9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
227s
max time network
293s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p26/logos64.msi
Size

1.1MB
MD5

e343ca68c1e51e24996575274ce54aac
SHA1

19f8726823d76da1d6deed569c79f9d64d7eca08
SHA256

bae1b9b7ced72b77ce1dec5db20de104edb17be324225399ef6dbc1e10ac8d57
SHA512

edaba1dc3d4d87d11120330eafc6f63c52ab9dea9faa8f4c29267e9c36fd377bb20d9f0aafd5c0057deb8680f54707d9f53ae2ac156315c2e52a14871f035be4
SSDEEP

24576:9F9qVtKDpo/3Pf0+TQNxshTK+63S3ZgTqGgeSZUf/:9F9qVt8oNC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\lkobenv.dll	msiexec.exe
File created	C:\Windows\system32\lkproc.dll	msiexec.exe
File created	C:\Windows\system32\logos_scs_wrapper.dll	msiexec.exe
File created	C:\Windows\system32\nidscmem.dll	msiexec.exe
File created	C:\Windows\system32\lkrealt.dll	msiexec.exe
File created	C:\Windows\system32\lksec.dll	msiexec.exe
File created	C:\Windows\system32\lksock.dll	msiexec.exe
File created	C:\Windows\system32\lkstime.dll	msiexec.exe
File created	C:\Windows\system32\lkbrow.dll	msiexec.exe
File created	C:\Windows\system32\lookout.sec	msiexec.exe
File created	C:\Windows\system32\lkdynam.dll	msiexec.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\National Instruments\Shared\Logos\lkopc.dll	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\Logos\usrmgr.chm	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\Security\nidm_client_manager.dll	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\Security\nidm_client_thinauth.dll	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\Security\nidm_discovery.dll	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\Security\nidm_context.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF74CD32B13C708EE8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7114.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI733A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7C768772-3A4B-445D-A29E-14A2FDA1545D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI739B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7438.tmp	msiexec.exe
File created	C:\Windows\Installer\e5870c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI734B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF079A2311F9DD58FB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5870c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI735B.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7329.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C8792F99F2CD543.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC8BE552723F90017.TMP	msiexec.exe
File created	C:\Windows\Installer\e5870c8.msi	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
420	MsiExec.exe
420	MsiExec.exe
420	MsiExec.exe
420	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059a4098a21d1e3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000059a4098a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090059a4098a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d59a4098a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000059a4098a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\PackageName = "logos64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\277867C7B4A3D5442AE9412ADF1A45D5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\Version = "318816256"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\PackageCode = "F092B06F105C46A4CB848B904B38058D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p26\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p26\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\277867C7B4A3D5442AE9412ADF1A45D5\Logos64MSM.LV.LOGOS64.1900 = "Logos64.LV.LOGOS64.1900"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\277867C7B4A3D5442AE9412ADF1A45D5\Logos64.LV.LOGOS64.1900	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\277867C7B4A3D5442AE9412ADF1A45D5\NIMUFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0A5788AB76737E643BED9072F572610A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0A5788AB76737E643BED9072F572610A\277867C7B4A3D5442AE9412ADF1A45D5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\ProductName = "NI Logos 19.0 (64-bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\Language = "9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\277867C7B4A3D5442AE9412ADF1A45D5\DeploymentFlags = "3"	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3896	msiexec.exe
Token: SeSecurityPrivilege	4468	msiexec.exe
Token: SeCreateTokenPrivilege	3896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3896	msiexec.exe
Token: SeLockMemoryPrivilege	3896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3896	msiexec.exe
Token: SeMachineAccountPrivilege	3896	msiexec.exe
Token: SeTcbPrivilege	3896	msiexec.exe
Token: SeSecurityPrivilege	3896	msiexec.exe
Token: SeTakeOwnershipPrivilege	3896	msiexec.exe
Token: SeLoadDriverPrivilege	3896	msiexec.exe
Token: SeSystemProfilePrivilege	3896	msiexec.exe
Token: SeSystemtimePrivilege	3896	msiexec.exe
Token: SeProfSingleProcessPrivilege	3896	msiexec.exe
Token: SeIncBasePriorityPrivilege	3896	msiexec.exe
Token: SeCreatePagefilePrivilege	3896	msiexec.exe
Token: SeCreatePermanentPrivilege	3896	msiexec.exe
Token: SeBackupPrivilege	3896	msiexec.exe
Token: SeRestorePrivilege	3896	msiexec.exe
Token: SeShutdownPrivilege	3896	msiexec.exe
Token: SeDebugPrivilege	3896	msiexec.exe
Token: SeAuditPrivilege	3896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3896	msiexec.exe
Token: SeChangeNotifyPrivilege	3896	msiexec.exe
Token: SeRemoteShutdownPrivilege	3896	msiexec.exe
Token: SeUndockPrivilege	3896	msiexec.exe
Token: SeSyncAgentPrivilege	3896	msiexec.exe
Token: SeEnableDelegationPrivilege	3896	msiexec.exe
Token: SeManageVolumePrivilege	3896	msiexec.exe
Token: SeImpersonatePrivilege	3896	msiexec.exe
Token: SeCreateGlobalPrivilege	3896	msiexec.exe
Token: SeCreateTokenPrivilege	3896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3896	msiexec.exe
Token: SeLockMemoryPrivilege	3896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3896	msiexec.exe
Token: SeMachineAccountPrivilege	3896	msiexec.exe
Token: SeTcbPrivilege	3896	msiexec.exe
Token: SeSecurityPrivilege	3896	msiexec.exe
Token: SeTakeOwnershipPrivilege	3896	msiexec.exe
Token: SeLoadDriverPrivilege	3896	msiexec.exe
Token: SeSystemProfilePrivilege	3896	msiexec.exe
Token: SeSystemtimePrivilege	3896	msiexec.exe
Token: SeProfSingleProcessPrivilege	3896	msiexec.exe
Token: SeIncBasePriorityPrivilege	3896	msiexec.exe
Token: SeCreatePagefilePrivilege	3896	msiexec.exe
Token: SeCreatePermanentPrivilege	3896	msiexec.exe
Token: SeBackupPrivilege	3896	msiexec.exe
Token: SeRestorePrivilege	3896	msiexec.exe
Token: SeShutdownPrivilege	3896	msiexec.exe
Token: SeDebugPrivilege	3896	msiexec.exe
Token: SeAuditPrivilege	3896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3896	msiexec.exe
Token: SeChangeNotifyPrivilege	3896	msiexec.exe
Token: SeRemoteShutdownPrivilege	3896	msiexec.exe
Token: SeUndockPrivilege	3896	msiexec.exe
Token: SeSyncAgentPrivilege	3896	msiexec.exe
Token: SeEnableDelegationPrivilege	3896	msiexec.exe
Token: SeManageVolumePrivilege	3896	msiexec.exe
Token: SeImpersonatePrivilege	3896	msiexec.exe
Token: SeCreateGlobalPrivilege	3896	msiexec.exe
Token: SeCreateTokenPrivilege	3896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3896	msiexec.exe
Token: SeLockMemoryPrivilege	3896	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3896	msiexec.exe
3896	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 420	4468	msiexec.exe	81
PID 4468 wrote to memory of 420	4468	msiexec.exe	81
PID 4468 wrote to memory of 420	4468	msiexec.exe	81
PID 4468 wrote to memory of 5072	4468	msiexec.exe	85
PID 4468 wrote to memory of 5072	4468	msiexec.exe	85
PID 4468 wrote to memory of 2412	4468	msiexec.exe	87
PID 4468 wrote to memory of 2412	4468	msiexec.exe	87
PID 4468 wrote to memory of 2412	4468	msiexec.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p26\logos64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 716BE23C5FF452F2A998649C7DE5CB25 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:420
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D09245C34B0B83630ED10BAFCF293473
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5870c7.rbs

Filesize
18KB

MD5
bd03d2955b6b76e926adef741d629ae3

SHA1
dee902552332a5e4c0291bdd65a97e0fc9f327d1

SHA256
4146f4be45ef9a83b77fed3b1cebf2978fc118b9e6d98f3408ef533b762d8c9a

SHA512
0a88a03f2af2b94ffa5b09a54d60982b89696843ee96370342319670c708659ad645aaf426b5557d508e9f68f25804ff5abab91e26876a7e57a62e16da9d7ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBD26.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
8bce753701941c000ff956c80a7cb6ae

SHA1
6f7c57d376b6d06417c63570ebd96ff0f36c3eda

SHA256
4c4434067a9856ef9f08db89d8fa7db88ad3fa6e05a512e269698139b9e95a3d

SHA512
67fdf42b877e6466c7a517d2392339e6e587ab94213009bb1ed442b00b0cbd3ce848292ab0ed244cbfc617d290e4dd081a5f455e26b5a435688ea0a6998b4553

Download Submit
\??\Volume{8a09a459-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{dca401aa-7b56-4cc8-b7b5-a12d977ef227}_OnDiskSnapshotProp

Filesize
6KB

MD5
85939c29ea593e25dd5b454283a6e88c

SHA1
e5c978ed77f4fe371b879d9056490747d8ced76a

SHA256
a8c36ccb3b1d4a495e9ba0a390a50112bbbc3a8c332fd3e5cb668f45dd9404bf

SHA512
cb5c7a2d5310f50d294ea05ac66605c82444de982ed2dc437713638f24230c1acceb488f7379b07a58c72a43c062b49290aba799ef70e4d3c729153cc1945b1f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads