Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_upr010.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_upr010.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target install_upr010.msi
- Size 6.8MB
- Sample260803-ewfreaybqa
- SHA256 0d6bea573c356522d3981523c4d66c39c3bddc65103f542a4e8f6cf499ef5592
- MD5 0ca7127bab16bb977ebce24a1312d94a
- SHA1 f913f869d914cc1e20da9d676e0b042c2155ad05
- SHA512 bdb9b111e3cabf15845eb76f75272deb8e6acb3f0d8291cd158ab0983dc64806f1d6ddaa19c6fa6a8d36275b0815f22297de76e084063e389a0e8e1f775a66fc
- SSDEEP 196608:+jh5lxqmIN1qEjEjWBS6kVsPRGVLZ8WidS:urqLNPEcuSPRGVi1dS
- TLSH T15C7633D179CB2BB1C59BDBB16147B86D3C2A7FC67D224D8A75AC76042E723292273340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\eKuox7 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1948 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 2716 qjTxxX.exe - Loads dropped DLL 2 IoCs
pid Process 4392 MsiExec.exe 2716 qjTxxX.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\eKuox7\\qjTxxX.exe\"" qjTxxX.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4392 MsiExec.exe 3 4392 MsiExec.exe 4 4392 MsiExec.exe 5 4392 MsiExec.exe 10 4392 MsiExec.exe 11 4392 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4132 cmd.exe 5404 cmd.exe 3556 cmd.exe 3300 cmd.exe 4756 cmd.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b qjTxxX.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF44B9031C4606E6D6.TMP msiexec.exe File created C:\Windows\Installer\e5984c6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFC4E1FCB07BBFA703.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{AB5B91D2-8262-88C3-C0B3-9F7A3D9BBE66} msiexec.exe File created C:\Windows\SystemTemp\~DF2AFDF0C73B96B4F2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8A45.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AF1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFB7843F356EC33A52.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5984c6.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e5984c8.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 912 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3292 cmd.exe 2264 cmd.exe 4188 cmd.exe 1420 cmd.exe 2936 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000508ea0cb0cbd3e300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801508ea0cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101508ea0cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3508ea0cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6508ea0cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\PackageName = "install_upr010.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\PackageCode = "CE0A64DE0F8D429408FAD40FFBE3F015" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94BE0DF692EECDFE6C8D0D14335F1104 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\ProductName = "TRUNC Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D19B5BA26283C880C3BF9A7D3B9EB66 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D19B5BA26283C880C3BF9A7D3B9EB66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3856 schtasks.exe 4780 schtasks.exe 1364 schtasks.exe 5816 schtasks.exe 6112 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 msiexec.exe 3236 msiexec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 4392 MsiExec.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe 2716 qjTxxX.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 912 msiexec.exe Token: SeIncreaseQuotaPrivilege 912 msiexec.exe Token: SeSecurityPrivilege 3236 msiexec.exe Token: SeCreateTokenPrivilege 912 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 912 msiexec.exe Token: SeLockMemoryPrivilege 912 msiexec.exe Token: SeIncreaseQuotaPrivilege 912 msiexec.exe Token: SeMachineAccountPrivilege 912 msiexec.exe Token: SeTcbPrivilege 912 msiexec.exe Token: SeSecurityPrivilege 912 msiexec.exe Token: SeTakeOwnershipPrivilege 912 msiexec.exe Token: SeLoadDriverPrivilege 912 msiexec.exe Token: SeSystemProfilePrivilege 912 msiexec.exe Token: SeSystemtimePrivilege 912 msiexec.exe Token: SeProfSingleProcessPrivilege 912 msiexec.exe Token: SeIncBasePriorityPrivilege 912 msiexec.exe Token: SeCreatePagefilePrivilege 912 msiexec.exe Token: SeCreatePermanentPrivilege 912 msiexec.exe Token: SeBackupPrivilege 912 msiexec.exe Token: SeRestorePrivilege 912 msiexec.exe Token: SeShutdownPrivilege 912 msiexec.exe Token: SeDebugPrivilege 912 msiexec.exe Token: SeAuditPrivilege 912 msiexec.exe Token: SeSystemEnvironmentPrivilege 912 msiexec.exe Token: SeChangeNotifyPrivilege 912 msiexec.exe Token: SeRemoteShutdownPrivilege 912 msiexec.exe Token: SeUndockPrivilege 912 msiexec.exe Token: SeSyncAgentPrivilege 912 msiexec.exe Token: SeEnableDelegationPrivilege 912 msiexec.exe Token: SeManageVolumePrivilege 912 msiexec.exe Token: SeImpersonatePrivilege 912 msiexec.exe Token: SeCreateGlobalPrivilege 912 msiexec.exe Token: SeBackupPrivilege 3884 vssvc.exe Token: SeRestorePrivilege 3884 vssvc.exe Token: SeAuditPrivilege 3884 vssvc.exe Token: SeBackupPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeBackupPrivilege 264 srtasks.exe Token: SeRestorePrivilege 264 srtasks.exe Token: SeSecurityPrivilege 264 srtasks.exe Token: SeTakeOwnershipPrivilege 264 srtasks.exe Token: SeBackupPrivilege 264 srtasks.exe Token: SeRestorePrivilege 264 srtasks.exe Token: SeSecurityPrivilege 264 srtasks.exe Token: SeTakeOwnershipPrivilege 264 srtasks.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe Token: SeTakeOwnershipPrivilege 3236 msiexec.exe Token: SeRestorePrivilege 3236 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 912 msiexec.exe 912 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 912 msiexec.exe 3236 msiexec.exe 4392 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3236 wrote to memory of 264 3236 msiexec.exe 94 PID 3236 wrote to memory of 4392 3236 msiexec.exe 96 PID 2716 wrote to memory of 1948 2716 qjTxxX.exe 101 PID 2716 wrote to memory of 5404 2716 qjTxxX.exe 103 PID 5404 wrote to memory of 3856 5404 cmd.exe 105 PID 5404 wrote to memory of 3224 5404 cmd.exe 106 PID 5404 wrote to memory of 4468 5404 cmd.exe 108 PID 2716 wrote to memory of 3556 2716 qjTxxX.exe 111 PID 3556 wrote to memory of 4780 3556 cmd.exe 113 PID 3556 wrote to memory of 5876 3556 cmd.exe 116 PID 4188 wrote to memory of 4928 4188 cmd.exe 115 PID 3556 wrote to memory of 2784 3556 cmd.exe 118 PID 2716 wrote to memory of 3300 2716 qjTxxX.exe 120 PID 3300 wrote to memory of 1364 3300 cmd.exe 122 PID 3300 wrote to memory of 4768 3300 cmd.exe 123 PID 3300 wrote to memory of 1480 3300 cmd.exe 125 PID 1420 wrote to memory of 1516 1420 cmd.exe 127 PID 2716 wrote to memory of 4756 2716 qjTxxX.exe 128 PID 4756 wrote to memory of 5816 4756 cmd.exe 130 PID 4756 wrote to memory of 2712 4756 cmd.exe 131 PID 4756 wrote to memory of 3032 4756 cmd.exe 133 PID 2936 wrote to memory of 5464 2936 cmd.exe 135 PID 2716 wrote to memory of 4132 2716 qjTxxX.exe 137 PID 4132 wrote to memory of 6112 4132 cmd.exe 139 PID 4132 wrote to memory of 4076 4132 cmd.exe 140 PID 4132 wrote to memory of 5132 4132 cmd.exe 142 PID 3292 wrote to memory of 2696 3292 cmd.exe 144 PID 2264 wrote to memory of 1120 2264 cmd.exe 145 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_upr010.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:912
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:264
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 14EA92B0DF329854EECFB5A819C2E4B7 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4740
-
C:\Users\Public\eKuox7\qjTxxX.exe"C:\Users\Public\eKuox7\qjTxxX.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:1948
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\eKuox7\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\eKuox7\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3856
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3224
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4468
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4780
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5876
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2784
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1364
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4768
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5816
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2712
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3032
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6112
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4076
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5132
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\eKuox7" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\eKuox7" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4928
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:856
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1516
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5464
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2696
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1120
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5984c7.rbs
- Size 7KB
- SHA256 3e29a19bd650056126a21d7bfd91aeb8f601c6c2990fc7b771ffcbf7ec11480b
- MD5 46ae8236dfe5645c208e37a54cfe0a9f
- SHA1 b39121334420392db5d0366e1547487cadfbd567
- SHA512 8139919896c5145d601401df60b984db722612921b4e9308b3ccf2c4409c395a02657e635475b74e117ea778b9736bb3553f94279a9b93c49a78b699f8058330
- SSDEEP 96:Dtgu0CzMaUU8h1CsThq/U8h1C6j4/xpThqjHsS56TWt8d6CKpljBzIjByy:DWCvzaIIVaI3CA7Kpk
- TLSH T1C2F13101B31196D2E9911B75CB831B1637F2D7DAA720735B088E80685F573883FE67AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eKuox7\UxEnhance64.dll
- Size 3.1MB
- SHA256 4b921ac6dae198abc41ec028fd865ef2e383fbe51f996a8917f230549554941a
- MD5 ee8ee0de173a99f1f85d015ac0454b28
- SHA1 b2abe2f4baaa60019bab374323d40b5b7e07c412
- SHA512 228b71f264196351b351cc83e224b2fde3f84cafa94f91c9140795453abb3121fa184b341f33e5e5c010717d2d98f57445e49c26455d75be7b7d0d75308f64e3
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+b:P9m29xx3Tiqt06ox6+z2rNNrKob
- TLSH T18DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eKuox7\adoresd.dat
- Size 4.7MB
- SHA256 626a0718126b166e37b16a4a34434acffd47f2b4ead74e18e9f5e40ab3d4e435
- MD5 c0ab592ee1a0502b4944fa00b175daf6
- SHA1 490c02977bfaaeb69d8baa1001d87fdcaf9c6af8
- SHA512 a014494a3492cc04862961f6323a274a68f1de26c7d705fd474631ba730ca45980cb4b8d1314cfc447d7b2b4880fb40cddad00c2e3fa0ea4acceb1e1a6fe15aa
- SSDEEP 98304:rmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:iu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1433633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eKuox7\msadox.tb
- Size 8KB
- SHA256 31ce2f4c46b36501482de6bba38bacdb27356e8c12959b20e1072dc1abdecfe8
- MD5 f26d7bf269b91d69bfa4d1772b0f32c6
- SHA1 82de4ee91d5cc3a34ad376045aaa559684259ba7
- SHA512 245c76aae33450e70ca822e0c6b7b8f83591903c01a68b33de175c321ac8b39db91081de6f3bfc4e21ef8225bfe6b752f37d2dffa62c70c0a1428de06fee619a
- SSDEEP 192:LqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:LsZqZOXQ3uqvR2Kfzp
- TLSH T1C4029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\eKuox7\qjTxxX.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8AF1.tmp
- Size 6.8MB
- SHA256 99c4cc89c0322b357536b7110aad0837d0e88a6418981798db45f1be9883f120
- MD5 6f5384bb937fd8082565fb497356b05c
- SHA1 f99ff347d605febbb2711b3ce8edea25350a7690
- SHA512 cf78f60be13f47f326c2e70636e9eed27c2e63a4cfd68d3b4bd443400e94ab07a253a4e53700836fdae0150dbf77f934a8b981b1d7e41b548bb60007e04b2341
- SSDEEP 196608:ljh5lxqmIN1qEjEj6BS6kVsPRGVLZ8WidN:drqLNPEIuSPRGVi1dN
- TLSH T13A7633D539CF27B0C59BDBB16147786E3C2A3BD678220E8E79AC76011E723292277740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5984c6.msi
- Size 6.8MB
- SHA256 0d6bea573c356522d3981523c4d66c39c3bddc65103f542a4e8f6cf499ef5592
- MD5 0ca7127bab16bb977ebce24a1312d94a
- SHA1 f913f869d914cc1e20da9d676e0b042c2155ad05
- SHA512 bdb9b111e3cabf15845eb76f75272deb8e6acb3f0d8291cd158ab0983dc64806f1d6ddaa19c6fa6a8d36275b0815f22297de76e084063e389a0e8e1f775a66fc
- SSDEEP 196608:+jh5lxqmIN1qEjEjWBS6kVsPRGVLZ8WidS:urqLNPEcuSPRGVi1dS
- TLSH T15C7633D179CB2BB1C59BDBB16147B86D3C2A7FC67D224D8A75AC76042E723292273340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 d8fff3d55afbeaf2ac79dc781dc2862e884a4ed73b71651c845173e2dd5df835
- MD5 e07dd40d9cd37366c12659485c60b24a
- SHA1 9fc6fad65022854b30cb610f9342219c8b09b68f
- SHA512 04b62761c6829b819a0a0593b63381c02ca29d15ba83c067b63e9cd1cecad33a11ce3bf705f61d4ee4126383d0c2797575e4ae20ac4fc8462a7d60a8aa7e0703
- SSDEEP 24576:0Fo3DMPKdoO/vvTL/yQqKC1gP7egB7tZUHMo93Uy8PE6JdrasIBm6jgb+Ok:3Ho
- TLSH T18C57A31437F92140E7B79E3CA8F06A234D397D5BAC19DE8D45411B4E0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cba08e50-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c204c6a3-fe9a-448f-813f-0007bfbd6ec0}_OnDiskSnapshotProp
- Size 6KB
- SHA256 9766641f795ca72049572407261a1a8b19b9bdda0c4072c3ec2217791ee13b8f
- MD5 5f0d1eebf83d4e5489871e433dd114e5
- SHA1 aef4dffb6d88da1f83acecea82f2e62f6bc7b99b
- SHA512 b8c661be6ddce2e6dc6b2e261d5ae3a1beadc37d5da4a68c031393703342910345818a7c9d21e61ebb5d5103471a45de53955007a7ef1d5f3d082b8566ef9bb7
- SSDEEP 96:F/IxSwnavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:mUb++uVm
- TLSH T173D189185AE54711E2B3AB322DF18557A877B811FF33CB8E0198238E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH