Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_b6j007.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_b6j007.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target install_b6j007.msi
- Size 5.8MB
- Sample260804-a4pl3aac77
- SHA256 776cb81fc5e5f395a6685fe8acbe9378ff5ef7d3ae70b364c6d1eaaf9d3840e3
- MD5 1afbcfbf12f181aead0960d5afc92761
- SHA1 f97b311767ba356b1dd2136f4b36217ffec1af48
- SHA512 f7d1085145a8e72bc76f2d1134b613b8dd5733aa389a0e19bed229d5c1fe1fe0e2ff55e764467f84702c628f9755808b04aba5facbda101668a685ffc987f9d7
- SSDEEP 98304:6J9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOeKIsRUo2zyyXxy318:49VN/A9nNMd6lZjiIsao2fw318
- TLSH T14F563382B9CA73B0D45BD3709522B55C722DBFC0EEB51C1B76A9360C1E37B0518BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Bt5Mbt = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4632 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 5600 bGDQQ5.exe - Loads dropped DLL 2 IoCs
pid Process 2228 MsiExec.exe 5600 bGDQQ5.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Bt5Mbt\\bGDQQ5.exe\"" bGDQQ5.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 9 2228 MsiExec.exe 10 2228 MsiExec.exe 15 2228 MsiExec.exe 16 2228 MsiExec.exe 17 2228 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 4688 cmd.exe 4764 cmd.exe 1640 cmd.exe 2836 cmd.exe 124 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b bGDQQ5.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5995dd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195} msiexec.exe File opened for modification C:\Windows\Installer\MSI9B0D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B8B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2FE05294EC27F879.TMP msiexec.exe File created C:\Windows\Installer\e5995dd.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF20192408DB768D95.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB059375178073DF9.TMP msiexec.exe File created C:\Windows\Installer\e5995df.msi msiexec.exe File created C:\Windows\SystemTemp\~DF5F857F7734E94679.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2944 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3756 cmd.exe 1292 cmd.exe 1352 cmd.exe 1332 cmd.exe 2640 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38\5651380B68661586C9476E7F935A1059 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\ProductName = "UNITAT Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\PackageCode = "8F2DB760BF1DD7840A93D152F90C3783" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\PackageName = "install_b6j007.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 616 schtasks.exe 5856 schtasks.exe 1920 schtasks.exe 2056 schtasks.exe 3316 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 msiexec.exe 856 msiexec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 2228 MsiExec.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe 5600 bGDQQ5.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeSecurityPrivilege 856 msiexec.exe Token: SeCreateTokenPrivilege 2944 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2944 msiexec.exe Token: SeLockMemoryPrivilege 2944 msiexec.exe Token: SeIncreaseQuotaPrivilege 2944 msiexec.exe Token: SeMachineAccountPrivilege 2944 msiexec.exe Token: SeTcbPrivilege 2944 msiexec.exe Token: SeSecurityPrivilege 2944 msiexec.exe Token: SeTakeOwnershipPrivilege 2944 msiexec.exe Token: SeLoadDriverPrivilege 2944 msiexec.exe Token: SeSystemProfilePrivilege 2944 msiexec.exe Token: SeSystemtimePrivilege 2944 msiexec.exe Token: SeProfSingleProcessPrivilege 2944 msiexec.exe Token: SeIncBasePriorityPrivilege 2944 msiexec.exe Token: SeCreatePagefilePrivilege 2944 msiexec.exe Token: SeCreatePermanentPrivilege 2944 msiexec.exe Token: SeBackupPrivilege 2944 msiexec.exe Token: SeRestorePrivilege 2944 msiexec.exe Token: SeShutdownPrivilege 2944 msiexec.exe Token: SeDebugPrivilege 2944 msiexec.exe Token: SeAuditPrivilege 2944 msiexec.exe Token: SeSystemEnvironmentPrivilege 2944 msiexec.exe Token: SeChangeNotifyPrivilege 2944 msiexec.exe Token: SeRemoteShutdownPrivilege 2944 msiexec.exe Token: SeUndockPrivilege 2944 msiexec.exe Token: SeSyncAgentPrivilege 2944 msiexec.exe Token: SeEnableDelegationPrivilege 2944 msiexec.exe Token: SeManageVolumePrivilege 2944 msiexec.exe Token: SeImpersonatePrivilege 2944 msiexec.exe Token: SeCreateGlobalPrivilege 2944 msiexec.exe Token: SeBackupPrivilege 4284 vssvc.exe Token: SeRestorePrivilege 4284 vssvc.exe Token: SeAuditPrivilege 4284 vssvc.exe Token: SeBackupPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeBackupPrivilege 1624 srtasks.exe Token: SeRestorePrivilege 1624 srtasks.exe Token: SeSecurityPrivilege 1624 srtasks.exe Token: SeTakeOwnershipPrivilege 1624 srtasks.exe Token: SeBackupPrivilege 1624 srtasks.exe Token: SeRestorePrivilege 1624 srtasks.exe Token: SeSecurityPrivilege 1624 srtasks.exe Token: SeTakeOwnershipPrivilege 1624 srtasks.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe Token: SeTakeOwnershipPrivilege 856 msiexec.exe Token: SeRestorePrivilege 856 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2944 msiexec.exe 2944 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2944 msiexec.exe 856 msiexec.exe 2228 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 856 wrote to memory of 1624 856 msiexec.exe 94 PID 856 wrote to memory of 2228 856 msiexec.exe 96 PID 5600 wrote to memory of 4632 5600 bGDQQ5.exe 100 PID 5600 wrote to memory of 4688 5600 bGDQQ5.exe 102 PID 4688 wrote to memory of 616 4688 cmd.exe 104 PID 4688 wrote to memory of 5348 4688 cmd.exe 105 PID 4688 wrote to memory of 3600 4688 cmd.exe 107 PID 5600 wrote to memory of 4764 5600 bGDQQ5.exe 111 PID 4764 wrote to memory of 5856 4764 cmd.exe 113 PID 4764 wrote to memory of 4308 4764 cmd.exe 114 PID 4764 wrote to memory of 5328 4764 cmd.exe 116 PID 1292 wrote to memory of 3436 1292 cmd.exe 118 PID 5600 wrote to memory of 1640 5600 bGDQQ5.exe 119 PID 1640 wrote to memory of 1920 1640 cmd.exe 121 PID 1640 wrote to memory of 2968 1640 cmd.exe 122 PID 1640 wrote to memory of 1688 1640 cmd.exe 124 PID 5600 wrote to memory of 2836 5600 bGDQQ5.exe 125 PID 2836 wrote to memory of 2056 2836 cmd.exe 127 PID 2836 wrote to memory of 3636 2836 cmd.exe 128 PID 2836 wrote to memory of 3492 2836 cmd.exe 130 PID 3756 wrote to memory of 2936 3756 cmd.exe 132 PID 5600 wrote to memory of 124 5600 bGDQQ5.exe 134 PID 124 wrote to memory of 3316 124 cmd.exe 136 PID 124 wrote to memory of 2600 124 cmd.exe 138 PID 124 wrote to memory of 5292 124 cmd.exe 140 PID 1352 wrote to memory of 3752 1352 cmd.exe 142 PID 1332 wrote to memory of 796 1332 cmd.exe 143 PID 2640 wrote to memory of 4484 2640 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_b6j007.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9D0FCFAA783BE8AD3AE263FE0917F8A8 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2228
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
C:\Users\Public\Bt5Mbt\bGDQQ5.exe"C:\Users\Public\Bt5Mbt\bGDQQ5.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:4632
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Bt5Mbt\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Bt5Mbt\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:616
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5348
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3600
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5856
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4308
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1920
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2968
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2056
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3636
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3492
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3316
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2600
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5292
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Bt5Mbt" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Bt5Mbt" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2936
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:1364
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3436
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3752
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:796
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4484
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5995de.rbs
- Size 7KB
- SHA256 da00e0de594a64ee65cd2086f358c58da69e18651948197a00292918724abe15
- MD5 82ddd0fd6fcb0a833c572f8928139b0c
- SHA1 d7eb7a003ee0004e036c6d37d7806f6ff60c06d5
- SHA512 29b128e4fba4fc963041a617c6768b50bb0ecaa78ee75212cd62e5237efeae0549aa4fc9789ed2f3b93c0187d5f0a01ce2831e3e58476687421049c8bece9713
- SSDEEP 96:eVvGwguT7RC3P/PaUUTl1CsThq5UTl1C6joXPxtThqxH6S5ivW1EVJcWCKpljSu5:e/CyzxIIXxIb8kcKpd
- TLSH T1DBF11C42B700D6F3EF871B75C713176637B2E3E89220274F099D88601E5638C6E9A29F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Bt5Mbt\UxEnhance64.dll
- Size 3.1MB
- SHA256 ad2b5d0840a9a0f19f4f0186e4c88539c7e09d0473fe8c04e2eb5ea4c9f4013a
- MD5 3ade4c4f1981d67ebb14fedd0dd2a618
- SHA1 e0581715064d44101285ac3bc682c7f3ebc1c7e4
- SHA512 2fae3a137c112a9bbcf0349702ba5df0f7ac8c6e3292487cc80e4bc7b7c207a527b1bbea2b1d70c21cc11121dca6a47f92827f5d92428f225a56c82d7d629041
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+o:P9m29xx3Tiqt06ox6+z2rNNrKoo
- TLSH T1C9E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Bt5Mbt\adoresd.dat
- Size 4.7MB
- SHA256 a735232e9527a358a89d242233600efa3b95532e292fbfab07cefe76fb914eaf
- MD5 970d54f70ba45334b1fc76d41bf94f7e
- SHA1 52a427c0ed0d4f7516ecc443ff4ee58f3d7060c1
- SHA512 e5c11787e9797038f1af8fe9c1798a31a58a8a896aaf5ec42cb9fa5d85823170a58a93cdf2cbcb2f43ea0fc5e8010c3857a950f4e1f3b08391ff4abde09b4dfe
- SSDEEP 98304:rmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:iu1SwOflfZPF6Ma0bsoa5+qd
- TLSH T17A3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Bt5Mbt\bGDQQ5.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Bt5Mbt\msadox.tb
- Size 8KB
- SHA256 e27aaf7cbc2e8495de34bf71112ab45588209b4b617f9c6a420c5879756e4a9c
- MD5 891f63f2b9c529b9ef7315cecd1b60f6
- SHA1 c7d615a20f0722f350691f53a70988f06469f664
- SHA512 96ed204aeae60d5b9e82fd4fafc176bd15b722553aa730bab585354c5a53bda647ee3656bf510633dc6194ab5a13d201820dfbbe67848dd591dc2b4edd3b7d0d
- SSDEEP 192:OqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:OsZqZOXQ3uqvR2Kfzp
- TLSH T1E4029E05D7A20CC7D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9B8B.tmp
- Size 5.8MB
- SHA256 5394028097aac1a174009015e135167c272840a048804023e3ca51c1c8fa7a1d
- MD5 edd821b414f73fffffec2c2a2b50158a
- SHA1 55aa2dda85f4e80ebbc8263836b53d2f56f7edb1
- SHA512 ab83aae1ad4874165a0464ef10011147a354db77221cf505c149c98f58b31da0880847ab2b74adaf97bc8c38f12ad62279eb37512baf67300597ae8870e6a71d
- SSDEEP 98304:gJ9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOe9IsRUo2zyyXxy31x:W9VN/A9nNMd6lZjVIsao2fw31x
- TLSH T15E56338269CA73F0D45BD3709522B41C711D7FC0EEB91C1A7AED2B581E37B0618BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5995dd.msi
- Size 5.8MB
- SHA256 776cb81fc5e5f395a6685fe8acbe9378ff5ef7d3ae70b364c6d1eaaf9d3840e3
- MD5 1afbcfbf12f181aead0960d5afc92761
- SHA1 f97b311767ba356b1dd2136f4b36217ffec1af48
- SHA512 f7d1085145a8e72bc76f2d1134b613b8dd5733aa389a0e19bed229d5c1fe1fe0e2ff55e764467f84702c628f9755808b04aba5facbda101668a685ffc987f9d7
- SSDEEP 98304:6J9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOeKIsRUo2zyyXxy318:49VN/A9nNMd6lZjiIsao2fw318
- TLSH T14F563382B9CA73B0D45BD3709522B55C722DBFC0EEB51C1B76A9360C1E37B0518BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 b4aa8e5122298b52dcaf2dda3ad2c2e40eabe388670b3c44326fb216d830aae9
- MD5 afa513ab71cc90d737f0e652938d4d71
- SHA1 5d45f21012a794581c99fd4e581cd98dfdfe5252
- SHA512 0e552c0f0dc9e98731e90fd24f336d1d4eefd1ae4baee729c87cbfc3878111b7fdc3acebd84d152166118c809afb08a27fee85aa69e7db447660c2d8319b755f
- SSDEEP 24576:OFo3DMPTdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+j:QHI
- TLSH T10B57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b4d260bf-6c5d-4d7e-b583-e6d0b3296617}_OnDiskSnapshotProp
- Size 6KB
- SHA256 fb336f6a4f13e647bd6a25cf77a8d9cfe01456f0d2ff468e9e99f5dce096cd46
- MD5 9dac3fe09c70353c3bf3370fdbd41a58
- SHA1 76317a2bb8a66b700c36bb642e52317ef85212b0
- SHA512 f54b31ebd6ef97b93f09b2554ef558e7b696ff359a604a62dfbfad358df12a87da65ee697e80c4ea2522a97477046d1391e683453919df51e0a71c8cf06f218f
- SSDEEP 96:FcIMbCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:mI5b++uVmN
- TLSH T17CD178085AF54711E2B3AB3129F18557A877B911FF33CB8E0198238E6631A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH