Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_s0up010.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_s0up010.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target install_s0up010.msi
- Size 5.1MB
- Sample260802-hd4bjaem5z
- SHA256 cec62981dd53662d65a3dc11e790d49d927c37a201a7573798e7e372a0cf7e0b
- MD5 b137953d85adbb1f6fa892100eac6bf6
- SHA1 fb3a843bab78d616623c189530c3e387aa111b22
- SHA512 77ebcf3de96ed3496cf985a25112e4a5c66f1c63808d13f0e05a91d269ec4798d3678e2eeb34a4cdab7e4585d06d0e03bbd9ea8b640ada4161714fa796207506
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC6018:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+8
- TLSH T1824633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\AUJZ5k = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5340 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5196 Mt875a.exe - Loads dropped DLL 2 IoCs
pid Process 260 MsiExec.exe 5196 Mt875a.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\AUJZ5k\\Mt875a.exe\"" Mt875a.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 260 MsiExec.exe 6 260 MsiExec.exe 9 260 MsiExec.exe 10 260 MsiExec.exe 11 260 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4460 cmd.exe 4604 cmd.exe 4508 cmd.exe 1392 cmd.exe 776 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b Mt875a.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFBAF80EB881E60582.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF22B2C9836871C158.TMP msiexec.exe File created C:\Windows\Installer\e5953b4.msi msiexec.exe File opened for modification C:\Windows\Installer\e5953b4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF791EE7E30E1CA00B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5AA9.tmp msiexec.exe File created C:\Windows\Installer\e5953b6.msi msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File created C:\Windows\SystemTemp\~DF66E17CB7A5F5B55E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5B56.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5460 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6040 cmd.exe 988 cmd.exe 1544 cmd.exe 4180 cmd.exe 1144 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "2EFED3948ABEB194B9D7D1BA28200776" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_s0up010.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2892 schtasks.exe 4512 schtasks.exe 2008 schtasks.exe 1692 schtasks.exe 5068 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3216 msiexec.exe 3216 msiexec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 260 MsiExec.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe 5196 Mt875a.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5460 msiexec.exe Token: SeIncreaseQuotaPrivilege 5460 msiexec.exe Token: SeSecurityPrivilege 3216 msiexec.exe Token: SeCreateTokenPrivilege 5460 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5460 msiexec.exe Token: SeLockMemoryPrivilege 5460 msiexec.exe Token: SeIncreaseQuotaPrivilege 5460 msiexec.exe Token: SeMachineAccountPrivilege 5460 msiexec.exe Token: SeTcbPrivilege 5460 msiexec.exe Token: SeSecurityPrivilege 5460 msiexec.exe Token: SeTakeOwnershipPrivilege 5460 msiexec.exe Token: SeLoadDriverPrivilege 5460 msiexec.exe Token: SeSystemProfilePrivilege 5460 msiexec.exe Token: SeSystemtimePrivilege 5460 msiexec.exe Token: SeProfSingleProcessPrivilege 5460 msiexec.exe Token: SeIncBasePriorityPrivilege 5460 msiexec.exe Token: SeCreatePagefilePrivilege 5460 msiexec.exe Token: SeCreatePermanentPrivilege 5460 msiexec.exe Token: SeBackupPrivilege 5460 msiexec.exe Token: SeRestorePrivilege 5460 msiexec.exe Token: SeShutdownPrivilege 5460 msiexec.exe Token: SeDebugPrivilege 5460 msiexec.exe Token: SeAuditPrivilege 5460 msiexec.exe Token: SeSystemEnvironmentPrivilege 5460 msiexec.exe Token: SeChangeNotifyPrivilege 5460 msiexec.exe Token: SeRemoteShutdownPrivilege 5460 msiexec.exe Token: SeUndockPrivilege 5460 msiexec.exe Token: SeSyncAgentPrivilege 5460 msiexec.exe Token: SeEnableDelegationPrivilege 5460 msiexec.exe Token: SeManageVolumePrivilege 5460 msiexec.exe Token: SeImpersonatePrivilege 5460 msiexec.exe Token: SeCreateGlobalPrivilege 5460 msiexec.exe Token: SeBackupPrivilege 1896 vssvc.exe Token: SeRestorePrivilege 1896 vssvc.exe Token: SeAuditPrivilege 1896 vssvc.exe Token: SeBackupPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeBackupPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 4116 srtasks.exe Token: SeSecurityPrivilege 4116 srtasks.exe Token: SeTakeOwnershipPrivilege 4116 srtasks.exe Token: SeBackupPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 4116 srtasks.exe Token: SeSecurityPrivilege 4116 srtasks.exe Token: SeTakeOwnershipPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe Token: SeTakeOwnershipPrivilege 3216 msiexec.exe Token: SeRestorePrivilege 3216 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5460 msiexec.exe 5460 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5460 msiexec.exe 3216 msiexec.exe 260 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3216 wrote to memory of 4116 3216 msiexec.exe 94 PID 3216 wrote to memory of 260 3216 msiexec.exe 96 PID 5196 wrote to memory of 5340 5196 Mt875a.exe 101 PID 5196 wrote to memory of 4460 5196 Mt875a.exe 103 PID 4460 wrote to memory of 5068 4460 cmd.exe 105 PID 4460 wrote to memory of 1772 4460 cmd.exe 107 PID 4460 wrote to memory of 2680 4460 cmd.exe 110 PID 5196 wrote to memory of 4604 5196 Mt875a.exe 111 PID 4604 wrote to memory of 2892 4604 cmd.exe 113 PID 4604 wrote to memory of 5724 4604 cmd.exe 114 PID 4604 wrote to memory of 408 4604 cmd.exe 116 PID 5196 wrote to memory of 4508 5196 Mt875a.exe 119 PID 4508 wrote to memory of 4512 4508 cmd.exe 121 PID 4508 wrote to memory of 6092 4508 cmd.exe 122 PID 4508 wrote to memory of 5424 4508 cmd.exe 124 PID 5196 wrote to memory of 1392 5196 Mt875a.exe 126 PID 1392 wrote to memory of 2008 1392 cmd.exe 128 PID 1392 wrote to memory of 5012 1392 cmd.exe 129 PID 1392 wrote to memory of 2416 1392 cmd.exe 131 PID 988 wrote to memory of 5116 988 cmd.exe 133 PID 6040 wrote to memory of 6020 6040 cmd.exe 134 PID 5196 wrote to memory of 776 5196 Mt875a.exe 135 PID 776 wrote to memory of 1692 776 cmd.exe 137 PID 776 wrote to memory of 936 776 cmd.exe 138 PID 776 wrote to memory of 1724 776 cmd.exe 140 PID 1544 wrote to memory of 4984 1544 cmd.exe 141 PID 4180 wrote to memory of 2980 4180 cmd.exe 144 PID 1144 wrote to memory of 3724 1144 cmd.exe 145 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_s0up010.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5460
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8F5C9DE5ACD3439D16E8B861694FEA42 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:260
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4720
-
C:\Users\Public\AUJZ5k\Mt875a.exe"C:\Users\Public\AUJZ5k\Mt875a.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:5340
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\AUJZ5k\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\AUJZ5k\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5068
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1772
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2680
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5724
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4512
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:6092
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5424
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2008
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5012
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1692
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:936
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1724
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\AUJZ5k" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\AUJZ5k" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:6020
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:3628
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5116
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4984
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2980
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3724
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5953b5.rbs
- Size 7KB
- SHA256 d1d21c5b6425f0aac3b5d6bef364ef38793c2916d472f516688ecfb3ebb8e712
- MD5 84c17cddb3db6513052e80f181892935
- SHA1 d824888b2ddb137386d378901ba162c86074712d
- SHA512 0b6b368fd46fd9109cbeebc99b0a28b9012adb85230700f53b35bcd3465e5b0e7c9fad671178183e764ae8ef1b5030849db39f6fbe51a1d32f39554c54b25db9
- SSDEEP 96:Dzgu0CnHaUUFQ1CsThq/UFQ1C6j4/xpThqjHsS56TWt8deCKplj/zIjByy:DwC6zKIIVKI3CALKpi
- TLSH T121F12101B31196D2E5911B75CB831B1637F2D3DAA320735B09DE80285F577883ED67AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\AUJZ5k\Mt875a.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\AUJZ5k\UxEnhance64.dll
- Size 3.1MB
- SHA256 14ea601cad1516fb79a6b7503405edf3ce6e70607c753953437001524ac24b35
- MD5 305983bb50bef30227aca5c027d5d057
- SHA1 9384867b18654a64c81f7653284eda9bb79e0fbd
- SHA512 05ce4f8a7ff9db2d58e8f4ea572398ddb1555599e2b4bab5d8c8143059fecdc4e3e534c63f2adf4be7556f737dd2d6a3945813ca219a24b6a587df18fba60bf9
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+z:P9m29xx3Tiqt06ox6+z2rNNrKoz
- TLSH T13CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\AUJZ5k\adoresd.dat
- Size 4.7MB
- SHA256 5b55ee89efd1e9b718a34fd1301d86db239ad3ab8a4d0d53b8509f5497570c00
- MD5 a813098a8ebb35e961f4af55a36135aa
- SHA1 7e0f8896a45b1347fc969f600710bf0794d2046f
- SHA512 38de32678460e1f08e736fee38d2cf9172f17db058ce12a8b636ddab613833811adba1e0e3b5374c96c245bcb6578bbff746f4225237ab3b002618d31f3f700f
- SSDEEP 98304:Zmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:8u1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1B63633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\AUJZ5k\msadox.tb
- Size 8KB
- SHA256 8c63a82966ccdbe6b42b87a8a1f7e6c8bb72918bfda5cf52a251846f6c73bd66
- MD5 931c8492d2b6c9d138547fcf00c9d2c2
- SHA1 fd5e096256491fd078d2f7cbbfe1338fc46251b8
- SHA512 eca8d1b7d2ab260cb1b0cf9a86b2092ae79173ae2fe2f2134bb68ac798744f108526457a8e68695e19a2b010aa6d0177ae5c8077a409d5ddd32997412099b9a8
- SSDEEP 192:WqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:WsZqZOXQ3uqvR2Kfzp
- TLSH T1E8029E05D7A20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072ED2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI5B56.tmp
- Size 5.1MB
- SHA256 e3564e82a3ab1e7188ac5c350271a8cd4613572155100db73a8e5e7d62afc69d
- MD5 5fef7a738b7d0492fb7eea69856230c6
- SHA1 75bfd8d8e051159b1f90145691fd2ba47fd420ee
- SHA512 a14a9ec16bf553732b23ea5db40edbc4a58201825a24729925437fc8f2846ecefd69d127117bcf3f57ae0d54bb411a32821b9ccaa35e565e4430f3e8590d5d3e
- SSDEEP 98304:8v2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9CYRTuNwqC601h:S2nuF8NCeEI69grA1YyYpF0aKNCdXq+h
- TLSH T1C53633D46C8F2278D08BD3B0031230BEF1197BD6BD379C16BADD6A198E729167875386
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5953b4.msi
- Size 5.1MB
- SHA256 cec62981dd53662d65a3dc11e790d49d927c37a201a7573798e7e372a0cf7e0b
- MD5 b137953d85adbb1f6fa892100eac6bf6
- SHA1 fb3a843bab78d616623c189530c3e387aa111b22
- SHA512 77ebcf3de96ed3496cf985a25112e4a5c66f1c63808d13f0e05a91d269ec4798d3678e2eeb34a4cdab7e4585d06d0e03bbd9ea8b640ada4161714fa796207506
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC6018:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+8
- TLSH T1824633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ad25994a4c0e2f6277cc78745aad2d6f50a11dea617ce0f3a8f34302aac76301
- MD5 796f164d5d73be1688061e81e3a6da44
- SHA1 511156f664029f744dc30abecd33d60640917b29
- SHA512 8b4d88427a2c5d66d6910143cc6012c1d1c44ce259c0c1e064ca8bacce943c18a1c31caafa71d6b2fbecebe367489bac929818995d2efc4490cc2b305d8ac9bf
- SSDEEP 24576:OFo3DMPfdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:YHU
- TLSH T10F57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5d5a2ab9-8798-4644-a719-f9f09ecc6ae5}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ba5a07c4f4cdd774bc06d5d18f9fc0a73bf087e2dc285e5b82d5e45958b5efad
- MD5 9be12911d01d1bf6540678ab7c17c661
- SHA1 a192c97ff2b4852362af8bb21bc3a27e9d2b205b
- SHA512 0319228f9551fb5e5ab9f64f255b3f1e621e4797b6ca3b438451b1393abd822e7a77fa5254ae6e8ef779c06427c1c406b0a36f152e0aba56618badecac5de6cb
- SSDEEP 96:FuNx7JCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:+3eb++uVm
- TLSH T1CBD189081AE54711E2B3AB3129F14557A877B811FF33CB8E0198238E2671A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH