Analysis
- max time kernel
136s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
02/02/2024, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3.msi
Resource
win7-20231215-en
windows7-x64
15 signatures
150 seconds
General
- Target ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3.msi
- Size 3.7MB
- Sample240202-blfrwacfgr
- SHA256 ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3
- MD5 426a59cd5e215e9f3696c1dcc8455d20
- SHA1 255d113da1dc32c3b341e643c01e9f5a13e060de
- SHA512 4b684a97aa6d3b08459b69fb610b6ad5458de56c056f79e91e164cd8914f58ed8734ea4493bbac42c18982a80ffea30d6ba4306ef722bafc49debd4b0f68540a
- SSDEEP 49152:TpUPbczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZ:Tp1BB7nxOtFjfBwpOff4BmCk2Zl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral2/memory/2548-112-0x0000000005A90000-0x0000000005DDE000-memory.dmp family_darkgate_v6 behavioral2/memory/2548-113-0x0000000005A90000-0x0000000005DDE000-memory.dmp family_darkgate_v6 - Modifies file permissions 1 TTPs 2 IoCs
pid Process 3752 ICACLS.EXE 2984 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7BE7.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e577b6a.msi msiexec.exe File opened for modification C:\Windows\Installer\e577b6a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{6D256197-E4CE-4F1D-A41D-04EEE888AB02} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8127.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8138.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE - Executes dropped EXE 2 IoCs
pid Process 2128 apdproxy.exe 2548 Autoit3.exe - Loads dropped DLL 6 IoCs
pid Process 4032 MsiExec.exe 2128 apdproxy.exe 2128 apdproxy.exe 2128 apdproxy.exe 2128 apdproxy.exe 4032 MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005cf4f6141e81f6580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005cf4f6140000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005cf4f614000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5cf4f614000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cf4f61400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4280 msiexec.exe 4280 msiexec.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 3160 msiexec.exe Token: SeIncreaseQuotaPrivilege 3160 msiexec.exe Token: SeSecurityPrivilege 4280 msiexec.exe Token: SeCreateTokenPrivilege 3160 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3160 msiexec.exe Token: SeLockMemoryPrivilege 3160 msiexec.exe Token: SeIncreaseQuotaPrivilege 3160 msiexec.exe Token: SeMachineAccountPrivilege 3160 msiexec.exe Token: SeTcbPrivilege 3160 msiexec.exe Token: SeSecurityPrivilege 3160 msiexec.exe Token: SeTakeOwnershipPrivilege 3160 msiexec.exe Token: SeLoadDriverPrivilege 3160 msiexec.exe Token: SeSystemProfilePrivilege 3160 msiexec.exe Token: SeSystemtimePrivilege 3160 msiexec.exe Token: SeProfSingleProcessPrivilege 3160 msiexec.exe Token: SeIncBasePriorityPrivilege 3160 msiexec.exe Token: SeCreatePagefilePrivilege 3160 msiexec.exe Token: SeCreatePermanentPrivilege 3160 msiexec.exe Token: SeBackupPrivilege 3160 msiexec.exe Token: SeRestorePrivilege 3160 msiexec.exe Token: SeShutdownPrivilege 3160 msiexec.exe Token: SeDebugPrivilege 3160 msiexec.exe Token: SeAuditPrivilege 3160 msiexec.exe Token: SeSystemEnvironmentPrivilege 3160 msiexec.exe Token: SeChangeNotifyPrivilege 3160 msiexec.exe Token: SeRemoteShutdownPrivilege 3160 msiexec.exe Token: SeUndockPrivilege 3160 msiexec.exe Token: SeSyncAgentPrivilege 3160 msiexec.exe Token: SeEnableDelegationPrivilege 3160 msiexec.exe Token: SeManageVolumePrivilege 3160 msiexec.exe Token: SeImpersonatePrivilege 3160 msiexec.exe Token: SeCreateGlobalPrivilege 3160 msiexec.exe Token: SeBackupPrivilege 4516 vssvc.exe Token: SeRestorePrivilege 4516 vssvc.exe Token: SeAuditPrivilege 4516 vssvc.exe Token: SeBackupPrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe Token: SeBackupPrivilege 1776 srtasks.exe Token: SeRestorePrivilege 1776 srtasks.exe Token: SeSecurityPrivilege 1776 srtasks.exe Token: SeTakeOwnershipPrivilege 1776 srtasks.exe Token: SeBackupPrivilege 1776 srtasks.exe Token: SeRestorePrivilege 1776 srtasks.exe Token: SeSecurityPrivilege 1776 srtasks.exe Token: SeTakeOwnershipPrivilege 1776 srtasks.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3160 msiexec.exe 3160 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4280 wrote to memory of 1776 4280 msiexec.exe 95 PID 4280 wrote to memory of 1776 4280 msiexec.exe 95 PID 4280 wrote to memory of 4032 4280 msiexec.exe 98 PID 4280 wrote to memory of 4032 4280 msiexec.exe 98 PID 4280 wrote to memory of 4032 4280 msiexec.exe 98 PID 4032 wrote to memory of 3752 4032 MsiExec.exe 99 PID 4032 wrote to memory of 3752 4032 MsiExec.exe 99 PID 4032 wrote to memory of 3752 4032 MsiExec.exe 99 PID 4032 wrote to memory of 4996 4032 MsiExec.exe 102 PID 4032 wrote to memory of 4996 4032 MsiExec.exe 102 PID 4032 wrote to memory of 4996 4032 MsiExec.exe 102 PID 4032 wrote to memory of 2128 4032 MsiExec.exe 103 PID 4032 wrote to memory of 2128 4032 MsiExec.exe 103 PID 4032 wrote to memory of 2128 4032 MsiExec.exe 103 PID 2128 wrote to memory of 2548 2128 apdproxy.exe 104 PID 2128 wrote to memory of 2548 2128 apdproxy.exe 104 PID 2128 wrote to memory of 2548 2128 apdproxy.exe 104 PID 4032 wrote to memory of 2984 4032 MsiExec.exe 106 PID 4032 wrote to memory of 2984 4032 MsiExec.exe 106 PID 4032 wrote to memory of 2984 4032 MsiExec.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3160
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56D61B5AA233FCAC62C45827594592132⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:3752
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\apdproxy.exe"C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\apdproxy.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2548
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:2984
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files.cab
- Size 3.4MB
- SHA256 b860f09732fad08ddb048b0322bc5df1a61fe7859dd91f6ca769a972bac4f5f3
- MD5 2bff42a75bcda5b313b7b91261c9d85f
- SHA1 de1be1be23a3c1d6b410c6af154d19e1e15da388
- SHA512 1056f0b1e68b4030d916cdff8fe2c1b20110fa05db6457aff6b10b93ff27c7f16eb8506469746fc19e67556ed21af094afdbaba5f1ee56f5c4c2c74a96e4bdaa
- SSDEEP 49152:ZczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZU:2BB7nxOtFjfBwpOff4BmCk2Zlu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\apdboot.dll
- Size 931KB
- SHA256 51d197826bb62d23d4d926c914409ea8c66de149418cdd43137ddf1cafffe347
- MD5 884e21631c0b78aea630fbe540d84778
- SHA1 a9f4eea988debc35d0aa60efbdee6708c2cc1655
- SHA512 2ab6994e822f6174f10264c70d02857a8eb47ddc9f10b414f2e314d5f5d996bd50886a47f58eafffec6f8b823b6d14715320a9f6e332934801182d57e298b714
- SSDEEP 12288:8CwXI/iPKmldxkIR+BCm8LJJKx2jKuIHTMWiXZU:5wMmlPd1LJwx2jK9oZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\apdproxy.exe
- Size 62KB
- SHA256 a16b93c374e77f98889d7ad7f38b2282dbc5a40511541b9105b1dcf9216c3cf3
- MD5 fc9e59fe8bc4fe05382cff5c8fc59de1
- SHA1 69423bc900644a910936d2c5828348d188e5d750
- SHA512 1d34be70cd701b606873aaf6910ab7fa7a3c4a81e0398d9bdcf8e8aac3dd63ec888c478e45600bf7e34301bec231038e8dccb457e49db8b5ff1c0740b68d072c
- SSDEEP 768:oSGP0wWfldXbYnoHbzrzHKSi90hHVKIYl2PN+iTre/S/Mqnzh9SLiB+L8rhOFPC1:oSGPGSwPPH9Kq0qzXrElX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\msvcp71.dll
- Size 488KB
- SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
- MD5 561fa2abb31dfa8fab762145f81667c2
- SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
- SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
- SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\files\sqlite3.dll
- Size 1.6MB
- SHA256 b6c0d1c8dfb907ce2d5bc7e493cfb1c5e1940f200475327dded1d3390c1d5c96
- MD5 13914f35fce12f03d0a3f3eda68b1b8e
- SHA1 5490e690e87d944bf5186d13e5f3a5a23d0c350f
- SHA512 ac06235fd132b36a80979f34aab4b382de3e33f0d91cdc8a94c9da09e7fbd65c13ae52dcf191671e46d9f390e62471a2c509fee81c666f4904e4a2e231e4d0ce
- SSDEEP 24576:sA+tZvFgx79B0s7OPkLZWoPxOz4J6BjC4y5oQAnTuXWfQwiN:sHFm3Gs7OPkUc6BjClynny5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\msiwrapper.ini
- Size 1KB
- SHA256 28c44298245bba453dbe06d9ebc8a930bb4fd73d13c5555accec1dac73449796
- MD5 f29ffa2470fbfac3e1bb9cac0c77eab4
- SHA1 f936ceacddf7b4ef601264d52bd6863ff0bf4b8f
- SHA512 6b31251d153d3e22725b93620dbde673fb4d327caea27482810e05dacf0c968e6bae475221bf5c3c43070bb7a53cb9ef74f28151d5f0deb369631b5784799f69
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\msiwrapper.ini
- Size 1KB
- SHA256 d1b72a136249ce3d3eb4f188a4f383214c66ae3cf9eef9a907860056bc159bfb
- MD5 c63d3fce20b4b05bfe105d627c89df2f
- SHA1 914386bdfba374a5d18c0bb28956137cd39b6a14
- SHA512 70f4a267a2c02ea4a546683a75b792e94ffbd84137af886768948bec0418b894b275dc161e167d1fefd9d9aef23dbb9081507e73cd1fa6f443e7a2c2954f96ca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MW-a8fa06cc-14b8-4fcd-b812-84ec0442e4c8\msiwrapper.ini
- Size 1KB
- SHA256 d17111034df032dc43668bf11f9b9e5c4aedb80c0f66ad6a14ec2c6c56c22cae
- MD5 0db5cdd2c31ae3699be37c8663403c10
- SHA1 f5d2eb2e9f5a77e7937edf3b2ce6a9da3e68d9a2
- SHA512 92aff976d6e4c40a9896a2bc20c1218c17da121c28e76505ff750c1992308366b899162007910390836f48a085f03c1c1db2545a9373145a3a20926ab257fbc5
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI7BE7.tmp
- Size 208KB
- SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
- MD5 d82b3fb861129c5d71f0cd2874f97216
- SHA1 f3fe341d79224126e950d2691d574d147102b18d
- SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
- SSDEEP 3072:3spAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:BtOdiRQYpgjpjew5GAyGxjqo8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\temp\Autoit3.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 efd7e44b28698ccfc8a1b207d68e14e161d3058d89e8ebc50b231693c82c6c69
- MD5 59e5c9994b50f662901f34dceea66746
- SHA1 38a588fcc6b3efd55d25502ee44e7028106bdb26
- SHA512 28f627280bc8c88000fc297a485b15e14e551e16b10679bc922d8a282ebdee0c39cfbc56e267d38f905f99d49d7a8f78619192b8506490618425e92a9d565300
- SSDEEP 24576:Sjdmqn+GdoO/vvTLLsG+/Fr7nxXMGYNzjBAt031gM9qLQJeGYTIq6f7cF:A
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{14f6f45c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{235f0e0a-2e7e-4e9d-aa0b-fb4f281dffeb}_OnDiskSnapshotProp
- Size 6KB
- SHA256 cd3b2c75db138e888d5c4ae050bc2fbf26fded2092debdd7659c3044ee45e101
- MD5 2425be3581f1dce6dd13a61dc6426630
- SHA1 6b8810ff101870ce8848a26a7433e63033b8fd78
- SHA512 6b2fd9266bf35f3e07288cb0d537427e5954ff3cb17606d9889c1937f974244727887078d600b542b2933b8f4ccb1c5eb30d78a48bd01ee735fa6ee60c8a7304
- SSDEEP 96:FKJ5MZQ8nYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQpuN:8iepb++sVmN
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\script.au3
- Size 595KB
- SHA256 64e1563ceef99893a1fe4ba93cd38763a68f2db5537545a08061e83af9fe299b
- MD5 07b5686c91ff17a1d86271601f9904b0
- SHA1 99fd675e912909af895a917c950e5ecc37b67869
- SHA512 321e27bb1cb5c020b4979c6dce687fb734cf24a8a6e420850019d087e61ec902dbb97e7ed164c9b7fbd7f8996eaf6c4e0bb65775355e8a7075b239424dd780c6
- SSDEEP 12288:IuLJxe9FfjUh4y5AQa7SgpzS8WwrJwVKXDcV8HL7lOWaPi9Qnwi8:DJ6BjC4y5oQAnTuXWfQwi8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\temp\test.txt
- Size 76B
- SHA256 99426e8b0d9b6366436d7db6883c98d6a8c2e5825b13a167a0c7495494182276
- MD5 4b1e3cb8c33b582a74656ec001aaaf7a
- SHA1 576cfd0d0538ca5ab90183139473895c3b8440ba
- SHA512 b7899e2236be8702f2852233f37cb98732e2f1ac97b909d0fdce216721d02337b4b3f5045464e2d13ac9c7e2320f56c574f7654aa348e96cba5932d1f7edba4f
- MD5 SHA1 SHA512