Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
lsa_v1.2.2_20251208_windows_x86-installer.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
lsa_v1.2.2_20251208_windows_x86-installer.msi
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target lsa_v1.2.2_20251208_windows_x86-installer.msi
- Size 12.9MB
- Sample260629-e18yracz9t
- SHA256 a943c34695bb9326b96a93bbbbf5c1bd038c4ec08bce85998781f2fb20bb3753
- MD5 ecc7a662f55f72aaca05df3f5415ac3a
- SHA1 d44d7f167ffeb53dc172d368e627195e2c8caa38
- SHA512 233b1f3ef01fc990e33c0621b58657f85c9d87bf3db8024f0e668c207148a9291fecb4dc2d9307ff8af5e0602a1eb863b75d44d8fc314f336c0c7b9e273c84f0
- SSDEEP 393216:oblY31leYuq/yk054mm19XPCXfZsQnuJ:obqllefTADP/CPZf
- TLSH T158D633852627178EF02F44B24CBB026897AAED391722805D77597DC2FFF37A2B1A7111
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1696 lsa.exe - Loads dropped DLL 2 IoCs
pid Process 1696 lsa.exe 1696 lsa.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 1396 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\LSA\bin\lsa.exe msiexec.exe File created C:\Program Files (x86)\LSA\bin\Packet.dll msiexec.exe File created C:\Program Files (x86)\LSA\bin\sscronet.dll msiexec.exe File created C:\Program Files (x86)\LSA\bin\WinDivert.dll msiexec.exe File created C:\Program Files (x86)\LSA\bin\wintun.dll msiexec.exe File created C:\Program Files (x86)\LSA\bin\wpcap.dll msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e594abb.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFD1E2A93FE01793D8.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF296F5D8C5D0C0050.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFFA9672758226914B.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{98D5BF44-8456-49F3-8150-40C8B415C286} msiexec.exe File opened for modification C:\Windows\Installer\MSI5124.tmp msiexec.exe File created C:\Windows\Installer\e594abd.msi msiexec.exe File created C:\Windows\SystemTemp\~DF9DBE9C6108D80C96.TMP msiexec.exe File created C:\Windows\Installer\e594abb.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1396 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsa.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c0864d100437b2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015c0864d10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015c0864d1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35c0864d100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65c0864d100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Kills process with taskkill 1 IoCs
pid Process 1524 taskkill.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness lsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft lsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion lsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network lsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness lsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE lsa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT lsa.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE6AE30145179C54C8AF5BBC9C92C44F\44FB5D8965483F941805048C4B512C68 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44FB5D8965483F941805048C4B512C68\Environment = "Binaries" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44FB5D8965483F941805048C4B512C68\Binaries msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Version = "16908290" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Media\1 = ";CD-ROM #1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\PackageCode = "65EAF94DB0ADDD240A3E33441B324456" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE6AE30145179C54C8AF5BBC9C92C44F msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44FB5D8965483F941805048C4B512C68 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\ProductName = "LSA" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\PackageName = "lsa_v1.2.2_20251208_windows_x86-installer.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\SourceList\Media\DiskPrompt = "LSA Installation" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44FB5D8965483F941805048C4B512C68\AdvertiseFlags = "388" msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeSecurityPrivilege 5860 msiexec.exe Token: SeCreateTokenPrivilege 1396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1396 msiexec.exe Token: SeLockMemoryPrivilege 1396 msiexec.exe Token: SeIncreaseQuotaPrivilege 1396 msiexec.exe Token: SeMachineAccountPrivilege 1396 msiexec.exe Token: SeTcbPrivilege 1396 msiexec.exe Token: SeSecurityPrivilege 1396 msiexec.exe Token: SeTakeOwnershipPrivilege 1396 msiexec.exe Token: SeLoadDriverPrivilege 1396 msiexec.exe Token: SeSystemProfilePrivilege 1396 msiexec.exe Token: SeSystemtimePrivilege 1396 msiexec.exe Token: SeProfSingleProcessPrivilege 1396 msiexec.exe Token: SeIncBasePriorityPrivilege 1396 msiexec.exe Token: SeCreatePagefilePrivilege 1396 msiexec.exe Token: SeCreatePermanentPrivilege 1396 msiexec.exe Token: SeBackupPrivilege 1396 msiexec.exe Token: SeRestorePrivilege 1396 msiexec.exe Token: SeShutdownPrivilege 1396 msiexec.exe Token: SeDebugPrivilege 1396 msiexec.exe Token: SeAuditPrivilege 1396 msiexec.exe Token: SeSystemEnvironmentPrivilege 1396 msiexec.exe Token: SeChangeNotifyPrivilege 1396 msiexec.exe Token: SeRemoteShutdownPrivilege 1396 msiexec.exe Token: SeUndockPrivilege 1396 msiexec.exe Token: SeSyncAgentPrivilege 1396 msiexec.exe Token: SeEnableDelegationPrivilege 1396 msiexec.exe Token: SeManageVolumePrivilege 1396 msiexec.exe Token: SeImpersonatePrivilege 1396 msiexec.exe Token: SeCreateGlobalPrivilege 1396 msiexec.exe Token: SeBackupPrivilege 1228 vssvc.exe Token: SeRestorePrivilege 1228 vssvc.exe Token: SeAuditPrivilege 1228 vssvc.exe Token: SeBackupPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe Token: SeTakeOwnershipPrivilege 5860 msiexec.exe Token: SeRestorePrivilege 5860 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1396 msiexec.exe 1396 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1396 msiexec.exe 5860 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5860 wrote to memory of 1048 5860 msiexec.exe 94 PID 5860 wrote to memory of 1696 5860 msiexec.exe 96 PID 5860 wrote to memory of 1524 5860 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\lsa_v1.2.2_20251208_windows_x86-installer.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1396
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1048
-
-
C:\Program Files (x86)\LSA\bin\lsa.exe"C:\Program Files (x86)\LSA\bin\lsa.exe" activate --silent --installer C:\Users\Admin\AppData\Local\Temp\lsa_v1.2.2_20251208_windows_x86-installer.msi --cwd C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1696
-
-
C:\Windows\system32\taskkill.exetaskkill.exe /IM lsa.exe /F2⤵
- Kills process with taskkill
PID:1524
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e594abc.rbs
- Size 9KB
- SHA256 4a4513ebff52f94f6733d654577714c6cc43202d3955d4b9b2471c861c15ed22
- MD5 bf8ad609f7cb7a30868ec7fdc348478a
- SHA1 a6f16c936a091207f0fb96c452f346846d061547
- SHA512 ce8a54096b108b668d2421275fb1dff8b21d04588f5aa7d4c83bf8e954c41f434989a05b225ec5374d02239dc3f74e708a0b10ca6db6ac98dc3ad238452b9521
- SSDEEP 96:aXjTvc9Om5pbPGi51o2RbKC/BJpUOQBCsThqAoUOQBC6jAIIkrThqANH6M5JF+5a:aTjqaiI8KCTiB0I7B0jgXsOw1+pyT29
- TLSH T13E125442A300C1D2F9575731D70737A637B3C3E99F0067AB0ADD81611E977D90F99A8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\LSA\bin\WinDivert.dll
- Size 212KB
- SHA256 f21221989f1e55981b9606ec9ca83efd1365998d8a02ed4fee9ff84620fedb5b
- MD5 e7d415ff7ca1c673c16a8854a0d4a94f
- SHA1 b745f70ababfa186ce34d297e6e3c775c818d979
- SHA512 6e93196da70d4f18964fd8700dfa08230c612ba01a860aea83ce6efda077307478e540899aa9eebc7564de37992b4b9af44b730d72c78101ac1da54c16ba1087
- SSDEEP 3072:WvZ0eEzl2ToT7nIk0eTH/FjzpgvIeLC0fHzkkqMQWV9Ty3zZygDgmq1O19AIk:WvkUOnIk0y8W0MM3i3bW
- TLSH T118247D0272D24589F9E285746AF4A3676A3ABFA157B3D6CF1EC0581E0E317D1BD34322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\LSA\bin\lsa.exe
- Size 21.0MB
- SHA256 7305ba18b573d5691648477fa7f269ca62645af1b788ea59edc55a813653aafe
- MD5 150d5bcf197468e37c4a68b72a14c4a4
- SHA1 fa96f1dcb72900ffd28fe2801bca6f9299225fe2
- SHA512 deb2a4546e922638f3b05b815765251d32e22e97e96c24cdf143e64a38a6b0d4a2e9b650b8757afc8e6ab09998482aec3aca67c3f2c008f902fe61c654478e43
- SSDEEP 393216:9xfr0D9hOwMsCskJWnrfrkgvetTcdbZrhFRQs5r6:9xyOwet4FhF6
- TLSH T1BD275B127B42A0FBC18B42B0F11EA33C9F73551997158EE3C6949EB85CB93D12D36A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\LSA\bin\sscronet.dll
- Size 7.5MB
- SHA256 5dc5390e03c42808b59186aa41375364e39bdeae3b31569710d4fcaf7634953e
- MD5 a0cfb62adf914d63f43187af67d33c82
- SHA1 cc8da96e8ca84e7ed99b381bb7e969fee75ed65d
- SHA512 6b5aa8d0f16e5e29da686afb5f1cd228125e57eea53e4e7cdb69e5bc6dab685ee7b77eefeab99dad67c24c75b6b0536d0cde6f2c26f8ed03fff35d291d57bfb1
- SSDEEP 196608:xCMsE71PAFB0t8c7jPV65H8wxeYZ+AZ0kgtaO33:xHsI1m0f/PV65H8wx5bKkgtJ
- TLSH T168769D42F4925078CC4721B2342EB73D9A3407458F388DEBC795ADA57FB02D32A7769A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\LSA\cache\preference.db
- Size 4KB
- SHA256 14948fa5e2d8f2d2f9d9f9349a2626f275b36c870d724b183d7c9216d676f20e
- MD5 9732e4a0ce6fc561f0243041ffd78e3b
- SHA1 33a7125e1431398266491d3c2e4ed3ed8eb454f9
- SHA512 862636d8240b45c4d36a7af6670b62cc811d09b942ca7a9a6a0c596681a2ac091814a8ada2e2f026193f8bce293eda118e485566a75de221678378939d569ad9
- TLSH T16B810240634000E1D09406B3549213081A06D59495510B231515005288815445860A84
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e594abb.msi
- Size 12.9MB
- SHA256 a943c34695bb9326b96a93bbbbf5c1bd038c4ec08bce85998781f2fb20bb3753
- MD5 ecc7a662f55f72aaca05df3f5415ac3a
- SHA1 d44d7f167ffeb53dc172d368e627195e2c8caa38
- SHA512 233b1f3ef01fc990e33c0621b58657f85c9d87bf3db8024f0e668c207148a9291fecb4dc2d9307ff8af5e0602a1eb863b75d44d8fc314f336c0c7b9e273c84f0
- SSDEEP 393216:oblY31leYuq/yk054mm19XPCXfZsQnuJ:obqllefTADP/CPZf
- TLSH T158D633852627178EF02F44B24CBB026897AAED391722805D77597DC2FFF37A2B1A7111
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 85ba5150ca152a2099ee0ef2859b2900ef25fa4cd9fcfee83503878af872c78b
- MD5 0f1c4dd5db1e6f27a5adf6064c847ef2
- SHA1 31cfa87bbaf1c2569cb0c6ef5c082db1515264c0
- SHA512 d4b2d37ed556fa9f7c4a8102cc2d4ecee69b5487398187e989db377bcbe3404096c4b9b829f52eeb440506038fe6a56b5d8311a51823d41bcb90e989d8e90ead
- SSDEEP 24576:4Fo3DMPRdoO/vvTL/iA7bSlgvr+xwLcY0GdJNW1jtu1a5MKr84h2bCx6fuf:sHU
- TLSH T18457A12436F92600E7B79E7CACF06A234D3A7D5B9C15DE8D45411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7a1673a9-04b5-42a3-b5c2-6fbc2000cdd9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c10884f202bb3d85cd1e3eabb84550550baaa671221d5c4a5200cc58504cb65c
- MD5 8ad25344c6674ce6e04c5748f0d6da66
- SHA1 2801acf26f2a9c50e2a1481d2b40833d5551d107
- SHA512 9dea66de7dab91518dbc83d32cdbcee404941764ae1911355950dc5c2a90cbf28cbdbb92bcfa9f65b6ca90758bd06af8a77afd39e4f142fd660c48f965dfe417
- SSDEEP 96:FfKtrDrvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:4tnb++uVm
- TLSH T18FD176085AF54711E2B3AB7128F18557A837B911EF33CB8E0198638E2631A11F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH