Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n001.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n001.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Install_28n001.msi
- Size 7.7MB
- Sample260729-cft8rasclf
- SHA256 0c94173d0cb26783553b7fc4eb4a3c0c4b67be3a5a4c424c9885f24827be7e6b
- MD5 cab3b5d5ddb9aca7c9ee6ab4379f42ff
- SHA1 04fb9f8b9dc41887734d2aae15f033de956c6b09
- SHA512 b52954c0db4a142c90173a7089423afecebb6422fd18d8b90b792785c1c8c96f98c6f9884939d75d5b111f88fbd36b6bb324dba52b14c2ba766dd0983d9bb87a
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDG:nAGiNMwnbQvQTyhv92ALhve0ETWI8Kh/
- TLSH T1488633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vbacVG = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation 8BScO7.exe - Executes dropped EXE 1 IoCs
pid Process 4972 8BScO7.exe - Loads dropped DLL 2 IoCs
pid Process 5692 MsiExec.exe 4972 8BScO7.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vbacVG\\8BScO7.exe\"" 8BScO7.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 23 5692 MsiExec.exe 29 5692 MsiExec.exe 42 5692 MsiExec.exe 44 5692 MsiExec.exe 45 5692 MsiExec.exe 53 5692 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 2648 cmd.exe 4948 cmd.exe 6040 cmd.exe 5944 cmd.exe 2684 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 8BScO7.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\biLZye 8BScO7.exe File created C:\Program Files (x86)\biLZye\biLZye.exe 8BScO7.exe File created C:\Program Files (x86)\biLZye\XPSPLOG.dll 8BScO7.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58ef5c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF076.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSIF0F4.tmp msiexec.exe File created C:\Windows\Installer\e58ef5e.msi msiexec.exe File created C:\Windows\Installer\e58ef5c.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 60 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3492 cmd.exe 1556 cmd.exe 5848 cmd.exe 1476 cmd.exe 1220 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "016BFF8D9B3A9E745AC40687F3D0AD47" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n001.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3712 schtasks.exe 3416 schtasks.exe 1076 schtasks.exe 4728 schtasks.exe 5556 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5756 msiexec.exe 5756 msiexec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 5692 MsiExec.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe 4972 8BScO7.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 672 Process not Found 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 60 msiexec.exe Token: SeIncreaseQuotaPrivilege 60 msiexec.exe Token: SeSecurityPrivilege 5756 msiexec.exe Token: SeCreateTokenPrivilege 60 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 60 msiexec.exe Token: SeLockMemoryPrivilege 60 msiexec.exe Token: SeIncreaseQuotaPrivilege 60 msiexec.exe Token: SeMachineAccountPrivilege 60 msiexec.exe Token: SeTcbPrivilege 60 msiexec.exe Token: SeSecurityPrivilege 60 msiexec.exe Token: SeTakeOwnershipPrivilege 60 msiexec.exe Token: SeLoadDriverPrivilege 60 msiexec.exe Token: SeSystemProfilePrivilege 60 msiexec.exe Token: SeSystemtimePrivilege 60 msiexec.exe Token: SeProfSingleProcessPrivilege 60 msiexec.exe Token: SeIncBasePriorityPrivilege 60 msiexec.exe Token: SeCreatePagefilePrivilege 60 msiexec.exe Token: SeCreatePermanentPrivilege 60 msiexec.exe Token: SeBackupPrivilege 60 msiexec.exe Token: SeRestorePrivilege 60 msiexec.exe Token: SeShutdownPrivilege 60 msiexec.exe Token: SeDebugPrivilege 60 msiexec.exe Token: SeAuditPrivilege 60 msiexec.exe Token: SeSystemEnvironmentPrivilege 60 msiexec.exe Token: SeChangeNotifyPrivilege 60 msiexec.exe Token: SeRemoteShutdownPrivilege 60 msiexec.exe Token: SeUndockPrivilege 60 msiexec.exe Token: SeSyncAgentPrivilege 60 msiexec.exe Token: SeEnableDelegationPrivilege 60 msiexec.exe Token: SeManageVolumePrivilege 60 msiexec.exe Token: SeImpersonatePrivilege 60 msiexec.exe Token: SeCreateGlobalPrivilege 60 msiexec.exe Token: SeBackupPrivilege 5360 vssvc.exe Token: SeRestorePrivilege 5360 vssvc.exe Token: SeAuditPrivilege 5360 vssvc.exe Token: SeBackupPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeBackupPrivilege 2984 srtasks.exe Token: SeRestorePrivilege 2984 srtasks.exe Token: SeSecurityPrivilege 2984 srtasks.exe Token: SeTakeOwnershipPrivilege 2984 srtasks.exe Token: SeBackupPrivilege 2984 srtasks.exe Token: SeRestorePrivilege 2984 srtasks.exe Token: SeSecurityPrivilege 2984 srtasks.exe Token: SeTakeOwnershipPrivilege 2984 srtasks.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe Token: SeTakeOwnershipPrivilege 5756 msiexec.exe Token: SeRestorePrivilege 5756 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 60 msiexec.exe 60 msiexec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 5756 wrote to memory of 2984 5756 msiexec.exe 94 PID 5756 wrote to memory of 5692 5756 msiexec.exe 96 PID 4972 wrote to memory of 2648 4972 8BScO7.exe 110 PID 2648 wrote to memory of 1076 2648 cmd.exe 113 PID 2648 wrote to memory of 976 2648 cmd.exe 114 PID 2648 wrote to memory of 5440 2648 cmd.exe 119 PID 3492 wrote to memory of 4676 3492 cmd.exe 121 PID 4972 wrote to memory of 4948 4972 8BScO7.exe 122 PID 4948 wrote to memory of 4728 4948 cmd.exe 124 PID 4948 wrote to memory of 4612 4948 cmd.exe 125 PID 1556 wrote to memory of 5632 1556 cmd.exe 128 PID 4948 wrote to memory of 3692 4948 cmd.exe 129 PID 4972 wrote to memory of 6040 4972 8BScO7.exe 130 PID 6040 wrote to memory of 5556 6040 cmd.exe 132 PID 6040 wrote to memory of 468 6040 cmd.exe 133 PID 5848 wrote to memory of 4516 5848 cmd.exe 136 PID 6040 wrote to memory of 5220 6040 cmd.exe 137 PID 4972 wrote to memory of 5944 4972 8BScO7.exe 138 PID 5944 wrote to memory of 3712 5944 cmd.exe 140 PID 5944 wrote to memory of 3544 5944 cmd.exe 141 PID 1476 wrote to memory of 3540 1476 cmd.exe 144 PID 5944 wrote to memory of 2564 5944 cmd.exe 145 PID 4972 wrote to memory of 2684 4972 8BScO7.exe 146 PID 2684 wrote to memory of 3416 2684 cmd.exe 148 PID 2684 wrote to memory of 1132 2684 cmd.exe 149 PID 1220 wrote to memory of 4648 1220 cmd.exe 152 PID 2684 wrote to memory of 520 2684 cmd.exe 153 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n001.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:60
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 825DE2252195F558B6E4FB66FE7BC0B2 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5692
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5360
-
C:\Users\Public\vbacVG\8BScO7.exeC:\Users\Public\vbacVG\8BScO7.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vbacVG\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vbacVG\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1076
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:976
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4728
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4612
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5556
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:468
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5220
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3712
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3544
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3416
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1132
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:520
-
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vbacVG" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vbacVG" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4676
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:4952
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5632
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4516
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3540
-
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4648
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58ef5d.rbs
- Size 7KB
- SHA256 8060fec956c8707b4db26ee6126dd1ba868f8ba323be3c2b60bf6a8f06e4d5de
- MD5 7da1b69fa2c278002dcf5fa429e5ba45
- SHA1 20f3851370755c84d4d00e6ab4cc2ade5536be33
- SHA512 1858b4d51a65a2fda6241db309d2eafa165b362ced6eba688164ca1d8aaff3ed7ffb6be3f672c436b2441a227c0a3ab2c7ca94eae8d3fee2f9ecf501cad38592
- SSDEEP 96:SVHP6b4uu1eqmxUUjdH021CsThqK/UjdH021C6jdAsDThqKjHYIK5RPWELEyE/Y4:SVvU4ezzxU2IIBsxU2ISBIHtI53Kp0
- TLSH T1BFF1FF56B20481E2F9977730CF271B263BB3D3E49314630B1ADE84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\vbacVG\8BScO7.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\vbacVG\UxEnhance64.dll
- Size 3.1MB
- SHA256 db243dd1aac782d5b100180d1adedef403de69aa4a2309269f5e1f9885b21001
- MD5 f11b8d25a36626d3a24228abf0cd8c03
- SHA1 1111d9f767d92dd6b68bc7758255ed42962f00c1
- SHA512 db8d3d3dfb13512c045bbbc987e454f4e2278d0e267b0f663b3fafd7611835160d2b304de030bae23b7768444622d0b491508d77b12477f8214fdf5e90df9971
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+4:P9m29xx3Tiqt06ox6+z2rNNrKo4
- TLSH T1C2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\vbacVG\adoresd.dat
- Size 4.8MB
- SHA256 d6af3dcc77f554dae7ee219e6497e547540d80aedfd2004e9d056f2324c8a392
- MD5 ae4a491977f9be53a826a7d2ab4fc8af
- SHA1 00a0e7452a61800ae82895b1169b93ea30bf5b88
- SHA512 bfedc23929bfed737b32bb0eb3b467c68e447259af45d67e844a1abd5fa8737c43600cc0030abf9e26ef6a1cd49ca95a06cfcd827b7d9676d5dffa1c5eb6554b
- SSDEEP 98304:ZuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:qQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1A1363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\vbacVG\msadox.tb
- Size 8KB
- SHA256 3edd83961a9885daaeae8f6397e6d55a9cb1b43dcc57c7ed5e2f286d81a17a80
- MD5 d6a97fa2d47427ce796333d4d70202c7
- SHA1 0a4d4b4edcb637169d02e708d3573326266a6077
- SHA512 ca1a821ca7e5355763eb8f5f63df4516ae13cf69df991b0c7900c26a80c7d7c0d57fc4eded4013ac6025ddcdf601441df042bf935aaf08adc96fb265ed7943d1
- SSDEEP 192:SqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:SsZqZOXQ3uqvR2Kfzp
- TLSH T195029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF0F4.tmp
- Size 7.7MB
- SHA256 8e94f1b2fd82b6e354f845b45782f03202b1decdf3f32b7a6446cae4e7ac1ecc
- MD5 8aaa198a3b56c0fc2a60bbdbd96ec7f4
- SHA1 2eefab634264d8574b8aa75336b0b779de76f644
- SHA512 d75cf8bbb296659b67ea9249aa7d12cacd8d0cb7b7f0aa6555263b2635441877f5cea311a3d251bd02cbed69068e06d61cd0f52aede3c23cf201d90aae082f05
- SSDEEP 196608:weAG43NM5TGvnbQvQ3DyB0gqqBjer7sR1hvBmSC0ETfnuI8KhonQWDw:DAGiNMwnbQvQTyhvj2ALhve0ETWI8KhP
- TLSH T1018633C2BCC633F4D597C3F88593A8BEBD597386FA534CD76AC468201E4321A6A79704
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58ef5c.msi
- Size 7.7MB
- SHA256 0c94173d0cb26783553b7fc4eb4a3c0c4b67be3a5a4c424c9885f24827be7e6b
- MD5 cab3b5d5ddb9aca7c9ee6ab4379f42ff
- SHA1 04fb9f8b9dc41887734d2aae15f033de956c6b09
- SHA512 b52954c0db4a142c90173a7089423afecebb6422fd18d8b90b792785c1c8c96f98c6f9884939d75d5b111f88fbd36b6bb324dba52b14c2ba766dd0983d9bb87a
- SSDEEP 196608:seAG43NM5TGvnbQvQ3DyB0gqqB9er7sR1hvBmSC0ETfnuI8KhonQWDG:nAGiNMwnbQvQTyhv92ALhve0ETWI8Kh/
- TLSH T1488633C2BCC133B0D597C3F48593A8BEBD687F45FA524C976AC478241E7322A2A76714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 59ae3d738b5458573c22a57a8aa6400409c1e9430c12bf0a3fd25de0e2bb149b
- MD5 0f6c802d2443616122909cdbac9d1e0b
- SHA1 aa72393a618e301672c811231caaa17c75038873
- SHA512 7c98afdeee267e7c02d45777aab8aaed21827a077439b29d6ffe07b7603730029c59f44888b9bbcb42941c1c69c2a53c7f2281e62fca822d52a841017ed92118
- SSDEEP 24576:cu8m+1zvdoO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:I
- TLSH T12847C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a3ff629f-763f-4c40-8799-98f80bfe0ef7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 da9c1479df8e6a8e7faefeb5f73547eb5538e49f120f01e0602836fbee797aa0
- MD5 13fb2b25e90da680b755da66f0c84d09
- SHA1 0bd951924d19b5a45b9406e02a5b9ffa34f80853
- SHA512 bf266e9e890ff20884a763b6c0b534bf5bd6e518b581c6501f5b4552fd32da65f1851ce37120a18d678379ea555604256dc142ef226d84026031df37fc4f5434
- SSDEEP 96:FDqDEnnYvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:hqVb++ZVm
- TLSH T181D19A185AE54311E2B3AB712DF18557A477B911EF33CB8E0198238E2671A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH