Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n003.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n003.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target Install_28n003.msi
- Size 6.8MB
- Sample260729-dbllgsshjf
- SHA256 6594c9852681cded09d477d96e17b9363f08bd6a0671e92fbc52e300c89cde0c
- MD5 0678ef67bfa63bb1e483c73b93cf48d0
- SHA1 82112d0dcc7f602fa213f307d915cf8c5dcb71ab
- SHA512 301a84c8683fb3048293edbe3acbbd99842826a060035caebad2d3962671a54cb1e8b43bd1c62339c273d0e3a3fb86d76cbcba09a4d780de881655fd6a03df37
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSr:mPnf8Dpkvv9Oq0IcK
- TLSH T114763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3128 MsiExec.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 3128 MsiExec.exe 14 3128 MsiExec.exe 15 3128 MsiExec.exe 16 3128 MsiExec.exe 17 3128 MsiExec.exe 18 3128 MsiExec.exe 19 3128 MsiExec.exe 20 3128 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e59ef67.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ef67.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF74F3AC69CA76579F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF803C89488A43104E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF5A2.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File opened for modification C:\Windows\Installer\MSIF4F5.tmp msiexec.exe File created C:\Windows\Installer\e59ef69.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCFA0253EC36EAA04.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4B86CB156994260B.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2392 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n003.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "6C1B6E781B437E449BE99DF04BBA7309" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2864 msiexec.exe 2864 msiexec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe 3128 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2392 msiexec.exe Token: SeIncreaseQuotaPrivilege 2392 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeCreateTokenPrivilege 2392 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2392 msiexec.exe Token: SeLockMemoryPrivilege 2392 msiexec.exe Token: SeIncreaseQuotaPrivilege 2392 msiexec.exe Token: SeMachineAccountPrivilege 2392 msiexec.exe Token: SeTcbPrivilege 2392 msiexec.exe Token: SeSecurityPrivilege 2392 msiexec.exe Token: SeTakeOwnershipPrivilege 2392 msiexec.exe Token: SeLoadDriverPrivilege 2392 msiexec.exe Token: SeSystemProfilePrivilege 2392 msiexec.exe Token: SeSystemtimePrivilege 2392 msiexec.exe Token: SeProfSingleProcessPrivilege 2392 msiexec.exe Token: SeIncBasePriorityPrivilege 2392 msiexec.exe Token: SeCreatePagefilePrivilege 2392 msiexec.exe Token: SeCreatePermanentPrivilege 2392 msiexec.exe Token: SeBackupPrivilege 2392 msiexec.exe Token: SeRestorePrivilege 2392 msiexec.exe Token: SeShutdownPrivilege 2392 msiexec.exe Token: SeDebugPrivilege 2392 msiexec.exe Token: SeAuditPrivilege 2392 msiexec.exe Token: SeSystemEnvironmentPrivilege 2392 msiexec.exe Token: SeChangeNotifyPrivilege 2392 msiexec.exe Token: SeRemoteShutdownPrivilege 2392 msiexec.exe Token: SeUndockPrivilege 2392 msiexec.exe Token: SeSyncAgentPrivilege 2392 msiexec.exe Token: SeEnableDelegationPrivilege 2392 msiexec.exe Token: SeManageVolumePrivilege 2392 msiexec.exe Token: SeImpersonatePrivilege 2392 msiexec.exe Token: SeCreateGlobalPrivilege 2392 msiexec.exe Token: SeBackupPrivilege 1148 vssvc.exe Token: SeRestorePrivilege 1148 vssvc.exe Token: SeAuditPrivilege 1148 vssvc.exe Token: SeBackupPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeBackupPrivilege 4120 srtasks.exe Token: SeRestorePrivilege 4120 srtasks.exe Token: SeSecurityPrivilege 4120 srtasks.exe Token: SeTakeOwnershipPrivilege 4120 srtasks.exe Token: SeBackupPrivilege 4120 srtasks.exe Token: SeRestorePrivilege 4120 srtasks.exe Token: SeSecurityPrivilege 4120 srtasks.exe Token: SeTakeOwnershipPrivilege 4120 srtasks.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2392 msiexec.exe 2392 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2392 msiexec.exe 2864 msiexec.exe 3128 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2864 wrote to memory of 4120 2864 msiexec.exe 93 PID 2864 wrote to memory of 3128 2864 msiexec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n003.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2392
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2D423DA68968CD1C0F2C26CADF7C417D E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3128
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ef68.rbs
- Size 7KB
- SHA256 1fb8977c16f44255bb173702edda7f631d841f8187fd16a603c5fff061163cce
- MD5 ec458ac32795652012198d6f797a483f
- SHA1 38e0c0f1a25135ca70b32d5627924b194a6ed6ec
- SHA512 724c00689b81327c969e267d4c1f29124aa5fb0ce12372161c4337763d5af284c57e750f680b0c3c7bb8cbc5de5b5cabac82ecec851744d5891999d2d9c73f26
- SSDEEP 96:qVzGgu0C3mxUUjdc21CsThqK/Ujdc21C6jdAsDThqKjHKIK5RPWELEyE/YwcCKpS:qVzXCuzxc2IIBsxc2ISBaHtI5XKpS
- TLSH T116F1F046B20585E2E9977730CF270F263BB3D3E4931463070ADD84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF5A2.tmp
- Size 6.8MB
- SHA256 1ab218a9ec2d006758a08ca895b650226b53d12fc4a17bae80a9d39645c00d9d
- MD5 afe697f26cf6bb8e9507be145db3745c
- SHA1 a9f07123082ce19fe1435b2f030973ec7bddd8dd
- SHA512 eac99aa3db17bfbbd7d85b387d91c5faa84555094ca02bf8db3d6f910b1089e318b08bb33fb0357420f54b860e34b47e91a1d8f57361bf00c0027882016d15dc
- SSDEEP 196608:lilcw0Iv39df8Dt7kvgmuwdObgc8Eu04gkcSj:EPnf8DpkvvnOq0Ick
- TLSH T16C6633C6B8C112B4E18FC3B04196346FB8AB3BD97D678C1A7A7827216E7371E9535342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59ef67.msi
- Size 6.8MB
- SHA256 6594c9852681cded09d477d96e17b9363f08bd6a0671e92fbc52e300c89cde0c
- MD5 0678ef67bfa63bb1e483c73b93cf48d0
- SHA1 82112d0dcc7f602fa213f307d915cf8c5dcb71ab
- SHA512 301a84c8683fb3048293edbe3acbbd99842826a060035caebad2d3962671a54cb1e8b43bd1c62339c273d0e3a3fb86d76cbcba09a4d780de881655fd6a03df37
- SSDEEP 196608:Xilcw0Iv39df8Dt7kvgmswdObgc8Eu04gkcSr:mPnf8Dpkvv9Oq0IcK
- TLSH T114763386F8C112B5E18FC3B0419625AEB86E3FD97E678C1A7A7833116E7372E5531381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 eb7500b1d2ee60a126c550be55e16a5c05d1c0252bf96d2bdc077229e6e78247
- MD5 dbc958c0d31714595278e55a7ad9eb0d
- SHA1 406a117a6151fb8e4e7a4bb005801e1b5e7f6930
- SHA512 f66e3bae391984923d8530be6f9567fceac37ad09de667656f80ffa09b992df20a3f4b49582361bdae7428d34f22a87759018f19f29a788d21c9d0e9d75a1483
- SSDEEP 24576:cFo3DMPDdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12Noee:WHg
- TLSH T1FF57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{93440071-c087-488f-ae0f-4f2850c0072c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 752aa6e26f4187ebdc0307f62a688bc601e8f02e35cf42e1c429d9d1895ca548
- MD5 d2655cb7940fe1fbc5e7c1b678b3a562
- SHA1 d38dd1ed1d61d2ebabf3ced55799cb8bd7ea00bb
- SHA512 5db46807293ec060ccb632eb02adbfd509d4965f3989d82e948123c58804134fc077f8655860ba33dc55e6857e38d1ef97f99afbc4dea18d43e9bf41b95f7da7
- SSDEEP 96:F1k2EW5mslDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:vkq5l/b++uVm
- TLSH T164D199085AF54711E2F3AB3229F18557A837B911EF33CB8E0198238E6671910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH