Analysis
- max time kernel
149s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
playit-windows-x86_64-signed.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
playit-windows-x86_64-signed.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target playit-windows-x86_64-signed.msi
- Size 2.6MB
- Sample260425-3cel1aay2s
- SHA256 320262f629020cab8d095efeb1853a2caf904be87f02d8f4fb21158fc760e1ae
- MD5 e35e8b9616a24c8dd4eb508a941ae044
- SHA1 2c38c5b59f4ac08ce2ee5a121c81288ebacfdcce
- SHA512 33cf8263b1944a55652f7366e8d56fbf43901438796aba39efa39f3295322c15be8707498e573a32c10261f59d3d32cc3291a705b76cd568c74f080eb0a67159
- SSDEEP 49152:yjzMwflSCLVqmqO1u1XGppIQ1ckjkrCOkPpIE6ANDVEFpmVci2wy9SIT7ZGjYTyR:ynMCSbEOGpWyckQrCbPOpFpmVci2wy9q
- TLSH T1C1D501EBBF708111C4230F799839B77C472F5E2C9A2551832F49B949EAF22C8576A5C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4012 msiexec.exe 3 4012 msiexec.exe 4 4012 msiexec.exe 5 4012 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\playit_gg\bin\playit.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58d2ad.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF74D8B4D9AF64E23E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE9D2ACFEFF9FB99E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID387.tmp msiexec.exe File opened for modification C:\Windows\Installer\{D5A0819F-A172-42D9-860C-2983CD1B1883}\ProductICO msiexec.exe File created C:\Windows\Installer\e58d2af.msi msiexec.exe File created C:\Windows\Installer\e58d2ad.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{D5A0819F-A172-42D9-860C-2983CD1B1883} msiexec.exe File created C:\Windows\Installer\{D5A0819F-A172-42D9-860C-2983CD1B1883}\ProductICO msiexec.exe File created C:\Windows\SystemTemp\~DFB210144B82B70FC6.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF38DF5CBBAE763B69.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4012 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f9272311ec871480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f9272310000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809005f927231000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a5f927231000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f927231000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 25 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AEF046202130BD4399AB6404AFE7E2D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AEF046202130BD4399AB6404AFE7E2D\F9180A5D271A9D2468C09238DCB18138 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Media\1 = ";CD-ROM #1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F9180A5D271A9D2468C09238DCB18138\Binaries msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\PackageCode = "252FFDB242369634EAE5CFCFBA5D793B" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Media\DiskPrompt = "Playit Installation" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Version = "1114113" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\ProductIcon = "C:\\Windows\\Installer\\{D5A0819F-A172-42D9-860C-2983CD1B1883}\\ProductICO" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F9180A5D271A9D2468C09238DCB18138\Environment = "Binaries" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\ProductName = "playit" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\PackageName = "playit-windows-x86_64-signed.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F9180A5D271A9D2468C09238DCB18138 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3808 msiexec.exe 3808 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4012 msiexec.exe Token: SeIncreaseQuotaPrivilege 4012 msiexec.exe Token: SeSecurityPrivilege 3808 msiexec.exe Token: SeCreateTokenPrivilege 4012 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4012 msiexec.exe Token: SeLockMemoryPrivilege 4012 msiexec.exe Token: SeIncreaseQuotaPrivilege 4012 msiexec.exe Token: SeMachineAccountPrivilege 4012 msiexec.exe Token: SeTcbPrivilege 4012 msiexec.exe Token: SeSecurityPrivilege 4012 msiexec.exe Token: SeTakeOwnershipPrivilege 4012 msiexec.exe Token: SeLoadDriverPrivilege 4012 msiexec.exe Token: SeSystemProfilePrivilege 4012 msiexec.exe Token: SeSystemtimePrivilege 4012 msiexec.exe Token: SeProfSingleProcessPrivilege 4012 msiexec.exe Token: SeIncBasePriorityPrivilege 4012 msiexec.exe Token: SeCreatePagefilePrivilege 4012 msiexec.exe Token: SeCreatePermanentPrivilege 4012 msiexec.exe Token: SeBackupPrivilege 4012 msiexec.exe Token: SeRestorePrivilege 4012 msiexec.exe Token: SeShutdownPrivilege 4012 msiexec.exe Token: SeDebugPrivilege 4012 msiexec.exe Token: SeAuditPrivilege 4012 msiexec.exe Token: SeSystemEnvironmentPrivilege 4012 msiexec.exe Token: SeChangeNotifyPrivilege 4012 msiexec.exe Token: SeRemoteShutdownPrivilege 4012 msiexec.exe Token: SeUndockPrivilege 4012 msiexec.exe Token: SeSyncAgentPrivilege 4012 msiexec.exe Token: SeEnableDelegationPrivilege 4012 msiexec.exe Token: SeManageVolumePrivilege 4012 msiexec.exe Token: SeImpersonatePrivilege 4012 msiexec.exe Token: SeCreateGlobalPrivilege 4012 msiexec.exe Token: SeBackupPrivilege 3376 vssvc.exe Token: SeRestorePrivilege 3376 vssvc.exe Token: SeAuditPrivilege 3376 vssvc.exe Token: SeBackupPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe Token: SeTakeOwnershipPrivilege 3808 msiexec.exe Token: SeRestorePrivilege 3808 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4012 msiexec.exe 4012 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3808 wrote to memory of 2788 3808 msiexec.exe 84 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\playit-windows-x86_64-signed.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4012
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2788
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58d2ae.rbs
- Size 9KB
- SHA256 3661f63e73b037fa347702180661d36bea011816d5477af17abc60595bada78c
- MD5 dbcaff35b5b73b4e91354959ccbbd6bc
- SHA1 51800a4689262e6dab8a443c901948fcacd7561f
- SHA512 865674b0420a398ed445051a4e571069f2af46aaceb335b319a18ed04e9a1f03ef407f384ac0f75c266df4d5feba57a105120854732a92a8cdf93927feb26982
- SSDEEP 192:0KJQgwvEMryKCsEI9BCI4BC+EWPwceJxMeawdwR7+V+2pJIiD13Nxcu8:0KJQgwvEMrdBCBiTQn
- TLSH T145124041AA1889E3E9A61738C3071F553BB3D2CAB740634F0ADC90A04F0779C5FE968E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\playit_gg\bin\playit.exe
- Size 4.9MB
- SHA256 b2bcff05044d1b01f3d557e4fc9e8f4df4bf8fc328df3010380f82d9c7565684
- MD5 9b8ea7807c36fbeff9717fd793b61475
- SHA1 e1575761bdf20de22d64fbe81d697a0c7b97ed73
- SHA512 f2e6bfa3b52b7c8dcc39b42cffbbbe2543bad3c68f777d37300cad05f8f99c780da091cf2d2a8d6fe8ebe47903297516727cee90092f2195210aff2bea4f8949
- SSDEEP 98304:l4NQpxWgFJcqT7MPSQA13kuF55AHn+Ez:lTW8cWMXqtA
- TLSH T191364A026F9A58A9C099C874C34B8B634E1234DF0A36F5BF4AC511192FBEAF56F1D319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\43FFE5C28177B37EEBE5BDCB272A0943_58C0A72F9AAC81ED0CD03DBA4A2209C8
- Size 313B
- SHA256 2c80a4969bd587dfe39c1c33cb5b1c049f500aa7d590f58b226c7a5c7b1160da
- MD5 702ceae9aa0d2eec7e7b4a87f759f942
- SHA1 9888d401be1dec5e0f87edf60208157dd63d2c50
- SHA512 1eeb4dae7532205e80483a032caeb08a3a6500f477e2bd95257a87a7630d665ec4c98d3c616398f479567e5d7d5e4d112a212ac8fe5e4234e8d1031f7fec0ea1
- TLSH T1AEE07DF26425C1831A202D280DF8C873781C00C1D0CD5462327033D69C2766D660F8C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\949D2E01833511C6366A8B529939FE66_A640373CFD567F7FA24BE1FC82025C7E
- Size 312B
- SHA256 814f31a0f1ae255352dc1e0d542c1a7524d6dea76f8ddf19ddd6e493ca9214b1
- MD5 2ce0e52c103216348d8fb2fddb362de8
- SHA1 d48d25d2a81c1a9cc141d556aa9aec721ebc73f4
- SHA512 1efd017493ca57117adbf9cb0e3042f10ac7a5fb689e4e53c87e4ce57c43cdcff5c994bcafd5bd6c086743bc321b0f22464332977853f090b8510e93c0e5e300
- TLSH T199E07D64CB05700B0E288A886753C38C32B3048DD187400F796CB76D9A1FA3C884382C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\43FFE5C28177B37EEBE5BDCB272A0943_58C0A72F9AAC81ED0CD03DBA4A2209C8
- Size 482B
- SHA256 8a4d7990aaa18064d2e14d66cac25df1a4241daa4b385b70fde744172f073ae4
- MD5 e8a4445921b14bdda7ffa75fac92eff1
- SHA1 7a8c59f0d8950d33079c52b1b33fd337966e8176
- SHA512 adb2ae179a345484c57183f4c39c1cc721336bfbaa57f9c14f67d5066f826beef4e56e1e1487ae7174171fdefb851f65c4f05004b2bd722d0b88590242520e20
- TLSH T104F05C2860D9811DE03AFF35CDDAA5A78916F212080152DE15227707AE52F01EC7653D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\949D2E01833511C6366A8B529939FE66_A640373CFD567F7FA24BE1FC82025C7E
- Size 494B
- SHA256 ec7aa90e15ba0ce3f5117a29596469f5e58b441be80b8334a3e8c57c9a93dc46
- MD5 8db96fd8b4d1d4151641c0d223b78fb5
- SHA1 bf252d6476f2d7f401b7aa1030ead10eba4772f7
- SHA512 f6422571a9404c6b89507165d5090e89f30b93b45723cfa970031113e30ef6995bd855a0c8478957d074baecb895ef878728c107184b9d23a73f139e9d324754
- TLSH T15DF055281ABF421DF83BEE3A89F093288D84F4630C08577A36C35A01AA42F00AC3353D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58d2ad.msi
- Size 2.6MB
- SHA256 320262f629020cab8d095efeb1853a2caf904be87f02d8f4fb21158fc760e1ae
- MD5 e35e8b9616a24c8dd4eb508a941ae044
- SHA1 2c38c5b59f4ac08ce2ee5a121c81288ebacfdcce
- SHA512 33cf8263b1944a55652f7366e8d56fbf43901438796aba39efa39f3295322c15be8707498e573a32c10261f59d3d32cc3291a705b76cd568c74f080eb0a67159
- SSDEEP 49152:yjzMwflSCLVqmqO1u1XGppIQ1ckjkrCOkPpIE6ANDVEFpmVci2wy9SIT7ZGjYTyR:ynMCSbEOGpWyckQrCbPOpFpmVci2wy9q
- TLSH T1C1D501EBBF708111C4230F799839B77C472F5E2C9A2551832F49B949EAF22C8576A5C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 12da52e6963a325712c16b3c10ca4dcf3397cea001159d6b3a347b028ff62eee
- MD5 64c70a3361653df66a08a15cdae83d77
- SHA1 352a9affd4820697fafbb14e26f2f9bc6dabfb81
- SHA512 d0c152b8eded698b4dfcd3f554f7c6b33977f497bbd08178a0069eb6e78431cde31395469e36c642b49c9236e654ca0691b5ac0c31026b52ab06b7fcb28367ea
- SSDEEP 24576:42gmSp1ndoO/vvTLSm5eRUXKfK5SgotjWW6dXpkpQy6o0198Yy4+7Ej+x:G
- TLSH T14B47C52836F92110E7F7DE3CB8F06A23493A7D579C1A9E8D05811F4D0961BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{3172925f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{50373364-59e7-4600-a9a9-3bf180046345}_OnDiskSnapshotProp
- Size 6KB
- SHA256 96da7410d014b1b2c63f7618006d244ab3714b234cc1911c8d19b794706d59fe
- MD5 eec37309f02c63981834f0f8e07f936e
- SHA1 facee48c5b9d919c5c5a1085ee206144e100c78f
- SHA512 f4be254171e5709e1a992eacc7980fa0f1e6c7ec410e726ea39d5c3ad30cc37212d2c8931475d0a3dd202a66b996efe135c47eec9883fbf78f107e736b36bd9b
- SSDEEP 96:FQcefxxvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:mcu7b++ZVm
- TLSH T1A3D177085AF54711E2B3AB7229F18557A877B911EF33CB8E0198238E6670910F875F5B
- MD5 SHA1 SHA512 SSDEEP TLSH