Overview

overview

8

Static

static

8

ZoomWorkspace.msi

windows10-2004-x64

7

ZoomWorkspace.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 18:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ZoomWorkspace.msi
  • Size 4.9MB
  • Sample261014-w5bbqag19x
  • SHA256 37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
backdoordiscoveryexecutionpersistenceprivilege_escalationransomwarerat

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 45 IoCs
  • PDQConnect remote access tool

    PDQConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:464
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3776
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding C0C8A5200B98C01032B1E7BD6739739B
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4632
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID915.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240703828 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2068
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIDD4E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240704968 16 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:4900
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 7EAAACBE04E6F4939374BC6B9541D564 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3620
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIE12A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705921 38 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSource
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:4144
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIE4F3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240706843 44 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteToken
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:3632
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIE737.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707390 50 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartService
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" start "PDQConnectAgent"
            4⤵
            • Launches sc.exe
            PID:1076
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 73CB0A7E0A3F44FDD398E166695C36DA E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI33D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714781 61 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
          3⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          PID:1660
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIA84.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240716406 77 pdqconnectupdater-setup!pdqconnectupdater_setup.CustomActions.CreateEventSource
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:3268
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding CA4646A7384DF8C73BA211AC3EEFEA84 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI1D33.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240721765 86 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:3084
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2310.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722703 96 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:4460
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI28A1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240724140 110 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:868
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2D67.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725343 122 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:740
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI3058.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726093 144 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CheckMsiFileName
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1224
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI3182.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726406 148 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSource
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:4524
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI32FA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726765 152 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteToken
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2076
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI34FE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727281 157 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartService
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" start "PDQConnectAgent"
            4⤵
            • Launches sc.exe
            PID:5068
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              5⤵
                PID:1076
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI3734.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727843 167 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler
            3⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1556
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1684
      • C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
        "C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Windows\system32\msiexec.exe
          "msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.15.30.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log
          2⤵
            PID:4328
        • C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe
          "C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe" --service
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Windows\system32\msiexec.exe
            "msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectAgent-5.15.38.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\install.log
            2⤵
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4824
        • C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
          "C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4524
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:868
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:4652
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:4756
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:2440
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:4292
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:4768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:3516
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:1428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:1244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:4704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
            2⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            PID:3008

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e58d7ed.rbs
              • Path C:\Config.Msi\e58d7ed.rbs
              • Size 403KB
              • SHA256 df8cd6cf9a9bb15083289cce0d3f70e1fbc570d064f92ca0d995b4337f273379
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d7f2.rbs
              • Path C:\Config.Msi\e58d7f2.rbs
              • Size 421KB
              • SHA256 26245a674714dfd7dc9be2b73527b044fa12094f65b1ddbef5f7c22b34a2cf28
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d7f9.rbs
              • Path C:\Config.Msi\e58d7f9.rbs
              • Size 403KB
              • SHA256 3d57ae73cea8367f2ee5396ddbc8d3e20200307f1e25d1a3949c33babfe22d29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d7fc.rbs
              • Path C:\Config.Msi\e58d7fc.rbs
              • Size 422KB
              • SHA256 f3beb1d31ed88146e58aa5f5eede16218ff377eb31eddde3afe865e2d0a60b73
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICENSE.html
              • Path C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html
              • Size 464KB
              • SHA256 2721a70fee6b5a8878caef3e1c202cb622dfe28ac1795f3c2ecb150d1e4d5188
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pdq-connect-agent.exe
              • Path C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
              • Size 9.0MB
              • SHA256 92d887dc1c024270c37fa81f737633b25e656fece7171f1ad439b6c592ff8aa2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pdq-connect-updater.exe
              • Path C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe
              • Size 6.0MB
              • SHA256 122010b9ac4b232d125bfff2350dbe0808263abb7115e158d3669368da82eeaf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PDQConnectAgent.db
              • Path C:\ProgramData\PDQ\PDQConnectAgent\PDQConnectAgent.db
              • Size 36KB
              • SHA256 ecd642d01261f9a534614ba7a16c10d244327f515662cb4cad3a4156fc4e634f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PDQConnectAgent-5.15.38.msi
              • Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectAgent-5.15.38.msi
              • Size 8.8MB
              • SHA256 0556d87036050a400b2e06c0daa575fc17770bd7dfc2bf0898d33a6fcdff5ec5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PDQConnectUpdater-5.15.30.msi
              • Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.15.30.msi
              • Size 4.2MB
              • SHA256 59d506e5898b3cffa31604f1ad4c03587dd8b05fdceed9367283ae80d44572f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              install.log
              • Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\install.log
              • Size 1KB
              • SHA256 f11471f3079a15ee35edd2a5f8ddd67201fbddfb8f00f532ac22f251c07345ed
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              updater_install.log
              • Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log
              • Size 1KB
              • SHA256 2b42d3f5673d687a3e4838e57b8c0bc74b4d6ec3b6d76185f619eade91d1271a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              token
              • Path C:\ProgramData\PDQ\PDQConnectAgent\token
              • Size 86B
              • SHA256 1d525d451614514ee79396e65e084e1587ac4c70d5bbde9fdfd9812badc7f379
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 b6ee29e2257f344fd859e326a17e80a16690fc13cbd2c9a1fd2f75a2257a2cca
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_FAD83375A7267CC9811656BCB894D31D
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_FAD83375A7267CC9811656BCB894D31D
              • Size 751B
              • SHA256 07df4205524cd62c60956142ef59d7ce5afbc597502d73409f8f78ad54fcf91e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 6cffa6aafff2185baf6aaafe651f52e8718763f51e76217fa3242a4ea5a47c7e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 f4d023f4425478e52aa56ec3a1245989889c38c68cbc850c5179c05c684d4e6c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_FAD83375A7267CC9811656BCB894D31D
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_FAD83375A7267CC9811656BCB894D31D
              • Size 404B
              • SHA256 950ecd7c7ee55f21fcb893d9ac27b48c68aab0fb426788a2be7dca50df461419
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 8abeee5c145ba17a8ea8a06835c4dee1e376efbd2988e4ef5972c2b03c00831f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              rundll32.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
              • Size 651B
              • SHA256 d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MSI1D33.tmp
              • Path C:\Windows\Installer\MSI1D33.tmp
              • Size 1.1MB
              • SHA256 99daed75b6e64725ea20fe5c376b80b7865836f4f04624a76f0db2b4d0e7a2bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI3182.tmp
              • Path C:\Windows\Installer\MSI3182.tmp
              • Size 1.2MB
              • SHA256 7cb1d760c7b79dd43db71d275ac52bd87938655170d594c0c2b704a64b54883d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI33D.tmp
              • Path C:\Windows\Installer\MSI33D.tmp
              • Size 566KB
              • SHA256 a10d427605158347b634ecba89873c20a2ca2e30b18908c69b6339826b83fea3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI8FC.tmp
              • Path C:\Windows\Installer\MSI8FC.tmp
              • Size 413KB
              • SHA256 54febbd1f0a3875df16a4b88621cc0a10729b3c94b9a68639aab27d36fe39381
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIA84.tmp
              • Path C:\Windows\Installer\MSIA84.tmp
              • Size 579KB
              • SHA256 988f34749dc59284bd4171cbd5172a22fd3d954053c0268744d7920d9672facc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSID915.tmp
              • Path C:\Windows\Installer\MSID915.tmp
              • Size 573KB
              • SHA256 a7780c30f73ec0c286961f15598e1d360e8837e717b67ba6b3a6eb4ea39557a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIDC82.tmp
              • Path C:\Windows\Installer\MSIDC82.tmp
              • Size 394KB
              • SHA256 50bbf22db97433456a4307211b99641740f20a6421bcee32216fa888feaa7b2c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIE12A.tmp
              • Path C:\Windows\Installer\MSIE12A.tmp
              • Size 577KB
              • SHA256 ad4df7fe53ec5e2f8e77d0583db6146658bd8fd259f5d67c668830ce69a1ac93
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WixSharp.UI.dll
              • Path C:\Windows\Installer\SFXCA0827B87FAA4EC09B8F7D3D24080BC113\WixSharp.UI.dll
              • Size 707KB
              • SHA256 3a06121020c53c5e40183be331a369028433b5f2e96a1f71ab1684043af13cc3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pdqconnectagent-setup.exe
              • Path C:\Windows\Installer\SFXCA0827B87FAA4EC09B8F7D3D24080BC113\pdqconnectagent-setup.exe
              • Size 49KB
              • SHA256 dadd4d01afc770659a4c0e8901fd93d399e6eebc7bf2f5a550227b5eadb5a213
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CustomAction.config
              • Path C:\Windows\Installer\SFXCA135232F33B4F25C8AB518561B6A07E3F\CustomAction.config
              • Size 980B
              • SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              WixSharp.dll
              • Path C:\Windows\Installer\SFXCA135232F33B4F25C8AB518561B6A07E3F\WixSharp.dll
              • Size 685KB
              • SHA256 cd978711231d2729e6ba4b5ef84236f671a7a40b7ee29f65b4e0f8ea5e06348f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WixToolset.Dtf.WindowsInstaller.dll
              • Path C:\Windows\Installer\SFXCA135232F33B4F25C8AB518561B6A07E3F\WixToolset.Dtf.WindowsInstaller.dll
              • Size 193KB
              • SHA256 cdd7f34dda1180f21205543c8ee836c5be66060d94441172366bce078e1cdb87
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pdqconnectagent-setup.exe
              • Path C:\Windows\Installer\SFXCA135232F33B4F25C8AB518561B6A07E3F\pdqconnectagent-setup.exe
              • Size 24KB
              • SHA256 d2c7a656fe448e1ae3e9cba77198f2f687d8a24f5022c77e0060f13a9a06ea51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WixSharp.dll
              • Path C:\Windows\Installer\SFXCA6C9D8A214449EF3A45FBD4E80B7B00D5\WixSharp.dll
              • Size 689KB
              • SHA256 8fced4b20ba39f8aacadefd9b2a60aaddb1823b516d452b0f62dd1fe8c335c2d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WixToolset.Mba.Core.dll
              • Path C:\Windows\Installer\SFXCA6D8047B99247B90B47B0DA8DC56CEE44\WixToolset.Mba.Core.dll
              • Size 165KB
              • SHA256 7ac0cd1434327758142883d1eb90a5421c2862c09b84cb9780ae5be1be3301af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pdqconnectagent-setup.pdb
              • Path C:\Windows\Installer\SFXCAE137554E61448388306C4EDA320C9502\pdqconnectagent-setup.pdb
              • Size 73KB
              • SHA256 9782f35358f48d87e7b4025f3e169ce49983d87d01f433996e9e67f000d46ce2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e58d7ee.msi
              • Path C:\Windows\Installer\e58d7ee.msi
              • Size 4.9MB
              • SHA256 37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              app_icon.ico
              • Path C:\Windows\Installer\{0EC05CD8-8D17-472C-86DA-AF1EA317056F}\app_icon.ico
              • Size 278KB
              • SHA256 21b0a4a7d60c8328f6987c1c9ae2773772100c08cf2123cf73c99376ffd9721c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_i5qwjr5c.gvj.ps1
              • Path C:\Windows\Temp\__PSScriptPolicyTest_i5qwjr5c.gvj.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metadata-2
              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 24.1MB
              • SHA256 ed37cd8628cf2a9465fdd298afd13229605a7a9d29db5aae8fedf5c2915c26a9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {ad8e8bc1-c77f-403e-a9a3-e1727dff4f85}_OnDiskSnapshotProp
              • Path \??\Volume{efdbfdc7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ad8e8bc1-c77f-403e-a9a3-e1727dff4f85}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 e1d8fdd4bc6ac2fd3c819653ddf4d550fab49eddd8802d9689697b14b39e194c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/740-323-0x000001BBE2970000-0x000001BBE2A28000-memory.dmp
              Download

              memory/740-321-0x000001BBC8C10000-0x000001BBC8C20000-memory.dmp
              Download

              memory/1244-614-0x0000026B7FC00000-0x0000026B7FD4E000-memory.dmp
              Download

              memory/1428-596-0x0000016A63570000-0x0000016A63625000-memory.dmp
              Download

              memory/1428-598-0x0000016A63380000-0x0000016A634CE000-memory.dmp
              Download

              memory/1660-176-0x00000245C1970000-0x00000245C1A22000-memory.dmp
              Download

              memory/2068-34-0x0000017889AA0000-0x0000017889AD4000-memory.dmp
              Download

              memory/2068-36-0x00000178A3680000-0x00000178A3732000-memory.dmp
              Download

              memory/2440-534-0x0000024BE71D0000-0x0000024BE7285000-memory.dmp
              Download

              memory/3008-646-0x000002AD73EE0000-0x000002AD73F95000-memory.dmp
              Download

              memory/3008-648-0x000002AD73910000-0x000002AD73B2C000-memory.dmp
              Download

              memory/3268-200-0x000001CD1F030000-0x000001CD1F038000-memory.dmp
              Download

              memory/4292-550-0x000002E9F3B90000-0x000002E9F3C45000-memory.dmp
              Download

              memory/4524-470-0x000001F97A140000-0x000001F97A164000-memory.dmp
              Download

              memory/4524-469-0x000001F97A140000-0x000001F97A16A000-memory.dmp
              Download

              memory/4524-468-0x000001F979FC0000-0x000001F979FCA000-memory.dmp
              Download

              memory/4524-467-0x000001F979F00000-0x000001F979FB5000-memory.dmp
              Download

              memory/4524-466-0x000001F979EE0000-0x000001F979EFC000-memory.dmp
              Download

              memory/4524-456-0x000001F9797B0000-0x000001F9797D2000-memory.dmp
              Download

              memory/4704-630-0x000002234DE90000-0x000002234DF45000-memory.dmp
              Download

              memory/4900-59-0x0000027E85D10000-0x0000027E85D1A000-memory.dmp
              Download