Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_ehe006.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_ehe006.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target install_ehe006.msi
- Size 9.8MB
- Sample260803-bdql4svhnc
- SHA256 36b4dda15c2743547fb832cf9e4faccbce88fab0ad3ab75374c5a19b31e4d3f2
- MD5 01827f1a33ff17d724860c4bf05311fd
- SHA1 605d7ee4015e77667c1cd594e40d3b04504cf826
- SHA512 7ef71810457c7d49563022d5180f96da667b61577f51f267b79196a76d059366f4761084b01bbda345e7c2c06339b78be97c1d5c212d75d46a63acf58491512e
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7r:ltLIMHH4DZx97ahOQw3r
- TLSH T1E3A63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\3iqjRF = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5672 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 4296 JbnccJ.exe - Loads dropped DLL 2 IoCs
pid Process 1908 MsiExec.exe 4296 JbnccJ.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\3iqjRF\\JbnccJ.exe\"" JbnccJ.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 1908 MsiExec.exe 11 1908 MsiExec.exe 16 1908 MsiExec.exe 17 1908 MsiExec.exe 18 1908 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4228 cmd.exe 3916 cmd.exe 5396 cmd.exe 4124 cmd.exe 3692 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b JbnccJ.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\ajclsa\ajclsa.exe JbnccJ.exe File created C:\Program Files (x86)\ajclsa\XPSPLOG.dll JbnccJ.exe File opened for modification C:\Program Files (x86)\ajclsa JbnccJ.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFDE5523CED16644FE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC3E99F188DCE15F6.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59c654.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF99D8E636EF6C7018.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File opened for modification C:\Windows\Installer\MSICBA3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICCEC.tmp msiexec.exe File created C:\Windows\Installer\e59c654.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF2157DC1F508686A8.TMP msiexec.exe File created C:\Windows\Installer\e59c656.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2996 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3116 cmd.exe 1860 cmd.exe 3112 cmd.exe 3384 cmd.exe 564 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_ehe006.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "434871A31319DC44C9F8C08E8F8A0054" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1892 schtasks.exe 3228 schtasks.exe 5656 schtasks.exe 4664 schtasks.exe 1040 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4908 msiexec.exe 4908 msiexec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe 4296 JbnccJ.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2996 msiexec.exe Token: SeIncreaseQuotaPrivilege 2996 msiexec.exe Token: SeSecurityPrivilege 4908 msiexec.exe Token: SeCreateTokenPrivilege 2996 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2996 msiexec.exe Token: SeLockMemoryPrivilege 2996 msiexec.exe Token: SeIncreaseQuotaPrivilege 2996 msiexec.exe Token: SeMachineAccountPrivilege 2996 msiexec.exe Token: SeTcbPrivilege 2996 msiexec.exe Token: SeSecurityPrivilege 2996 msiexec.exe Token: SeTakeOwnershipPrivilege 2996 msiexec.exe Token: SeLoadDriverPrivilege 2996 msiexec.exe Token: SeSystemProfilePrivilege 2996 msiexec.exe Token: SeSystemtimePrivilege 2996 msiexec.exe Token: SeProfSingleProcessPrivilege 2996 msiexec.exe Token: SeIncBasePriorityPrivilege 2996 msiexec.exe Token: SeCreatePagefilePrivilege 2996 msiexec.exe Token: SeCreatePermanentPrivilege 2996 msiexec.exe Token: SeBackupPrivilege 2996 msiexec.exe Token: SeRestorePrivilege 2996 msiexec.exe Token: SeShutdownPrivilege 2996 msiexec.exe Token: SeDebugPrivilege 2996 msiexec.exe Token: SeAuditPrivilege 2996 msiexec.exe Token: SeSystemEnvironmentPrivilege 2996 msiexec.exe Token: SeChangeNotifyPrivilege 2996 msiexec.exe Token: SeRemoteShutdownPrivilege 2996 msiexec.exe Token: SeUndockPrivilege 2996 msiexec.exe Token: SeSyncAgentPrivilege 2996 msiexec.exe Token: SeEnableDelegationPrivilege 2996 msiexec.exe Token: SeManageVolumePrivilege 2996 msiexec.exe Token: SeImpersonatePrivilege 2996 msiexec.exe Token: SeCreateGlobalPrivilege 2996 msiexec.exe Token: SeBackupPrivilege 2516 vssvc.exe Token: SeRestorePrivilege 2516 vssvc.exe Token: SeAuditPrivilege 2516 vssvc.exe Token: SeBackupPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeBackupPrivilege 5880 srtasks.exe Token: SeRestorePrivilege 5880 srtasks.exe Token: SeSecurityPrivilege 5880 srtasks.exe Token: SeTakeOwnershipPrivilege 5880 srtasks.exe Token: SeBackupPrivilege 5880 srtasks.exe Token: SeRestorePrivilege 5880 srtasks.exe Token: SeSecurityPrivilege 5880 srtasks.exe Token: SeTakeOwnershipPrivilege 5880 srtasks.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe Token: SeTakeOwnershipPrivilege 4908 msiexec.exe Token: SeRestorePrivilege 4908 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2996 msiexec.exe 2996 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2996 msiexec.exe 4908 msiexec.exe 1908 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4908 wrote to memory of 5880 4908 msiexec.exe 94 PID 4908 wrote to memory of 1908 4908 msiexec.exe 96 PID 4296 wrote to memory of 5672 4296 JbnccJ.exe 99 PID 4296 wrote to memory of 4228 4296 JbnccJ.exe 101 PID 4228 wrote to memory of 3228 4228 cmd.exe 103 PID 4228 wrote to memory of 2336 4228 cmd.exe 105 PID 4228 wrote to memory of 3748 4228 cmd.exe 107 PID 4296 wrote to memory of 3916 4296 JbnccJ.exe 109 PID 3916 wrote to memory of 5656 3916 cmd.exe 111 PID 3916 wrote to memory of 2928 3916 cmd.exe 114 PID 3916 wrote to memory of 1948 3916 cmd.exe 116 PID 4296 wrote to memory of 5396 4296 JbnccJ.exe 118 PID 5396 wrote to memory of 4664 5396 cmd.exe 120 PID 5396 wrote to memory of 1700 5396 cmd.exe 121 PID 5396 wrote to memory of 624 5396 cmd.exe 123 PID 4296 wrote to memory of 4124 4296 JbnccJ.exe 126 PID 4124 wrote to memory of 1040 4124 cmd.exe 128 PID 3116 wrote to memory of 2916 3116 cmd.exe 125 PID 4124 wrote to memory of 2760 4124 cmd.exe 129 PID 4124 wrote to memory of 4916 4124 cmd.exe 131 PID 1860 wrote to memory of 4736 1860 cmd.exe 132 PID 4296 wrote to memory of 3692 4296 JbnccJ.exe 134 PID 3692 wrote to memory of 1892 3692 cmd.exe 136 PID 3692 wrote to memory of 596 3692 cmd.exe 137 PID 3692 wrote to memory of 3536 3692 cmd.exe 139 PID 3112 wrote to memory of 5740 3112 cmd.exe 141 PID 3384 wrote to memory of 1268 3384 cmd.exe 143 PID 564 wrote to memory of 1272 564 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_ehe006.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2996
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5880
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7044631FC94DD7C2BA31C57CAA088877 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
C:\Users\Public\3iqjRF\JbnccJ.exe"C:\Users\Public\3iqjRF\JbnccJ.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:5672
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3iqjRF\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3iqjRF\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3228
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2336
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5656
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2928
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4664
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1700
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1040
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2760
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4916
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1892
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:596
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3536
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3iqjRF" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3iqjRF" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2916
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:200
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4736
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5740
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1268
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1272
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c655.rbs
- Size 7KB
- SHA256 3305245e6b4087ab9a385929e082e9f11be2f58cb5253373a38d4d2419e5e80e
- MD5 fd0329f2dcb66a98320f4c944edfb354
- SHA1 32a201ccd50f9e53690dd0795405a775e594d023
- SHA512 26415ae99b4af9b8aaaf970e66a0aa9a96f54fcb535b24796abee0c741c03be659154dc8195ebb94f393fbc7cbf57b0f7ee983ffaeff2f9a6dc71e01f54d0d45
- SSDEEP 96:rngu0CnlaUU841CsThq/U841C6j4/xpThqjHsS56TWt8deCKpljVzIjByy:rUCoztIIVtI3CArKpg
- TLSH T19CF12001B71196D2F9911B75CB831B1A37F2D3DAA320735B089E80285F577883EE57AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3iqjRF\JbnccJ.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3iqjRF\UxEnhance64.dll
- Size 3.1MB
- SHA256 804655a9de987c81163ff2a4de2c9301f0ac47f6611bb8a1e5da43c9827fffed
- MD5 e8dcc0b3aabbf2dbbd101f60c0610c3a
- SHA1 23d6dc43cdb400fdab8dc44f02a1f57205a64d16
- SHA512 af0f798f0e3e311cc7111eaa080ccb319f6ff7d73a7893b92a631b5ab7df1c85c406c86b47c756d4f224c1a74f2340b4b3212bc4939cd91f10ad2e502f32b06d
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+m:P9m29xx3Tiqt06ox6+z2rNNrKom
- TLSH T1FCE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3iqjRF\adoresd.dat
- Size 4.7MB
- SHA256 0659607c6f44ea476b434c426ff2cc37e73aa8e5df8e0d625aed8216c7a7fe4b
- MD5 71ae217cc396e3f809598b452d9878be
- SHA1 1455fbb4608bb404d8e984de0528dc875c727eda
- SHA512 7be6e239f1767db761bc9567cf703eddf29001a6114914a60284c19e3ba86eb977a7e95da9d392b676b37ab8007fc2b8e7974a8d0e23fc142396f2c3e64682ba
- SSDEEP 98304:Tmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:6u1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1C93633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3iqjRF\msadox.tb
- Size 8KB
- SHA256 ab93f3d6b25dd849f0f70ac54d5d8dc5ac7fef3bd45b05385ef2f5f7cc9306a8
- MD5 2aaa0f52eb4aa1f0b5dd094fc417c62a
- SHA1 bc5b2604567a037d3da2a1020bd519b6ce111027
- SHA512 4cf7233073d24f5d95b55164b07157565830ce00a1faabd23d13b9e10ee48773e7ec78ce6a16b765737267bd458a3ca686e28626b66fce696ff5a9c427c3e41a
- SSDEEP 192:IqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IsZqZOXQ3uqvR2Kfzp
- TLSH T19B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICCEC.tmp
- Size 9.8MB
- SHA256 dff63e24efbf723a847a18b6c8b98a9b1f04c014bab4f5174e3059a98739b386
- MD5 9b2163d752642c4173740737e654560e
- SHA1 5c122585ddf0f89a94afd46a61f7dc1b3691f6cb
- SHA512 7299a994f88284dd6996c620e300f493a9a1fd69c06f9af6affe72f73268797d35bc7476a7397da102f6fd35c8596ade7febf2cf51328ca73a03c96a21e3e3d2
- SSDEEP 196608:g2cqthMixMRIa2mMtqn0I0K8HtDkY/HlYkW222C0RkyWdTOHnwEhPy6A7h:gtLIMHHODZx97ahOHw3h
- TLSH T1D5A63382BD8E33B0D18BD374B50A655F389837D9BAB65841BAED36021FA37271738750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c654.msi
- Size 9.8MB
- SHA256 36b4dda15c2743547fb832cf9e4faccbce88fab0ad3ab75374c5a19b31e4d3f2
- MD5 01827f1a33ff17d724860c4bf05311fd
- SHA1 605d7ee4015e77667c1cd594e40d3b04504cf826
- SHA512 7ef71810457c7d49563022d5180f96da667b61577f51f267b79196a76d059366f4761084b01bbda345e7c2c06339b78be97c1d5c212d75d46a63acf58491512e
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7r:ltLIMHH4DZx97ahOQw3r
- TLSH T1E3A63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 b498eedfc49bac788e8d6639acb336c0871308b42416157494010401c5f2d898
- MD5 358a48767fe884e85100353e56af98a0
- SHA1 6acf698e93a241c7941a4becd09ff2b34fc14f23
- SHA512 6daff3b940c730591ffac8dcbb018693846f45e3649991e4a1105acd1115ef5a8939d2ee4187f39ee2ed2ebb7098a5495f4fd4be6db78d5a19b79eafb3b67517
- SSDEEP 24576:MFo3DMPEdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0uC:ZHw
- TLSH T1EE57A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e7710bc6-69b8-48d4-83b9-632b206851dc}_OnDiskSnapshotProp
- Size 6KB
- SHA256 76b035a3005025233064401c2a769dc2bc820ac1dd7f5cf6efa09764060e8bea
- MD5 4abfdc8f027346333b6fe8251692faee
- SHA1 4bbee86195a04147d6e8a85509111431c9ecf453
- SHA512 969d6aac901cdfecff30d2ffd650ca251a22570427dcdbd23255f5676f1f30e7a4ec022dbde9eda1f50fec0f6de3c752c584e0a39d15c8fc8af26092576ac8b0
- SSDEEP 96:FJQpTx03vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:/YUb++uVm
- TLSH T134D187085AE54711E2B3AB3129F18557A877B811EF33CB8E0198238E6631A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH