37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZoomWorkspace.msi
Size 4.9MB
Sample261014-w5bbqag19x
SHA256 37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3
MD5 cfda340fa82d1b5f33cf82ae5070fbf4
SHA1 1702b75976ef12eca324e341f91d90643bb3568e
SHA512 39d973a72c97eee42d14f603b4f22a593fa647a24389c7025624d58ffc079d40676c0a41d6191531c6acd72af0a86f6402eb3a898a60ef56d3ce6548585ae17c
SSDEEP 98304:iaI+R+g7rDoHeQufnPW/X423wED86HWKFIIKU5ctwAnlOAs2s6:iArDo+pfe/o2CKWKFRl5MW/6
TLSH
T1BD360115B6940CADD8E64235846EF115AE32380D273C86DB4E767DF83E26ED0A37A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor discovery execution persistence privilege_escalation ransomware rat

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3768	pdq-connect-agent.exe
6116	pdq-connect-updater.exe
2056	pdq-connect-agent.exe

Loads dropped DLL 45 IoCs

pid	Process
2260	MsiExec.exe
2540	rundll32.exe
2260	MsiExec.exe
2260	MsiExec.exe
5868	rundll32.exe
2260	MsiExec.exe
2260	MsiExec.exe
996	MsiExec.exe
3376	rundll32.exe
996	MsiExec.exe
1768	rundll32.exe
996	MsiExec.exe
2972	rundll32.exe
996	MsiExec.exe
996	MsiExec.exe
5372	MsiExec.exe
2152	rundll32.exe
5372	MsiExec.exe
5372	MsiExec.exe
6016	rundll32.exe
5372	MsiExec.exe
2812	MsiExec.exe
5148	rundll32.exe
2812	MsiExec.exe
420	rundll32.exe
2812	MsiExec.exe
2812	MsiExec.exe
5748	rundll32.exe
2812	MsiExec.exe
2812	MsiExec.exe
2764	rundll32.exe
2812	MsiExec.exe
2812	MsiExec.exe
2812	MsiExec.exe
4944	rundll32.exe
2812	MsiExec.exe
1760	rundll32.exe
2812	MsiExec.exe
4744	rundll32.exe
2812	MsiExec.exe
2240	rundll32.exe
2812	MsiExec.exe
2812	MsiExec.exe
2812	MsiExec.exe
5580	rundll32.exe

PDQConnect remote access tool
PDQConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3292	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html	msiexec.exe
File created	C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe	msiexec.exe
File created	C:\Program Files\PDQ\PDQConnectUpdater\LICENSE.html	msiexec.exe
File created	C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe	msiexec.exe
File opened for modification	C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe	msiexec.exe
File opened for modification	C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{F03416B2-8C97-4CC4-8578-5F6A58244B84}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF4825CD5229E357B8.TMP	msiexec.exe
File created	C:\Windows\Installer\e593fc5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6BF038D1F98556E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA3DF81A88543E0F8B68E07D7F0C36689\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF4F52038F6B00FA60.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCACC461DFAE94E31AB4EDB7A6C4815CFDB\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DF42C0DD71DA4778EB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA115C474D2848A88BB05BBAC9458B742A\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA177C404E6C49201A08A239E55AEC550A\pdqconnectagent-setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAEB0EB8FCFD43456B5DC671FF04283E05\pdqconnectagent-setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5245.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55D1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF33E84F66BC2A4B40.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA115C474D2848A88BB05BBAC9458B742A\pdqconnectagent-setup.exe	rundll32.exe
File created	C:\Windows\SystemTemp\~DF263ED30A9596578A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF23D73DB4F7E7AC40.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4gvhq35x.nxd.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI4FB4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{0EC05CD8-8D17-472C-86DA-AF1EA317056F}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA723D09FFA040A5B9E7E4867ACC6487DB\pdqconnectagent-setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2D4A5119594AE13927D71693F7AFF5A4\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA87D0C791434B1F1A08AC98BFD0EC01E0\pdqconnectupdater-setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA3DF81A88543E0F8B68E07D7F0C36689\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI957C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA2D4A5119594AE13927D71693F7AFF5A4\pdqconnectagent-setup.pdb	rundll32.exe
File created	C:\Windows\SystemTemp\~DF50065998AACDD59D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_n1h5tcbj.fja.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ounvkfev.cdk.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI6729.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6787.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFA6A76D5A81592AA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA3DF81A88543E0F8B68E07D7F0C36689\WixToolset.Mba.Core.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF7C2AB93078A0A5BC.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F03416B2-8C97-4CC4-8578-5F6A58953B84}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uf5kftkq.5up.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hwammzqx.fsm.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCA05920D89AF425428A08D4EB456AAAA00\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA6680376BD14BC96990AEC918B0D92A0C\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\{F03416B2-8C97-4CC4-8578-5F6A58244B84}\app_icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF023FB0F5DC599BB9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI791E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA115C474D2848A88BB05BBAC9458B742A\WixSharp.dll	rundll32.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jqlszaeo.gmm.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\e593fbe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAADDC2DC62E4CC73AD3B45648D3023A25\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAADDC2DC62E4CC73AD3B45648D3023A25\pdqconnectagent-setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA87D0C791434B1F1A08AC98BFD0EC01E0\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFFC62A6E2653DC7E1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA115C474D2848A88BB05BBAC9458B742A\WixSharp.UI.dll	rundll32.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_g10voik4.slg.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_oesqp0os.e0h.ps1	powershell.exe
File created	C:\Windows\SystemTemp\~DF75EB7434CA583011.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA177C404E6C49201A08A239E55AEC550A\WixToolset.Mba.Core.dll	rundll32.exe
File created	C:\Windows\Installer\wix{F03416B2-8C97-4CC4-8578-5F6A58953B84}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ym4ymoky.vsk.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_up0114q4.kg5.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCA9E8FD605144A3FA92A780F651BEB23EE\pdqconnectagent-setup.exe	rundll32.exe
File created	C:\Windows\SystemTemp\~DFBDC936308493E7CF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAE5D753D05B415F6BC06A3EE5202E3274\pdqconnectagent-setup.exe	rundll32.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2748	sc.exe
3896	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5440	powershell.exe
4940	powershell.exe
4232	powershell.exe
3396	powershell.exe
2784	powershell.exe
4000	powershell.exe
6088	powershell.exe
5096	powershell.exe
5796	powershell.exe
2544	powershell.exe
1964	powershell.exe
4448	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3292	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pdq-connect-agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pdq-connect-updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pdq-connect-updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pdq-connect-agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pdq-connect-agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pdq-connect-agent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000de3438a4f689b710000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010de3438a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010de3438a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30de3438a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60de3438a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 0b18c58220c067e0da5bbf5f6a8e01d60b58eb8bf25bf490521c7efb065fc281	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFilesHash = e26c589a3efb0ca5127be33b8fd7f37167609acd278f311a8e02418f1fa60930	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8DC50CE071D8C27468ADFAE13A7150F6\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8DC50CE071D8C27468ADFAE1356251F6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\Version = "84410391"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\ProductIcon = "C:\\Windows\\Installer\\{0EC05CD8-8D17-472C-86DA-AF1EA317056F}\\app_icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\PDQ\\PDQConnectAgent\\Updates\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68559B348	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\SourceList\PackageName = "PDQConnectAgent-5.15.38.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\PackageCode = "3719F5C739A63DF488A0F605E62047F2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\ProductIcon = "C:\\Windows\\Installer\\{F03416B2-8C97-4CC4-8578-5F6A58244B84}\\app_icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\SourceList\PackageName = "PDQConnectUpdater-5.15.30.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68559B348\Complete	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\PDQ\\PDQConnectAgent\\Updates\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\PackageName = "ZoomWorkspace.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\SourceList\Net\1 = "C:\\ProgramData\\PDQ\\PDQConnectAgent\\Updates\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68542B448	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\PackageCode = "378B1810A34680C40944F56E4ABDE5E8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\ProductName = "PDQConnectUpdater"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\ProductName = "PDQConnectAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\ProductIcon = "C:\\Windows\\Installer\\{F03416B2-8C97-4CC4-8578-5F6A58953B84}\\app_icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68542B448\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\ProductName = "PDQConnectAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\Version = "84869158"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48\2B61430F79C84CC45887F5A68542B448	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\Version = "84869150"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B61430F79C84CC45887F5A68542B448	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8DC50CE071D8C27468ADFAE13A7150F6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68559B348\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2B61430F79C84CC45887F5A6803ABC48\2B61430F79C84CC45887F5A68559B348	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B61430F79C84CC45887F5A68542B448\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
1296	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
5440	powershell.exe
5440	powershell.exe
5440	powershell.exe
4940	powershell.exe
4940	powershell.exe
4940	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	1296	msiexec.exe
Token: SeCreateTokenPrivilege	3292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	msiexec.exe
Token: SeLockMemoryPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeMachineAccountPrivilege	3292	msiexec.exe
Token: SeTcbPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	3292	msiexec.exe
Token: SeTakeOwnershipPrivilege	3292	msiexec.exe
Token: SeLoadDriverPrivilege	3292	msiexec.exe
Token: SeSystemProfilePrivilege	3292	msiexec.exe
Token: SeSystemtimePrivilege	3292	msiexec.exe
Token: SeProfSingleProcessPrivilege	3292	msiexec.exe
Token: SeIncBasePriorityPrivilege	3292	msiexec.exe
Token: SeCreatePagefilePrivilege	3292	msiexec.exe
Token: SeCreatePermanentPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	3292	msiexec.exe
Token: SeRestorePrivilege	3292	msiexec.exe
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeDebugPrivilege	3292	msiexec.exe
Token: SeAuditPrivilege	3292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3292	msiexec.exe
Token: SeChangeNotifyPrivilege	3292	msiexec.exe
Token: SeRemoteShutdownPrivilege	3292	msiexec.exe
Token: SeUndockPrivilege	3292	msiexec.exe
Token: SeSyncAgentPrivilege	3292	msiexec.exe
Token: SeEnableDelegationPrivilege	3292	msiexec.exe
Token: SeManageVolumePrivilege	3292	msiexec.exe
Token: SeImpersonatePrivilege	3292	msiexec.exe
Token: SeCreateGlobalPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	2128	vssvc.exe
Token: SeRestorePrivilege	2128	vssvc.exe
Token: SeAuditPrivilege	2128	vssvc.exe
Token: SeBackupPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeSecurityPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe
Token: SeSecurityPrivilege	3376	rundll32.exe
Token: SeBackupPrivilege	3376	rundll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3292	msiexec.exe
3292	msiexec.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3292	msiexec.exe
1296	msiexec.exe
2260	MsiExec.exe
996	MsiExec.exe
4204	msiexec.exe
5372	MsiExec.exe
4612	msiexec.exe
2812	MsiExec.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 936	1296	msiexec.exe	95
PID 1296 wrote to memory of 2260	1296	msiexec.exe	97
PID 2260 wrote to memory of 2540	2260	MsiExec.exe	98
PID 2260 wrote to memory of 5868	2260	MsiExec.exe	99
PID 1296 wrote to memory of 996	1296	msiexec.exe	100
PID 996 wrote to memory of 3376	996	MsiExec.exe	101
PID 996 wrote to memory of 1768	996	MsiExec.exe	102
PID 996 wrote to memory of 2972	996	MsiExec.exe	103
PID 2972 wrote to memory of 2748	2972	rundll32.exe	104
PID 3768 wrote to memory of 4204	3768	pdq-connect-agent.exe	109
PID 1296 wrote to memory of 5372	1296	msiexec.exe	110
PID 5372 wrote to memory of 2152	5372	MsiExec.exe	111
PID 5372 wrote to memory of 6016	5372	MsiExec.exe	112
PID 6116 wrote to memory of 4612	6116	pdq-connect-updater.exe	114
PID 1296 wrote to memory of 2812	1296	msiexec.exe	115
PID 2812 wrote to memory of 5148	2812	MsiExec.exe	116
PID 2812 wrote to memory of 420	2812	MsiExec.exe	117
PID 2812 wrote to memory of 5748	2812	MsiExec.exe	118
PID 2812 wrote to memory of 2764	2812	MsiExec.exe	119
PID 2812 wrote to memory of 4944	2812	MsiExec.exe	120
PID 2812 wrote to memory of 1760	2812	MsiExec.exe	121
PID 2812 wrote to memory of 4744	2812	MsiExec.exe	122
PID 2812 wrote to memory of 2240	2812	MsiExec.exe	123
PID 2240 wrote to memory of 3896	2240	rundll32.exe	124
PID 2812 wrote to memory of 5580	2812	MsiExec.exe	127
PID 2056 wrote to memory of 5440	2056	pdq-connect-agent.exe	128
PID 2056 wrote to memory of 4940	2056	pdq-connect-agent.exe	131
PID 2056 wrote to memory of 6088	2056	pdq-connect-agent.exe	133
PID 2056 wrote to memory of 4232	2056	pdq-connect-agent.exe	135
PID 2056 wrote to memory of 5096	2056	pdq-connect-agent.exe	137
PID 2056 wrote to memory of 3396	2056	pdq-connect-agent.exe	139
PID 2056 wrote to memory of 5796	2056	pdq-connect-agent.exe	141
PID 2056 wrote to memory of 2544	2056	pdq-connect-agent.exe	143
PID 2056 wrote to memory of 2784	2056	pdq-connect-agent.exe	145
PID 2056 wrote to memory of 1964	2056	pdq-connect-agent.exe	147
PID 2056 wrote to memory of 4000	2056	pdq-connect-agent.exe	149
PID 2056 wrote to memory of 4448	2056	pdq-connect-agent.exe	151

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:936
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5689D6EA5BB0FC63B56382F8A69619DF
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4329.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240731312 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2540
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4A70.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732921 16 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
    3⤵
    - Loads dropped DLL
    PID:5868
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 571D6B7882154231EF4448C794836CE8 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4D90.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733687 38 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSource
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4FB4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734234 44 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteToken
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1768
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5245.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734875 50 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start "PDQConnectAgent"
      4⤵
      Launches sc.exe
      PID:2748
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 06ED7072513248B36DE6DADCD3C98715 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI642A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739531 61 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2152
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6882.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740500 77 pdqconnectupdater-setup!pdqconnectupdater_setup.CustomActions.CreateEventSource
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:6016
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C0106CB07130E2204E7C81ED93706FC3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI791E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240745343 86 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5148
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI81F9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240747031 96 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:420
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8920.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240748843 110 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
    3⤵
    - Loads dropped DLL
    PID:5748
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8D3A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750000 122 WixSharp!WixSharp.ManagedProjectActions.WixSharp_BeforeInstall_Action
    3⤵
    - Loads dropped DLL
    PID:2764
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI91F0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751140 144 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4944
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9378.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751640 148 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.CreateEventSource
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1760
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI957C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752031 152 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.WriteToken
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4744
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI97DF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752671 157 pdqconnectagent-setup!pdqconnectagent_setup.CustomActions.StartService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start "PDQConnectAgent"
      4⤵
      Launches sc.exe
      PID:3896
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9C47.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753765 167 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\system32\msiexec.exe
  "msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.15.30.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4204

C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe
"C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\system32\msiexec.exe
  "msiexec" /i C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectAgent-5.15.38.msi /quiet /qn /norestart /L*V C:\ProgramData\PDQ\PDQConnectAgent\Updates\install.log
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4612

C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
"C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593fbf.rbs

Path C:\Config.Msi\e593fbf.rbs
Size 403KB
SHA256 ce1f7a9fe07825855164175f36f59221af87310563f706e484fb8fa220d258e7
MD5 6a90c68e6d565993271f760445f75a9e
SHA1 f25a330fe2746e9f280e09022c56731478942d5b
SHA512 770e9315c75703e43be32f3d5e31dcd865e37b168006bfce1fa57073d16c05381d4e58f9ff7b1f8beec84e70f7597b52c8ab9833bc5e7262b94815bc1f31f1ac
SSDEEP 6144:2hMMdxm+3CharitB9vYS4ckdWUFQwwufBI8MnSVz9s:2hxdxdMaYYS4pdWUFkufW8Mws
TLSH
T15B946A29B7E418EDE4B78276C5A78130FF75754D3320D5AE8BA8452D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593fc4.rbs

Path C:\Config.Msi\e593fc4.rbs
Size 421KB
SHA256 57b1feead36c6f41f3ffbbe9de3b5e1e01aa7b8f474a4dfcafd9aba7833bf5c0
MD5 7f95dc9e5da84f83a5f2ae477be6025f
SHA1 7ee6395e13f310fd5775f4c0563bef76dd106379
SHA512 747ca755bf84563584d5e76f866639b7cbdf0b468e38b77d0d0c645c316c350d36874f7be646f1e45c1dce54fac0c875302d419f3d0fb748616f6f6afabc980d
SSDEEP 6144:kJqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zx9:iqjGaYh3UGgFjKgZF35VijuoYG
TLSH
T195945B29B3E418EDE4B682B6C5A78130FF75744D332095AF87A8952D1F3B6A430BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593fcb.rbs

Path C:\Config.Msi\e593fcb.rbs
Size 403KB
SHA256 a592bfb3ddd12bba2591595d830a8991596de669cb2272f247c7a8c5212f77cf
MD5 1f9462dc5caa82d6c0005ca1bf367c11
SHA1 42b6e81bbfccdd881121d294546eaa98ef004360
SHA512 9308d25d40fff015ade67795d79e4145c0f101cd9d4554b05856aab99d88ff7a4b8f512fd3501b0cfb6abd8031f8ed891995afece2831e0d787eaee76e51d246
SSDEEP 6144:JhMMdxm+3CharitB9vYS4ckdWUFQwwufBI8MnSVz9K:JhxdxdMaYYS4pdWUFkufW8MwK
TLSH
T11D946A29B7E418EDE4B78276C5A78131FF75B44D3320D5AE87A8452D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593fce.rbs

Path C:\Config.Msi\e593fce.rbs
Size 422KB
SHA256 f017c82f31b69fff56a5a2cecd5d481ad59916594637e02ac3e98bd5d697479c
MD5 9b7ea76ea8b0463e9e435cb912cc00de
SHA1 8d2243a4409b775f0000ce356576571ee1210dff
SHA512 6df22e7c4d5128f34b3585b9859cde10c7b1706882a81539eb6d865a148e7b1a87e5128d9fd7ea4e9ae9269d251286ecb445c7d86d1d0b18e327fe0055fd8a80
SSDEEP 6144:uJqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxg:0qjGaYh3UGgFjKgZF35VijuoYT
TLSH
T175946A29B3E418EDE4B68276C5A78130FF75744D332095AF87A8952D1F3BAA430BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.html

Path C:\Program Files\PDQ\PDQConnectAgent\LICENSE.html
Size 464KB
SHA256 2721a70fee6b5a8878caef3e1c202cb622dfe28ac1795f3c2ecb150d1e4d5188
MD5 9de1be521c4db3aba4752afcc2713ddb
SHA1 76a09dd3e38bf221155c1f37ee092ef11b906ff9
SHA512 d803619f21fbf060010718b277056debc3b74a7d11ff1e8527cb851c39924b5c54bebc10096dbad5d0bff2f693caa10fab75b68a1a47c5a3cf8032fac1daacfc
SSDEEP 12288:DWDYBJmnYbWCvCg9TxqnTn18Ks7htWLDKXCqVHPlczYXoRdRpRWCw8gIly3QR2PQ:G
TLSH
T175A4A62F7A9803770BD602A1AB5765CBF21F913F3B4A1A94305DD0281F3B92543FB699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdq-connect-agent.exe

Path C:\Program Files\PDQ\PDQConnectAgent\pdq-connect-agent.exe
Size 9.0MB
SHA256 92d887dc1c024270c37fa81f737633b25e656fece7171f1ad439b6c592ff8aa2
MD5 adfdda1711c38cb94d1c6b843eca3e5c
SHA1 9aba7f0219dbb47ff775ee1ad38180b83e124c7a
SHA512 6eca982849effe6ffc3f920de2d904b62b193fa25762a8ae61d2f1982e41cb49c92129716182f3a5df821bab26c74dc156302aa9836c44034a1464e6598f7338
SSDEEP 98304:uWkyfMLgZv1dg61VQnVX8GQ0wZiQ73fcqFd:NkIwqVOVMGQkIvd
TLSH
T1A3964B063F9999A9D09DC874C24A4BA74E2230DF1E39B5EF45D646292F3E6F51F2C308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdq-connect-updater.exe

Path C:\Program Files\PDQ\PDQConnectUpdater\pdq-connect-updater.exe
Size 6.0MB
SHA256 122010b9ac4b232d125bfff2350dbe0808263abb7115e158d3669368da82eeaf
MD5 a27193228dc2fd3a4e1e6c2297b66c96
SHA1 456885c5ef4e5f45b1149c95a1221982a1a3cba2
SHA512 d8dc3b236cd638fe8cb283fc4f50de20b8ac8003a05d8994183898e7099e67554bddb9485858703f7d29bb4e3349ca71b54c9b514a84b483fa90558ece3e4e6e
SSDEEP 49152:KIe4OExH2Ks0irDsnvfHAQMzOmqJOT7+NjvPh9EkNKHAwFYFj1Lsr5W5Jy6zN6vn:hZrsh092A9SAe8U/CRpX/H4
TLSH
T14A567C167F9A85F9D0DEC874C2564AA38E3230DF1A35A6EF05C646182F3AAF55F2C344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDQConnectAgent.db

Path C:\ProgramData\PDQ\PDQConnectAgent\PDQConnectAgent.db
Size 36KB
SHA256 3afd8ca66bc64d321ec796f30f7f5da01ca54acfd749b054c90c03ab28d286fa
MD5 330167a596830f5499fb554970ac7efd
SHA1 d9a342bd543779bdf28208c3a26f01eb2c2eced5
SHA512 202ab0b69ca4f158192708804932dee3ddec9e5f960dc7daf18d9771ec4d968e6feff8ce208b997ac60a93bb9874abf087879945d8cd2becf651e207fe520366
SSDEEP 48:TxlW3rdYFvR5+fvRAjk0RJQtShYom9vzmF:lI3ZYVR5+XRAXRt1wv0
TLSH
T18FF243C713E97560E7B3027A94523FF00ABB9C4E8A7269E145E70C548DC1112867EA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDQConnectAgent-5.15.38.msi

Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectAgent-5.15.38.msi
Size 8.8MB
SHA256 0556d87036050a400b2e06c0daa575fc17770bd7dfc2bf0898d33a6fcdff5ec5
MD5 0bc9056310e893bb6c5465d45a541386
SHA1 2cdebec6f187bd8b5c0fc58f01275d8be9071254
SHA512 21d08150af892f6848330553a292c51987577f5c54622f32e4d63f6fc4701a6bc3ea58bc209bdcdb7f874d68e6198794acb8fc388bea40664dae53c0467244b0
SSDEEP 98304:m/TcDdN0/2UUYO1mUfq45yAy16s8WGr0AinTFB5WNd1ouUW328Pvd++jRBaFjTZY:mq0/YZB7YEFblYNmI+jRBGZzzW9z
TLSH
T1A6961108B2D40C6DD5A252348A5EF1109E32BC1C177C80EB6E76BDF97A3AAD093767D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDQConnectUpdater-5.15.30.msi

Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\PDQConnectUpdater-5.15.30.msi
Size 4.2MB
SHA256 59d506e5898b3cffa31604f1ad4c03587dd8b05fdceed9367283ae80d44572f6
MD5 24175e8005b9edc15946ee0703d546aa
SHA1 7da9f5dd3227e8b201ef04a45e51282f347ced36
SHA512 d47d7469937f9eb49d7f14012bb816a0a2aee43ddb2810036844b4d03a441a778032f60efea8ebcfc2ef07fe31767e4aca62c100f3d65469502cf21cea1fabbc
SSDEEP 98304:WwClByAUfZya8JAlXMAXDR7Tz1xM1FYIbQ4dTjytI/:WHIl8ilXMAF7VWcIHBMY
TLSH
T1DF16E01572A40CADE8A24239846EF120AE717C0D233C85DB4E767DF97E3AAD063767D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\install.log
Size 3KB
SHA256 d29b6adbc3da37a030a031208ea3dfa1d934391197d2bea5b091bd2282bfef63
MD5 e6ab039b995bbd4663547f555fe7a0d8
SHA1 1c1d6d0a31ef56bc247bb06a32524e4c466d6285
SHA512 526ab118f3100dfed2cf1849525d10421602ac97dedb473cef14fc61a65509608e29eb18ad808f9dc1576d3c0c0044b35adf7188d81a5a8744059d428a9b8e05
TLSH
T1828129262BD50C44B2B75B07A9B384115933BCD29D35DF4C3388835A01ABD05A97C3FE
MD5 SHA1 SHA512 TLSH

Submit Download

updater_install.log

Path C:\ProgramData\PDQ\PDQConnectAgent\Updates\updater_install.log
Size 1KB
SHA256 7cdaabda1ce0fc70d705088f62c48e75423c8f06ff78ba18948d5590fd6ce46f
MD5 763f451f3e4aa0d2937bd1b7ca8934d0
SHA1 4f837407fb999c722487498c67faf6c10876cffa
SHA512 2893c65fc4f3262c06b8b3e8ae6e2502e57f888380de163ee948671493465d1e3c293f09b3e3914ec7cdcf24a9702487d56309ae1e24ae3e00497e6c160cda7d
TLSH
T19131E4511EE50805B2B61787AEF7C4615A73FDE36834DF4C3348829E06ABD09686C3AE
MD5 SHA1 SHA512 TLSH

Submit Download

token

Path C:\ProgramData\PDQ\PDQConnectAgent\token
Size 86B
SHA256 1d525d451614514ee79396e65e084e1587ac4c70d5bbde9fdfd9812badc7f379
MD5 7a7f2cf21294cf4f15124848e8bd9600
SHA1 9e97e38cd6b912b8dd7a97d10def805989a055ea
SHA512 4ff8fead32ad07c9aeeb06644fc5f3c797cac8b764606ae1398255c036c6339ef019edc3ec0cccc046e93bbf7163193300468239c9b8a56e9d6137e75fa8b7c3
TLSH
T1EFA012C540DC06040F838442197DCB93C041193442B4ACB214F4539940400A55250103
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4329.tmp

Path C:\Windows\Installer\MSI4329.tmp
Size 573KB
SHA256 a7780c30f73ec0c286961f15598e1d360e8837e717b67ba6b3a6eb4ea39557a7
MD5 de21fbfcab260ec4cfa3e14ae988cf94
SHA1 6c9c2e3945ef1c370bddf3ed7b495fbbd9bc9bbe
SHA512 565bd738aa0c536eb98256ba4b15050b68b7477a3afc47d062100e3e3265abe8663d69e2da592da9f08aaf985e242f683619c33bb1ef1ade724659f41c7b35ea
SSDEEP 12288:e5r+haztpo5L2qsmNRHRWxFIqdYcl/XUDgx:e5rpvol2q1MLIqdYcl/Yq
TLSH
T131C4E15A77E80D79FD7B517988630606E272BC165730CBEF0360425AAF2F7C19839B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4A11.tmp

Path C:\Windows\Installer\MSI4A11.tmp
Size 394KB
SHA256 50bbf22db97433456a4307211b99641740f20a6421bcee32216fa888feaa7b2c
MD5 44e75952b658ffe4869cd40db1299c8f
SHA1 6bb94bf54f401772d2aa21a37f17b319fe0417b3
SHA512 bca6f5b4bc1f301191f713c7ecb5161ad8eedba6503ddee0ffc41b6e48c617c4fec19de22a63e139055ddba4fe4dae51505bb005b5cdad72d6684dfecd55c8a6
SSDEEP 6144:khMMdxm+3CharitB9vYS4ckdWUFQwwufBI8MnSVz9:khxdxdMaYYS4pdWUFkufW8Mw
TLSH
T1FE846B29F7E418EDE4B78276C4A68530FF75754D3320D5AE8BA8452D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4D90.tmp

Path C:\Windows\Installer\MSI4D90.tmp
Size 577KB
SHA256 ad4df7fe53ec5e2f8e77d0583db6146658bd8fd259f5d67c668830ce69a1ac93
MD5 2f1726ce364ff99f531c505fe8818e6f
SHA1 83d92163fb31fa93244f43b75abf1adab6dd52f1
SHA512 2b2243ed145e7234d9b1ebf0712e49a561df77fe8be4af4bbaba48b75f9b886d80fba2f2d75058d2de87293d3cc621975bca86fa63c2b9585893dd597c02e8d1
SSDEEP 12288:25r+hVznDY0MSt/jJYkS2ubDv/trvrrlwyEkY:25r4XVup2a/trvflwyEkY
TLSH
T187C4F14677E90CA5FC77923989634906D273BC115770D7DF03A08269AF2B7D1A83AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI642A.tmp

Path C:\Windows\Installer\MSI642A.tmp
Size 566KB
SHA256 a10d427605158347b634ecba89873c20a2ca2e30b18908c69b6339826b83fea3
MD5 d4c57dfa1d98b98bb9248f57b27435da
SHA1 e165fa98801bb4f11498e49378fe2ce15fa3189c
SHA512 eccb3dd8a52dfa3ee9186d4d786789388cf127f11e7bdbb4b60e18f3e28e77826ccb431519dbb03d05e3795895bd166ece10b61ac2e245ead161c436b90806da
SSDEEP 12288:P01JoVpRft4+YFzXPCUHhC3anxDIxSZtLj2B/jtD:P014zfiFD6u9xHZhyltD
TLSH
T19FC4E156B3FD09AAFC77563E88630645E672BC014730D6EF0360465ADF2B7D0993AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6787.tmp

Path C:\Windows\Installer\MSI6787.tmp
Size 413KB
SHA256 54febbd1f0a3875df16a4b88621cc0a10729b3c94b9a68639aab27d36fe39381
MD5 ee729e752fa4e2e8b7755a138a188463
SHA1 b0048f505d180d10feb1afa01cc4d3f5f15cf2a2
SHA512 41a90d86894fbb1386099a6cccab416d88e76a4cadf83a90f8f91cf196a0feea2a4ab91daa6828303d8706cf9141ca1249425dac1df13d5d9ebd8958db909ba8
SSDEEP 6144:0JqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxR:SqjGaYh3UGgFjKgZF35VijuoYg
TLSH
T1E6946B29B3E418EDE4B682B6C5A78034FF75744D332095AF87A4952D1F3BAA430BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6882.tmp

Path C:\Windows\Installer\MSI6882.tmp
Size 579KB
SHA256 988f34749dc59284bd4171cbd5172a22fd3d954053c0268744d7920d9672facc
MD5 ca9519e37adadaba234c67b1c52601f2
SHA1 0de22ee5bbbbfe2b4769e4a6fe4e8cb948b5e797
SHA512 33429534ba5f2811c7b0afbce0ea6dff28de42322abbe18da616d47fa404c89684f384f73cb942a1ca209749af35c5955e93a4082b2689c7eb28cd067fc95708
SSDEEP 12288:/01Jo3Fl9C7nFByz0iEWyDI6lst5lXL9yAw1+DODo:/01ChwfnXWyXlw5lb9y7jDo
TLSH
T1CBC4F14573E91DBAFD77923988634655D2727C110735CBEF03A0029ADF2BBE09939B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI791E.tmp

Path C:\Windows\Installer\MSI791E.tmp
Size 1.1MB
SHA256 99daed75b6e64725ea20fe5c376b80b7865836f4f04624a76f0db2b4d0e7a2bf
MD5 c160dea67a9e89495f32eaad0f7a6b39
SHA1 870e6107f1c85f2a45e2cc83b562c59debdf6456
SHA512 cd26b977dbf65723c7a51d17b4b56cea4c9630dd349fcfff2c83d3b9cb3c51ac2732ce27a77fa76694e39ea75f6b4d0cc9393a2dd1c8ea81f926433e3c3b6a49
SSDEEP 24576:P014QfiFD6u9xHZ49qRqnKKZj2zzrB9iE9yw4:sCQCD79lBReKKAr5yw4
TLSH
T19845124A73E50869FCBB917A8963478596727C411B30DAEF03A0466ECF3F7C0953AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9378.tmp

Path C:\Windows\Installer\MSI9378.tmp
Size 1.2MB
SHA256 7cb1d760c7b79dd43db71d275ac52bd87938655170d594c0c2b704a64b54883d
MD5 eb2e9bda5dedde7cb0d7d0762f4bb2a3
SHA1 0ed738a4a0586a7075a2666dd65c8c38290512e9
SHA512 5be5bfd9312b450033962bf5417f67f6b7a9f0d4ccb035f9563728b94e451a9f3b4b08a1a7f1bcf0c7c1df386cdefbc9178c237417c3373a23ef66e80db10228
SSDEEP 24576:/0106uAThqtrCLWdFn2UisTKZxcM9zOOxGDXMEdnj0nI7V+12u:8e6B/u2LQKZptxwX3n+12u
TLSH
T10845124A37F80979FDBB513988634505E6B3BD510B70D6EF03A0461AEF3BB909536B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA143FCD146A4EFB7A033354568304E659\CustomAction.config
Size 980B
SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
MD5 c9c40af1656f8531eaa647caceb1e436
SHA1 907837497508de13d5a7e60697fc9d050e327e19
SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
TLSH
T1E2111C2C85E4F92B9A325A533A208896EFB0A1B2A174510CB09FBA170F720CE8257325
MD5 SHA1 SHA512 TLSH

Submit Download

WixSharp.dll

Path C:\Windows\Installer\SFXCA143FCD146A4EFB7A033354568304E659\WixSharp.dll
Size 685KB
SHA256 cd978711231d2729e6ba4b5ef84236f671a7a40b7ee29f65b4e0f8ea5e06348f
MD5 86e26888f15860835a2ff1423f25a513
SHA1 429cc9a7ab03804db6a510d514e06e03a6df5f7e
SHA512 375079e65650d511376da5a28dde71216c956159b68e8e9da1af3ee59782c29ed13fd4e77f8d1182446cc4be41a5d380e7528aec0975e3db9e7bfff8c7333d35
SSDEEP 12288:fUFSMfXjXj2jVj0jVjbjLjljhOBjFj1jMjmjKjYjcjDjGj0jAjXj0jBjCjTjyjD5:cwMLzYBuBHXxkRh2ocCm/Iu6zuNEvUDz
TLSH
T148E45A0227E85666E5BF2B3CE8B466058777F8069932E74F568894ED0EB3784DC10B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA143FCD146A4EFB7A033354568304E659\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 cdd7f34dda1180f21205543c8ee836c5be66060d94441172366bce078e1cdb87
MD5 7a9f5179ec8e7cc6ab0549ca2f840b93
SHA1 f0193d65259dbb266e8bcf092a9f10218808a0e0
SHA512 ceb348aed28245959d1fa0132aa628324070e8c3d7f73a014beab34098e2d1c9c41fc1ebac0e1cf4489f8d0f7dac991e8ae4d462bbceae5547135955e8d67843
SSDEEP 3072:FOf7tVL+l4lj19l4uDHY2j69UgoTqddqmCnfKlRUjW01KyKwPXCm3SEtPxnU:FgQQx542j6jomdKgz6nU
TLSH
T1D3149D2A57F84B3ECEFF8778E2A14252C7B1F1E27103D71D5D8281A62163394B692397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdqconnectagent-setup.exe

Path C:\Windows\Installer\SFXCA143FCD146A4EFB7A033354568304E659\pdqconnectagent-setup.exe
Size 24KB
SHA256 d2c7a656fe448e1ae3e9cba77198f2f687d8a24f5022c77e0060f13a9a06ea51
MD5 8712a4337c8e63964f77139daf0c63a2
SHA1 ca3cd08a12e9c969edbcb3d569ef9216d6a01b95
SHA512 50627a513e87cc8740c2c53ba16960545486c0335f405d25328e318cbfda8b336dfa3797fe37fe9474bb88f0bae366265e2ab96ff709efe538b9d3ac69433f23
SSDEEP 384:CSxdesIXbIaz7ASxt7HACNyEIYi2mL4/y8RLLIvb:bm7bD4SDM/YiDLk51Ly
TLSH
T1BEB26C5263E80829EE7B6F357DF291215D31FA566860C5CE3088808F1F57F806EA1BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Mba.Core.dll

Path C:\Windows\Installer\SFXCA177C404E6C49201A08A239E55AEC550A\WixToolset.Mba.Core.dll
Size 165KB
SHA256 7ac0cd1434327758142883d1eb90a5421c2862c09b84cb9780ae5be1be3301af
MD5 ec393b51456ee6ae6c3fa9bd840ec783
SHA1 b5e4de49d8e1528242e0983a9821563d5353cf61
SHA512 1fbd5d534aa787baf6a63fab686b5b2686e410c919a82b54495a3a3e7c6601fb8712d800eeefc766990e590adeafed21f6b1f8e23e9f05dd4cf14bd90a27cdcf
SSDEEP 3072:ZqzYZ685Vo818ywNzQ0Opiunb80abDrPd:ZoiEXOplo0+1
TLSH
T1C9F3F729039CACBDC68A0F3DA0D1847586B4EB1D58D1E3A59A01FBFB3523F981D135B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdqconnectagent-setup.pdb

Path C:\Windows\Installer\SFXCA2D4A5119594AE13927D71693F7AFF5A4\pdqconnectagent-setup.pdb
Size 73KB
SHA256 9782f35358f48d87e7b4025f3e169ce49983d87d01f433996e9e67f000d46ce2
MD5 948d3cd5d0acffcffecd80dd99976626
SHA1 eb1fc877d3b46faa039710f883144362f6c49786
SHA512 ba78eac06498d4389f268992b747ef6ab7cb2139cdcab435b19e04bc828396a810b20d858ef0265645f2a5395d4ce0483593fb0a8bad448d64fcd4729466a3f6
SSDEEP 768:hFvuybuy7D8hkRJ95sw18+M0a4l5oqKusH4UzANALD8hkRJ95sO1:hZ18h0aQHKJYgoW1
TLSH
T1CD731E1BBB44CA32D8559BF1129B4F7D5634EE4A878183CB6388716CAEF334A1D86394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.dll

Path C:\Windows\Installer\SFXCA87D0C791434B1F1A08AC98BFD0EC01E0\WixSharp.dll
Size 689KB
SHA256 8fced4b20ba39f8aacadefd9b2a60aaddb1823b516d452b0f62dd1fe8c335c2d
MD5 2457c81b6fba66731b5294341a839877
SHA1 ccbed50c7758749422bc9cebb03a296c4eec233d
SHA512 57cdfa9687ca60a43d5ad2783b723eb751638c8a2901e8bdac02a1033017565e1692d6e81315afef9414574e9d4400400da5fcf1a7e21eea3e5adf63d0bf63d3
SSDEEP 12288:9obAmMDkFj9Xq2adWD3zaDfJMMPm1Uby7zc+IaoMLFxicAhseX+fR1Yjd:lmrtTamP2aoMLFxicAhs2yR1Yj
TLSH
T155E45A0223F88925E9BF6B3CEC7521055777F806A936E74F2A88E4ED1E62740DD10B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixSharp.UI.dll

Path C:\Windows\Installer\SFXCAA06F12A325499AEB78BDD81A829FF54B\WixSharp.UI.dll
Size 707KB
SHA256 3a06121020c53c5e40183be331a369028433b5f2e96a1f71ab1684043af13cc3
MD5 88e091eae42d61ce29b2c4219bc278ae
SHA1 dfe35f6e203975e31c181e7b6a7f8ab1ea116205
SHA512 fd67fc60fe840711a3ad27b8f78b0cb4db2dd8e120cfcd8721818304ed45d1fa6527561d7a3c4bd0101e8b0f6dffeef273d4f1aa6e1205da5810a82dc07e70e6
SSDEEP 12288:egyz2KnLuZjDk13oBOk3ptdPucKp/zSm9YHIewnTk04KMnSuOlK7QLggsdZvm453:4y3wTk04tSjKBZvm45t5Q7WWFM2stty
TLSH
T151F4DF0D36EDDE22D57787F0AAA001090334D15BCB37DAFAF88504D61A66761867BFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdqconnectagent-setup.exe

Path C:\Windows\Installer\SFXCAA06F12A325499AEB78BDD81A829FF54B\pdqconnectagent-setup.exe
Size 49KB
SHA256 dadd4d01afc770659a4c0e8901fd93d399e6eebc7bf2f5a550227b5eadb5a213
MD5 c9ccb6cdd9e309fd8f5eaf6beb9d5347
SHA1 77bf0ac396194e0bfb143bab94f1b4f798abb7f6
SHA512 e3a578e6bfa00b17301e9277f2615e5fe51936e8136e6a2a54ea39741f36d9a9a3bcd9232550ea86ce58b329934f248f9ef6465b8224e8edc6f26c7cd12214bd
SSDEEP 768:eSG5Ng5uPj6Wp8Nde+BHbWeX6mDjP8NqPknYiDL9rA+/rEDKl:JD2Vp8PbdX7jP8bn7frEDKl
TLSH
T14633090172E81E27E9BA9AF229B415114BF5F9162820D3CD5CC660CF0AF7F845AE1F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593fc0.msi

Path C:\Windows\Installer\e593fc0.msi
Size 4.9MB
SHA256 37f2c4607a1fad32eda76af2514588cd704b5d5ee83ceb93c14bf10b33c1c8f3
MD5 cfda340fa82d1b5f33cf82ae5070fbf4
SHA1 1702b75976ef12eca324e341f91d90643bb3568e
SHA512 39d973a72c97eee42d14f603b4f22a593fa647a24389c7025624d58ffc079d40676c0a41d6191531c6acd72af0a86f6402eb3a898a60ef56d3ce6548585ae17c
SSDEEP 98304:iaI+R+g7rDoHeQufnPW/X423wED86HWKFIIKU5ctwAnlOAs2s6:iArDo+pfe/o2CKWKFRl5MW/6
TLSH
T1BD360115B6940CADD8E64235846EF115AE32380D273C86DB4E767DF83E26ED0A37A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_icon.ico

Path C:\Windows\Installer\{0EC05CD8-8D17-472C-86DA-AF1EA317056F}\app_icon.ico
Size 278KB
SHA256 21b0a4a7d60c8328f6987c1c9ae2773772100c08cf2123cf73c99376ffd9721c
MD5 b17911403313b8ec4035bf1ac1089dc1
SHA1 ce926a858f35611a5238a1c71da38a92b328f836
SHA512 5eeb80234bfd44ecad026df563a355134c18aae1861679045b73271f07a3c6bcc8d9d5f5a289a608a4bf8d09ff9d090b43406f3748d37e3100117219146b8fee
SSDEEP 1536:X7GUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUx:r
TLSH
T1E054CCA83A489E5DD4E2963E716CF2559CA4655E117C4AEACF3BBCF13989CE393003C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_m1bzwb0n.ens.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_m1bzwb0n.ens.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a8604f7584629aa2e786b095bff3127e85b1796daef7fda26ca34eb79608e1f5
MD5 5c8891b89c190cbd4086f28cf9fd6bc0
SHA1 30be1293a158211f5117b85464b93e3883b24498
SHA512 17196e32cfd04a8aed25e80ce2c99c4acd6db3ec68ea213328771c57730f14abc86ca2a42bf2882f0cfd228a8ceb1668e9722c42ff961336edaa35eab2a04f05
SSDEEP 24576:VFo3DMPtdoO/vvTL/SQuOCVAPbeEl7pd0josdzQ2YLAaJZP+sohm+nEf6OA:dHA
TLSH
T18457C32436F92210E7F79E3DA8F06A27893A7D5B9C15DE8D05411B4E0822F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e889d8f8-9c83-4e8c-907a-7b1652f94abf}_OnDiskSnapshotProp

Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e889d8f8-9c83-4e8c-907a-7b1652f94abf}_OnDiskSnapshotProp
Size 6KB
SHA256 dfac789f22db76714d52c4cf303b7c7c0d9252ccc42555d340130f598bc228ac
MD5 b8d4600de40f08494ce05ff3b3c04d3c
SHA1 087825dbc1df22ba9fc863c7ddeb4aecc8f32ec2
SHA512 0575967699111d9c76338b9e01f12a6d44e183bd0dbc9e65ba177b23aa9fdeac29b200b8694318fa25600be51fd33359f820d08e017b52bd87da091445e0b082
SSDEEP 96:FjZHLLvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:rbb++uVm
TLSH
T1CBD19B085AF54711E2B3AB7128F54557A477B811EF33CB8E0198238E2671A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-157-0x0000027EBEB80000-0x0000027EBEC32000-memory.dmp

Download

memory/2540-19-0x0000026ECB2E0000-0x0000026ECB314000-memory.dmp

Download

memory/2540-21-0x0000026EE42A0000-0x0000026EE4352000-memory.dmp

Download

memory/2764-310-0x0000023E85E00000-0x0000023E85E10000-memory.dmp

Download

memory/2764-312-0x0000023E9E060000-0x0000023E9E118000-memory.dmp

Download

memory/4232-465-0x000001ABCC420000-0x000001ABCC4D2000-memory.dmp

Download

memory/5440-442-0x000001394BA60000-0x000001394BA82000-memory.dmp

Download

memory/5440-445-0x0000013963E90000-0x0000013963EAE000-memory.dmp

Download

memory/5440-446-0x00000139641D0000-0x0000013964282000-memory.dmp

Download

memory/5440-447-0x0000013963E80000-0x0000013963E8A000-memory.dmp

Download

memory/5440-448-0x0000013964410000-0x000001396443A000-memory.dmp

Download

memory/5440-449-0x0000013964410000-0x0000013964434000-memory.dmp

Download

memory/5796-483-0x000001FF6EC90000-0x000001FF6ED42000-memory.dmp

Download

memory/5868-42-0x0000021F989F0000-0x0000021F989FA000-memory.dmp

Download

memory/6016-179-0x0000012E7FD00000-0x0000012E7FD08000-memory.dmp

Download