26374a9d227f0a6fd9f72c982bb7939ecb8f18d5311d81fb4f3b64ba17eb732b

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chunk-0.msi
Size 3.1MB
Sample261014-g4vxeaxt8l
SHA256 26374a9d227f0a6fd9f72c982bb7939ecb8f18d5311d81fb4f3b64ba17eb732b
MD5 82ccebfd1fcf4542597c9a83e37798d3
SHA1 06b9e90e078657b483d4c52b1d2a52b9a778093e
SHA512 691e00a3d685e90d603179faea7e879072b10eeb5e24b106b58d65cff099604e7abe242cbb87d7111da514e6cf3942169eb291cb65515cd893535e1090b0fc18
SSDEEP 49152:PRR/DPfeIwlimwVjPswS/nu7hp5mfc8we/GQp2lwyD8exGJXnUIT:XLPfe1Ubp1F+k8kQ+wyg0G2C
TLSH
T153E52321F294183EEABE067B892B96719F3BBC140720C57F4358751DAF767802736B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5220	msiexec.exe
4	5220	msiexec.exe
14	2192	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
3104	HPAssessAndRespond.exe
2392	HPAssessAndRespond.exe

Loads dropped DLL 14 IoCs

pid	Process
1312	MsiExec.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
8	MsiExec.exe
2220	MsiExec.exe
1312	MsiExec.exe
5524	rundll32.exe
5524	rundll32.exe
5524	rundll32.exe
1312	MsiExec.exe
5048	rundll32.exe
5048	rundll32.exe
5048	rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\hpqlog\HPAssessAndRespond.Agent.log	HPAssessAndRespond.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\HP\HP Assess and Respond\HPAssessAndRespond.exe	msiexec.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59a1a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6C5.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{50BFBFFB-DF2C-4EF2-A281-ED9F87D5EEC8}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEF6.tmp-0\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBEF6.tmp-0\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA6C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD30.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF420785FF9BF10E5E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6052E041BE88399B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEA7.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{50BFBFFB-DF2C-4EF2-A281-ED9F87D5EEC8}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIBD30.tmp-0\ServiceActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF2CC5A296212DA295.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a1a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6C5.tmp-0\ServiceActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA6C5.tmp-0\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA6C5.tmp-0\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{50BFBFFB-DF2C-4EF2-A281-ED9F87D5EEC8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE87.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC7FF52E955BF4275.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e59a1a7.msi	msiexec.exe
File created	C:\Windows\Installer\{50BFBFFB-DF2C-4EF2-A281-ED9F87D5EEC8}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD30.tmp-0\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBEF6.tmp-0\ServiceActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB000.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEF6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEF6.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD30.tmp-0\CustomAction.config	rundll32.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5676	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5220	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5256	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	HPAssessAndRespond.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	HPAssessAndRespond.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	HPAssessAndRespond.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	HPAssessAndRespond.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\PackageCode = "0577EA7131A63AF449828569B05DECFE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\ProductIcon = "C:\\Windows\\Installer\\{50BFBFFB-DF2C-4EF2-A281-ED9F87D5EEC8}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E7C0E2DA02F5B2D458941FFEB4EAE15E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E7C0E2DA02F5B2D458941FFEB4EAE15E\BFFBFB05C2FD2FE42A18DEF9785DEE8C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BFFBFB05C2FD2FE42A18DEF9785DEE8C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\ProductName = "HP Assess and Respond"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\Version = "16842811"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BFFBFB05C2FD2FE42A18DEF9785DEE8C\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList\PackageName = "chunk-0.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFFBFB05C2FD2FE42A18DEF9785DEE8C	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3276	msiexec.exe
3276	msiexec.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5220	msiexec.exe
Token: SeSecurityPrivilege	3276	msiexec.exe
Token: SeCreateTokenPrivilege	5220	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5220	msiexec.exe
Token: SeLockMemoryPrivilege	5220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5220	msiexec.exe
Token: SeMachineAccountPrivilege	5220	msiexec.exe
Token: SeTcbPrivilege	5220	msiexec.exe
Token: SeSecurityPrivilege	5220	msiexec.exe
Token: SeTakeOwnershipPrivilege	5220	msiexec.exe
Token: SeLoadDriverPrivilege	5220	msiexec.exe
Token: SeSystemProfilePrivilege	5220	msiexec.exe
Token: SeSystemtimePrivilege	5220	msiexec.exe
Token: SeProfSingleProcessPrivilege	5220	msiexec.exe
Token: SeIncBasePriorityPrivilege	5220	msiexec.exe
Token: SeCreatePagefilePrivilege	5220	msiexec.exe
Token: SeCreatePermanentPrivilege	5220	msiexec.exe
Token: SeBackupPrivilege	5220	msiexec.exe
Token: SeRestorePrivilege	5220	msiexec.exe
Token: SeShutdownPrivilege	5220	msiexec.exe
Token: SeDebugPrivilege	5220	msiexec.exe
Token: SeAuditPrivilege	5220	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5220	msiexec.exe
Token: SeChangeNotifyPrivilege	5220	msiexec.exe
Token: SeRemoteShutdownPrivilege	5220	msiexec.exe
Token: SeUndockPrivilege	5220	msiexec.exe
Token: SeSyncAgentPrivilege	5220	msiexec.exe
Token: SeEnableDelegationPrivilege	5220	msiexec.exe
Token: SeManageVolumePrivilege	5220	msiexec.exe
Token: SeImpersonatePrivilege	5220	msiexec.exe
Token: SeCreateGlobalPrivilege	5220	msiexec.exe
Token: SeBackupPrivilege	3356	vssvc.exe
Token: SeRestorePrivilege	3356	vssvc.exe
Token: SeAuditPrivilege	3356	vssvc.exe
Token: SeBackupPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeDebugPrivilege	2192	rundll32.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeShutdownPrivilege	2220	MsiExec.exe
Token: SeDebugPrivilege	3104	HPAssessAndRespond.exe
Token: SeDebugPrivilege	2392	HPAssessAndRespond.exe
Token: SeShutdownPrivilege	2392	HPAssessAndRespond.exe
Token: SeCreatePagefilePrivilege	2392	HPAssessAndRespond.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe
Token: SeTakeOwnershipPrivilege	3276	msiexec.exe
Token: SeRestorePrivilege	3276	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5220	msiexec.exe
5220	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5220	msiexec.exe
3276	msiexec.exe
1312	MsiExec.exe
8	MsiExec.exe
2220	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 4888	3276	msiexec.exe	94
PID 3276 wrote to memory of 1312	3276	msiexec.exe	96
PID 1312 wrote to memory of 2192	1312	MsiExec.exe	97
PID 2192 wrote to memory of 5256	2192	rundll32.exe	98
PID 5256 wrote to memory of 5676	5256	cmd.exe	100
PID 3276 wrote to memory of 8	3276	msiexec.exe	101
PID 3276 wrote to memory of 2220	3276	msiexec.exe	102
PID 1312 wrote to memory of 5524	1312	MsiExec.exe	107
PID 1312 wrote to memory of 5048	1312	MsiExec.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\chunk-0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4888
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 459A077BB66DE525C2C4DD142F56C35D
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA6C5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756609 2 ServiceActions!ServiceActions.CustomActions.StopServiceAndWait
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C sc stop
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5256
    - - C:\Windows\system32\sc.exe
        
        sc stop
        5⤵
        Launches sc.exe
        
        PID:5676
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBD30.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762390 31 ServiceActions!ServiceActions.CustomActions.AddUpdateServiceDependency
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5524
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBEF6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762671 37 ServiceActions!ServiceActions.CustomActions.InstallServiceEvent
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7D9ADADF016F6F5F6839C0702E33D438
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:8
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5A59176AFC47C9D85DA6EE64605AF95F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Program Files\HP\HP Assess and Respond\HPAssessAndRespond.exe
"C:\Program Files\HP\HP Assess and Respond\HPAssessAndRespond.exe" -i
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Program Files\HP\HP Assess and Respond\HPAssessAndRespond.exe
"C:\Program Files\HP\HP Assess and Respond\HPAssessAndRespond.exe" -i
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Impair Defenses

T1562

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e59a1a6.rbs

Path C:\Config.Msi\e59a1a6.rbs
Size 219KB
SHA256 2b209387657d36b3920c65c4446be2b7885c2d33da2a003ec20b5f9c04ad92f3
MD5 80bb4fc78f21ea9ff29b0df017811cd4
SHA1 0b612ede80e819abbcfb7cfa0e7c2678fbe49012
SHA512 f41ae7600a59375e3202f8b40256f4d4b97588b92226751b4fff97b95451f26928adc34a1ac5798bf3ef3b7c4b867c13594d55ab897ad9da5f9e862ec61eae91
SSDEEP 3072:8Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxa4:8t/kE1jOZy2KL4GBiwQtEa4L2sJ
TLSH
T1D7249D216180847EE7FA0936993ED671BF3DF2241760C99EC3888C1E6D644C16BB7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HPAssessAndRespond.exe

Path C:\Program Files\HP\HP Assess and Respond\HPAssessAndRespond.exe
Size 3.0MB
SHA256 7edad8ffdad06ace3200a5755d2f1c141aa9272de0a7fc58bebad9b16dbfb735
MD5 1b58c2c57df4dcc54588e1327e23c2dd
SHA1 1592a95fff06238353887969225562c2ef4ddd73
SHA512 f55ac3b431041b3f2b61d0c8a81acddc2b1c1b9522f33827b6dc8141a8d55c98f4b75ec7f7fdb0c53227568d564d8d7d1c749a28ee60a89087d82eab3ccf3f05
SSDEEP 49152:4oMeUJAimFqcPEwp5jDx5HkgTweJuQr2UTWH+R:nFfkc9r3tTWQFTWH+
TLSH
T11CE5C005DBA36F0AE7195979E4334BA14670E7402706F30E6FB875BCBC823751AA26DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b6ee29e2257f344fd859e326a17e80a16690fc13cbd2c9a1fd2f75a2257a2cca
MD5 80cdf8fcad886a7ed11661fe7efbb599
SHA1 f028e1d6235da4b2080de3fef59141052bf9bcb9
SHA512 8949955cbdff8301f46fc36b1dfdecb7751ad99ccc3b26c68208e7e4231d74ec2cf705a813f2315517be2e42330d9e0a332df7f0fd0aceae9d3975b7eeb110ec
TLSH
T1ACF0D42355FF70B51B0BD49C1EE55F7012B61A5C10D7856F383509D4598F9D5F50F029
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2EA0E4A795707F956F0E5FE15EDB4B66

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2EA0E4A795707F956F0E5FE15EDB4B66
Size 727B
SHA256 c4b81bc240037b086b5254d594989c4ea25231d8eaf0f1211d728c12121597dd
MD5 f93231a0baf5eab508db8910a7f25927
SHA1 43528b3b7215ffd9cd887d72a9e034574c91d57c
SHA512 503459ec7112b737e4fa2919c618d1677b20748533bb0fda00c70d7e491f91ee63326bc0bdf2d4222375968cd66a0c323f1c0f863421ff351e7eb290e16b2670
TLSH
T1230194478DC427D0C623AD088DF72F73752DA010C58A05AE1D3B24FCF14935A1AFC042
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 98a7b79594d98a581c639dc80206be351a65feef3051dcb1ebb7bf550e726765
MD5 a8a1d856a4b8881eee16f1b793f2f013
SHA1 2c3f4dea025f1446b1fb266a3b704a7311eafa7c
SHA512 83c4bb73592e448713736811e25dc3da14c4664d23771cfa7a92361b0bd7f4a5713b48ec861f19111ccbfdf048852c72f15fbe26c546c701d63b17c95b75b745
TLSH
T1EC01154BE4901A11BA215D6688AE49B4B45BF09E1681A3B79E74100B01EE5E19D17F94
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 050e0fb08bd158445c4d33400cf888c546e4865cbc91b5372589fae867d4d4dd
MD5 6f7164bc827d427930bd5fc78a1e6f13
SHA1 10ca098e4d703bf1e0776cc87ebf7425a239e543
SHA512 d81a0ac8333931e9b2b28918c6995b4c3b130e7be49216a90a6ada90d3e103a1745325358832213e18d7abd96330eefc17f80094c37ee8752f0dc012d63075d6
TLSH
T1B6E0C03037FA012FF2B0A77803D590C66F26F0072C45577D0D81201D6A099004C92C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2EA0E4A795707F956F0E5FE15EDB4B66

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2EA0E4A795707F956F0E5FE15EDB4B66
Size 412B
SHA256 1b23f937bb9e4dc93b7c24a466ccfe4194daefe6d9128f9e7989294443787ebd
MD5 424cb9c167634de3cabae159e3239cb4
SHA1 bf665f3cc34912f571b597c9eb07eb8dc48c3e1f
SHA512 92efd0ddaf026e2aef48e04f80346aaa92a3ed9d615517b2a96756ec00cdef874e9f2e5b248e12b2a7138ae5a52e18a4fb36990f3d8cad13acab6e3eb423c3e5
TLSH
T158E0203831F6054DF5F1F47C02F569314D59F3460501D6BA17949B16FE19F805CB1669
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 8e39867fdab2b13bffe3a54818148a36caf657778ca59a96f83a98b563cf54bf
MD5 6d84441a9755746ffd50ed4fae9143f6
SHA1 a791ad5e4dfd24089ca91b52380a9e01c0879572
SHA512 81975a2068a082c8e29d81d3fad80118fa161eec58a985f2a2ea664e004992427ae0e57d66e93ea14d1db8e15c648bc37b72cb0196afbb3ed8c3e2e48b10aaa2
TLSH
T1DCE06F2822EBB48EF090A83186EAA1720D4AF2191044C3B826A0030FBB4BE406C11AB8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i3sx1oox.bkh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3sx1oox.bkh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA6C5.tmp

Path C:\Windows\Installer\MSIA6C5.tmp
Size 553KB
SHA256 e7845a390e0c9b19aee3d069c6a883dd2d3e1e8c02f6265567778676c7a54326
MD5 07d2cffaa5c73f5098fe08d84cbd1bac
SHA1 a2f060a38762ef83857f714d6316fc06a822e549
SHA512 2d863bf58382e92286c5d4c03fd601a8db0dc580bf84cdb474d7010c8db4d63e954ab8371ee23d6b0dc9a68915bce138b7fbf1605cdb9453a659f929441ab39e
SSDEEP 12288:+PVdJDcpje+Cd9SigWte98G7mWugXCMW+o:+dPp0x98mmWutLl
TLSH
T126C4F16637F80DBAFCB3963989639A06C7737C110570D66F03644159EF6F3846A3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSIA6C5.tmp-0\CustomAction.config
Size 1KB
SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
MD5 01c01d040563a55e0fd31cc8daa5f155
SHA1 3c1c229703198f9772d7721357f1b90281917842
SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
TLSH
T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceActions.dll

Path C:\Windows\Installer\MSIA6C5.tmp-0\ServiceActions.dll
Size 34KB
SHA256 21829956c0e0165dcebaf90a9a94ce5bc492128538a8c699eb8d4facd88489bd
MD5 e7cc410ef50393258b1a8c979ebd0f8b
SHA1 1b620d94c42b8fc6ff335ac2ab7474f40b80887a
SHA512 c6f896e6033fe30a6039e0dc2f3fcf80bc253af731aa84a63ce6a1256ab4f88e482d439d51f2a7142c7ec9cba7be61b956b62421c6cc7e0bae4d41096ee8f1b0
SSDEEP 768:Efc/pWY8sf3a53PSbb5y+oSeClxcmDYit5ALbzC0:rWY8sf3a53kb59oHC5D7J0
TLSH
T172F21B1257F88E15FDBB5B78B8F006250EB2F989E532CA4D1E80D0DD5D62B409AA13B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAEA7.tmp

Path C:\Windows\Installer\MSIAEA7.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIBD30.tmp-0\Microsoft.Deployment.WindowsInstaller.dll
Size 183KB
SHA256 791da16b0df6956e88b04dab8b543b99dc2abd9af24aa25208fe5a0981e811b3
MD5 c2c83128276cc7c9cccc399bb5d76031
SHA1 776f9ca8175d95d0bc7c44847d60091bdf415041
SHA512 c8651107f699daa299182dbe594da76cd794ba0d7661a483aaa932f0967a3af5761c8e8a3250cb501019d39b483d09427ac75aa7fa3a191a090e226d8d9fd515
SSDEEP 3072:pGfZS7hUuK3PcbFeRRLxyR69UgoCaf8xzCnfKlRUjW01KyPePc:lzMRLkR6joxfKK3
TLSH
T1CC047D2953FC473ACAEF4778E2614261D7B1F2E67117DB0E9C8181BA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Windows\Installer\MSIBEF6.tmp-0\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59a1a7.msi

Path C:\Windows\Installer\e59a1a7.msi
Size 3.1MB
SHA256 26374a9d227f0a6fd9f72c982bb7939ecb8f18d5311d81fb4f3b64ba17eb732b
MD5 82ccebfd1fcf4542597c9a83e37798d3
SHA1 06b9e90e078657b483d4c52b1d2a52b9a778093e
SHA512 691e00a3d685e90d603179faea7e879072b10eeb5e24b106b58d65cff099604e7abe242cbb87d7111da514e6cf3942169eb291cb65515cd893535e1090b0fc18
SSDEEP 49152:PRR/DPfeIwlimwVjPswS/nu7hp5mfc8we/GQp2lwyD8exGJXnUIT:XLPfe1Ubp1F+k8kQ+wyg0G2C
TLSH
T153E52321F294183EEABE067B892B96719F3BBC140720C57F4358751DAF767802736B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HPAssessAndRespond.Agent.log

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\hpqlog\HPAssessAndRespond.Agent.log
Size 3KB
SHA256 c0d3066db1da7a9621c23c882321b123e346974255aba00a5b2e0da64015270f
MD5 3580dc6b95638e138ae4dba2be67cf31
SHA1 f0a7c3bcb86ccbb36f64b87a118029248ef23e45
SHA512 e632ca5050148f6b461da526e27c3d06c86d391c2d60a16b1d280e20f6505066beccff217416cc8af0870cbd20ec8aac45f18577fc711b2a278d42c82a45f042
TLSH
T10761FDA4EEC2F0EFC658C11888513E44EF22725699F873B932D5C94192AA647D73F2D8
MD5 SHA1 SHA512 TLSH

Submit Download

HPAssessAndRespond.Agent.log

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\hpqlog\HPAssessAndRespond.Agent.log
Size 4KB
SHA256 b4812bc26a15ddc145d883a52824293f92c51f7f4a885392db463c7c2fd31abe
MD5 e308b5dd5f21912ae463dee82488a984
SHA1 dd84808d3e0ca11461ed5154f423b5025ef06463
SHA512 4dc69672fc4ee67e9c3bb421d8860d124eda77eb97e1de9c858f3d61040119827f8e4297a53f840eac0c33098ff1971a8351917e71852594822c35414d09a57f
SSDEEP 96:3G6LVlViOk/SSwu/qLyNW3VGVugtjNyuyk/K2aWJvbUZUWZVPVij:Uz/3j3zboUj
TLSH
T1C8A1CBA4AEC2F1EFC618C128C4153E44EF23325999F873B932D5C95152AA247D73F698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 bc8d81ab7b9dfda36c62f8a7df28a5bfa826f153caed578ac0a3e4ac0cb6e479
MD5 4d91050db0d743a704b2730bd188a029
SHA1 cc0b4e5fd4ee20023ec8ea072bc9bd544b29ad65
SHA512 3504c64ad47f09a870a91c4ff8fa6d350aa1ed09a1d9561d70e7ac0f91b3bfb867dba8cad825f2173ab109849e18049de1a16b501453cee84c1146fc4014f661
SSDEEP 24576:xFo3DMPidoO/vvTL/SQPvCFg/L+F07osEiJdNiBH5KBq5YOfc4h2PW1+ruf:mHI
TLSH
T1EB57A12436F92200E7B79E3DA8F06A634D3A7D5B9C15DE8D45411B8E0822F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6d91d86e-b0ac-4bc4-9af7-5e4c974bece5}_OnDiskSnapshotProp

Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6d91d86e-b0ac-4bc4-9af7-5e4c974bece5}_OnDiskSnapshotProp
Size 6KB
SHA256 b6c2f9224a9682fc4a9ca73a899e869ae21c9518ac8000a657f91fd251acde67
MD5 b0097c6ce831fc7d9dc8c805f48f6776
SHA1 cfcf372082ef36978075a43657f25cfb6af8c00d
SHA512 e8a093be19a80e6afc4f872e361f293f2a2c51336462b5388a1019bed66c61a72a9f4ea1eb9e364f2c71137cd259500a159d07db50918c27b2d0d590bc0c1208
SSDEEP 96:FfQnb1Yaqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:+n+b++uVmN
TLSH
T175D178185AF54711E2B3AB3229F18557A877B911EF33CB8E0198238E6671910F835F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2192-47-0x0000022B59630000-0x0000022B59652000-memory.dmp

Download

memory/2192-34-0x0000022B40560000-0x0000022B4058E000-memory.dmp

Download

memory/2192-38-0x0000022B40510000-0x0000022B4051A000-memory.dmp

Download

memory/3104-73-0x000001EFB8FF0000-0x000001EFB9002000-memory.dmp

Download

memory/3104-67-0x000001EF9E720000-0x000001EF9EA2E000-memory.dmp

Download

memory/3104-69-0x000001EFB93D0000-0x000001EFB964E000-memory.dmp

Download

memory/3104-71-0x000001EFB8FA0000-0x000001EFB8FEC000-memory.dmp

Download

memory/3104-74-0x000001EFB9650000-0x000001EFB96C6000-memory.dmp

Download

memory/3104-72-0x000001EFB9250000-0x000001EFB9300000-memory.dmp

Download

memory/5048-165-0x000001E47AC30000-0x000001E47ACE2000-memory.dmp

Download