3c1aa8627871e0c1d698e0854d482f5f6e7323b6c65e2488efa264fc5436c0d5

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A8B50F1767FFE24416B671820377036B.exe
Size 5.6MB
Sample260907-ed5mtaee93
SHA256 3c1aa8627871e0c1d698e0854d482f5f6e7323b6c65e2488efa264fc5436c0d5
MD5 a8b50f1767ffe24416b671820377036b
SHA1 55d6ac8ea97ccfc0d0bea16bf3c4f6a0609f46b8
SHA512 67822a375e79cf8a06a7dd5105d373473e631488bf2f4d0b13193eb1671cb1e780c17bb68a1e0fe8cc16e1607c424732ec07bd1a3163e173e50c568eb4573d6d
SSDEEP 98304:9hDq6qXCP7yKPNmxecLushvf7UQIYWuxmKeAK12QzwdTgvV/RQebJF:TDq6UE7ovRQzK86e/
TLSH
T1B8567C30764AC52BDA7E01B0292CDA9F556D7E720B7154D7B3DC2E6E1AB48C20732E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4240	WindowsEvent.exe
1196	WindowsEvent.exe

Loads dropped DLL 19 IoCs

pid	Process
3840	MsiExec.exe
4924	MsiExec.exe
4924	MsiExec.exe
4924	MsiExec.exe
4924	MsiExec.exe
4924	MsiExec.exe
4924	MsiExec.exe
4924	MsiExec.exe
3012	MsiExec.exe
3012	MsiExec.exe
3012	MsiExec.exe
3012	MsiExec.exe
3012	MsiExec.exe
4240	WindowsEvent.exe
4240	WindowsEvent.exe
4240	WindowsEvent.exe
4240	WindowsEvent.exe
1196	WindowsEvent.exe
1196	WindowsEvent.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\P:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\R:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\S:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\U:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\V:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\W:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\O:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\M:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\D:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\G:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\Y:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	A8B50F1767FFE24416B671820377036B.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599570.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AA6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_g50kyqs1.dlu.ps1	powershell.exe
File created	C:\Windows\Installer\e599570.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98CD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_inhr0w0w.suz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_u1mdj0rc.q3j.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI98FD.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8F6DB9BA-A7C4-4C73-9E34-60994271DA61}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3D4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0t5p2qqj.tue.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1ff0ykdt.gq4.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI9699.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI991D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF020389E0651B8C9F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hzjz3chh.ujc.psm1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA22B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI995D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98AD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEBBA495DAC684D6B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_yb4fhgwe.si2.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSIA2F7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB223C47FD564B024.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BD1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_abyyqk3c.ip1.ps1	powershell.exe
File created	C:\Windows\SystemTemp\~DF0D5D968F664A612E.TMP	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3336	powershell.exe
2484	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsEvent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A8B50F1767FFE24416B671820377036B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4184	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2764	msiexec.exe
2764	msiexec.exe
3336	powershell.exe
3336	powershell.exe
3336	powershell.exe
3012	MsiExec.exe
3012	MsiExec.exe
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe
4240	WindowsEvent.exe
4240	WindowsEvent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2764	msiexec.exe
Token: SeCreateTokenPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeAssignPrimaryTokenPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeLockMemoryPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeIncreaseQuotaPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeMachineAccountPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeTcbPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSecurityPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeTakeOwnershipPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeLoadDriverPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSystemProfilePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSystemtimePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeProfSingleProcessPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeIncBasePriorityPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreatePagefilePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreatePermanentPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeBackupPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeRestorePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeShutdownPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeDebugPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeAuditPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSystemEnvironmentPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeChangeNotifyPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeRemoteShutdownPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeUndockPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSyncAgentPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeEnableDelegationPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeManageVolumePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeImpersonatePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreateGlobalPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreateTokenPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeAssignPrimaryTokenPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeLockMemoryPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeIncreaseQuotaPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeMachineAccountPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeTcbPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSecurityPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeTakeOwnershipPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeLoadDriverPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSystemProfilePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSystemtimePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeProfSingleProcessPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeIncBasePriorityPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreatePagefilePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreatePermanentPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeBackupPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeRestorePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeShutdownPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeDebugPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeAuditPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSystemEnvironmentPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeChangeNotifyPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeRemoteShutdownPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeUndockPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeSyncAgentPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeEnableDelegationPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeManageVolumePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeImpersonatePrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreateGlobalPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeCreateTokenPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeAssignPrimaryTokenPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeLockMemoryPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeIncreaseQuotaPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe
Token: SeMachineAccountPrivilege	2436	A8B50F1767FFE24416B671820377036B.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2436	A8B50F1767FFE24416B671820377036B.exe
252	msiexec.exe
252	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2764	msiexec.exe
3840	MsiExec.exe
252	msiexec.exe
4924	MsiExec.exe
3012	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3840	2764	msiexec.exe	91
PID 2436 wrote to memory of 252	2436	A8B50F1767FFE24416B671820377036B.exe	92
PID 2764 wrote to memory of 4924	2764	msiexec.exe	93
PID 2764 wrote to memory of 3012	2764	msiexec.exe	94
PID 3012 wrote to memory of 3336	3012	MsiExec.exe	95
PID 3012 wrote to memory of 2484	3012	MsiExec.exe	100
PID 4240 wrote to memory of 3556	4240	WindowsEvent.exe	104
PID 3556 wrote to memory of 4184	3556	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\A8B50F1767FFE24416B671820377036B.exe
"C:\Users\Admin\AppData\Local\Temp\A8B50F1767FFE24416B671820377036B.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\TelegramLangue\TelegramLangue 1.0.0\install\TGVN.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\A8B50F1767FFE24416B671820377036B.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1788512283 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:252

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8619E6982179B5B531EA2178E0A32102 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7AFB604B8777F41BF5CCBFABBA596AE7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 681EDEBF9DB39556132D4B9BD68A5E3A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss9C39.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi9C36.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr9C37.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr9C38.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA40E.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiA40B.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrA40C.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrA40D.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2484

C:\Windows\system32\rundll32.exe
rundll32.exe
1⤵
PID:4832

C:\ProgramData\TranslationsConfig\WindowsEvent.exe
C:\ProgramData\TranslationsConfig\WindowsEvent.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\ProgramData\TranslationsConfig\cleanup.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4184

C:\ProgramData\TranslationsConfig\WindowsEvent.exe
"C:\ProgramData\TranslationsConfig\WindowsEvent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599573.rbs

Path C:\Config.Msi\e599573.rbs
Size 1.0MB
SHA256 4d1010a158b1c216955f5bbabd7c04cbc3846773d8e8d93970678207a0cf7c80
MD5 a884a80f06b6437b05a10581df202f7c
SHA1 65948749a6fdb00fe12e8b4fc374cbd7dee34a0c
SHA512 428d56b48320b0a2b54bb6eedcc4d5c1801d5467f336aa0e17110a0ebf61c293f5be95c317b6659d0e54aff159040e02ddf71462e1170af4ff07b92c76015cd7
SSDEEP 24576:w25snmmtZ725snmmtZBAR/12h2SekeUuyZD6lvs0zqa3o:RuxtZIuxtZeRmTreUuyZD6lvVz9o
TLSH
T118358C207586C03BE6BE0670182D9A6A6A7E7D614F7148DBB3C81E7E4EB05C19B31F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataReport.dll

Path C:\ProgramData\TranslationsConfig\DataReport.dll
Size 188KB
SHA256 0d5d794dfff75ca8e424e4c257b614f83cc047a062f9f1aac7be209b20ab023b
MD5 7d0ec8a1b0b349cc5483971d793cde89
SHA1 41725e87d7e4293579dcdcd41ab0c04f3635f67d
SHA512 e8321af8ab5777c6fbb1b19655524633eaa9a36eb86070394997b3ab601ed13f74e01093d400ab46f28f165a32778cfca2cbc617bc93efc4fd5e405f4b5ec460
SSDEEP 3072:SJn+9mv/+WZyXgqTHK4R1zxzcjj1CDLxux44dnVlviMTEi4wxnJ30Wr/xewdqmY:an+gv/JZqK4lxzMj+Nux4axxEuJ300QH
TLSH
T16A145B01B981C076D76F0970983ADB759E3DBC514FA0A9DB73848DFA4A706C0DB38B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\TranslationsConfig\VCRUNTIME140.dll
Size 72KB
SHA256 8e08575492175e042f093f325b07a5c14ca71e7c581474838db3d48f5aab1312
MD5 4113057339d9e4e376bded9074d20c17
SHA1 372cc8ed3115f8ecbbaaf863d3afc56c0ed407c5
SHA512 4590b3e88f988fda56f4f04f5ac2806a16415caa7601009e81c3fca8be7ef8d2ac5dd2da9ee267e6ac5380cbfe1336816121edefb64b75fb549811ba82525db5
SSDEEP 1536:lLMc6xv5M5Ot/MCsjw0BuRK3jteIcecbAos86PvTzRb:lLM15MQt/zqw+IqaecbAos8uTJ
TLSH
T14E73AE21B0D240BFC1AA8574527AEA03573DAA204BF59FDB6FD86D441F79AC2E730217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsEvent.exe

Path C:\ProgramData\TranslationsConfig\WindowsEvent.exe
Size 94KB
SHA256 a5c1d5331261580c14513f04eeeecc04a5169ac69b3c24e531c9e08926b55981
MD5 3151b934f1f285211af6d4c816881900
SHA1 28f84751829a706b2cd7fd0c80242062a92e3f25
SHA512 d2ec59f76d5b4031557eee140ba05b168822f76687afcc1995a3123312ab7aec51ed32ed3e83310fb214e5e3f6423204e048a8195cb29a90ecca933d501d9b8e
SSDEEP 768:/9uLB6XJydIoqEEV/92xXuYsnlZLck/V0S6P1//zA1XfXvb0xtAhhZU9QZU9JbYM:FuoXg1R7slZP/mSk+XwxohzEb7OxG6E
TLSH
T1FD93E81266028420F7590B706925FAF449AAAE3C5BD0F1CFF278BE3A69712C3597714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup.bat

Path C:\ProgramData\TranslationsConfig\cleanup.bat
Size 184B
SHA256 1f6081e0c01649dbecbd39e4842809ae9535affb126743c4b21c7802230181d8
MD5 ae7bdfa0dfec0efb9a0700efe1dc4f73
SHA1 c11a0ee4ae20d0a0dc4a0b7d54a55e86af384bbe
SHA512 92a5e519b510714967906006902e9ba4a074c202b73764b37833a8b96939565a57fb51bbaba5708de5c0f0c3d90cdc66c5e8392dfc7b1d0b73175b10f90cb709
TLSH
T190C08057412F47D1744302D6975DA8C1B71EC6F136F4142B505D1373D948C59F32B480
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\TranslationsConfig\msvcp140.dll
Size 425KB
SHA256 e4c71980dbb4a1e1a86816687afdaea043b639b531135fc4516fb2429fe623fc
MD5 7e8bdd2c2304e204b44a3bec09d66062
SHA1 6ceae8090735f32f54f45fbaa2cfcd8886cf5a38
SHA512 3af7f3b69899be78ea44591b2c7335a9f5852579d13e69b3dd042321407f15381718ea0861ad6154d335ef90b0fcd6d7667a1b5eb4bf2ff9bc894705309137e5
SSDEEP 12288:eWkQOYOpU2PmQ6hB9NvCKNo+GVD4hUgiW6QR7t5s03Ooc8dHkC2esdSt:eqOYOpU9QgB9NvCwo+e03Ooc8dHkC2eD
TLSH
T179942932BB464DF1E58A13B971CA472193F6FC610361E3C397EAF0292F566C1A673A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7d973bbe0c6be9a03c3f3d75015ab8a4c518042153e61cc813cc9132e0dd52f0
MD5 40fee7702a34966e9a39fb6160ceaf31
SHA1 35b021a4361be123c67bc39fc1b5170efd793a0e
SHA512 a84c734876fbc488f1804b06159413b83092020ba94f202d4688e481aac2f94cbc280ac3eb1ef174d5b9028f9103935e75df9c119a1486d39a0420f5963f9519
TLSH
T122216533B3DD8624C89A413A10CEAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

MSI912B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI912B.tmp
Size 436KB
SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
MD5 475d20c0ea477a35660e3f67ecf0a1df
SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
TLSH
T1C5947C2032AAC437D97E09B0392DDA9F516D7EA54B7240DBA3C82D6E1DB18C25735F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pss9C39.ps1

Path C:\Users\Admin\AppData\Local\Temp\pss9C39.ps1
Size 5KB
SHA256 a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b
MD5 fc1bb6c87fd1f08b534e52546561c53c
SHA1 db402c5c1025cf8d3e79df7b868fd186243aa9d1
SHA512 5495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86
SSDEEP 96:5wb5jTmmywV2BVrIovmkiGjxcj6BngOcvjb:5wbdTif/njVyvb
TLSH
T1B1C1B042B3E62504F5F77B49AA7E04340A1B3A456E3ED50E85EC680D1BF39589829BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr9C37.ps1

Path C:\Users\Admin\AppData\Local\Temp\scr9C37.ps1
Size 506B
SHA256 f6bd6027d2a70df773e7e2d4cd78fb20a7f28c1f2eb11a3722ccb5d9ee975d6f
MD5 9adfa4dc0d416164603155626f53c89c
SHA1 a03ca2aa3253a6f8ced39d2166792a3e08d16877
SHA512 7a9829f86bb204c4fba36f378571bc8c46ddb53df5888da460367bc5e4f7e57e46cebbdbf977daee5ceb837d2732ec2d66b45bf421571d26c15ff6281c7c51fd
TLSH
T146F06D030BD72214B7B36755ABBA44314B233D951A3C884D81DCE4495FF3E0584A0BF3
MD5 SHA1 SHA512 TLSH

Submit Download

scrA40C.ps1

Path C:\Users\Admin\AppData\Local\Temp\scrA40C.ps1
Size 810B
SHA256 851ceaa1d8629771cf74d158b5bba2446c3f44d1b14c2b7336c18f30eee53993
MD5 0ef75535a6f31252a97f8bbe7159fae4
SHA1 713f285db9cdb57f2ed12650a982ba94c203f189
SHA512 ae0b08f5e2fd0515ece75fc34bceaac915d85540241e6b17bf40081cb3aa0acbd054f7d0d5bc56e9955ecb2c9fdac12bc596603a38e57fff55046a2ad2b48c82
TLSH
T1E001D24316E64549B2B36FD816BB117547637C5A2C38E86D01CCB40E4BFBA80C9A0BFB
MD5 SHA1 SHA512 TLSH

Submit Download

TGVN.msi

Path C:\Users\Admin\AppData\Roaming\TelegramLangue\TelegramLangue 1.0.0\install\TGVN.msi
Size 2.3MB
SHA256 d0a10c8e70bc5910e69557c31fdaa58fc296c0cfb3c304b60f9d1dd6cc0c60a9
MD5 fb3763a83f7b04d2e059b329272f4ac8
SHA1 20ae4c451cd3070a9375ade84a5a22a7f6eae568
SHA512 32c41ccc31fc76ea6fd48fcf69ea83cab390f691a547d5e28788b1debc57728d842d33b238fbce57d0def92505f89f716bc9413a8330d7217628b3b6e26e6a53
SSDEEP 49152:c6lYWuxtZUZKumZriAQ512QzwcZDrFLpRmTreUuyZD6lvVz9:pYWuxmKeAK12QzwdTgvV
TLSH
T144B58C20328AC43BD9BE0170292DDA6E5579BEA20B7144DBB3C82E3E59F05C25B35F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TGVN1.cab

Path C:\Users\Admin\AppData\Roaming\TelegramLangue\TelegramLangue 1.0.0\install\TGVN1.cab
Size 487KB
SHA256 694c5b317155286785e46ed6d4ce525eccda9f0392c1b1de6288fce7dfa14acc
MD5 03a0409442639ada357008f43b1b857c
SHA1 0c29967c48ef571383b42dce2efca747d4527da6
SHA512 acbc2eee5c8cebf2128a104fef66a23558c41534816574c3918521e824346a3b7828a61ac5225aad3617e7ffc4fa117be1a0bc42a1fba542064e0dc39d978da8
SSDEEP 12288:PudmvJbbPEDoUBARDBDMxM+SzIeh5ofc9gCGp:PuMxbPEch1lIeh5ofc9wp
TLSH
T188B4236C70BD36780427CA6935B0B236AF3AE0811C7D526E6D649B2C0E54F43DD6E87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI995D.tmp

Path C:\Windows\Installer\MSI995D.tmp
Size 597KB
SHA256 2e15823e8384eb7a15cb5daae61ebb031f3928bc511e74115d950afa98ef9572
MD5 999c6b224a8215a8ffe9792c82d93754
SHA1 9aa98fd47aa4472a9d44c1d41233d9c767deee4c
SHA512 7438d35e7263b8b9918c163beafeb18bc35cab7b8577487e24089517016b85e8e13817f13caee011bb1e4ed35af28d3a91e99950c24a2566c0b6453092fa1347
SSDEEP 12288:qh5s6tgHTD9IFxOB5GfOnDDlkz1n77JEQzwM7ASAA4QZK6rFN:i5s66EGlA1n2QzwsAArZDrFN
TLSH
T17FD45B70255AC437E4BD45B02A6CCA6E557D7FB20B7A44C7A3C86E3A19F08C24771E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9AC6.tmp

Path C:\Windows\Installer\MSI9AC6.tmp
Size 187KB
SHA256 775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93
MD5 f11e8ec00dfd2d1344d8a222e65fea09
SHA1 235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20
SHA512 6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3
SSDEEP 3072:TM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiF:TBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mh0
TLSH
T144145B117989C43BDA6F2A30193DDBAB672C7A608F7148DBF3895E394E341C15A34E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9BD1.tmp

Path C:\Windows\Installer\MSI9BD1.tmp
Size 574KB
SHA256 df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897
MD5 7b7d9e2c9b8236e7155f2f97254cb40e
SHA1 99621fc9d14511428d62d91c31865fb2c4625663
SHA512 fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228
SSDEEP 12288:LBX/lKyuDvn4SsWPbV5BPsahK7RcekeUuyZD6WGvzQ5VEPL2Ra3D:x12h2SekeUuyZD6lvs0zqa3
TLSH
T19CC48D20368AC07BE5BE0270146CAA6E557E7D710F7508DBA3D82A3E1AF45D29732F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA3D3.tmp

Path C:\Windows\Installer\MSIA3D3.tmp
Size 102KB
SHA256 80220b96b370df9020484a2c1d47a8350c246e4d913f170e938ab82dddf61d3d
MD5 e423c45f5a9c20f3fe168e0c00f6d19c
SHA1 8eba465f36edffce2bee6751322c623b3c511594
SHA512 6303a7e75c1d9247765aa2063cb0c34d8fcaf6de538ac6aff60537c335f96eb6f9dcd7aebea21ee48fbb7f7138a0c7a2efbcf9a25699e162fc0c86bda30c5df8
SSDEEP 3072:JYdxaGCMiiKdqLo2Umsp395QWnthHkfQqhwV1u39p:3BMXvo2NszWm7Q629
TLSH
T19DA32A51F892D032D6AE4C388525CA65DF3EAC91DFE0ACD73B840DEA4D306D09F39A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_inhr0w0w.suz.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_inhr0w0w.suz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2484-101-0x000002DC1FB60000-0x000002DC1FB7E000-memory.dmp

Download

memory/2764-122-0x000001FB8E0C0000-0x000001FB8EA64000-memory.dmp

Download

memory/3336-63-0x0000014A73910000-0x0000014A7391A000-memory.dmp

Download

memory/3336-61-0x0000014A738E0000-0x0000014A738FE000-memory.dmp

Download

memory/3336-62-0x0000014A73BA0000-0x0000014A73C52000-memory.dmp

Download

memory/3336-56-0x0000014A5B6D0000-0x0000014A5B6F2000-memory.dmp

Download