d6ce7a23f073880398edabc2f69e9cce4310505a710af420da16e8c6edb5e393

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6ce7a23f073880398edabc2f69e9cce4310505a710af420da16e8c6edb5e393.msi
Size 5.8MB
Sample260909-jbsyfstyaz
SHA256 d6ce7a23f073880398edabc2f69e9cce4310505a710af420da16e8c6edb5e393
MD5 36483f52ccd71b4e84da0d249efacd6a
SHA1 5c4c81c5b0ae8e31a98d1f3cec7eb9e6d1fd2bf2
SHA512 22b192e2b16f82c7ab5a85bd51ecee279bc60eb3b8a502e0c5faa49299b94e73d660139a167dced2322779a190561ab2cb00b68c5f8d80a1792c786cc3eb9db5
SSDEEP 98304:k7dWfWXSWAyVz+HdXVrnU1bm8HjICm9mVeUWsZIPwNi3KrGj0ivvqxJqLyAT4suW:udeWNVUdXC1ywjzmwRtZ3AyxIr
TLSH
T19656332DB8930F7AE63133341C0DDE5D466ADD6A07026809F8E5B6C59F3D13136E92E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\QmkkXRJBTfWz.exe,"	QmkkXRJBTfWz.exe

Executes dropped EXE 7 IoCs

pid	Process
4200	qYUeyTkcgNKxdVH.exe
2016	qYUeyTkcgNKxdVH.exe
4176	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
1776	BatchTarget.exe
1520	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5304 set thread context of 2276	5304	QmkkXRJBTfWz.exe	108
PID 5304 set thread context of 3056	5304	QmkkXRJBTfWz.exe	109

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FindCommandDevOps\vfZ4ImoFQy1gI.data	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\LqgYtkkX0EcXoyO.data	QmkkXRJBTfWz.exe
File opened for modification	C:\Program Files (x86)\FindCommandDevOps\launcher_config.json	qYUeyTkcgNKxdVH.exe
File created	C:\Program Files (x86)\FindCommandDevOps\VtKigfyMUorydPQ	MsiExec.exe
File opened for modification	C:\Program Files (x86)\test$$$.txt.me	qYUeyTkcgNKxdVH.exe
File created	C:\Program Files (x86)\test$$$.txt.me	qYUeyTkcgNKxdVH.exe
File created	C:\Program Files (x86)\SWindowsTemp\26a70390-b643-4439-bbce-de3457f3ab24.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\72bf69c4-3a0b-471f-a6d4-44b6cffe0afb_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\8b78ee15-4ff3-48b0-90eb-7c7e34b5f66d_.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\72171a1a-32f7-4aaa-8d21-5b4d3af8dd5b.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\VtKigfyMUorydPQ_part1	msiexec.exe
File opened for modification	C:\Program Files (x86)\FindCommandDevOps\2_QmkkXRJBTfWz.exe	qYUeyTkcgNKxdVH.exe
File created	C:\Program Files (x86)\SWindowsTemp\d4608b62-e683-4afa-8e16-0c3689cb4c32_.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\abf2693f-5124-46d8-8ba0-3f674183b1d2.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\e77a641b-fa8c-40f6-977e-9c336ff9e914.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\d1d83d38-2b3d-4cba-afb3-580ac02dcf2e.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\6f2087b4-1ada-4ce2-9ab0-a695a9818385.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\SWindowsTemp\88a6374b-5c2f-4517-80b1-f8a5d81cfa24.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\9aaf9631-aefb-4637-a132-3a71a546cb39.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\9d8f8715-22de-4205-a8b6-a9521847c4b1.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\c56c9efa-b3b1-432f-ae25-80d29603b695.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\8f75f6ec-22d2-468c-98d5-a792ff94e00c_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\b90a0994-e993-41f0-8ec1-75aee035259b_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\a46857df-4c6a-4e3b-8515-65d9a57f085d.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\751a724f-f541-448d-8687-b7d7233d7d20.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\QmkkXRJBTfWz.exe	MsiExec.exe
File created	C:\Program Files (x86)\SWindowsTemp\6ee24fff-ec90-4804-901d-4ab0b0cb6d37.log	QmkkXRJBTfWz.exe
File opened for modification	C:\Program Files (x86)\output.txt	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\klVSo48wnVDziJ1pPRq_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\45b3558e-722e-4a22-94d2-da8f81241139_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\1fba218f-2024-4780-bcfa-fd8fe476571c.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\ffcb15e9-b30c-4bd0-9d94-40d9202eb070.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\40597792-e3b3-47c1-a732-6c75b785a67f.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\985c7899-758c-493f-aa1c-fd593968bbb5.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\fa12c755-956a-4136-b3f7-c361c3d01bad.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\e9zDx1GttoEwp5AbOdH1Cl7J3FU_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\tDLcKVZtZlaHfMTJM_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\pAJnUJUPakKKEOzLOn0Tm8gtz.data	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\81a58443-292d-4de3-b7d1-76c82c46936e_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\669def92-9c37-4c8a-97f9-0147ab22d1ab_.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\c9321a42-ebed-4306-aad0-827d90ab9344.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\4417bda1-2401-4ea3-bad1-d88c82372233.tmp	QmkkXRJBTfWz.exe
File opened for modification	C:\Program Files (x86)\FindCommandDevOps\SodaMusicLauncher.exe	qYUeyTkcgNKxdVH.exe
File opened for modification	C:\Program Files (x86)\FindCommandDevOps\imnGWLvc.sys	qYUeyTkcgNKxdVH.exe
File created	C:\Program Files (x86)\SWindowsTemp\BatchTarget.exe	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\8f93383c-b8a4-4001-ae8e-93955872ea53.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\934bd5cd-d9b3-421e-a6c1-89f583a31a8b.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\74578a24-ff35-49a9-a5da-19af96c76548.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\8fecc853-582e-4f7b-aa7e-f91898823b08.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\xqiX7NDTdXkVG.Log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\db4f9ce5-101b-4e8b-8e20-ca1f53d35e35.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\f627aaf4-812f-4ac2-83bb-0e2c822cc8cc.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\c387df03-2bfe-4442-a2b5-9fed7275fa50.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\yZmdN4WeENzMPOpZ3uI_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\MLP4oSj8bRNLfGys_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\UbSR3YHVcPgQVZG2D8PJxXlg.Log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\ficJIcgZkP.data	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\e8c0a4e3-a102-40ac-9d67-ab1ab2fca816_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\6a16f36b-4df3-442b-98fd-b69b420d0472_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\FindCommandDevOps\qYUeyTkcgNKxdVH.exe	msiexec.exe
File created	C:\Program Files (x86)\SWindowsTemp\d6052a61-edfe-4c31-ab46-d21e9f9ce793_.tmp	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\bbcb81f6-1758-4339-bbad-04da8e2265f2.log	QmkkXRJBTfWz.exe
File created	C:\Program Files (x86)\SWindowsTemp\969e8960-0737-4f02-87fc-b32a4965c878_.tmp	QmkkXRJBTfWz.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFC4C305E33D927109.TMP	msiexec.exe
File created	C:\Windows\QmkkXRJBTfWz.exe	MsiExec.exe
File created	C:\Windows\SodaMusicLauncher.exe	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIE7C6.tmp	msiexec.exe
File created	C:\Windows\imnGWLvc.sys	MsiExec.exe
File created	C:\Windows\vcruntime140.dll	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF238FEC431C61610C.TMP	msiexec.exe
File created	C:\Windows\launcher_config.json	MsiExec.exe
File created	C:\Windows\Installer\e59e257.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e257.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA125BE94EF2AA2D3.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DAED0B99-75D0-452D-9D79-D0B6261D64B6}	msiexec.exe
