Analysis
- max time kernel
139s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2023, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
6309e1.msi
Resource
win7-20231023-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
6309e1.msi
Resource
win10v2004-20231023-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 6309e1.msi
- Size 4.1MB
- Sample231127-r4qmsshb67
- SHA256 33a57eed92fa4acf1be788ce387d0f6f3804aab316d04bcfe8b43cccaf08bdbf
- MD5 9159f9fb42365dc0a492ece7ec9aa546
- SHA1 8b8426ade01c916bb1f08f69dee611d4cd2379b5
- SHA512 d40dcb370495edfe29c4eb488f7ca628a284a69de1d0aa8485d1c92659ab4a80839ce773f1f8b938f2333587019cb42831dd6ea2e349ae4bf7d096a09da657c5
- SSDEEP 49152:2DxTgxjSwdT55PZUdV0Du9WsVFPLYLeyCtw50kqKKAf5Q8+5eNBA:bxjSwdqswLYKy0wpqKKAf5Q
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
test101234
Attributes
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
yykdmh0r.life
is45ipqt.life
btycmaq0.life
bei9dppm.life
3jhcm6ou.life
1q04n1r6.life
10ciy2hb.life
11ou1grl.life
83b0leyy.life
t31jn4t1.life
b24f19ne.life
igak9l9s.life
hkgd9kar.life
02uhomlq.life
zpy1vssg.life
j57fzy12.life
zmlly8xo.life
pe6r5tzc.life
cg4cuoyi.life
pyjijjlm.life
m3vc2ce4.life
p1p97dov.life
ep0kbvph.life
0rlxan4o.life
zdx0i18o.life
7kmzys39.life
e97igyz6.life
hjcbhzd8.life
az77sw77.life
d0k4fdaa.life
c9l8ri53.life
ay03u2te.life
t99iv15x.life
6a1fbhay.life
zna5lybe.life
vxyojl27.life
mddoknvi.life
2z2dl1og.life
vojg90l2.life
awr5omre.life
tcjcv520.life
aqjjchti.life
6qwim2j8.life
1p34o0do.life
8hxwl72r.life
wykpnxcx.life
o10qz4xe.life
7564a2mg.life
aiv8bb2b.life
jwyxm0f3.life
4soexc4m.life
3xqy6csn.life
3k8iq1nb.life
w2hje2t7.life
fra3xqrx.life
4r3inwrt.life
qhfoevow.life
a9nhflze.life
jpngew6a.life
baunjh6t.life
yqofro9q.life
uq034w07.life
oq36weoi.life
vv5sfo80.life
0req10rd.life
m4v4xq2f.life
1p24echu.life
ohwv1vpp.life
z2tp7x2v.life
q65io756.life
-
dga_seed
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
rc4.plain
Signatures
- Loads dropped DLL 5 IoCs
pid Process 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4892 MsiExec.exe - Blocklisted process makes network request 4 IoCs
flow pid Process 44 4892 MsiExec.exe 54 4892 MsiExec.exe 56 4892 MsiExec.exe 58 4892 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4892 MsiExec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI8BE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI944E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI94DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9644.tmp msiexec.exe File created C:\Windows\Installer\e588ac6.msi msiexec.exe File opened for modification C:\Windows\Installer\e588ac6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000064ad0c2742b1dab0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000064ad0c20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900064ad0c2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d064ad0c2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000064ad0c200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 4312 msiexec.exe Token: SeIncreaseQuotaPrivilege 4312 msiexec.exe Token: SeSecurityPrivilege 4636 msiexec.exe Token: SeCreateTokenPrivilege 4312 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4312 msiexec.exe Token: SeLockMemoryPrivilege 4312 msiexec.exe Token: SeIncreaseQuotaPrivilege 4312 msiexec.exe Token: SeMachineAccountPrivilege 4312 msiexec.exe Token: SeTcbPrivilege 4312 msiexec.exe Token: SeSecurityPrivilege 4312 msiexec.exe Token: SeTakeOwnershipPrivilege 4312 msiexec.exe Token: SeLoadDriverPrivilege 4312 msiexec.exe Token: SeSystemProfilePrivilege 4312 msiexec.exe Token: SeSystemtimePrivilege 4312 msiexec.exe Token: SeProfSingleProcessPrivilege 4312 msiexec.exe Token: SeIncBasePriorityPrivilege 4312 msiexec.exe Token: SeCreatePagefilePrivilege 4312 msiexec.exe Token: SeCreatePermanentPrivilege 4312 msiexec.exe Token: SeBackupPrivilege 4312 msiexec.exe Token: SeRestorePrivilege 4312 msiexec.exe Token: SeShutdownPrivilege 4312 msiexec.exe Token: SeDebugPrivilege 4312 msiexec.exe Token: SeAuditPrivilege 4312 msiexec.exe Token: SeSystemEnvironmentPrivilege 4312 msiexec.exe Token: SeChangeNotifyPrivilege 4312 msiexec.exe Token: SeRemoteShutdownPrivilege 4312 msiexec.exe Token: SeUndockPrivilege 4312 msiexec.exe Token: SeSyncAgentPrivilege 4312 msiexec.exe Token: SeEnableDelegationPrivilege 4312 msiexec.exe Token: SeManageVolumePrivilege 4312 msiexec.exe Token: SeImpersonatePrivilege 4312 msiexec.exe Token: SeCreateGlobalPrivilege 4312 msiexec.exe Token: SeBackupPrivilege 3840 vssvc.exe Token: SeRestorePrivilege 3840 vssvc.exe Token: SeAuditPrivilege 3840 vssvc.exe Token: SeBackupPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeBackupPrivilege 2204 srtasks.exe Token: SeRestorePrivilege 2204 srtasks.exe Token: SeSecurityPrivilege 2204 srtasks.exe Token: SeTakeOwnershipPrivilege 2204 srtasks.exe Token: SeBackupPrivilege 2204 srtasks.exe Token: SeRestorePrivilege 2204 srtasks.exe Token: SeSecurityPrivilege 2204 srtasks.exe Token: SeTakeOwnershipPrivilege 2204 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4312 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4636 wrote to memory of 2204 4636 msiexec.exe 100 PID 4636 wrote to memory of 2204 4636 msiexec.exe 100 PID 4636 wrote to memory of 4640 4636 msiexec.exe 102 PID 4636 wrote to memory of 4640 4636 msiexec.exe 102 PID 4636 wrote to memory of 4640 4636 msiexec.exe 102 PID 4636 wrote to memory of 4892 4636 msiexec.exe 103 PID 4636 wrote to memory of 4892 4636 msiexec.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6309e1.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4312
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F94DC99D4D39F28CED2429BC42F79E952⤵
- Loads dropped DLL
PID:4640
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8E0232315172FB1357092ABB2C7963912⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4892
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Installer\MSI8BE0.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI8BE0.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI92D6.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI92D6.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI944E.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI944E.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI944E.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI94DB.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI94DB.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI9644.tmp
- Size 2.1MB
- SHA256 353fda6e116118809b49dd3001ee532ddfacacaa40a43b951c9f1dd69c8e7491
- MD5 b6e50a33a2f3caa5346db94ab198ee99
- SHA1 3734be87824bdce42c6f83115fde40a82bb42615
- SHA512 e849b0bf1b49030bc21584384908fd44a6400a1db8ad75dbc9241d53765dca4b0e9407838ee20945e038a23e70e02b74903ed1109e0c0eda5d2d2f044a9d6ad6
- SSDEEP 24576:UpdkybQ1gsfT4UQClJlSGLYWI46rupRC+arczUPOb4fnOHDfEhyijMJhJSqLAcJX:eu9WsVFPLYLeyCtw50kqKKAf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI9644.tmp
- Size 2.1MB
- SHA256 353fda6e116118809b49dd3001ee532ddfacacaa40a43b951c9f1dd69c8e7491
- MD5 b6e50a33a2f3caa5346db94ab198ee99
- SHA1 3734be87824bdce42c6f83115fde40a82bb42615
- SHA512 e849b0bf1b49030bc21584384908fd44a6400a1db8ad75dbc9241d53765dca4b0e9407838ee20945e038a23e70e02b74903ed1109e0c0eda5d2d2f044a9d6ad6
- SSDEEP 24576:UpdkybQ1gsfT4UQClJlSGLYWI46rupRC+arczUPOb4fnOHDfEhyijMJhJSqLAcJX:eu9WsVFPLYLeyCtw50kqKKAf
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 1bede9161568bc5bcb39e5810fecc93f875eb222bf284068384638b5fbafd906
- MD5 7994c688249f87a2310ed41d91d4cb24
- SHA1 a1a53d63cef2033541082c28ebc26db99aae7fd2
- SHA512 6d7c74f99f8f31f76d37066e22bf63e5caee1843efe0deced1b89a78f99003a14af69f7bf721b9e3d46a1bb13d49c4b6ccda9aaab0c68a8db967b3f1aeabaf8f
- SSDEEP 24576:zjdmqn+UdoO/vvTLkD2OAF7boBYzW39TMRQN0YKgjNa7vm+mIj3lVPU8q:L
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{c2d04a06-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{23c66889-5659-4ed0-8c44-7876a34b9946}_OnDiskSnapshotProp
- Size 5KB
- SHA256 4602798aa105b88851de1807a906e8a63683da527d277914871854df3262a7ba
- MD5 84069d52dcc9df8f7222cb40e05699c6
- SHA1 7b933e04a51051dbd3629c003e4f0cb99a7b72c5
- SHA512 37d980ac44adf6ff428c829dd8e1981b46cc2ff36a076cc22a0c464397682fbeb939afa91706c6e2677d2ecc544c7bd6704004dd3f26de5cedade8fdae637938
- SSDEEP 96:F+FS6jnB4/DD84LTHzbOHXOHBlBRQb8S89XE56tZSVQEJN:IF4b++G1pN
- MD5 SHA1 SHA512 SSDEEP