Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_ehe007.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_ehe007.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target install_ehe007.msi
- Size 9.5MB
- Sample260803-cf29cswdpf
- SHA256 8c05c21f190a87d6b9d63b51bc7162a510a0306ac7c4d55b89210554f84bc105
- MD5 79394a8421cd0f9b9143874743fa6bd0
- SHA1 0cad684a555349ce530762e59c23d45832e4e5bd
- SHA512 c2e82f314677499a5bf8419f1c7963945334fdbd6f36b15205df0a72067293daadf09332aaae7600bbbed665ef6bbbab251e6da235187fc7e2a0c801ffc68093
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6CjC:0EYjUu32p2rxxc0cGYj6CW
- TLSH T1A4A633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\FyX9aw = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5924 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5288 2fZ0ks.exe - Loads dropped DLL 2 IoCs
pid Process 4968 MsiExec.exe 5288 2fZ0ks.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\FyX9aw\\2fZ0ks.exe\"" 2fZ0ks.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 4968 MsiExec.exe 14 4968 MsiExec.exe 16 4968 MsiExec.exe 17 4968 MsiExec.exe 18 4968 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4940 cmd.exe 5464 cmd.exe 1104 cmd.exe 1388 cmd.exe 4420 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 2fZ0ks.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF39D.tmp msiexec.exe File created C:\Windows\Installer\e59ec0e.msi msiexec.exe File created C:\Windows\SystemTemp\~DF5B45B7CA847CA02C.TMP msiexec.exe File created C:\Windows\Installer\e59ec0c.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ec0c.msi msiexec.exe File created C:\Windows\SystemTemp\~DF9EB320D1409E13F4.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File created C:\Windows\SystemTemp\~DF1254BC52F12D5D09.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF61F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF53F8B2338BEE540D.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3180 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4728 cmd.exe 6028 cmd.exe 2796 cmd.exe 6068 cmd.exe 2264 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_ehe007.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "4F17EA6D9AD82D64CACEFA513569A439" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1876 schtasks.exe 2848 schtasks.exe 1584 schtasks.exe 1628 schtasks.exe 2468 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5408 msiexec.exe 5408 msiexec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe 5288 2fZ0ks.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3180 msiexec.exe Token: SeIncreaseQuotaPrivilege 3180 msiexec.exe Token: SeSecurityPrivilege 5408 msiexec.exe Token: SeCreateTokenPrivilege 3180 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3180 msiexec.exe Token: SeLockMemoryPrivilege 3180 msiexec.exe Token: SeIncreaseQuotaPrivilege 3180 msiexec.exe Token: SeMachineAccountPrivilege 3180 msiexec.exe Token: SeTcbPrivilege 3180 msiexec.exe Token: SeSecurityPrivilege 3180 msiexec.exe Token: SeTakeOwnershipPrivilege 3180 msiexec.exe Token: SeLoadDriverPrivilege 3180 msiexec.exe Token: SeSystemProfilePrivilege 3180 msiexec.exe Token: SeSystemtimePrivilege 3180 msiexec.exe Token: SeProfSingleProcessPrivilege 3180 msiexec.exe Token: SeIncBasePriorityPrivilege 3180 msiexec.exe Token: SeCreatePagefilePrivilege 3180 msiexec.exe Token: SeCreatePermanentPrivilege 3180 msiexec.exe Token: SeBackupPrivilege 3180 msiexec.exe Token: SeRestorePrivilege 3180 msiexec.exe Token: SeShutdownPrivilege 3180 msiexec.exe Token: SeDebugPrivilege 3180 msiexec.exe Token: SeAuditPrivilege 3180 msiexec.exe Token: SeSystemEnvironmentPrivilege 3180 msiexec.exe Token: SeChangeNotifyPrivilege 3180 msiexec.exe Token: SeRemoteShutdownPrivilege 3180 msiexec.exe Token: SeUndockPrivilege 3180 msiexec.exe Token: SeSyncAgentPrivilege 3180 msiexec.exe Token: SeEnableDelegationPrivilege 3180 msiexec.exe Token: SeManageVolumePrivilege 3180 msiexec.exe Token: SeImpersonatePrivilege 3180 msiexec.exe Token: SeCreateGlobalPrivilege 3180 msiexec.exe Token: SeBackupPrivilege 4948 vssvc.exe Token: SeRestorePrivilege 4948 vssvc.exe Token: SeAuditPrivilege 4948 vssvc.exe Token: SeBackupPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeBackupPrivilege 5144 srtasks.exe Token: SeRestorePrivilege 5144 srtasks.exe Token: SeSecurityPrivilege 5144 srtasks.exe Token: SeTakeOwnershipPrivilege 5144 srtasks.exe Token: SeBackupPrivilege 5144 srtasks.exe Token: SeRestorePrivilege 5144 srtasks.exe Token: SeSecurityPrivilege 5144 srtasks.exe Token: SeTakeOwnershipPrivilege 5144 srtasks.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe Token: SeTakeOwnershipPrivilege 5408 msiexec.exe Token: SeRestorePrivilege 5408 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3180 msiexec.exe 3180 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3180 msiexec.exe 5408 msiexec.exe 4968 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5408 wrote to memory of 5144 5408 msiexec.exe 93 PID 5408 wrote to memory of 4968 5408 msiexec.exe 95 PID 5288 wrote to memory of 5924 5288 2fZ0ks.exe 98 PID 5288 wrote to memory of 4420 5288 2fZ0ks.exe 100 PID 4420 wrote to memory of 1876 4420 cmd.exe 102 PID 4420 wrote to memory of 4788 4420 cmd.exe 103 PID 4420 wrote to memory of 4576 4420 cmd.exe 107 PID 5288 wrote to memory of 4940 5288 2fZ0ks.exe 109 PID 4940 wrote to memory of 2848 4940 cmd.exe 111 PID 4940 wrote to memory of 5624 4940 cmd.exe 112 PID 4940 wrote to memory of 5044 4940 cmd.exe 114 PID 2264 wrote to memory of 2552 2264 cmd.exe 117 PID 4728 wrote to memory of 1416 4728 cmd.exe 118 PID 5288 wrote to memory of 5464 5288 2fZ0ks.exe 119 PID 5464 wrote to memory of 1584 5464 cmd.exe 121 PID 5464 wrote to memory of 3676 5464 cmd.exe 122 PID 5464 wrote to memory of 4100 5464 cmd.exe 124 PID 5288 wrote to memory of 1104 5288 2fZ0ks.exe 125 PID 1104 wrote to memory of 1628 1104 cmd.exe 127 PID 1104 wrote to memory of 4668 1104 cmd.exe 128 PID 1104 wrote to memory of 3636 1104 cmd.exe 130 PID 5288 wrote to memory of 1388 5288 2fZ0ks.exe 133 PID 1388 wrote to memory of 2468 1388 cmd.exe 135 PID 1388 wrote to memory of 5584 1388 cmd.exe 136 PID 1388 wrote to memory of 788 1388 cmd.exe 138 PID 6028 wrote to memory of 2872 6028 cmd.exe 141 PID 2796 wrote to memory of 2320 2796 cmd.exe 142 PID 6068 wrote to memory of 4928 6068 cmd.exe 143 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_ehe007.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3180
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5144
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DB669F89992E5617E719811E6B4EE68A E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4968
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
C:\Users\Public\FyX9aw\2fZ0ks.exe"C:\Users\Public\FyX9aw\2fZ0ks.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:5924
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\FyX9aw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\FyX9aw\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1876
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4788
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4576
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5624
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1584
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3676
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1628
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4668
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2468
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5584
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:788
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\FyX9aw" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\FyX9aw" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2552
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:5392
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1416
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2872
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2320
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4928
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ec0d.rbs
- Size 7KB
- SHA256 72af5a14373092bebe7ec23bde06d542d0d12c6621d64816644ab32fd91d0bc4
- MD5 5c93e410eb053cc46d1df65c4d04b47d
- SHA1 d991a6572283d3248084a38108ef37cad91923c4
- SHA512 ef1dc340c751bddd70483df91887e8b24f468ef26161cc5270802ef517b81fe7d009f114e3dba0b800c5e321b8db15e62e0f81d0a2b03612f3911cea15354f18
- SSDEEP 96:zEXMgu0CvgaUU8Q1CsThq/U8Q1C6j4/xpThqjHsS56TWt8d4CCKplj8zIjByy:zYBCfzPIIVPI3CAyKpn
- TLSH T1C3F11001B31196D2F9911B75CB831B1637F2D7DAA320735B088E80685F573883EE67AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\FyX9aw\2fZ0ks.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\FyX9aw\UxEnhance64.dll
- Size 3.1MB
- SHA256 f7e0e8239264ce37572f9a0b42a3b2f332d743ba3a0aecb537231d2327f1e61b
- MD5 81b1ebe0ea13469536b4ae080aaa666c
- SHA1 b83eff17f5583d259f2ec0bcea57170d9d72a0f1
- SHA512 0c08f49a4046082ee2ac4c0479da73d1e106ca75990102cd3f37bb6f5b949770786257977d840b156a60231a0a3d2fb0bf0b6ca2ecb14427e4c3934caf0c65ce
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+1:P9m29xx3Tiqt06ox6+z2rNNrKo1
- TLSH T121E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\FyX9aw\adoresd.dat
- Size 4.7MB
- SHA256 793e99e4d6bda7114bacb90782b3121d452397607cea6c72e52cb99a760ac271
- MD5 08aa4bf83594d025389f616b92d0162b
- SHA1 87ad0be8ee43ad3daf88e9bf205c2dc80da1f6d2
- SHA512 3236fc1997c35e423c77ecb26f7da880115291ae4ed59a2a9a9282161e4b58daff4a189ab0eb27b32f9ee7f963ab6662578d97acb455ec433a6563309b5018f9
- SSDEEP 98304:Mmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:fu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T15E3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\FyX9aw\msadox.tb
- Size 8KB
- SHA256 4adc1fe383adba0845bbd64934331bda4dc5c358b736eb969fa111cfd8d68d4b
- MD5 51580281fe6c24ab2cd95250264503ab
- SHA1 a78cd1ea217c1b0abd49bc198b70f6810eaf2114
- SHA512 7d308045cc1c08130a6d89511e40201a6a4755fe455d3b04482e6793d13f168bc094888c6109b4d894609f778735b07a700dad8a318e62e54d66e4df7bd222de
- SSDEEP 192:IXqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IXsZqZOXQ3uqvR2Kfzp
- TLSH T1D6029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072ED2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF61F.tmp
- Size 9.4MB
- SHA256 970b33da9e2d3704ca829d65a4808b13546bff6ce0a9b6050de9faeb3f810016
- MD5 608b880dce0636a294839e2fba35b8c3
- SHA1 be8f27f6de5c4676f001ea46056ac241c801702d
- SHA512 4dec48bc331f6114da54a681528bf68bd9ec57b7a4634cdfff13999432c3da9fd425251d66847fa05d520d481a13c4325c82e1294ed63ba258c9e76b4bc09467
- SSDEEP 196608:caiT8E2kV6vjU8N32p3rBev5rxx5+0ciSEh4nGSg2+6Cj7:NEYjUu32pQrxxc0cG1j6Cf
- TLSH T109A633C2BD8B7B71C19BCB319583242D7C1B3B99BAAE8C0637853B409C76B19537A315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59ec0c.msi
- Size 9.5MB
- SHA256 8c05c21f190a87d6b9d63b51bc7162a510a0306ac7c4d55b89210554f84bc105
- MD5 79394a8421cd0f9b9143874743fa6bd0
- SHA1 0cad684a555349ce530762e59c23d45832e4e5bd
- SHA512 c2e82f314677499a5bf8419f1c7963945334fdbd6f36b15205df0a72067293daadf09332aaae7600bbbed665ef6bbbab251e6da235187fc7e2a0c801ffc68093
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6CjC:0EYjUu32p2rxxc0cGYj6CW
- TLSH T1A4A633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 4df63f2d39f19d442dad9766a15934a1a3b18731e0357153672ae5040ce206cc
- MD5 a3e5b0db3871d70ff655255e5239f1d0
- SHA1 956603eb35c19445b41514440e7d28ba67ce32b8
- SHA512 f336537d41c9e31ac4654b1687f170baded187b8e1492c1d294451a365ad2c00f938ca6ed7824ee705ec9a0ada9f24daaef7f3ff9299f807bbd1aee84644e88b
- SSDEEP 24576:8Fo3DMPCdoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfUReR:jH8
- TLSH T13357162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{078e0fc0-a2d5-4931-ba36-e3ab39689bfa}_OnDiskSnapshotProp
- Size 6KB
- SHA256 95e025e4c8c8212002f34df06fd2087ebd743b812465fb1d9fccf4141e0948fd
- MD5 a0ca0aac62598b199bda57167ef6985a
- SHA1 4f2686090db88a55016dd6b2c4dc19b7c2766f75
- SHA512 7caaa98b16fc430d5dfa18f4fe91deb8426d9d32034937af4db3bb00adf6fae12bb37f051e4137a16754de64a328dd0b6f2e0115691226a7485da6d4b656c486
- SSDEEP 96:F/lxhUvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:P4b++uVm
- TLSH T1F8D188080AF54711E2B3AB3229F18557A877B911EF33CB8E0198638E6671910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH