Analysis
- max time kernel
99s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/06/2026, 01:18
Behavioral task
behavioral1
Sample
ZoomWorkspace.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZoomWorkspace.msi
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target ZoomWorkspace.msi
- Size 4.9MB
- Sample260622-bn79xahs2t
- SHA256 37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3
- MD5 cfda340fa82d1b5f33cf82ae5070fbf4
- SHA1 1702b75976ef12eca324e341f91d90643bb3568e
- SHA512 39d973a72c97eee42d14f603b4f22a593fa647a24389c7025624d58ffc079d40676c0a41d6191531c6acd72af0a86f6402eb3a898a60ef56d3ce6548585ae17c
- SSDEEP 98304:iaI+R+g7rDoHeQufnPW/X423wED86HWKFIIKU5ctwAnlOAs2s6:iArDo+pfe/o2CKWKFRl5MW/6
- TLSH T1BD360115B6940CADD8E64235846EF115AE32380D273C86DB4E767DF83E26ED0A37A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 4 IoCs
pid Process 2160 pdq-connect-agent.exe 2704 pdq-connect-agent.exe 5252 pdq-connect-updater.exe 1836 pdq-connect-agent.exe - Loads dropped DLL 45 IoCs
pid Process 5200 MsiExec.exe 5812 rundll32.exe 5200 MsiExec.exe 5200 MsiExec.exe 1612 rundll32.exe 5200 MsiExec.exe 5200 MsiExec.exe 2996 MsiExec.exe 3908 rundll32.exe 2996 MsiExec.exe 2984 rundll32.exe 2996 MsiExec.exe 5580 rundll32.exe 2996 MsiExec.exe 2996 MsiExec.exe 1552 MsiExec.exe 5924 rundll32.exe 1552 MsiExec.exe 1552 MsiExec.exe 5796 rundll32.exe 1552 MsiExec.exe 5636 MsiExec.exe 4600 rundll32.exe 5636 MsiExec.exe 5396 rundll32.exe 5636 MsiExec.exe 5636 MsiExec.exe 236 rundll32.exe 5636 MsiExec.exe 5636 MsiExec.exe 3792 rundll32.exe 5636 MsiExec.exe 5636 MsiExec.exe 5636 MsiExec.exe 2436 rundll32.exe 5636 MsiExec.exe 4176 rundll32.exe 5636 MsiExec.exe 4716 rundll32.exe 5636 MsiExec.exe 2356 rundll32.exe 5636 MsiExec.exe 5636 MsiExec.exe 5636 MsiExec.exe 3240 rundll32.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5444 msiexec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SYSTEM32\symbols\exe\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Windows\System32\symbols\exe\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Windows\System32\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SYSTEM32\symbols\DLL\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\dll\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Windows\System32\exe\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\exe\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Windows\SYSTEM32\DLL\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\PDQ\PDQConnectAgent\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html msiexec.exe File created C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html msiexec.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\symbols\DLL\kernel32.pdb pdq-connect-agent.exe File created C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe msiexec.exe File created C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe msiexec.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\exe\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\dll\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\symbols\dll\ntdll.pdb pdq-connect-agent.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\pdq_connect_agent.pdb pdq-connect-agent.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\kernel32.pdb pdq-connect-agent.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\DLL\kernel32.pdb pdq-connect-agent.exe File created C:\Program Files\PDQ\PDQConnectUpdater\LICENSE.html msiexec.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe msiexec.exe File opened for modification C:\Program Files\PDQ\PDQConnectAgent\symbols\exe\pdq_connect_agent.pdb pdq-connect-agent.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_z3cut0df.cj2.ps1 powershell.exe File opened for modification C:\Windows\Installer\SFXCA9BC64CE1294D537BFE972B7197020154\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA5CB4EBCE6D4ECEA8D22E21915E04E160\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_zkctmk2z.jvd.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_b0abjrr5.bjb.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ze55qkit.uxh.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2dvy15x2.j1w.ps1 powershell.exe File opened for modification C:\Windows\Installer\MSI3BCC.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0EA3D36397CA2184.TMP msiexec.exe File opened for modification C:\Windows\Installer\SFXCA3F8BCF4C80464B3BC280C6640B49076D\pdqconnectagent-setup.pdb rundll32.exe File opened for modification C:\Windows\Installer\SFXCA3476D3E78B4AA2BB214707616BA1CBCE\WixToolset.Mba.Core.dll rundll32.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_igix4dca.c0y.ps1 powershell.exe File opened for modification C:\Windows\Installer\MSI4209.tmp msiexec.exe File opened for modification C:\Windows\Installer\{0EC05CD8-8D17-472C-86DA-AF1EA3C7A56F}\app_icon.ico msiexec.exe File created C:\Windows\SystemTemp\~DF419F6A3E518614E6.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8C3A.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA8D3853D7B042FC989D84357107724004\pdqconnectagent-setup.pdb rundll32.exe File created C:\Windows\SystemTemp\~DFB1E53F476BBAD607.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFFC8DE9F31ED69A50.TMP msiexec.exe File opened for modification C:\Windows\Installer\SFXCA9BC64CE1294D537BFE972B7197020154\WixToolset.Mba.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA10E2794D3A4F26F92224F93DDA921A15\pdqconnectagent-setup.exe rundll32.exe File created C:\Windows\SystemTemp\~DFBD7923F85EE1E591.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI984A.tmp msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_bttzviaj.003.psm1 powershell.exe File opened for modification C:\Windows\Installer\MSI5411.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA401130947D428A2B01AB9AB63C4B58C1\WixSharp.dll rundll32.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_0hqqwc0x.ona.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_hzoumh3p.jub.psm1 powershell.exe File opened for modification C:\Windows\Installer\SFXCA35FE2D966D478258F690EFCB0BA34ADE\WixSharp.dll rundll32.exe File created C:\Windows\SystemTemp\~DF8EC6218199615907.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7B7DE389F1119976.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF0371C6C0EC56A6F2.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_42ib5mys.xek.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5fvhi2vj.bjc.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_mjibi3st.g2x.psm1 powershell.exe File opened for modification C:\Windows\Installer\SFXCACE6C354E2C4C121BE8D8B99AA8AA7816\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_tzp4uy01.ll1.psm1 powershell.exe File opened for modification C:\Windows\Installer\SFXCAADF5089C6D41A2493BC2B3905425593D\pdqconnectagent-setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI93B0.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA3F8BCF4C80464B3BC280C6640B49076D\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA401130947D428A2B01AB9AB63C4B58C1\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DF29F0158F693BFB4A.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_whop5y02.qp5.ps1 powershell.exe File created C:\Windows\Installer\e592e41.msi msiexec.exe File created C:\Windows\SystemTemp\~DF6B2C645F595EC954.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI893B.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA10E2794D3A4F26F92224F93DDA921A15\WixSharp.UI.dll rundll32.exe File created C:\Windows\SystemTemp\~DFF636E87DDBF4051A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI31E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAAB80A5E03B48C8DA8D707B814C9FC818\pdqconnectagent-setup.exe rundll32.exe File opened for modification C:\Windows\Installer\SFXCAD9666740364B0D88DBFD73AA17161619\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA8D3853D7B042FC989D84357107724004\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI51ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA3476D3E78B4AA2BB214707616BA1CBCE\pdqconnectagent-setup.exe rundll32.exe File opened for modification C:\Windows\Installer\SFXCA3476D3E78B4AA2BB214707616BA1CBCE\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_qu33aqsl.0se.psm1 powershell.exe File opened for modification C:\Windows\Installer\SFXCAD9666740364B0D88DBFD73AA17161619\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\{F03416B2-8C97-4CC4-8578-5F6A58835B84}\app_icon.ico msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_n2g24aqs.cge.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5goc4l4h.scy.psm1 powershell.exe File created C:\Windows\Installer\SourceHash{0EC05CD8-8D17-472C-86DA-AF1EA3C7A56F} msiexec.exe File opened for modification C:\Windows\Installer\MSI9955.tmp msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_n5dj0crr.goi.ps1 powershell.exe File opened for modification C:\Windows\Installer\SFXCAADF5089C6D41A2493BC2B3905425593D\CustomAction.config rundll32.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1784 sc.exe 5744 sc.exe -
pid Process 1148 powershell.exe 5036 powershell.exe 4484 powershell.exe 1788 powershell.exe 2228 powershell.exe 5592 powershell.exe 2420 powershell.exe 4368 powershell.exe 4792 powershell.exe 4544 powershell.exe 4304 powershell.exe 5456 powershell.exe 3656 powershell.exe 5772 powershell.exe 2596 powershell.exe 3128 powershell.exe 4228 powershell.exe 5284 powershell.exe 1200 powershell.exe 3200 powershell.exe 3664 powershell.exe 1148 powershell.exe 4108 powershell.exe 964 powershell.exe 4460 powershell.exe 4616 powershell.exe 1204 powershell.exe 1464 powershell.exe 3200 powershell.exe 2340 powershell.exe 2864 powershell.exe 5372 powershell.exe 3364 powershell.exe 5372 powershell.exe 4228 powershell.exe 4868 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5444 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000045c06fad178b6f4e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380145c06fad0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410145c06fad000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e345c06fad00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e645c06fad00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\SourceList\Net\1 = "C:\\ProgramData\\PDQ\\PDQConnectAgent\\Updates\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\Assignment = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\SourceList\Media msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8DC50CE071D8C27468ADFAE1356251F6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8DC50CE071D8C27468ADFAE13A7C5AF6\Complete msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\Version = "84541464" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\Version = "84803592" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48\2B61430F79C84CC45887F5A68538B548 msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8DC50CE071D8C27468ADFAE13A7C5AF6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\ProductIcon = "C:\\Windows\\Installer\\{F03416B2-8C97-4CC4-8578-5F6A58244B84}\\app_icon.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68538B548 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\PackageName = "ZoomWorkspace.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\SourceList msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68542B448\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48\2B61430F79C84CC45887F5A68542B448 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\PackageCode = "DE6A1EC1E0C23B542B3AE6800C4351FA" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{F0355F57-DBC0-440F-B366-D48C042AC19C} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\PackageCode = "EB8195939D4347947ACB02D133BE9F86" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68542B448 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\SourceList\PackageName = "PDQConnectAgent-5.14.8.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\ProductName = "PDQConnectUpdater" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7C5AF6\ProductIcon = "C:\\Windows\\Installer\\{0EC05CD8-8D17-472C-86DA-AF1EA3C7A56F}\\app_icon.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68538B548\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{8BE9B970-7059-4DCA-A8C7-7F6C240A58F7} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 6048 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5416 msiexec.exe 5032 explorer.exe 5032 explorer.exe 3200 powershell.exe 3200 powershell.exe 3200 powershell.exe 5772 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5444 msiexec.exe Token: SeIncreaseQuotaPrivilege 5444 msiexec.exe Token: SeSecurityPrivilege 6048 msiexec.exe Token: SeCreateTokenPrivilege 5444 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5444 msiexec.exe Token: SeLockMemoryPrivilege 5444 msiexec.exe Token: SeIncreaseQuotaPrivilege 5444 msiexec.exe Token: SeMachineAccountPrivilege 5444 msiexec.exe Token: SeTcbPrivilege 5444 msiexec.exe Token: SeSecurityPrivilege 5444 msiexec.exe Token: SeTakeOwnershipPrivilege 5444 msiexec.exe Token: SeLoadDriverPrivilege 5444 msiexec.exe Token: SeSystemProfilePrivilege 5444 msiexec.exe Token: SeSystemtimePrivilege 5444 msiexec.exe Token: SeProfSingleProcessPrivilege 5444 msiexec.exe Token: SeIncBasePriorityPrivilege 5444 msiexec.exe Token: SeCreatePagefilePrivilege 5444 msiexec.exe Token: SeCreatePermanentPrivilege 5444 msiexec.exe Token: SeBackupPrivilege 5444 msiexec.exe Token: SeRestorePrivilege 5444 msiexec.exe Token: SeShutdownPrivilege 5444 msiexec.exe Token: SeDebugPrivilege 5444 msiexec.exe Token: SeAuditPrivilege 5444 msiexec.exe Token: SeSystemEnvironmentPrivilege 5444 msiexec.exe Token: SeChangeNotifyPrivilege 5444 msiexec.exe Token: SeRemoteShutdownPrivilege 5444 msiexec.exe Token: SeUndockPrivilege 5444 msiexec.exe Token: SeSyncAgentPrivilege 5444 msiexec.exe Token: SeEnableDelegationPrivilege 5444 msiexec.exe Token: SeManageVolumePrivilege 5444 msiexec.exe Token: SeImpersonatePrivilege 5444 msiexec.exe Token: SeCreateGlobalPrivilege 5444 msiexec.exe Token: SeBackupPrivilege 1504 vssvc.exe Token: SeRestorePrivilege 1504 vssvc.exe Token: SeAuditPrivilege 1504 vssvc.exe Token: SeBackupPrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeBackupPrivilege 5156 srtasks.exe Token: SeRestorePrivilege 5156 srtasks.exe Token: SeSecurityPrivilege 5156 srtasks.exe Token: SeTakeOwnershipPrivilege 5156 srtasks.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeBackupPrivilege 5156 srtasks.exe Token: SeRestorePrivilege 5156 srtasks.exe Token: SeSecurityPrivilege 5156 srtasks.exe Token: SeTakeOwnershipPrivilege 5156 srtasks.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeRestorePrivilege 6048 msiexec.exe Token: SeTakeOwnershipPrivilege 6048 msiexec.exe Token: SeBackupPrivilege 3908 rundll32.exe Token: SeBackupPrivilege 3908 rundll32.exe Token: SeBackupPrivilege 3908 rundll32.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 5444 msiexec.exe 5444 msiexec.exe 5952 sihost.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe 5032 explorer.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 5444 msiexec.exe 6048 msiexec.exe 5200 MsiExec.exe 2996 MsiExec.exe 2952 msiexec.exe 1552 MsiExec.exe 5416 msiexec.exe 5636 MsiExec.exe 3344 StartMenuExperienceHost.exe 236 SearchHost.exe 5032 explorer.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 6048 wrote to memory of 5156 6048 msiexec.exe 93 PID 6048 wrote to memory of 5200 6048 msiexec.exe 95 PID 5200 wrote to memory of 5812 5200 MsiExec.exe 96 PID 5200 wrote to memory of 1612 5200 MsiExec.exe 97 PID 6048 wrote to memory of 2996 6048 msiexec.exe 98 PID 2996 wrote to memory of 3908 2996 MsiExec.exe 99 PID 2996 wrote to memory of 2984 2996 MsiExec.exe 100 PID 2996 wrote to memory of 5580 2996 MsiExec.exe 101 PID 5580 wrote to memory of 5744 5580 rundll32.exe 103 PID 2704 wrote to memory of 2952 2704 pdq-connect-agent.exe 107 PID 6048 wrote to memory of 1552 6048 msiexec.exe 108 PID 1552 wrote to memory of 5924 1552 MsiExec.exe 109 PID 1552 wrote to memory of 5796 1552 MsiExec.exe 110 PID 2704 wrote to memory of 5416 2704 pdq-connect-agent.exe 113 PID 6048 wrote to memory of 5636 6048 msiexec.exe 114 PID 5636 wrote to memory of 4600 5636 MsiExec.exe 115 PID 5636 wrote to memory of 5396 5636 MsiExec.exe 116 PID 5636 wrote to memory of 236 5636 MsiExec.exe 117 PID 5636 wrote to memory of 3792 5636 MsiExec.exe 118 PID 5636 wrote to memory of 2436 5636 MsiExec.exe 119 PID 5636 wrote to memory of 4176 5636 MsiExec.exe 120 PID 5636 wrote to memory of 4716 5636 MsiExec.exe 121 PID 5636 wrote to memory of 2356 5636 MsiExec.exe 122 PID 2356 wrote to memory of 1784 2356 rundll32.exe 123 PID 5636 wrote to memory of 3240 5636 MsiExec.exe 126 PID 5952 wrote to memory of 5032 5952 sihost.exe 131 PID 1836 wrote to memory of 3200 1836 pdq-connect-agent.exe 181 PID 1836 wrote to memory of 5772 1836 pdq-connect-agent.exe 141 PID 1836 wrote to memory of 4304 1836 pdq-connect-agent.exe 143 PID 1836 wrote to memory of 2596 1836 pdq-connect-agent.exe 160 PID 1836 wrote to memory of 3664 1836 pdq-connect-agent.exe 147 PID 1836 wrote to memory of 4368 1836 pdq-connect-agent.exe 149 PID 1836 wrote to memory of 3128 1836 pdq-connect-agent.exe 151 PID 1836 wrote to memory of 1148 1836 pdq-connect-agent.exe 169 PID 1836 wrote to memory of 1788 1836 pdq-connect-agent.exe 155 PID 1836 wrote to memory of 4228 1836 pdq-connect-agent.exe 173 PID 1836 wrote to memory of 4616 1836 pdq-connect-agent.exe 159 PID 1836 wrote to memory of 5456 1836 pdq-connect-agent.exe 161 PID 1836 wrote to memory of 2228 1836 pdq-connect-agent.exe 163 PID 1836 wrote to memory of 4792 1836 pdq-connect-agent.exe 165 PID 1836 wrote to memory of 4868 1836 pdq-connect-agent.exe 167 PID 1836 wrote to memory of 1148 1836 pdq-connect-agent.exe 169 PID 1836 wrote to memory of 4108 1836 pdq-connect-agent.exe 171 PID 1836 wrote to memory of 4228 1836 pdq-connect-agent.exe 173 PID 1836 wrote to memory of 1204 1836 pdq-connect-agent.exe 175 PID 1836 wrote to memory of 1464 1836 pdq-connect-agent.exe 177 PID 1836 wrote to memory of 964 1836 pdq-connect-agent.exe 179 PID 1836 wrote to memory of 3200 1836 pdq-connect-agent.exe 181 PID 1836 wrote to memory of 5036 1836 pdq-connect-agent.exe 183 PID 1836 wrote to memory of 5372 1836 pdq-connect-agent.exe 201 PID 1836 wrote to memory of 4544 1836 pdq-connect-agent.exe 187 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5444
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D92425F3F2F0517A328B1BB5F915D48B2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI31E4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726937 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5812
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI36E8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728140 16 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1612
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 10FC87298763BC73AA5CE2D090FA2EC6 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3C1B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729375 38 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSource3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3F0A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729984 44 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteToken3⤵
- Loads dropped DLL
PID:2984
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4209.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240730812 50 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartService3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start "PDQConnectAgent"4⤵
- Launches sc.exe
PID:5744
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 3DBA4AFA6D519A5EE180DD5CA3BE85FA E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4E31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734078 61 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action3⤵
- Loads dropped DLL
PID:5924
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI51ED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734750 77 pdqconnectupdater-setup!pdqconnectupdater_setup.CustomActions.CreateEventSource3⤵
- Loads dropped DLL
PID:5796
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 88E7236BB83BCEF70C8364401B9C2E43 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI893B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240748906 86 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4600
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8C3A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240749671 96 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5396
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9100.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750859 110 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action3⤵
- Loads dropped DLL
PID:236
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9420.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751656 122 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3792
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI974F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752468 144 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CheckMsiFileName3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2436
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI984A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752734 148 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSource3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4176
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9955.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753125 152 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteToken3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4716
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9C05.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753687 157 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartService3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start "PDQConnectAgent"4⤵
- Launches sc.exe
PID:1784
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9F44.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754500 167 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3240
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\msiexec.exe"msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.10.24.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log2⤵
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Windows\system32\msiexec.exe"msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectAgent-5.14.8.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\install.log2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5416
-
-
C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2160
-
C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe"C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe" --service1⤵
- Executes dropped EXE
PID:5252
-
C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5772
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:2596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:3664
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:3128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:4228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4616 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2596
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:5456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:2228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:3200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:5036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:5372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:2340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:3656
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:5284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:5592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:3364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:5372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:2864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:4460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:1200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
PID:2420
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5032
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:236
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3344
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592e3b.rbs
- Size 403KB
- SHA256 da76d96a18d3a4e4b8cde65508a3fd0b0c2e009ba07049cc6dff36e32ab54212
- MD5 32ea6c1160c8bb2ae3263163bd500be2
- SHA1 79a0533dbf526a43480c221762cfed0ace5131ac
- SHA512 61e8ced29cf20e96fbb1d0cfaa6357cc3877bcd2198efa9a28da00241732b048b405716f247df494530efd401188e056300b9e97f48617af04430a06affea7ce
- SSDEEP 6144:lhMMdxm+3CharitB9vYS4ckdWUFQwwufBI8MnSVz9T:lhxdxdMaYYS4pdWUFkufW8MwT
- TLSH T192946A29B7E418EDE4B78276C5A78130FF75754D3320D5AE8BA8452D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e592e40.rbs
- Size 421KB
- SHA256 d750ccaa63ad85609b483388d8e8628d88f85d166009a6fe71826e46179038f7
- MD5 6c4fd1c4e895e4f3c7ee7cb58e826393
- SHA1 982e74e360133f0960e614e889e91e4d87b2fa1e
- SHA512 66c5ef8298b94f5b4f2c44d5b484228475d2f353f18e207a69b877620837ae35615bc43cae73cfc3ef008c63e6eb7eab5363955f0a0a6958aca971c966253f69
- SSDEEP 6144:KJqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxV:gqjGaYh3UGgFjKgZF35VijuoYm
- TLSH T132945B29B3E418EDE4B68276C5A78130FF75744D332095AF87A8952D1F3BAA430BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e592e47.rbs
- Size 403KB
- SHA256 3c63479a8d2c49a0b5b38e187675dd936c8ba7e85af852fdfa1ccb90a99f9683
- MD5 85f37d3837420013851b186115d9d7f6
- SHA1 3592a71372dd567fa39a30aef02c09d6a4a63618
- SHA512 b8b2c648829a146de843a064a5847290be94d68c6388ae946e1ba2b4c60b1525d86386555c9b9898f038a0b1eb08478893a7a5eb4fdb3a272ee5fe03c380847c
- SSDEEP 6144:BhMMdxm+3CharitB9vYS4ckdWUFQwwufBI8MnSVz9S:BhxdxdMaYYS4pdWUFkufW8MwS
- TLSH T15B946A29B7E418EDE4B78276C5A78131FF75B44D3320D5AE87A8452D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e592e4a.rbs
- Size 422KB
- SHA256 b38efcec13bfdb430985fe7a886722114faa0f11757a478eae8b9984ca107af0
- MD5 79533f7ef1ac625967f4e1575eef31af
- SHA1 b8326116bc5cac49c241cb466dd239382bec3bbc
- SHA512 1df4ec4c9e402e9db0345606967c2bc85e6a845525fbf118311d101b1700bdfb4989844d2c4ad52b1986d85e5c86ab4b7c45fa0b4310dcdd42f3a34294b6c42f
- SSDEEP 6144:MJqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxj:6qjGaYh3UGgFjKgZF35VijuoYW
- TLSH T18E946A29B3E418EDE4B68276C5A78130FF75744D332095AF87A8952D1F3BAA430BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html
- Size 464KB
- SHA256 2721a70fee6b5a8878caef3e1c202cb622dfe28ac1795f3c2ecb150d1e4d5188
- MD5 9de1be521c4db3aba4752afcc2713ddb
- SHA1 76a09dd3e38bf221155c1f37ee092ef11b906ff9
- SHA512 d803619f21fbf060010718b277056debc3b74a7d11ff1e8527cb851c39924b5c54bebc10096dbad5d0bff2f693caa10fab75b68a1a47c5a3cf8032fac1daacfc
- SSDEEP 12288:DWDYBJmnYbWCvCg9TxqnTn18Ks7htWLDKXCqVHPlczYXoRdRpRWCw8gIly3QR2PQ:G
- TLSH T175A4A62F7A9803770BD602A1AB5765CBF21F913F3B4A1A94305DD0281F3B92543FB699
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
- Size 9.0MB
- SHA256 92d887dc1c024270c37fa81f737633b25e656fece7171f1ad439b6c592ff8aa2
- MD5 adfdda1711c38cb94d1c6b843eca3e5c
- SHA1 9aba7f0219dbb47ff775ee1ad38180b83e124c7a
- SHA512 6eca982849effe6ffc3f920de2d904b62b193fa25762a8ae61d2f1982e41cb49c92129716182f3a5df821bab26c74dc156302aa9836c44034a1464e6598f7338
- SSDEEP 98304:uWkyfMLgZv1dg61VQnVX8GQ0wZiQ73fcqFd:NkIwqVOVMGQkIvd
- TLSH T1A3964B063F9999A9D09DC874C24A4BA74E2230DF1E39B5EF45D646292F3E6F51F2C308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe
- Size 4.5MB
- SHA256 926cc05d1a591657542dcd2550a9ee87760bfbfca1e27a9257a09c5884ed2703
- MD5 8621201a7a8a38d5ab4d8077a04e0a64
- SHA1 f772ee078ad4f20d9dd5564daa13a1ffc4ccfe76
- SHA512 694178846c4154f4a2ffb53685fd647b60384cf0e939ef107263dba4faffc438aabf48b725e6aad812cabaf6a315823e59555f3ece3ace958e0e4e397c6c6040
- SSDEEP 49152:PqKrL7GQYLm423vqU1eOjfBNaYOqcRjDq5aGE+nl11G26sNUbOZ5WUBzCdKD7mMM:hLIT+oCZ5u21PBXyd4m
- TLSH T16C267C027F8989F9C09DC474C2964BA79A3270CB1E35B6EF45D506682F3AAF51F2D318
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\PDQConnectAgent.db
- Size 36KB
- SHA256 a9451f4d2d9664b971fb6f0d69b423d54c68f4e26ddfeecce8abcb8e13bad737
- MD5 7c6be174c186a33f194ab2e65b5573b7
- SHA1 8d8328bfa6f3866bb609d6bb5a9766717ed1b193
- SHA512 5d002aefee7037c9b51ee8e7caade492a02eb8a2207bfa055a6a4d96da0f5319584a8f93f17533144ee8284e08abec9dcca8f5eb8151217693956cc77652ac3a
- SSDEEP 48:TxlW3rdYFvR5+fvRAjk0rZl+Qt+Ex52m9vzmulo0:lI3ZYVR5+XRAXd32wvD
- TLSH T122F243C353A83250EAB7017E94623BB10D7B9C4E993669E145E60C548DC1112867E9DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectAgent-5.14.8.msi
- Size 8.6MB
- SHA256 e502bdd406e6760a99b436ad93e860f72d8e88cbb3fe96a9e7ecc204b63fbb40
- MD5 3ee696f577e141c93d30487267d17563
- SHA1 d3cc582139c1e713418055d4b63b2a8ca0490ec7
- SHA512 1130cc27b30fc5094db1256e0981cf389128c25c9c50aa4f0487b60a6208b47e04dd7471ae43f2ba1cc305f14b966ab7160dcfa4579640eab29a415cf2b2a98e
- SSDEEP 196608:rhnSPIXGipGgy+3fLdCJqJwg0KuLc8PAS/qTC:rhSwXGipGgyaLdNwgL4cNS/qe
- TLSH T1EE96010472D40D6DD4A252348A1EF0149E32BC0C177D81EBAEB6BDF97A3AAD097767C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.10.24.msi
- Size 3.6MB
- SHA256 b8686716f4720eac29f9068395661639517884d077f1fb3916f6a6b58cd7a3f3
- MD5 8bc5fbee30330c9811c611d5d988c3a4
- SHA1 d7097a88bece3dd470b92bebed6fcd6d4c0373e3
- SHA512 87dde4c9d808d6fd3c7e1d0361a9de4d59c36bf48a0a6963c4f07355e23add7c6c3558c70110d7c4fdce963e4d4e1968a3b58815c658cc40014b631f2c2468b6
- SSDEEP 49152:6aoltxr7siQCfa9CD79lv0tDANyjLtOY4inLyukTuwTKyKnGk/+1gnAXN3fa2sjp:ix3lVYUfZyYinLN8q/VYN3f7Y+fE
- TLSH T18306DF1572940CADE8A64235846EF521AE717C0D233C86DB4E727DF93E3AAD0633A7D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\install.log
- Size 1KB
- SHA256 e990d1bb6946b5de3f4949f1e08090701ff82e0c2d76019faf3c796b8cde1b82
- MD5 e5c807841ea74abd34c62c0c9c363cff
- SHA1 0bc27d289a2f788bcc65b9527886267bcb8b6b8a
- SHA512 66f474cbf5e269815a89e683b5f64a7b36c3591c152747ee75c1746c22a64d05805ed63d7df07bbee888eebebb7770926db1d335de12aee2dc5c7cb6462d5cd4
- TLSH T1B731E9591EE90805B2B35747AEB3C5621E73FCE26874DB0C2384935946ABD096C293BE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log
- Size 3KB
- SHA256 d9ed2b84cc4fde2e2d2405b0841a1189d55d7ae1c541da937c1b6cc450d36ad0
- MD5 74b83ced883373bad606c5325be29f8d
- SHA1 8acffb7549d6fb0846b25152f4d52865ecbfa09d
- SHA512 e3c8b2c4d303c7a23364e4f4af5794d97e4f86946d9db47a9fcfa6fe3200a2b366b0033b01428f9b418962d33880788b7220afb40204a279b974820fe557847c
- TLSH T15F7119592FE50945B6B35B47AAF7C4120A33BDD16C34E70C2388835A07ABD0D98787BE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log
- Size 101KB
- SHA256 7cd4c1f3d6a9b5e7dbb530db27c973e4bf8563eaec7d80d6e0740c5ee406a7c9
- MD5 11985665dfd3727db2efda5c09dac61c
- SHA1 9f5125ba12fb9cee57692d3e0a2f1a4ccdf717f3
- SHA512 52fcf1e91624c9501a1ab557e9df3648eae2914b35f2cb4156e39cd553d826ab211508bfaa2e6ea29e558ac13f10f72cb69dd77ec99f7569e2e651d255c005d8
- SSDEEP 1536:ty5Va/R0zBR87xTGv7Lq7oH5XZoGZXvnGwgenzxj4MsdDdngja213aMLYdwo+J4n:tqbja213aMLYvpS4
- TLSH T17CA338296FF80159B2B39B479BF308134A33BD2A9935E90D21D5834D01B2E0DD9797BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDQ\PDQConnectAgent\token
- Size 86B
- SHA256 1d525d451614514ee79396e65e084e1587ac4c70d5bbde9fdfd9812badc7f379
- MD5 7a7f2cf21294cf4f15124848e8bd9600
- SHA1 9e97e38cd6b912b8dd7a97d10def805989a055ea
- SHA512 4ff8fead32ad07c9aeeb06644fc5f3c797cac8b764606ae1398255c036c6339ef019edc3ec0cccc046e93bbf7163193300468239c9b8a56e9d6137e75fa8b7c3
- TLSH T1EFA012C540DC06040F838442197DCB93C041193442B4ACB214F4539940400A55250103
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI31E4.tmp
- Size 573KB
- SHA256 a7780c30f73ec0c286961f15598e1d360e8837e717b67ba6b3a6eb4ea39557a7
- MD5 de21fbfcab260ec4cfa3e14ae988cf94
- SHA1 6c9c2e3945ef1c370bddf3ed7b495fbbd9bc9bbe
- SHA512 565bd738aa0c536eb98256ba4b15050b68b7477a3afc47d062100e3e3265abe8663d69e2da592da9f08aaf985e242f683619c33bb1ef1ade724659f41c7b35ea
- SSDEEP 12288:e5r+haztpo5L2qsmNRHRWxFIqdYcl/XUDgx:e5rpvol2q1MLIqdYcl/Yq
- TLSH T131C4E15A77E80D79FD7B517988630606E272BC165730CBEF0360425AAF2F7C19839B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI364B.tmp
- Size 394KB
- SHA256 50bbf22db97433456a4307211b99641740f20a6421bcee32216fa888feaa7b2c
- MD5 44e75952b658ffe4869cd40db1299c8f
- SHA1 6bb94bf54f401772d2aa21a37f17b319fe0417b3
- SHA512 bca6f5b4bc1f301191f713c7ecb5161ad8eedba6503ddee0ffc41b6e48c617c4fec19de22a63e139055ddba4fe4dae51505bb005b5cdad72d6684dfecd55c8a6
- SSDEEP 6144:khMMdxm+3CharitB9vYS4ckdWUFQwwufBI8MnSVz9:khxdxdMaYYS4pdWUFkufW8Mw
- TLSH T1FE846B29F7E418EDE4B78276C4A68530FF75754D3320D5AE8BA8452D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3C1B.tmp
- Size 577KB
- SHA256 ad4df7fe53ec5e2f8e77d0583db6146658bd8fd259f5d67c668830ce69a1ac93
- MD5 2f1726ce364ff99f531c505fe8818e6f
- SHA1 83d92163fb31fa93244f43b75abf1adab6dd52f1
- SHA512 2b2243ed145e7234d9b1ebf0712e49a561df77fe8be4af4bbaba48b75f9b886d80fba2f2d75058d2de87293d3cc621975bca86fa63c2b9585893dd597c02e8d1
- SSDEEP 12288:25r+hVznDY0MSt/jJYkS2ubDv/trvrrlwyEkY:25r4XVup2a/trvflwyEkY
- TLSH T187C4F14677E90CA5FC77923989634906D273BC115770D7DF03A08269AF2B7D1A83AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI4E31.tmp
- Size 565KB
- SHA256 54c1adad259af5669f44de6af64f157c269a9e12546b400f15b9ef49c621e539
- MD5 99f6ba0dc043d58bb31f9c41c3ce98de
- SHA1 b1c1b607de9b5c94e1ef08fabd6e09bed05f4556
- SHA512 53a5181c62ebbc02f690522cdc28f364616e4d30df13b6762fd9dca132c6f84c64f0d7cba103e993c021f1cb6202c3ea1d864385bd4d76c5ee171820529073aa
- SSDEEP 12288:4aSabyWAmvft4+YFzXPCUHhC3anxDIxSZtLj2B/jtD:4aSabBfiFD6u9xHZhyltD
- TLSH T1A2C4F156B7E909A5FC7B553988630646E773BC015730CAEF03A0465A9F2F7C0993AF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI5150.tmp
- Size 413KB
- SHA256 54febbd1f0a3875df16a4b88621cc0a10729b3c94b9a68639aab27d36fe39381
- MD5 ee729e752fa4e2e8b7755a138a188463
- SHA1 b0048f505d180d10feb1afa01cc4d3f5f15cf2a2
- SHA512 41a90d86894fbb1386099a6cccab416d88e76a4cadf83a90f8f91cf196a0feea2a4ab91daa6828303d8706cf9141ca1249425dac1df13d5d9ebd8958db909ba8
- SSDEEP 6144:0JqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxR:SqjGaYh3UGgFjKgZF35VijuoYg
- TLSH T1E6946B29B3E418EDE4B682B6C5A78034FF75744D332095AF87A4952D1F3BAA430BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI51ED.tmp
- Size 578KB
- SHA256 58b68a22f2a74e305676e33473bffd195f163252cdd7a3a09a3b876e587676d5
- MD5 fd3d872c83b9917754b37fa25d166b02
- SHA1 3456991bd00ea331801ea747462a02fa33ab59f8
- SHA512 0bacb3a2d140df176000d51309abdee8c833c653256a60902c9796ab432b1f8f062e81f254f8536a7019f000d2c7d8bd940cc879922f0223a958b661414d0d19
- SSDEEP 12288:4aSabyW62Id5Vji2aND329sHGrzbzs8667p6CKB9:4aSab0lYA9xr716iQCKT
- TLSH T1C3C4E159B3E80DA9FC7B9179C8630A06D2727C115771CAEF03A0425A9E3F7D19939F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI893B.tmp
- Size 1.1MB
- SHA256 61276a2c0e043191be5bb247cc49b03add0649de375403bdde8b5c97f70d036d
- MD5 6ade154751d0657e95c864d1a96f169c
- SHA1 73b53fd675f1567c59c4f4ba7fceb6a47d879a7e
- SHA512 05f0fec3876cdd85296a12dc69c4d9f473ba2576c17c3deac2bb68ecfcb103654074903e3c1a27ff7f3bb5d3064555c537b2858ab1c790cea40be1a12621544e
- SSDEEP 24576:P014AfiFD6u9xHZx01JAQDK6Zb93ACKBpXDiUEMeHoor/:sCACD79lc1JAOK6zm/QMeHVr/
- TLSH T13945120677E908A9FCB742398563068896737D425730D7EF43A046AADF2F7D0D53AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9955.tmp
- Size 1.2MB
- SHA256 a0cd081506a588854a0180d03bb2d98bb73585732b5f4256672ac1b2ba31f888
- MD5 74adad8eeebacc9e222cdf754d194a44
- SHA1 7920cf7603257caaf0060bb734aba676964a5434
- SHA512 4f5d5dab776b3ded4b039fe5f1488197938aa32ae872368bdac296c060ace7787c248fcd13d10f0914dc5d7da33dc3aea022afd13211061de81f8e6b275c5917
- SSDEEP 24576:/010lwgYFsPsqrT9aEu2eRKRxQypRt5QvZMEYYY/PpGhZWJL+Atl:8eKgYw19aEu2OKRf6dxhZWJLD
- TLSH T19F45120537F90DA5ECBB52398873464996337D020B71D6EF03A0465AEF2B7E0D536BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA1012B51BAC465A89D9E4484CE8CB090C\WixSharp.dll
- Size 689KB
- SHA256 8fced4b20ba39f8aacadefd9b2a60aaddb1823b516d452b0f62dd1fe8c335c2d
- MD5 2457c81b6fba66731b5294341a839877
- SHA1 ccbed50c7758749422bc9cebb03a296c4eec233d
- SHA512 57cdfa9687ca60a43d5ad2783b723eb751638c8a2901e8bdac02a1033017565e1692d6e81315afef9414574e9d4400400da5fcf1a7e21eea3e5adf63d0bf63d3
- SSDEEP 12288:9obAmMDkFj9Xq2adWD3zaDfJMMPm1Uby7zc+IaoMLFxicAhseX+fR1Yjd:lmrtTamP2aoMLFxicAhs2yR1Yj
- TLSH T155E45A0223F88925E9BF6B3CEC7521055777F806A936E74F2A88E4ED1E62740DD10B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA3F8BCF4C80464B3BC280C6640B49076D\WixToolset.Mba.Core.dll
- Size 165KB
- SHA256 7ac0cd1434327758142883d1eb90a5421c2862c09b84cb9780ae5be1be3301af
- MD5 ec393b51456ee6ae6c3fa9bd840ec783
- SHA1 b5e4de49d8e1528242e0983a9821563d5353cf61
- SHA512 1fbd5d534aa787baf6a63fab686b5b2686e410c919a82b54495a3a3e7c6601fb8712d800eeefc766990e590adeafed21f6b1f8e23e9f05dd4cf14bd90a27cdcf
- SSDEEP 3072:ZqzYZ685Vo818ywNzQ0Opiunb80abDrPd:ZoiEXOplo0+1
- TLSH T1C9F3F729039CACBDC68A0F3DA0D1847586B4EB1D58D1E3A59A01FBFB3523F981D135B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA5CB4EBCE6D4ECEA8D22E21915E04E160\WixSharp.UI.dll
- Size 707KB
- SHA256 3a06121020c53c5e40183be331a369028433b5f2e96a1f71ab1684043af13cc3
- MD5 88e091eae42d61ce29b2c4219bc278ae
- SHA1 dfe35f6e203975e31c181e7b6a7f8ab1ea116205
- SHA512 fd67fc60fe840711a3ad27b8f78b0cb4db2dd8e120cfcd8721818304ed45d1fa6527561d7a3c4bd0101e8b0f6dffeef273d4f1aa6e1205da5810a82dc07e70e6
- SSDEEP 12288:egyz2KnLuZjDk13oBOk3ptdPucKp/zSm9YHIewnTk04KMnSuOlK7QLggsdZvm453:4y3wTk04tSjKBZvm45t5Q7WWFM2stty
- TLSH T151F4DF0D36EDDE22D57787F0AAA001090334D15BCB37DAFAF88504D61A66761867BFA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA5CB4EBCE6D4ECEA8D22E21915E04E160\pdqconnectagent-setup.exe
- Size 49KB
- SHA256 9c11430643d0eab4b07d96d20675990003e43430c5106d7b87f70fc6175a3460
- MD5 130736768980637831f86d6f7b84b835
- SHA1 5312353883f66540d5db9a3916f500f0217d959d
- SHA512 2c1fc792a75fd9bbf25a7997f565574277782a01b3de9d4a62e5f43e217aab22774d4c101fc60ec9b7c306d96b236773e4b2024bbfe34719775a09805a03d509
- SSDEEP 768:SSG5Ng5uPj6Wp8Nde+BHbWeX6mDjP8NiPKWDYiDLk5urEORpr:ND2Vp8PbdX7jP8kD7RrEORpr
- TLSH T10D33080172E81E27E8BA9EF269F415014BB1FA562821D3CD5CC560DF0AF6F805AE1F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAAB80A5E03B48C8DA8D707B814C9FC818\pdqconnectagent-setup.exe
- Size 24KB
- SHA256 d2c7a656fe448e1ae3e9cba77198f2f687d8a24f5022c77e0060f13a9a06ea51
- MD5 8712a4337c8e63964f77139daf0c63a2
- SHA1 ca3cd08a12e9c969edbcb3d569ef9216d6a01b95
- SHA512 50627a513e87cc8740c2c53ba16960545486c0335f405d25328e318cbfda8b336dfa3797fe37fe9474bb88f0bae366265e2ab96ff709efe538b9d3ac69433f23
- SSDEEP 384:CSxdesIXbIaz7ASxt7HACNyEIYi2mL4/y8RLLIvb:bm7bD4SDM/YiDLk51Ly
- TLSH T1BEB26C5263E80829EE7B6F357DF291215D31FA566860C5CE3088808F1F57F806EA1BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAADF5089C6D41A2493BC2B3905425593D\CustomAction.config
- Size 980B
- SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
- MD5 c9c40af1656f8531eaa647caceb1e436
- SHA1 907837497508de13d5a7e60697fc9d050e327e19
- SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
- TLSH T1E2111C2C85E4F92B9A325A533A208896EFB0A1B2A174510CB09FBA170F720CE8257325
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCAADF5089C6D41A2493BC2B3905425593D\WixSharp.dll
- Size 685KB
- SHA256 cd978711231d2729e6ba4b5ef84236f671a7a40b7ee29f65b4e0f8ea5e06348f
- MD5 86e26888f15860835a2ff1423f25a513
- SHA1 429cc9a7ab03804db6a510d514e06e03a6df5f7e
- SHA512 375079e65650d511376da5a28dde71216c956159b68e8e9da1af3ee59782c29ed13fd4e77f8d1182446cc4be41a5d380e7528aec0975e3db9e7bfff8c7333d35
- SSDEEP 12288:fUFSMfXjXj2jVj0jVjbjLjljhOBjFj1jMjmjKjYjcjDjGj0jAjXj0jBjCjTjyjD5:cwMLzYBuBHXxkRh2ocCm/Iu6zuNEvUDz
- TLSH T148E45A0227E85666E5BF2B3CE8B466058777F8069932E74F568894ED0EB3784DC10B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAADF5089C6D41A2493BC2B3905425593D\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 cdd7f34dda1180f21205543c8ee836c5be66060d94441172366bce078e1cdb87
- MD5 7a9f5179ec8e7cc6ab0549ca2f840b93
- SHA1 f0193d65259dbb266e8bcf092a9f10218808a0e0
- SHA512 ceb348aed28245959d1fa0132aa628324070e8c3d7f73a014beab34098e2d1c9c41fc1ebac0e1cf4489f8d0f7dac991e8ae4d462bbceae5547135955e8d67843
- SSDEEP 3072:FOf7tVL+l4lj19l4uDHY2j69UgoTqddqmCnfKlRUjW01KyKwPXCm3SEtPxnU:FgQQx542j6jomdKgz6nU
- TLSH T1D3149D2A57F84B3ECEFF8778E2A14252C7B1F1E27103D71D5D8281A62163394B692397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e592e3a.msi
- Size 4.9MB
- SHA256 37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3
- MD5 cfda340fa82d1b5f33cf82ae5070fbf4
- SHA1 1702b75976ef12eca324e341f91d90643bb3568e
- SHA512 39d973a72c97eee42d14f603b4f22a593fa647a24389c7025624d58ffc079d40676c0a41d6191531c6acd72af0a86f6402eb3a898a60ef56d3ce6548585ae17c
- SSDEEP 98304:iaI+R+g7rDoHeQufnPW/X423wED86HWKFIIKU5ctwAnlOAs2s6:iArDo+pfe/o2CKWKFRl5MW/6
- TLSH T1BD360115B6940CADD8E64235846EF115AE32380D273C86DB4E767DF83E26ED0A37A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{F03416B2-8C97-4CC4-8578-5F6A58835B84}\app_icon.ico
- Size 278KB
- SHA256 21b0a4a7d60c8328f6987c1c9ae2773772100c08cf2123cf73c99376ffd9721c
- MD5 b17911403313b8ec4035bf1ac1089dc1
- SHA1 ce926a858f35611a5238a1c71da38a92b328f836
- SHA512 5eeb80234bfd44ecad026df563a355134c18aae1861679045b73271f07a3c6bcc8d9d5f5a289a608a4bf8d09ff9d090b43406f3748d37e3100117219146b8fee
- SSDEEP 1536:X7GUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUx:r
- TLSH T1E054CCA83A489E5DD4E2963E716CF2559CA4655E117C4AEACF3BBCF13989CE393003C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_mqyya1hs.kys.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e7578962feaa76e85300f575b77d7c6414c0bc19d9fb3355a60ef4046e69cc3f
- MD5 1dc0ec93cf5e0830662574dcaf868075
- SHA1 46da7854a162a067263761fa2e595131230fbd65
- SHA512 1d9740b3c8367d7a899a4e83e2ef406de04351a324fdb95ec2c06b0e2c1d9734215796fd463b6ce233861959510d668eaefc63a2a0a259bb072ea499679cce6f
- SSDEEP 24576:EFo3DMPkdoO/vvTL/yAddi1Qf7uHWb6eEgLftgjFLIT6Z68984RGN0XcJ+F:lHA
- TLSH T11457B16436F92240E7B79E3CA8F06A235D3A7D5B9C15DE8D05411B4E0822F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ad6fc045-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c3d5af59-0533-4857-8f6a-4d2584949cd1}_OnDiskSnapshotProp
- Size 6KB
- SHA256 fabab4c9d64d3922556255dd7fe73b557a09137566dbe40be213eba6e949f0ea
- MD5 d3870812c0930b776880a446503b3634
- SHA1 c0477a48dbbb9721c262d5b7874d5fb51667a442
- SHA512 3fa2a0f10f166e84c43d6c3c7d62f15cc61c59f0892835e372991bd89ea20cbc196e6868bebd94537c2df8653d9b4dcc800b192605ed6e07fa90b99b4a2fcc8d
- SSDEEP 96:FOHnjgOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:cDgCb++uVm
- TLSH T1E6D187085AF54311E2B3AB3129F18557A877B811EF33CB8E0198238F2671A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH