Analysis
- max time kernel
92s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/09/2024, 11:24
Static task
static1
Behavioral task
behavioral1
Sample
922590e679f418d5e871ed027a0fb986c15439d381046e2c6c01d1f100da1ed3.msi
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
922590e679f418d5e871ed027a0fb986c15439d381046e2c6c01d1f100da1ed3.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 922590e679f418d5e871ed027a0fb986c15439d381046e2c6c01d1f100da1ed3.msi
- Size 2.2MB
- Sample240925-nhp8cswcmd
- SHA256 922590e679f418d5e871ed027a0fb986c15439d381046e2c6c01d1f100da1ed3
- MD5 bbf5cd6b084221a207c6d4948b48cf52
- SHA1 6c4560eb2358f2a0041e1db56bcce232fb13d20d
- SHA512 09f6eb8582c170fb5bd01d5f9f57697d5c3e011df1790ddc44cff2c15a7df35d2c7273f68ffef7a54e45c72e99299ddf048ea65696a9eaf70df7d6005ab5e328
- SSDEEP 49152:FEiJT5NKpt6ikhfxm2C6VQQQe/dJLXgiTRsanWzywHB5PML5YmbK:FEiJVNut6zhfxo6aArs1yg5P4bK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSOneDrive = "C:\\Users\\Admin\\AppData\\Local\\MsOneDrive\\client32.exe" reg.exe - Blocklisted process makes network request 4 IoCs
flow pid Process 4 2804 msiexec.exe 6 2804 msiexec.exe 8 2804 msiexec.exe 10 2804 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{5FE62CC3-0C02-41FE-96AE-EEEECA11AE27} msiexec.exe File opened for modification C:\Windows\Installer\MSI9839.tmp msiexec.exe File created C:\Windows\Installer\e57977f.msi msiexec.exe File created C:\Windows\Installer\e57977d.msi msiexec.exe File opened for modification C:\Windows\Installer\e57977d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 4964 client32.exe - Loads dropped DLL 5 IoCs
pid Process 4964 client32.exe 4964 client32.exe 4964 client32.exe 4964 client32.exe 4964 client32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2804 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000bf081c85bb6cd1e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000bf081c850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900bf081c85000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dbf081c85000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000bf081c8500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 3380 reg.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3372 msiexec.exe 3372 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2804 msiexec.exe Token: SeIncreaseQuotaPrivilege 2804 msiexec.exe Token: SeSecurityPrivilege 3372 msiexec.exe Token: SeCreateTokenPrivilege 2804 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2804 msiexec.exe Token: SeLockMemoryPrivilege 2804 msiexec.exe Token: SeIncreaseQuotaPrivilege 2804 msiexec.exe Token: SeMachineAccountPrivilege 2804 msiexec.exe Token: SeTcbPrivilege 2804 msiexec.exe Token: SeSecurityPrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeLoadDriverPrivilege 2804 msiexec.exe Token: SeSystemProfilePrivilege 2804 msiexec.exe Token: SeSystemtimePrivilege 2804 msiexec.exe Token: SeProfSingleProcessPrivilege 2804 msiexec.exe Token: SeIncBasePriorityPrivilege 2804 msiexec.exe Token: SeCreatePagefilePrivilege 2804 msiexec.exe Token: SeCreatePermanentPrivilege 2804 msiexec.exe Token: SeBackupPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeShutdownPrivilege 2804 msiexec.exe Token: SeDebugPrivilege 2804 msiexec.exe Token: SeAuditPrivilege 2804 msiexec.exe Token: SeSystemEnvironmentPrivilege 2804 msiexec.exe Token: SeChangeNotifyPrivilege 2804 msiexec.exe Token: SeRemoteShutdownPrivilege 2804 msiexec.exe Token: SeUndockPrivilege 2804 msiexec.exe Token: SeSyncAgentPrivilege 2804 msiexec.exe Token: SeEnableDelegationPrivilege 2804 msiexec.exe Token: SeManageVolumePrivilege 2804 msiexec.exe Token: SeImpersonatePrivilege 2804 msiexec.exe Token: SeCreateGlobalPrivilege 2804 msiexec.exe Token: SeBackupPrivilege 4004 vssvc.exe Token: SeRestorePrivilege 4004 vssvc.exe Token: SeAuditPrivilege 4004 vssvc.exe Token: SeBackupPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe Token: SeTakeOwnershipPrivilege 3372 msiexec.exe Token: SeRestorePrivilege 3372 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2804 msiexec.exe 2804 msiexec.exe 4964 client32.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3372 wrote to memory of 1980 3372 msiexec.exe 93 PID 3372 wrote to memory of 1980 3372 msiexec.exe 93 PID 3372 wrote to memory of 3380 3372 msiexec.exe 96 PID 3372 wrote to memory of 3380 3372 msiexec.exe 96 PID 3372 wrote to memory of 4964 3372 msiexec.exe 95 PID 3372 wrote to memory of 4964 3372 msiexec.exe 95 PID 3372 wrote to memory of 4964 3372 msiexec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\922590e679f418d5e871ed027a0fb986c15439d381046e2c6c01d1f100da1ed3.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2804
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1980
-
-
C:\Users\Admin\AppData\Local\MsOneDrive\client32.exe"C:\Users\Admin\AppData\Local\MsOneDrive\client32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4964
-
-
C:\Windows\system32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MSOneDrive /t REG_SZ /d "C:\Users\Admin\AppData\Local\MsOneDrive\client32.exe"2⤵
- Adds Run key to start application
- Modifies registry key
PID:3380
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4004
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57977e.rbs
- Size 10KB
- SHA256 318f97f186a8f19035b0a2c7f8e1cb666057b4220ab0a4385cf4d8ceb2f505b9
- MD5 c26c90efc0de50038d983f8c68e8fdcf
- SHA1 1d282824a514df69a2c8ffe7f1297282d0ce73d3
- SHA512 3661c658ffe15d974877a7bb4ea359145209c5fb36b184405a8ae37befb87007c71334944f555719650b1d15d8ec3480de239ed2f9672016ab340aa9496463b3
- SSDEEP 96:CiXU5fW+IeS62SCJg9x499gFPUw9tW7rSzVJ6ffRRe09w9U1Uz2eD2JTCsThqOU5:CiXQ6p7eqOiOIUiOZAwLpi2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5
- Size 1KB
- SHA256 217c19a888d72b94dde5cac6b0bfc0c3d14f68ce2d3c007cb62001549fb33fcd
- MD5 20eb622ba51e653e80e9fddadef5bf9b
- SHA1 83e7151af9fe29946f0048c4c2c84a9df8b4270b
- SHA512 bcfc9dd9716634731775930f361754187efc785dc10421294d4ead777651a0cb2ec625afdcc0f2c9c1a6a1859b4ab572a81e5e3331ab6fba94a14e45a37c57c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B03113490075047F519A3F760F0FF379_EAA7EAA3882323A05D27C396DC25384C
- Size 2KB
- SHA256 22a8c3160135600c796baf888ecf54abdae2bd7ec5ebc64d0e4393ffd7d0d414
- MD5 9632ebce41950afead114978a2addc45
- SHA1 b14c961ec578339ac98b201ae211f8fcc663f8d4
- SHA512 d19277a18fd0d297d37037c8c1e72a428c57faedd88b292416d761a1d4f7e14fa38d1e5cc2f0c4c3caf74b48cf17775765f283c9fbb5ce117ff2171ddef023cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5
- Size 412B
- SHA256 89f05b2edea752ebb1666cdde5266109de2e7b2d51b706961964f213694792e1
- MD5 50f3c07a8244bc963ff5d1d20d35783d
- SHA1 70f6d54c6a6033ee3469d25604903f54a7591b5b
- SHA512 bd67d7d1126d645d0e93b47fa7223e2094037f40f3ab60e804839b9fd31d1646654b4f3c6c0a734f9be8128b5fcabd61182ccca946cfe012e8f5a7d98ded6d29
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B03113490075047F519A3F760F0FF379_EAA7EAA3882323A05D27C396DC25384C
- Size 428B
- SHA256 8ea450a3e4fdd63a1397b3529c9d8ae7fea1348953320d7bc7abad88401fefbe
- MD5 93c626ab1028c8a419c163f2ccb66e7a
- SHA1 b6f3502b5a300568796664309d6c6117e17256b5
- SHA512 0295e3c33ee4c7eb9cd7014ac70facb2c5c7ad56202e35381aa1d7f394737dd10ca14de9743b01daf046f5bf89776fd5848378eae6d2df86d85130b0f06954ec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\MsOneDrive\HTCTL32.DLL
- Size 306KB
- SHA256 13a17f2ad9288aac8941d895251604beb9524fa3c65c781197841ee15480a13f
- MD5 3eed18b47412d3f91a394ae880b56ed2
- SHA1 1b521a3ed4a577a33cce78eee627ae02445694ab
- SHA512 835f35af4fd241caa8b6a639626b8762db8525ccceb43afe8fffc24dffad76ca10852a5a8e9fc114bfbf7d1dc1950130a67037fc09b63a74374517a1f5448990
- SSDEEP 6144:Jd0nVF1ZtRq6itu9i3uxUnNPhMKj8TwFIKhJ08fvF0dGhZUbol:JYZrokUnNPhMY8TwFIcJB0i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\MsOneDrive\MSVCR100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\MsOneDrive\NSM.LIC
- Size 262B
- SHA256 fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc
- MD5 b9956282a0fed076ed083892e498ac69
- SHA1 d14a665438385203283030a189ff6c5e7c4bf518
- SHA512 7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\MsOneDrive\PCICL32.dll
- Size 3.3MB
- SHA256 c7baf1647f6fef1b1a4231c9743f20f7a4b524ca4eb987a0acbeeef7e037d7e3
- MD5 f782c24a376285c9b8a3a116175093f8
- SHA1 b8fdb6e95c7313cf31f14a3a31cc334b56e6df09
- SHA512 256385a6663dcf70a5a9a1b766d1f826760f07efa9b9248047dc43d41f6a9f4dd56ca2b218c222ea1d441e2f7ba9bb114cde6954827b9761ebb1f23bba7ad1bb
- SSDEEP 49152:oMnz9yqTXur/eAtTAh8bWbxnwDnsT2kaOgkcwSENUv7O:oMnzIqTXuCAtUh8b5xggAS7zO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\MsOneDrive\client32.exe
- Size 104KB
- SHA256 db0acb4a3082edc19ca9a78b059258ea36b4be16eee4f1172115fc83e693a903
- MD5 f6abef857450c97ea74cd8f0eb9a8c0a
- SHA1 a1acdd10f5a8f8b086e293c6a60c53630ad319fb
- SHA512 b6a2196ebfa51bb3fb8fb2b95ad5275828ab5435fd859fc993e2b3ed92a74799fe1c8b178270f99c79432f39aa9dbc0090038f037fcb651ab75c14b18102671f
- SSDEEP 384:rmXhuZ758V5+6j6Qa86Fkv2Wr120hZD4otVVtV6is:iEd8VZl6FhWr80/sotVVtV6is
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\MsOneDrive\client32.ini
- Size 664B
- SHA256 d4c1f00382f01abbb3142ef6d9c3e51557d0ced12a52861d8c5df44d1ce723ac
- MD5 14f6ebed5e1176f17c18d00a2dc64b2e
- SHA1 cb9c079373658ce098e1d07d4a2c997bf3141b4b
- SHA512 e5f24a695749d693e873ea60b8caaff5cb3b306887721e3f9f308afe697fba37f3a6226322aedebb46764d6bbbaf21df44d4c6a02db49b067437d7e7d0cceaf9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\MsOneDrive\pcicapi.dll
- Size 44KB
- SHA256 1716640cce74322f7ee3e3e02b75cd53b91686f66e389d606dab01bd9f88c557
- MD5 9daa86d91a18131d5caf49d14fb8b6f2
- SHA1 6b2f7ceb6157909e114a2b05a48a1a2606b5caf1
- SHA512 9a98e0d9e2dda8aefa54bddb3c7b71501d638dff68863939de6caa117b0e7bf15e581a75419ef8a0da3f1c56a19f1b0f4c86d65f8581773ab88ff5764b9bb3aa
- SSDEEP 768:3o6OZSOe0iI6IdE+OPCH4mf6u0Qn+6wwbiRGp9E+yhwBkbp9E+8iROr:3o6mSOqIqPCYmfRnlwwbioQ+yhwBkbQ1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\MsOneDrive\pcichek.dll
- Size 27KB
- SHA256 0038ab626624fa2df9f65dd5e310b1206a9cd4d8ab7e65fb091cc25f13ebd34e
- MD5 e311935a26ee920d5b7176cfa469253c
- SHA1 eda6c815a02c4c91c9aacd819dc06e32ececf8f0
- SHA512 48164e8841cfc91f4cbf4d3291d4f359518d081d9079a7995378f970e4085b534f4bafc15b83f4824cc79b5a1e54457b879963589b1acbcfe727a03eb3dffd1c
- SSDEEP 768:X52mBHj1XCdnJ8EriRGp9E+l/kaTj1XCdnJ8EZp9E+8iROA:JPBHj5CdnTrioQ+l/kaTj5CdnTZQ+8iX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e57977d.msi
- Size 2.2MB
- SHA256 922590e679f418d5e871ed027a0fb986c15439d381046e2c6c01d1f100da1ed3
- MD5 bbf5cd6b084221a207c6d4948b48cf52
- SHA1 6c4560eb2358f2a0041e1db56bcce232fb13d20d
- SHA512 09f6eb8582c170fb5bd01d5f9f57697d5c3e011df1790ddc44cff2c15a7df35d2c7273f68ffef7a54e45c72e99299ddf048ea65696a9eaf70df7d6005ab5e328
- SSDEEP 49152:FEiJT5NKpt6ikhfxm2C6VQQQe/dJLXgiTRsanWzywHB5PML5YmbK:FEiJVNut6zhfxo6aArs1yg5P4bK
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 112a147c89d7c7cfed30e62407c981e46485cfaae25ce07debefd01af1080989
- MD5 cce695cb01f6182abca41e0a1dfa9a00
- SHA1 8462e789bb16a5bea06f591c627ed9e92396aa40
- SHA512 fa0fe8f362a952262cf8366f724176fb8ef2820f579734dba32acc59373f721787f3e2ed593abbd35aaf2b06b2be9a0920a92db7a63af196def9108ccde50821
- SSDEEP 24576:nSqm41C3doO/vvTLEq6utnWKp51ZYQhKOjKNphQ262q2LZGWohFVLaa/N:m
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{851c08bf-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ab54cd8d-5049-4bbb-8e98-af0e1ec106e4}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8e1597c0aeff3cb77449f368e3c74d5dbdffb7727dafeb42ef79cb5f8a2e54ab
- MD5 bd4a73bc2f4cddef40f927145776779f
- SHA1 2947f0b497cd6991299920bd951c5266b48f9c0d
- SHA512 292961559d895e0c644c18c88db62dfa8533f0539d6ef36d68ee49857a3462d229de9edab07d459c547c893c4e601aa36fe33d0613a0933922774be8df3e1178
- SSDEEP 96:FOFTe4NL4nDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:0FKWEb++lVm
- MD5 SHA1 SHA512 SSDEEP