F42BA363A990661F7CE70BC4D
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_082FF9BC1A34EEE63A2FDEF17DCF8C7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_082FF9BC1A34EEE63A2FDEF17DCF8C7F
Size 638B
SHA256 3b10308309367bf6754a4197691552358f4b6c3555f2916c821d45dae801e76b
MD5 773b09f38e9dc6be9beb7ff3f264f755
SHA1 36d4b280fbd8a316b803d9f442d36823c0117d60
SHA512 4228214ed3f074e3537c2c3a645aeaf60e0aba0ccf34d21c04e3a6ef53118e149d89edd91f24de2c48cc5639094b82978d75c67bbcbfc7aca974f717dfce8335
TLSH
T19CF0234FCD1A8980F0B0109289FCF7A020C5B513A0C0232F5A3DB3466EBAB72348382B
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 5d2bd1a88fa067b2c8c5797878d8ff9b8ac511da7affe60f9058759cb667dd66
MD5 53828ad897a5d613c5fc0016d17f2530
SHA1 e3362ba78a56f670563d734a3e9a85c71ff72641
SHA512 caa90bffd3150409fdadea0a98d82ee8a3d61e7437cc8eea2381f18ba9719ec8c68ecd75633cf720fca6207eb34423e9cf1e5180be057ed0bca53f195935824b
TLSH
T1B431C9E77FA879109F064D91CCADDB713CF239E175984CF53824849BA863FA41416C2D
MD5 SHA1 SHA512 TLSH

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_71A3756DBB32C004799210B766A7AFA4
Size 492B
SHA256 f7615df01b93da25cae0e5030553d7f8928735f70993f1585b83620d38ab4de8
MD5 c0fb0f192af5112c6a143fb6cae52bc2
SHA1 cae7601b799f3848264486daba6421348a8bbd27
SHA512 f92fa6e311c599cf9f02e6de20cf763e243c74650552bbb8145cba4c8525def2819d4c270491d9f93ee90044bb25ba3f88713ebbb30aa4c171adc86497bc5646
TLSH
T141F05C18B2FE412FF576ED39C6E4A9A66466F2113C014479079245457E13F02CE22C2D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 2fca32a92dd9976c8c758d4d6788059eef5e79c726da4a3bb9197a076ccc7c9d
MD5 a614afc679ff930abc7bad0fe66c22a3
SHA1 b6ad3087c76a7db9e5564f703f76349a16961647
SHA512 e4781beb2f424af5c095a428b1f33ffae4b1a6ccc770df879500c1e6c41b7aa0a99768b83d130cc3adfd2a5e11888d90da0bbec151916d92b18366043222482c
TLSH
T10FF0AB682EFA003FF5AA8D7687D0A4E34C49F123246289E402A523099A07E4A2C21166
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_082FF9BC1A34EEE63A2FDEF17DCF8C7F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_082FF9BC1A34EEE63A2FDEF17DCF8C7F
Size 480B
SHA256 954dd4f20aaa5b2c242d5aeea9b10caf93b1e051c4d4da63e40d83e5c89fabfd
MD5 cca976139a4f6ad4e73c5412c415c5de
SHA1 762218e4a7a6c29b0c51e28f3fd11199578a42ee
SHA512 b776df4d205e034b07fdd707bb84169f22f0be6b0bbc9adae749a87d14ecaabd7acce572df278e0d3ace1624191c600edcac712fed3bc65819b91ef3f9ff2265
TLSH
T148F0AB2C2ADE01FBE2FAAA79C3E44DE3655DF00330892FFC026803166E03B419E12518
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 0cf4b346fbcc5572ae7480c321d508adebc903ca493c1b245f428819d7df1ad8
MD5 c2a5f566d80a2a4b52a7ec0e2962d344
SHA1 6613c3b82413eb2ea021e1d9d87dbba1fe6dbd9e
SHA512 6214f632f5d9c01c4ffe3813440e27163b6f6e66a8290633b62087016f752637d866da1b8d7a1c8fedfb10a488c819cdc5a6468fad91581f8a68ebd2daed287e
TLSH
T1DEF0A33465F9106DE0375E38CFD9F515B87CF7122041577325A2060A760A7425ED1537
MD5 SHA1 SHA512 TLSH

Submit Download

e5817b9.msi

Path C:\Windows\Installer\e5817b9.msi
Size 18.0MB
SHA256 8cd4bb344103ed4ce374df68cb2c8d8e15f773576c44a738f94530f3b1b0d2ef
MD5 b79be30ac6890357694d51291a9c63ca
SHA1 9a59ac3a1fc93b83da5aaec4d2b6b6aec1d1d6b4
SHA512 91e186bdc0c9486499a01a3fc67aa7b5419e0d4a71c3ee3be1717c7ec0bf17a0a2050f21da4c11a53d665050bfd53e65bbdd25aa40f5dfb27874ffbef18afed8
SSDEEP 393216:byMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pGnL:eCj8XUW27YWFlbaAHbhLa
TLSH
T12417339BCE427F76F663DA3F47E1172D54A12D535453C09BA3223A3C0A36B816BE90C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite.interop.dll

Path C:\Windows\Temp\Costura\370AC3D2F4BDCF180A9B67A95B28C0DC\64\sqlite.interop.dll
Size 1.6MB
SHA256 96c952efa25720eec63437df20e20b8959dde5230c6f1d5c30be68cf72665532
MD5 df5c214d9a436a6a96c93cb8927194e4
SHA1 70110af5cd1600ca5552c3ba69a0ac58e33750e4
SHA512 2207725c056f109dffa95f2ac2bd2ffb8131232ce558173c1ef608d715922e5166f2974ce3a2e132cf405317d1502a14a71fbe895334707fd96b9350825d3b86
SSDEEP 24576:NGOu/gMGBbocBpflBQO8wgLGYS/YxwFtXBCtt2Ry0X76AQKKf:cGBBrQO8R6YS/YxeBCO
TLSH
T12A757B47F2B801ACD5ABC2B88A575607E7B134451B70A7DF50A48BA62F13FF6167E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 60d4c6001c7d2eee9cdd91ba02dddfe23faa056abb8cfb826ac306fbe5910872
MD5 a091f9c0be57da6d7ad7db7a17d41ebd
SHA1 de8294f3059ea9176f2381c4987a4397b9017864
SHA512 d5f8da85a38052593a13f52007be533ff1f2d9a807bba7e0c4577232c58c5d84e72363a5d899a74e888059774e4b3680bf0d1f8ee5af223bed1edccb7e55f7db
SSDEEP 24576:f2gmSp12doO/vvTLx26+xEHqfqJRg4OQW25dXpkajB6IkG+/4hrtb3w9h:0
TLSH
T11047C32436F92110E7F79E3C68F0AA234D3A7D5B9C1A9E8D05451F4E0961FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{94c572fe-38f7-467d-ba67-05b155a3ec32}_OnDiskSnapshotProp

Path \??\Volume{b9c79ca0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{94c572fe-38f7-467d-ba67-05b155a3ec32}_OnDiskSnapshotProp
Size 6KB
SHA256 e9c47bf209dae17776a53a1a23a15c75077c9920ad7086389aa4c1331933bf89
MD5 2f9c889b43db611d12f125e95d707a7b
SHA1 8556ff6f6dae8acf515d62fc3c8ec5a168cdf411
SHA512 54d2c36892a345c52fab7fa90f0ba25af2e0dc928f9b4d69848f1f165c4eb320d2be158412ba2f9399fb4c3ea9271cd2f70be9f855b658e79ee01d668390530d
SSDEEP 96:FYIs7+ltvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:iIhlnb++ZVmN
TLSH
T127D189085AE54711E2B3AB3229F18557A837B911EF33CB8E0298238E6670910F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-228-0x0000000000C10000-0x0000000000C41000-memory.dmp

Download

memory/672-229-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Download

memory/672-219-0x0000000000450000-0x000000000045C000-memory.dmp

Download

memory/1828-234-0x00000225C73C0000-0x00000225C73F1000-memory.dmp

Download

memory/1828-203-0x00000225C8D00000-0x00000225C8D12000-memory.dmp

Download

memory/1828-201-0x00000225C6F40000-0x00000225C6FFC000-memory.dmp

Download

memory/1828-207-0x00000225E1600000-0x00000225E167E000-memory.dmp

Download

memory/1828-236-0x00000225E22B0000-0x00000225E22C2000-memory.dmp

Download

memory/1828-209-0x00000225E41A0000-0x00000225E41A8000-memory.dmp

Download

memory/1828-235-0x00000225E1570000-0x00000225E157C000-memory.dmp

Download

memory/3084-237-0x00000286A5930000-0x00000286A5961000-memory.dmp

Download

memory/3084-215-0x00000286A59D0000-0x00000286A59E2000-memory.dmp

Download

memory/3084-239-0x00000286C08C0000-0x00000286C08D2000-memory.dmp

Download

memory/3084-238-0x00000286A5A00000-0x00000286A5A0C000-memory.dmp

Download

memory/5556-230-0x000002152EB60000-0x000002152EB6C000-memory.dmp

Download

memory/6004-190-0x000001F097230000-0x000001F097248000-memory.dmp

Download

memory/6004-193-0x000001F0B0160000-0x000001F0B01A8000-memory.dmp

Download

memory/6004-185-0x000001F096640000-0x000001F096E1A000-memory.dmp

Download

memory/6004-191-0x000001F0972F0000-0x000001F0972FE000-memory.dmp

Download

memory/6004-205-0x000001F0B0E90000-0x000001F0B0F20000-memory.dmp

Download

memory/6004-206-0x000001F0B0FA0000-0x000001F0B1016000-memory.dmp

Download

memory/6004-192-0x000001F0978A0000-0x000001F097900000-memory.dmp

Download

memory/6004-233-0x000001F0972D0000-0x000001F0972DC000-memory.dmp

Download

memory/6004-195-0x000001F097900000-0x000001F097926000-memory.dmp

Download

memory/6004-194-0x000001F0B0200000-0x000001F0B023A000-memory.dmp

Download

memory/6124-225-0x0000019309B70000-0x0000019309BA1000-memory.dmp

Download

memory/6124-19-0x0000019309B70000-0x0000019309BA1000-memory.dmp

Download

memory/6124-20-0x000001930B950000-0x000001930B95C000-memory.dmp

Download

memory/6124-226-0x000001930B950000-0x000001930B95C000-memory.dmp

Download