e93862eae8bf5168f68536e2f96824f800832ce97da8d1f5f0fcd63675a34c88

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e93862eae8bf5168f68536e2f96824f800832ce97da8d1f5f0fcd63675a34c88.msi
Size 3.1MB
Sample260810-vc5jestbld
SHA256 e93862eae8bf5168f68536e2f96824f800832ce97da8d1f5f0fcd63675a34c88
MD5 cdff0005455b48dae8c3676e34567ad2
SHA1 13b793fccfd73806072a272763ba512bb18f2105
SHA512 57d1cdba9b5515d6c2ef95e18c4f0607826563e365ff33d5d425eddde0a95bb89750d77e727c45d425885fc53f7b6d964822eac3d0edb47d334b013560b0eed2
SSDEEP 98304:s06j2gwRph8YEdZxyQOPAFnU8Z61zfTAE1w1:Kj2garEdfyBPApUQCzfV1w
TLSH
T160E533976E8C8323C0C8253493C8117AB3190DB2BF94446575AE77AE387EA3891FD4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3408	powershell.exe
3172	powershell.exe
1720	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
1120	agent.exe
2768	ContosoRmmAgent.exe
4992	ContosoRmmAgent.exe
2940	ContosoRmmActivity.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e598c48.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30D1C2815C4AA674.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9030.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2p2fgl1r.ypy.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\e598c48.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{049C66FE-7C6B-43A2-979D-46A93FF567A9}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ogjxkeij.j1f.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fdkkbfgy.crm.ps1	powershell.exe
File created	C:\Windows\Installer\e598c4a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF71998CBD4B06BB93.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kidt43fc.cnp.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_p3zv1lth.qch.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rs3p2tqm.va2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_o3ix2llo.btq.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DF0761F47509F21111.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qfrcf31u.ffb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hwhkkri3.quf.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1tx3b0kj.r3q.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFA9D9164E2509713A.TMP	msiexec.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3304	sc.exe
5928	sc.exe
860	sc.exe
716	sc.exe
3060	sc.exe
5124	sc.exe
1140	sc.exe
1224	sc.exe
2776	sc.exe
3452	sc.exe
2816	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2608	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3904	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EF66C940B6C72A3479D9649AF35F769A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\ProductName = "Contoso RMM Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\PackageCode = "38580F5133976AD439301D39F15A2E81"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D7AF758131773D25F81F42121B8EA7B7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList\PackageName = "e93862eae8bf5168f68536e2f96824f800832ce97da8d1f5f0fcd63675a34c88.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EF66C940B6C72A3479D9649AF35F769A\Main	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D7AF758131773D25F81F42121B8EA7B7\EF66C940B6C72A3479D9649AF35F769A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF66C940B6C72A3479D9649AF35F769A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3324	schtasks.exe
4444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5260	msiexec.exe
5260	msiexec.exe
1120	agent.exe
3408	powershell.exe
3408	powershell.exe
3408	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2608	msiexec.exe
Token: SeSecurityPrivilege	5260	msiexec.exe
Token: SeCreateTokenPrivilege	2608	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2608	msiexec.exe
Token: SeLockMemoryPrivilege	2608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2608	msiexec.exe
Token: SeMachineAccountPrivilege	2608	msiexec.exe
Token: SeTcbPrivilege	2608	msiexec.exe
Token: SeSecurityPrivilege	2608	msiexec.exe
Token: SeTakeOwnershipPrivilege	2608	msiexec.exe
Token: SeLoadDriverPrivilege	2608	msiexec.exe
Token: SeSystemProfilePrivilege	2608	msiexec.exe
Token: SeSystemtimePrivilege	2608	msiexec.exe
Token: SeProfSingleProcessPrivilege	2608	msiexec.exe
Token: SeIncBasePriorityPrivilege	2608	msiexec.exe
Token: SeCreatePagefilePrivilege	2608	msiexec.exe
Token: SeCreatePermanentPrivilege	2608	msiexec.exe
Token: SeBackupPrivilege	2608	msiexec.exe
Token: SeRestorePrivilege	2608	msiexec.exe
Token: SeShutdownPrivilege	2608	msiexec.exe
Token: SeDebugPrivilege	2608	msiexec.exe
Token: SeAuditPrivilege	2608	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2608	msiexec.exe
Token: SeChangeNotifyPrivilege	2608	msiexec.exe
Token: SeRemoteShutdownPrivilege	2608	msiexec.exe
Token: SeUndockPrivilege	2608	msiexec.exe
Token: SeSyncAgentPrivilege	2608	msiexec.exe
Token: SeEnableDelegationPrivilege	2608	msiexec.exe
Token: SeManageVolumePrivilege	2608	msiexec.exe
Token: SeImpersonatePrivilege	2608	msiexec.exe
Token: SeCreateGlobalPrivilege	2608	msiexec.exe
Token: SeBackupPrivilege	3976	vssvc.exe
Token: SeRestorePrivilege	3976	vssvc.exe
Token: SeAuditPrivilege	3976	vssvc.exe
Token: SeBackupPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3408	powershell.exe
Token: SeIncreaseQuotaPrivilege	3408	powershell.exe
Token: SeSecurityPrivilege	3408	powershell.exe
Token: SeTakeOwnershipPrivilege	3408	powershell.exe
Token: SeLoadDriverPrivilege	3408	powershell.exe
Token: SeBackupPrivilege	3408	powershell.exe
Token: SeRestorePrivilege	3408	powershell.exe
Token: SeShutdownPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe
Token: SeTakeOwnershipPrivilege	5260	msiexec.exe
Token: SeRestorePrivilege	5260	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2608	msiexec.exe
2608	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	msiexec.exe
5260	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5260 wrote to memory of 4512	5260	msiexec.exe	94
PID 5260 wrote to memory of 1120	5260	msiexec.exe	96
PID 1120 wrote to memory of 3408	1120	agent.exe	97
PID 1120 wrote to memory of 6132	1120	agent.exe	100
PID 1120 wrote to memory of 2776	1120	agent.exe	102
PID 1120 wrote to memory of 3304	1120	agent.exe	104
PID 1120 wrote to memory of 5928	1120	agent.exe	106
PID 1120 wrote to memory of 3172	1120	agent.exe	108
PID 1120 wrote to memory of 860	1120	agent.exe	110
PID 1120 wrote to memory of 716	1120	agent.exe	112
PID 1120 wrote to memory of 3060	1120	agent.exe	114
PID 1120 wrote to memory of 5124	1120	agent.exe	116
PID 1120 wrote to memory of 1140	1120	agent.exe	118
PID 1120 wrote to memory of 4444	1120	agent.exe	121
PID 2768 wrote to memory of 3452	2768	ContosoRmmAgent.exe	123
PID 2768 wrote to memory of 2816	2768	ContosoRmmAgent.exe	125
PID 2768 wrote to memory of 1720	2768	ContosoRmmAgent.exe	127
PID 4992 wrote to memory of 1224	4992	ContosoRmmAgent.exe	131
PID 2768 wrote to memory of 3324	2768	ContosoRmmAgent.exe	134
PID 2768 wrote to memory of 3904	2768	ContosoRmmAgent.exe	136
PID 2768 wrote to memory of 2940	2768	ContosoRmmAgent.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e93862eae8bf5168f68536e2f96824f800832ce97da8d1f5f0fcd63675a34c88.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4512
- C:\ProgramData\ContosoRMM\Agent\agent.exe
  "C:\ProgramData\ContosoRMM\Agent\agent.exe" install
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' Get-ScheduledTask | Where-Object { $_.TaskName -match '(?i)Contoso|ContosoRmm|RMM|Watchdog|Migrate|Recover' -or ($_.Actions | Where-Object { ($_.Execute -match '(?i)Contoso|ContosoRmm') -or ($_.Arguments -match '(?i)Contoso|ContosoRmm') }) } | ForEach-Object { $_.TaskName + '||' + $_.TaskPath } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Delete /TN ContosoRmmAgentWatchdog /F
    3⤵
    PID:6132
- - C:\Windows\system32\sc.exe
    sc.exe stop ContosoRmmAgent
    3⤵
    - Launches sc.exe
    PID:2776
- - C:\Windows\system32\sc.exe
    sc.exe query ContosoRmmAgent
    3⤵
    - Launches sc.exe
    PID:3304
- - C:\Windows\system32\sc.exe
    sc.exe qc ContosoRmmAgent
    3⤵
    - Launches sc.exe
    PID:5928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Id -ne 1120 -and $(try { $_.Path -and $_.Path.StartsWith('C:\ProgramData\ContosoRMM', [StringComparison]::OrdinalIgnoreCase) } catch { $false }) } | ForEach-Object { Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\system32\sc.exe
    sc.exe create ContosoRmmAgent binPath= \"C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe\" start= delayed-auto DisplayName= "Contoso RMM Agent"
    3⤵
    - Launches sc.exe
    PID:860
- - C:\Windows\system32\sc.exe
    sc.exe description ContosoRmmAgent "Contoso RMM Agent. Maintains an outbound connection to the Contoso RMM management server for monitoring and authorized software deployment."
    3⤵
    - Launches sc.exe
    PID:716
- - C:\Windows\system32\sc.exe
    sc.exe failure ContosoRmmAgent reset= 86400 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:3060
- - C:\Windows\system32\sc.exe
    sc.exe failureflag ContosoRmmAgent 1
    3⤵
    - Launches sc.exe
    PID:5124
- - C:\Windows\system32\sc.exe
    sc.exe start ContosoRmmAgent
    3⤵
    - Launches sc.exe
    PID:1140
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /TN ContosoRmmAgentWatchdog /TR "C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe watchdog" /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe
"C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\sc.exe
  sc.exe failure ContosoRmmAgent reset= 86400 actions= restart/5000/restart/10000/restart/30000
  2⤵
  - Launches sc.exe
  PID:3452
- C:\Windows\system32\sc.exe
  sc.exe failureflag ContosoRmmAgent 1
  2⤵
  - Launches sc.exe
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' Get-ScheduledTask | Where-Object { $_.TaskName -match '(?i)Contoso|ContosoRmm|RMM|Watchdog|Migrate|Recover' -or ($_.Actions | Where-Object { ($_.Execute -match '(?i)Contoso|ContosoRmm') -or ($_.Arguments -match '(?i)Contoso|ContosoRmm') }) } | ForEach-Object { $_.TaskName + '||' + $_.TaskPath } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1720
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Create /TN ContosoRmmAgentWatchdog /TR "C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe watchdog" /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3324
- C:\Windows\system32\taskkill.exe
  taskkill.exe /F /IM maintenance-ui.exe
  2⤵
  - Kills process with taskkill
  PID:3904
- C:\ProgramData\ContosoRMM\Agent\ContosoRmmActivity.exe
  "C:\ProgramData\ContosoRMM\Agent\ContosoRmmActivity.exe" activity-helper
  2⤵
  - Executes dropped EXE
  PID:2940

C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe
C:\ProgramData\ContosoRMM\Agent\ContosoRmmAgent.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\system32\sc.exe
  sc.exe query ContosoRmmAgent
  2⤵
  - Launches sc.exe
  PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e598c49.rbs

Path C:\Config.Msi\e598c49.rbs
Size 7KB
SHA256 4d8ea13d1a8f20901e9fe47eb6d55dff76f9d5940a79d3a51f64e00bba3737b0
MD5 ffd8222f47d9a9f7ed1aab248a6ef067
SHA1 79130410ca4834c8d0ca6adcf5f28f9cee402455
SHA512 7a5539695ea9c477a17c869beabb7fd310ceae85ddec82d67b9062276d96a305cb9bfbb864b2f959e71f40758208aa654a9311c127dc51ddb2fe6deedd8864fe
SSDEEP 96:ym2VRRAeCHwnZUARTCsTloUARTC6jZ6OdFTladRW53iWcFyrKCMpljkKpjBby:zyRFC6SgOIpgO6BsoMpG
TLSH
T18FF10F456B4881E3EF921B34C70727923BBBE3CAE754238B558E80601F463885E9978F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pin-diag

Path C:\ProgramData\ContosoRMM\Agent\.pin-diag
Size 90B
SHA256 d07bc3722818221c7de28d645c304e04af8a00d3453337ef417e6b8ad69a3413
MD5 6d11042fa4031f5235af1a264ad0c9df
SHA1 402fcbccdf5efe059541d51af8136e8178daaf50
SHA512 a1fbd5708b51ec5a9a6fd7c37266c2e54979d973d31c612aa0e4c7420735a2d6acde0b1f4667d44b40530162f163ca30ea26ca8f984d79d3bb7068886c6304b2
TLSH
T160B01298BC91661C840031071080A4401144B33A5581C735013B0DF0015C149A99122E
MD5 SHA1 SHA512 TLSH

Submit Download

agent.exe

Path C:\ProgramData\ContosoRMM\Agent\agent.exe
Size 7.5MB
SHA256 86ac373e6e8848b412bdb990c9f039d1178bddc4506a165cb79be0b92b93ad95
MD5 33cadef630c187b7ecd2996fcb373136
SHA1 0a5c1a8663777200122b118172fafd9c8717d6a8
SHA512 d0f55bc9f342743ccb5a9b1f46b45802d9f4b3c237d82b217b81cce5ed000bda0b22a72eb8ab31fae9e97a6ad53bdad9d7152e7cc2ec2556d1da3c4655f59068
SSDEEP 49152:KEFeQofgeopTY1yH+e7gT0aaObhw5OdQK5qGDcUMnwz5e6176vySq5IV5rzqjsQ4:KEFpeTsNUMwFCu/csDI1Ew3
TLSH
T181864907ECA555E9C1AEE5318A769153BB707C491B3023D72B90F6283F36BD0ADBA314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

e598c48.msi

Path C:\Windows\Installer\e598c48.msi
Size 3.1MB
SHA256 e93862eae8bf5168f68536e2f96824f800832ce97da8d1f5f0fcd63675a34c88
MD5 cdff0005455b48dae8c3676e34567ad2
SHA1 13b793fccfd73806072a272763ba512bb18f2105
SHA512 57d1cdba9b5515d6c2ef95e18c4f0607826563e365ff33d5d425eddde0a95bb89750d77e727c45d425885fc53f7b6d964822eac3d0edb47d334b013560b0eed2
SSDEEP 98304:s06j2gwRph8YEdZxyQOPAFnU8Z61zfTAE1w1:Kj2garEdfyBPApUQCzfV1w
TLSH
T160E533976E8C8323C0C8253493C8117AB3190DB2BF94446575AE77AE387EA3891FD4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hwhkkri3.quf.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_hwhkkri3.quf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 71869facccc04f15e6dee9d37a1485568d56a3c30fbb8c64a3b901c0c5aace78
MD5 7d20349b010ccf53af52f93bbe60bf89
SHA1 9533544d6411ee4a442e416975946c92f2a174d7
SHA512 05ca63d641aef737f0282fe2623f2e3716582d33468d9df4a37ddc44fef148a2b0209d9bf1ab5f3d1b445760679a55aa0e980a65ff8760cb14208ad0fe4eabfd
SSDEEP 24576:6Fo3DMP+doO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVet:NHc
TLSH
T10457D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d4e1f5e2-9021-47cd-a299-de720da849e4}_OnDiskSnapshotProp

Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d4e1f5e2-9021-47cd-a299-de720da849e4}_OnDiskSnapshotProp
Size 6KB
SHA256 8cdd2fb2546559dabb4a64837019517f38d046ce2569ddcf9c54a9c093e65399
MD5 9c29b32dccdb41762c03bc939c6ecccb
SHA1 437024f9ac740e3050879e8b65543c68d56b5589
SHA512 16785b1abf83a86e7b0f27b51d89cbaca4b37dffb11fc7223a9165e440ab45a55e1f311f19de8a9c41ff4a02e4d60cd562a093d3def56a3492a1d171c126f5a8
SSDEEP 96:FuQBMDuDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:w8Mgb++uVmN
TLSH
T1EAD186081AF54711E2B3AB7129F18557A837B911EF33CB8E0198638E6631A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3408-19-0x000001D3A5D90000-0x000001D3A5DAE000-memory.dmp

Download

memory/3408-18-0x000001D3A5C10000-0x000001D3A5C1A000-memory.dmp

Download

memory/3408-17-0x000001D3A5B50000-0x000001D3A5C02000-memory.dmp

Download

memory/3408-16-0x000001D3A5B30000-0x000001D3A5B4E000-memory.dmp

Download

memory/3408-13-0x000001D3A5890000-0x000001D3A58B2000-memory.dmp

Download