Analysis
- max time kernel
205s - max time network
203s - platform
windows11-21h2_x64 - resource
win11-20231215-en - resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system - submitted
31/01/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
doomday.msi
Resource
win7-20231215-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
doomday.msi
Resource
win10-20231215-en
windows10-1703-x64
11 signatures
300 seconds
Behavioral task
behavioral3
Sample
doomday.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral4
Sample
doomday.msi
Resource
win11-20231215-en
windows11-21h2-x64
12 signatures
300 seconds
General
- Target doomday.msi
- Size 3.7MB
- Sample240131-tkv5aagah2
- SHA256 ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3
- MD5 426a59cd5e215e9f3696c1dcc8455d20
- SHA1 255d113da1dc32c3b341e643c01e9f5a13e060de
- SHA512 4b684a97aa6d3b08459b69fb610b6ad5458de56c056f79e91e164cd8914f58ed8734ea4493bbac42c18982a80ffea30d6ba4306ef722bafc49debd4b0f68540a
- SSDEEP 49152:TpUPbczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZ:Tp1BB7nxOtFjfBwpOff4BmCk2Zl
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 464 apdproxy.exe 3788 Autoit3.exe - Loads dropped DLL 6 IoCs
pid Process 3208 MsiExec.exe 464 apdproxy.exe 464 apdproxy.exe 464 apdproxy.exe 464 apdproxy.exe 3208 MsiExec.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 2328 ICACLS.EXE 4460 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF0930E8784D8DFE60.TMP msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e57ecd1.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ecd1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{6D256197-E4CE-4F1D-A41D-04EEE888AB02} msiexec.exe File opened for modification C:\Windows\Installer\MSIFA60.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFC66043858201F3C5.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF4595A4834681033.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIEE29.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSIFA5F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1CB82F3D245CE599.TMP msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0cc323fcaa8ba2e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b0cc323f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b0cc323f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db0cc323f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b0cc323f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3924 msiexec.exe 3924 msiexec.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1156 msiexec.exe Token: SeIncreaseQuotaPrivilege 1156 msiexec.exe Token: SeSecurityPrivilege 3924 msiexec.exe Token: SeCreateTokenPrivilege 1156 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1156 msiexec.exe Token: SeLockMemoryPrivilege 1156 msiexec.exe Token: SeIncreaseQuotaPrivilege 1156 msiexec.exe Token: SeMachineAccountPrivilege 1156 msiexec.exe Token: SeTcbPrivilege 1156 msiexec.exe Token: SeSecurityPrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeLoadDriverPrivilege 1156 msiexec.exe Token: SeSystemProfilePrivilege 1156 msiexec.exe Token: SeSystemtimePrivilege 1156 msiexec.exe Token: SeProfSingleProcessPrivilege 1156 msiexec.exe Token: SeIncBasePriorityPrivilege 1156 msiexec.exe Token: SeCreatePagefilePrivilege 1156 msiexec.exe Token: SeCreatePermanentPrivilege 1156 msiexec.exe Token: SeBackupPrivilege 1156 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeShutdownPrivilege 1156 msiexec.exe Token: SeDebugPrivilege 1156 msiexec.exe Token: SeAuditPrivilege 1156 msiexec.exe Token: SeSystemEnvironmentPrivilege 1156 msiexec.exe Token: SeChangeNotifyPrivilege 1156 msiexec.exe Token: SeRemoteShutdownPrivilege 1156 msiexec.exe Token: SeUndockPrivilege 1156 msiexec.exe Token: SeSyncAgentPrivilege 1156 msiexec.exe Token: SeEnableDelegationPrivilege 1156 msiexec.exe Token: SeManageVolumePrivilege 1156 msiexec.exe Token: SeImpersonatePrivilege 1156 msiexec.exe Token: SeCreateGlobalPrivilege 1156 msiexec.exe Token: SeBackupPrivilege 3496 vssvc.exe Token: SeRestorePrivilege 3496 vssvc.exe Token: SeAuditPrivilege 3496 vssvc.exe Token: SeBackupPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeRestorePrivilege 3924 msiexec.exe Token: SeTakeOwnershipPrivilege 3924 msiexec.exe Token: SeBackupPrivilege 1544 srtasks.exe Token: SeRestorePrivilege 1544 srtasks.exe Token: SeSecurityPrivilege 1544 srtasks.exe Token: SeTakeOwnershipPrivilege 1544 srtasks.exe Token: SeBackupPrivilege 1544 srtasks.exe Token: SeRestorePrivilege 1544 srtasks.exe Token: SeSecurityPrivilege 1544 srtasks.exe Token: SeTakeOwnershipPrivilege 1544 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1156 msiexec.exe 1156 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3924 wrote to memory of 1544 3924 msiexec.exe 85 PID 3924 wrote to memory of 1544 3924 msiexec.exe 85 PID 3924 wrote to memory of 3208 3924 msiexec.exe 87 PID 3924 wrote to memory of 3208 3924 msiexec.exe 87 PID 3924 wrote to memory of 3208 3924 msiexec.exe 87 PID 3208 wrote to memory of 2328 3208 MsiExec.exe 88 PID 3208 wrote to memory of 2328 3208 MsiExec.exe 88 PID 3208 wrote to memory of 2328 3208 MsiExec.exe 88 PID 3208 wrote to memory of 560 3208 MsiExec.exe 90 PID 3208 wrote to memory of 560 3208 MsiExec.exe 90 PID 3208 wrote to memory of 560 3208 MsiExec.exe 90 PID 3208 wrote to memory of 464 3208 MsiExec.exe 92 PID 3208 wrote to memory of 464 3208 MsiExec.exe 92 PID 3208 wrote to memory of 464 3208 MsiExec.exe 92 PID 464 wrote to memory of 3788 464 apdproxy.exe 93 PID 464 wrote to memory of 3788 464 apdproxy.exe 93 PID 464 wrote to memory of 3788 464 apdproxy.exe 93 PID 3208 wrote to memory of 4460 3208 MsiExec.exe 95 PID 3208 wrote to memory of 4460 3208 MsiExec.exe 95 PID 3208 wrote to memory of 4460 3208 MsiExec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\doomday.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1156
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADB3672C9CDD8F8ACC139D4907171CA52⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2328
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\apdproxy.exe"C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\apdproxy.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3788
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:4460
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files.cab
- Size 3.4MB
- SHA256 b860f09732fad08ddb048b0322bc5df1a61fe7859dd91f6ca769a972bac4f5f3
- MD5 2bff42a75bcda5b313b7b91261c9d85f
- SHA1 de1be1be23a3c1d6b410c6af154d19e1e15da388
- SHA512 1056f0b1e68b4030d916cdff8fe2c1b20110fa05db6457aff6b10b93ff27c7f16eb8506469746fc19e67556ed21af094afdbaba5f1ee56f5c4c2c74a96e4bdaa
- SSDEEP 49152:ZczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZU:2BB7nxOtFjfBwpOff4BmCk2Zlu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\MSVCR71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\apdboot.dll
- Size 931KB
- SHA256 51d197826bb62d23d4d926c914409ea8c66de149418cdd43137ddf1cafffe347
- MD5 884e21631c0b78aea630fbe540d84778
- SHA1 a9f4eea988debc35d0aa60efbdee6708c2cc1655
- SHA512 2ab6994e822f6174f10264c70d02857a8eb47ddc9f10b414f2e314d5f5d996bd50886a47f58eafffec6f8b823b6d14715320a9f6e332934801182d57e298b714
- SSDEEP 12288:8CwXI/iPKmldxkIR+BCm8LJJKx2jKuIHTMWiXZU:5wMmlPd1LJwx2jK9oZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\apdproxy.exe
- Size 62KB
- SHA256 a16b93c374e77f98889d7ad7f38b2282dbc5a40511541b9105b1dcf9216c3cf3
- MD5 fc9e59fe8bc4fe05382cff5c8fc59de1
- SHA1 69423bc900644a910936d2c5828348d188e5d750
- SHA512 1d34be70cd701b606873aaf6910ab7fa7a3c4a81e0398d9bdcf8e8aac3dd63ec888c478e45600bf7e34301bec231038e8dccb457e49db8b5ff1c0740b68d072c
- SSDEEP 768:oSGP0wWfldXbYnoHbzrzHKSi90hHVKIYl2PN+iTre/S/Mqnzh9SLiB+L8rhOFPC1:oSGPGSwPPH9Kq0qzXrElX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\msvcp71.dll
- Size 488KB
- SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
- MD5 561fa2abb31dfa8fab762145f81667c2
- SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
- SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
- SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\files\sqlite3.dll
- Size 1.6MB
- SHA256 b6c0d1c8dfb907ce2d5bc7e493cfb1c5e1940f200475327dded1d3390c1d5c96
- MD5 13914f35fce12f03d0a3f3eda68b1b8e
- SHA1 5490e690e87d944bf5186d13e5f3a5a23d0c350f
- SHA512 ac06235fd132b36a80979f34aab4b382de3e33f0d91cdc8a94c9da09e7fbd65c13ae52dcf191671e46d9f390e62471a2c509fee81c666f4904e4a2e231e4d0ce
- SSDEEP 24576:sA+tZvFgx79B0s7OPkLZWoPxOz4J6BjC4y5oQAnTuXWfQwiN:sHFm3Gs7OPkUc6BjClynny5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\msiwrapper.ini
- Size 440B
- SHA256 34bd89ef70361468defecfa850963ebfb08095e3a55b3f77e36284ea016af76b
- MD5 515480fbdf28bba4d40dddfd66f256ec
- SHA1 a5561633a6ef5e392030176e0fadda8e8957fc34
- SHA512 e7d9cbc29cf5e6dc60a120ab13d46ed7aa69dec234f4c32fa02f8d3ca810fdf9214957abbe35fefadf0dd10a2a0412479adcfa140d0cb79f7855edccda72753b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\msiwrapper.ini
- Size 1KB
- SHA256 b63088d5d02bc78f2285693aa6302f5a637c976d8eee4a15e3ec6920d4549a46
- MD5 32746a96f19490a980a014e0655a8145
- SHA1 b2d7db2cbff16b9a98f66ed5f7878193d35d9c2a
- SHA512 ab79dab325ee706d65eaedc877252a8997dcd4dca0d6d6f2e0f7d47fcbe0e0449ca17aad8f3ac30e1f24b07dcf722dec78be9143186a61b2a5029e16e7c8912c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-b56f947e-54e6-4c8c-afcf-57384f6e6dbb\msiwrapper.ini
- Size 1KB
- SHA256 01be8bde8cca947076be315ab005feba5b7a467e0ed389b41eea9f5cb8be108e
- MD5 a4aac5b2c3781ded128ab96062248114
- SHA1 6cf929daf12c612af216d7e67a6b733e908641c2
- SHA512 b5ae5a5cbf2176db3e7957bad091ae7f56364887bd02ed5103b2b0a92666de54ff9bc7c8f0e8a459c9b317669767eefccf64819e362e0ca4bf7d29a545cb7d48
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIEE29.tmp
- Size 208KB
- SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
- MD5 d82b3fb861129c5d71f0cd2874f97216
- SHA1 f3fe341d79224126e950d2691d574d147102b18d
- SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
- SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 12.8MB
- SHA256 2df0dec8574af143c84dbe35999c7d1e74e6887dd304b607eab6b4b612a02103
- MD5 ffd1dc6663ac7283ceb52fb68a3722c5
- SHA1 4c01a8000deb7c2f7c01ef065680a8ee382523ff
- SHA512 48953d2bffd692ce0a3cfe527abe578f05814ea72a82d507e9cd14f96e244743c549a25969ab2ad8b6c9dc2843addb7ef1c381ff499b070f43613aca0e1d92bd
- SSDEEP 12288:+0l12wSH9QlO/bLnjwccHkW1TxV6GpZIKqBcvAPWH8WEmkoHdXS3LHuUGbDVdWxz:1BSdoO/voV6GKZIKj5Er7BT3zhzSBP
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{3f32ccb0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{37d59339-77a4-40a3-8257-b9445e7753ef}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e654787bd7de53711163bcebafb54b9e6f34a1b222e38a963a6bca4cdb784adb
- MD5 cecf97f68e1f88a02879c5089e2929cc
- SHA1 85c943cfe48536c7232396a1ac6db5e19a6fc7c9
- SHA512 a8a4aee202702fe6a004387f0865aef0ff41094e94d306019cfc15c8a89eacbc984515c5073749f7610c9a3040f80ada77c29cb170b44d408c6a4e32a40d21bd
- SSDEEP 96:FhiwMZsHpADD84LTHzbOHXOHBlBRQ+8Sc9XE56tOSVQEJN:viRZb++3VeN
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\Autoit3.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\script.au3
- Size 595KB
- SHA256 64e1563ceef99893a1fe4ba93cd38763a68f2db5537545a08061e83af9fe299b
- MD5 07b5686c91ff17a1d86271601f9904b0
- SHA1 99fd675e912909af895a917c950e5ecc37b67869
- SHA512 321e27bb1cb5c020b4979c6dce687fb734cf24a8a6e420850019d087e61ec902dbb97e7ed164c9b7fbd7f8996eaf6c4e0bb65775355e8a7075b239424dd780c6
- SSDEEP 12288:IuLJxe9FfjUh4y5AQa7SgpzS8WwrJwVKXDcV8HL7lOWaPi9Qnwi8:DJ6BjC4y5oQAnTuXWfQwi8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\test.txt
- Size 76B
- SHA256 99426e8b0d9b6366436d7db6883c98d6a8c2e5825b13a167a0c7495494182276
- MD5 4b1e3cb8c33b582a74656ec001aaaf7a
- SHA1 576cfd0d0538ca5ab90183139473895c3b8440ba
- SHA512 b7899e2236be8702f2852233f37cb98732e2f1ac97b909d0fdce216721d02337b4b3f5045464e2d13ac9c7e2320f56c574f7654aa348e96cba5932d1f7edba4f
- MD5 SHA1 SHA512