File created	C:\Windows\Installer\e59e259.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDD606DCB86B989C3.TMP	msiexec.exe
File created	C:\Windows\SodaMusic.exe	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3424	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QmkkXRJBTfWz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QmkkXRJBTfWz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BatchTarget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QmkkXRJBTfWz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QmkkXRJBTfWz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\VBScriptSetScriptStateStarted = "240780125"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99B0DEAD0D57D254D9970D6B62D1466B\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\ProductName = "FindCommandDevOps"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\06C5836E650BBF44081648A0E54145D7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\06C5836E650BBF44081648A0E54145D7\99B0DEAD0D57D254D9970D6B62D1466B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\PackageCode = "287AC2109A173FD4C9FEC3874091F8DA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\Version = "67567621"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList\PackageName = "d6ce7a23f073880398edabc2f69e9cce4310505a710af420da16e8c6edb5e393.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99B0DEAD0D57D254D9970D6B62D1466B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99B0DEAD0D57D254D9970D6B62D1466B\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3660	msiexec.exe
3660	msiexec.exe
4176	QmkkXRJBTfWz.exe
4176	QmkkXRJBTfWz.exe
4176	QmkkXRJBTfWz.exe
4176	QmkkXRJBTfWz.exe
4176	QmkkXRJBTfWz.exe
4176	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
5304	QmkkXRJBTfWz.exe
1776	BatchTarget.exe
1776	BatchTarget.exe
1776	BatchTarget.exe
1776	BatchTarget.exe
1776	BatchTarget.exe
1776	BatchTarget.exe
1520	QmkkXRJBTfWz.exe
1520	QmkkXRJBTfWz.exe
1520	QmkkXRJBTfWz.exe
1520	QmkkXRJBTfWz.exe
1520	QmkkXRJBTfWz.exe
1520	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe
4668	QmkkXRJBTfWz.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3424	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3424	msiexec.exe
Token: SeSecurityPrivilege	3660	msiexec.exe
Token: SeCreateTokenPrivilege	3424	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3424	msiexec.exe
Token: SeLockMemoryPrivilege	3424	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3424	msiexec.exe
Token: SeMachineAccountPrivilege	3424	msiexec.exe
Token: SeTcbPrivilege	3424	msiexec.exe
Token: SeSecurityPrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeLoadDriverPrivilege	3424	msiexec.exe
Token: SeSystemProfilePrivilege	3424	msiexec.exe
Token: SeSystemtimePrivilege	3424	msiexec.exe
Token: SeProfSingleProcessPrivilege	3424	msiexec.exe
Token: SeIncBasePriorityPrivilege	3424	msiexec.exe
Token: SeCreatePagefilePrivilege	3424	msiexec.exe
Token: SeCreatePermanentPrivilege	3424	msiexec.exe
Token: SeBackupPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeShutdownPrivilege	3424	msiexec.exe
Token: SeDebugPrivilege	3424	msiexec.exe
Token: SeAuditPrivilege	3424	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3424	msiexec.exe
Token: SeChangeNotifyPrivilege	3424	msiexec.exe
Token: SeRemoteShutdownPrivilege	3424	msiexec.exe
Token: SeUndockPrivilege	3424	msiexec.exe
Token: SeSyncAgentPrivilege	3424	msiexec.exe
Token: SeEnableDelegationPrivilege	3424	msiexec.exe
Token: SeManageVolumePrivilege	3424	msiexec.exe
Token: SeImpersonatePrivilege	3424	msiexec.exe
Token: SeCreateGlobalPrivilege	3424	msiexec.exe
Token: SeBackupPrivilege	3236	vssvc.exe
Token: SeRestorePrivilege	3236	vssvc.exe
Token: SeAuditPrivilege	3236	vssvc.exe
Token: SeBackupPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe
Token: SeTakeOwnershipPrivilege	3660	msiexec.exe
Token: SeRestorePrivilege	3660	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3424	msiexec.exe
3424	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3424	msiexec.exe
3660	msiexec.exe
5716	MsiExec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3928	3660	msiexec.exe	94
PID 3660 wrote to memory of 5716	3660	msiexec.exe	96
PID 5716 wrote to memory of 4200	5716	MsiExec.exe	99
PID 5716 wrote to memory of 2016	5716	MsiExec.exe	101
PID 5716 wrote to memory of 4176	5716	MsiExec.exe	103
PID 5304 wrote to memory of 1776	5304	QmkkXRJBTfWz.exe	105
PID 1776 wrote to memory of 1520	1776	BatchTarget.exe	106
PID 5304 wrote to memory of 2276	5304	QmkkXRJBTfWz.exe	108
PID 5304 wrote to memory of 2276	5304	QmkkXRJBTfWz.exe	108
PID 5304 wrote to memory of 3056	5304	QmkkXRJBTfWz.exe	109
PID 5304 wrote to memory of 3056	5304	QmkkXRJBTfWz.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d6ce7a23f073880398edabc2f69e9cce4310505a710af420da16e8c6edb5e393.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3928
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 20825B199D93DB47AF715A8D88DA82AA E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Program Files (x86)\FindCommandDevOps\qYUeyTkcgNKxdVH.exe
    "C:\Program Files (x86)\FindCommandDevOps\qYUeyTkcgNKxdVH.exe" x "C:\Program Files (x86)\FindCommandDevOps\VtKigfyMUorydPQ." -force -to "C:\Program Files (x86)\FindCommandDevOps"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4200
- - C:\Program Files (x86)\FindCommandDevOps\qYUeyTkcgNKxdVH.exe
    "C:\Program Files (x86)\FindCommandDevOps\qYUeyTkcgNKxdVH.exe" x "C:\Program Files (x86)\FindCommandDevOps\ImQgGqrTOvomaoU." -not "1_QmkkXRJBTfWz.exe" -not "1_" -not "1_//__SERVERFILENAME2__" -not "asd" -not "sdf" -not "ghj" -not "1_iLVwMhSKnIhm.xml" -not "1_.xml" -not "1_//__XMLFILENAME3__" -not "StartSearch.exe" -force -to "C:\Program Files (x86)\FindCommandDevOps"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2016
- - C:\Windows\QmkkXRJBTfWz.exe
    "C:\Windows\QmkkXRJBTfWz.exe" -FindCommandDevOps 173
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\QmkkXRJBTfWz.exe
"C:\Windows\QmkkXRJBTfWz.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Program Files (x86)\SWindowsTemp\BatchTarget.exe
  "C:\Program Files (x86)\SWindowsTemp\BatchTarget.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\QmkkXRJBTfWz.exe
    C:\Windows\QmkkXRJBTfWz.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1520
- C:\Windows\SysWOW64\svchost.exe
  -k netsvcs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2276
- C:\Windows\SysWOW64\svchost.exe
  -k netsvcs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056

C:\Program Files (x86)\FindCommandDevOps\QmkkXRJBTfWz.exe
"C:\Program Files (x86)\FindCommandDevOps\QmkkXRJBTfWz.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e258.rbs

Path C:\Config.Msi\e59e258.rbs
Size 8KB
SHA256 b5083867ef8536b701d2a9f27cc1ca7f8210b85335b3ba9d327f0acbdb796a62
MD5 9b35ccff4e1a635f9bc77575ba453a6a
SHA1 4263a344f389661ae403848228bafcb8dd6a010b
SHA512 cedb5a5cfffd3cbf1bda62493ecdacd2365db8b9be48aad874ec13e416610a1c1213b3c06bd85a4bea5b343d78466cd4b12ca152e052dae90c67a6183eb41e73
SSDEEP 96:0mzg4rY1CT/7oUXqrwnCsTlVUXqrwnC6jae2SoTl+gi5jKg7W4hOkcCUcpljayWG:R21C/HarwCIsarwCrwDNUcpP
TLSH
T1120242017743D1D3F8961739C74B1B1637B2D3D9BB02230F29CEA9646F527DA0EA428A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_QmkkXRJBTfWz.exe

Path C:\Program Files (x86)\FindCommandDevOps\2_QmkkXRJBTfWz.exe
Size 2.3MB
SHA256 69dabd09eb9a2bb35d6ca2882801a6a973b0d497e6687c2230027fc91fbcf05d
MD5 147dba7d2733ed81b9cc0d0cf94e703c
SHA1 81a33764f7230a5a41f23770178036483ab0602b
SHA512 590c7b9cfd3d6310838245c4db2dc1fbb8121d91d4b99d1cedb4604336d66bc68dc36f6f52ed04dde1adff23b5dfab7c42c0b144130cc8d0bb0dde84ee1e41fd
SSDEEP 49152:9uNiqdCJphYK1rvDiOFnYU3oP8ndqJ08U3dD4:QNiqevm+YLek0DdD4
TLSH
T16BB59E55FDEB28B1EA12163208B652AF2331ED190F31AFC7D940777ABC7B5E00932665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImQgGqrTOvomaoU

Path C:\Program Files (x86)\FindCommandDevOps\ImQgGqrTOvomaoU
Size 4.3MB
SHA256 d0c77d19360e12bca34b52ad1bea2d90e34153f1f831c5109abe2d49ba4b9cbd
MD5 67e298849a53203a733416124f7e8e5a
SHA1 cb6d126ae8e891a92067f96197c768fc4643a43f
SHA512 fe979fe762521b097f1ac623a5e9e9a70c4e80fef749271fe13be50f60440d36f6d310494af8fd5217c23b3ea6225a826e7f0f5f7fe3bbd6a181dafd9ac8ebe8
SSDEEP 98304:5TCKyw1h/Q43Gd9xmhfqju9ejnxLOr0GX2bWEJLANS2sdW:5mm/Je/sLKnchQWeDk
TLSH
T1E12633717C431DF958234966A74A1A7994AD08630B260CDB6BF0A3CD36DF385AF9B30D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SodaMusicLauncher.exe

Path C:\Program Files (x86)\FindCommandDevOps\SodaMusicLauncher.exe
Size 1.1MB
SHA256 ad4a507da02c3b171ed3afbea034dd7fa29898f8bb76de25b31426cc3e6ef22f
MD5 357ae9220222ef354eadfc23e0e53643
SHA1 c18c17ed4bfeb5b0447512663569c67b3c92cc1b
SHA512 14336f33bbb42cc5fd1e8c7fa0483edeac01f474ea034cdcf2345e61b2526929daeeb248a6f1824ee111d2101c8647720e8b79ce6f3628151e05315ee6d949c2
SSDEEP 24576:08KBY/yq+CjKOGUnEr+Qu/L1caFyf/ywWJul1ZSkUMgCCg/n:75+oKOhnEr+Qu/L1jy4Jul1ZEWCg/n
TLSH
T1E545AE02F151D0B6C8536271645DE33C7A299E0A4F624DC7C7E4FDF86AB05C21E36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VtKigfyMUorydPQ

Path C:\Program Files (x86)\FindCommandDevOps\VtKigfyMUorydPQ
Size 4.3MB
SHA256 078c3519ac473bc5fc77b2c06f584722e965b2b23156713fae3b4fe32aa11d83
MD5 5464e6afc870bb8c2b354e3c985639cb
SHA1 89c9d8910ae189e926d3463b65e8f3dfd36dc6f6
SHA512 a4cef2136c9659ae75df0b4fa212f161665591359c5df36a7b56c6473bc051d2ffb3523ac0ad9a2140038f45c3af9c3bddcd6c5e213490ab979e1300ea76fb1c
SSDEEP 98304:/WCl33mNvQz36I9+fsOB+D9GQrev7rPly2DV5kLnAD2szR:/fOv6/8RAVrkE4VSCN
TLSH
T1AC26337178431DF958234976A74A1A7994AD08630B260CDB6BF0A3CD36DF385AF9B30D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VtKigfyMUorydPQ_part1

Path C:\Program Files (x86)\FindCommandDevOps\VtKigfyMUorydPQ_part1
Size 1.2MB
SHA256 65d8dcacc67f934772e8842840b10bfe7abdc601de9efa6e5d00dce1f47ffe63
MD5 c0f715656a76b321e1d9ebc1f4e8cf47
SHA1 15509d641b70cca5d8b7e1a61b7843e3d9a821eb
SHA512 13879f4731e19ae8b1684c4096c74264aa2179672b5a6de260e9689cb92ef8a4292294fae58f56a1f85159f3e7af23940c42c4e29e97cb401847e0edcca5567f
SSDEEP 24576:OitonClf6A53dv6xUbS78mUvIrAPCJ5Q2UD0gp5xd8T8t9gI:OitWClfJtv3K8mNvQ2Uf3JgI
TLSH
T18C4523B1BA823DFC016342A353566D14F5F502B3273B49E35EB0C69C22DB3A1EE5671A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VtKigfyMUorydPQ_part2

Path C:\Program Files (x86)\FindCommandDevOps\VtKigfyMUorydPQ_part2
Size 3.1MB
SHA256 bf9654e2a9daaec45b90ba6a3755e13849e48fd9f45b1f46a9c01bd3aa0f4764
MD5 9af9551da36526dffd939bee06abc3ff
SHA1 ce3de252b0b88b9b044d7c0ba310bc24a72b3c1a
SHA512 4e9ef83d43dfa85ecf74707e84dc5ee0af195265a439911ce62c26e0bd1e21156cce242145a765d5a0ae97e91653a71ca92eb49d70c4b5754a0d30df57cadd3d
SSDEEP 98304:j9+fsOB+D9GQrev7rPly2DV5kLnAD2szR:j8RAVrkE4VSCN
TLSH
T11FE5337138030DD5AD634C39B68A12BA445EAC530F652CDD67F2B3CA69CF3856B9B20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imnGWLvc.sys

Path C:\Program Files (x86)\FindCommandDevOps\imnGWLvc.sys
Size 486KB
SHA256 efaa1c0f401e2b3e5383fc82ebe94f1d8e0eced6c3be5b731f2baa429d3f2e23
MD5 4c51c72522685c708b923d0f71e883cb
SHA1 d2b21a58ed206f24c5ba4ad3d81476d6ca9de7ab
SHA512 4e88cf84be139b9ab810e319225e89726ed061c6a4ba5ad9eacbcdeb9ab601334b6246979df4b78e4904a65f6c5fb2a9cc56f1dd4cbe2770ba5fe18abb624448
SSDEEP 12288:mUhwflBMdKKA0kgP0mAptYBinTT0uNjaezi7gDruU1eQLu32XE:sTMdKKcm74nX0Vez1rxDUT
TLSH
T1EBB423541E7627C6EE37E3723912DFC001918DAB9F4D0834BDE5C8927607E2DA68F25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_config.json

Path C:\Program Files (x86)\FindCommandDevOps\launcher_config.json
Size 49B
SHA256 1e88788d09f1741d384b4383a4976f533cc99b755ee9686ecc4549982f337fbe
MD5 823fe18b232a287a1addf53c78c7cf70
SHA1 63d7544e4b3f0a3b566d6fe9b3b5f3d423e80b4a
SHA512 00bcc3af4d4fe71a0cbf6b3cf33180e63fc535a13525acabfd53ef14704ff911df4658e49a9d658153d45a3c46dea02421e3e87d0d30ce74423ef86f1a481862
MD5 SHA1 SHA512

Submit Download

qYUeyTkcgNKxdVH.exe

Path C:\Program Files (x86)\FindCommandDevOps\qYUeyTkcgNKxdVH.exe
Size 3.4MB
SHA256 e66fbe993731adcc2cd7e8e5579af4ee8c19c39270fc6ea66a6d82a3526ec09b
MD5 be5a0a165b9dc3c0b059fd3943bab01c
SHA1 b223ccd7551beb4b0d7f8443ce3285ae602a0fc6
SHA512 21a708f2b28e257a1dded785a74695ca40d126deff4bc8e2e2b116f9e083485cd8ac8360e31cf579f7e877630802014db71976bde58832b4a35385d228f89bbe
SSDEEP 49152:PiQEbU/AQR+ANwOX9hlEgf0xiKOwk7utdWaowbbUZFxMmFXZ1k:pXDGiKOwjW1wv9mFXZ
TLSH
T109F53A27D162519CC07BD1B896EFE23264227C4D827475FE6689EB326F10F60872AF1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\FindCommandDevOps\vcruntime140.dll
Size 73KB
SHA256 c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
MD5 cefcd5d1f068c4265c3976a4621543d4
SHA1 4d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA512 d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
SSDEEP 1536:52HuqvERNjBwySXtVaSvrgOFw9RxKMniecbCera4:52HZMRNjKySdLcOiHiecbCerD
TLSH
T1F4739E0278D0C272D1AD4AB9057AF612663DAA204FD15FDB7FD858C8AB75AC1EF31213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7c25c0b-53e1-4dd8-b603-e77b9f7dfba3.tmp

Path C:\Program Files (x86)\SWindowsTemp\b7c25c0b-53e1-4dd8-b603-e77b9f7dfba3.tmp
Size 1B
SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

Submit Download

test$$$.txt.me

Path C:\Program Files (x86)\test$$$.txt.me
Size 24B
SHA256 835dfeda58ea10a92266f1a560bab977c54fd7ff17a78358aa593d8de56782ff
MD5 f2ba9a018ece2b5c2116cd820dc6df48
SHA1 5ce60c27da1c9deed52ab524143f7220ccd93d8b
SHA512 ae06da9320cf26d5fb74ba70f1bc2dbc286a2fd7b281ded12ff812f56e7b718a9767cc086a6ffbe77a6b86fc5fa522016a972ecec70a74edb7e6459b06125928
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\WindowsTemp\p
Size 59B
SHA256 8ba78c1a611739ee593c53f9176742b4abc8b53cab9ad3692cc9ea8bc5665996
MD5 ab3887d2b1c9ada4aa54202b16576b07
SHA1 41cf8b79ec93747ccc449b86731162ecbd7e8294
SHA512 8ad102604e489f708a574f6fdd9e91e0340c3553e090b32a802411cf85aa5863c962352139ac5928392252e7c9ab14e6d5a5d5ba43c2fb3cafa1fb10f6841289
TLSH
T15CA0029154BDDD4D82581C5A5206CF404A91E6806545940159A12C91B4618F74DA1DC4
MD5 SHA1 SHA512 TLSH

Submit Download

e59e257.msi

Path C:\Windows\Installer\e59e257.msi
Size 5.8MB
SHA256 d6ce7a23f073880398edabc2f69e9cce4310505a710af420da16e8c6edb5e393
MD5 36483f52ccd71b4e84da0d249efacd6a
SHA1 5c4c81c5b0ae8e31a98d1f3cec7eb9e6d1fd2bf2
SHA512 22b192e2b16f82c7ab5a85bd51ecee279bc60eb3b8a502e0c5faa49299b94e73d660139a167dced2322779a190561ab2cb00b68c5f8d80a1792c786cc3eb9db5
SSDEEP 98304:k7dWfWXSWAyVz+HdXVrnU1bm8HjICm9mVeUWsZIPwNi3KrGj0ivvqxJqLyAT4suW:udeWNVUdXC1ywjzmwRtZ3AyxIr
TLSH
T19656332DB8930F7AE63133341C0DDE5D466ADD6A07026809F8E5B6C59F3D13136E92E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d1fd946d64e25534bdeaebbae5d8bee08df9fad79dc77d2cc7895036a0bc19c2
MD5 49af151412ec55adc9f0bbbba61a3ecd
SHA1 50bc671af5be6ddec3a3e2e8ee7167fb6c30b58f
SHA512 13f6c74bba91a5684cb5fba1a240084b39d3397c4a672b2ae6be5235e4400211fdf971e024822b3f3878ff2509b4df134692d117840e02a4c3ad7eec4c02fb65
SSDEEP 24576:ZFo3DMPedoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfURed:qHw
TLSH
T16357162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{08579679-c80f-4378-95e0-11bcc0d20527}_OnDiskSnapshotProp

Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{08579679-c80f-4378-95e0-11bcc0d20527}_OnDiskSnapshotProp
Size 6KB
SHA256 aaa2bc13544c40f5a17e1bd0d5550fc4844395ca2e7556f8ef99b9f6333f5831
MD5 c495bfec2691e39d34034f1d4bfdf5f5
SHA1 486facb2661f3a1376d0ae7c14734970e91ebfb8
SHA512 eb1b06a20e523bfd154919674dd619cf8638922174aa62560a5e12184b81a930f8943fa35dcfba209b5e57a50dbb8426682e2d97661cec7201a2bb2cde631531
SSDEEP 96:F6p8hBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:MpIb++uVmN
TLSH
T1D9D19A181AF54711E2B3AB3228F54557A837B911EF33CB8E0198638E2670910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-234-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-238-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-239-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-237-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-240-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-233-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-241-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-236-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-242-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-243-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-244-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-232-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1520-235-0x000000002A540000-0x000000002A605000-memory.dmp

Download

memory/1776-208-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-224-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-213-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-214-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-212-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-211-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-210-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-209-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-207-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-206-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-205-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-204-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-203-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/1776-198-0x000000002A7C0000-0x000000002A885000-memory.dmp

Download

memory/2016-38-0x00007FF705CE0000-0x00007FF70604C000-memory.dmp

Download

memory/4176-61-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-67-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-56-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-58-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-59-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-57-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-63-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-65-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-68-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-60-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-66-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-54-0x000000002A740000-0x000000002A7BC000-memory.dmp

Download

memory/4176-62-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4176-64-0x000000002A9C0000-0x000000002AA85000-memory.dmp

Download

memory/4200-23-0x00007FF705CE0000-0x00007FF70604C000-memory.dmp

Download

memory/4668-252-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-255-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-257-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-259-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-258-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-256-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-254-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/4668-253-0x000000002A3C0000-0x000000002A485000-memory.dmp

Download

memory/5304-153-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-146-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-145-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-144-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-147-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-148-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-149-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-150-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-151-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-152-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-156-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-154-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download

memory/5304-155-0x0000000029E40000-0x0000000029F05000-memory.dmp

Download