Analysis
- user interaction
yes - max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 15:04
Behavioral task
behavioral1
Sample
file.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target file.msi
- Size 8.2MB
- Sample260722-sfrevsxdlf
- SHA256 23845c79a0d27642e5d4ae36ae1c246ba4455346b5910b45e5bba3d0a80044c3
- MD5 979d3e4e42f165e9e3838a03f05cdd43
- SHA1 a6fc411b635f56a3e22cfee6998c515b9da28726
- SHA512 3c52ff5c3119c6fafb2d46b3f55adf9b0b3f0ede81c8878447694169b0ea72eb3af4fe4afe22ec86b828a110eaf086b3aa8e39f204fb46b0298bcc43cbe10455
- SSDEEP 196608:KxFr494Ac84hP1KgzvXpExbfByyWlrHKCtVsJwVb8hXx3:Ur39LbXIbpylpXtVCwKhXx3
- TLSH T1BE86338A9D132316CA0BD3FF2947FB5946792CD5822B540D7718B31C2E3A6DE972D2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1568 notepad++.exe - Loads dropped DLL 7 IoCs
pid Process 1568 notepad++.exe 1568 notepad++.exe 1568 notepad++.exe 1568 notepad++.exe 1568 notepad++.exe 1568 notepad++.exe 1568 notepad++.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4296 msiexec.exe 7 4296 msiexec.exe 9 4296 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e58979a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DDF13824-1FA0-4E5A-8453-FB6A23E145A4} msiexec.exe File created C:\Windows\Installer\e589798.msi msiexec.exe File opened for modification C:\Windows\Installer\e589798.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9B22.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4296 msiexec.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4180 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4144 msiexec.exe 4144 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4296 msiexec.exe Token: SeIncreaseQuotaPrivilege 4296 msiexec.exe Token: SeSecurityPrivilege 4144 msiexec.exe Token: SeCreateTokenPrivilege 4296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4296 msiexec.exe Token: SeLockMemoryPrivilege 4296 msiexec.exe Token: SeIncreaseQuotaPrivilege 4296 msiexec.exe Token: SeMachineAccountPrivilege 4296 msiexec.exe Token: SeTcbPrivilege 4296 msiexec.exe Token: SeSecurityPrivilege 4296 msiexec.exe Token: SeTakeOwnershipPrivilege 4296 msiexec.exe Token: SeLoadDriverPrivilege 4296 msiexec.exe Token: SeSystemProfilePrivilege 4296 msiexec.exe Token: SeSystemtimePrivilege 4296 msiexec.exe Token: SeProfSingleProcessPrivilege 4296 msiexec.exe Token: SeIncBasePriorityPrivilege 4296 msiexec.exe Token: SeCreatePagefilePrivilege 4296 msiexec.exe Token: SeCreatePermanentPrivilege 4296 msiexec.exe Token: SeBackupPrivilege 4296 msiexec.exe Token: SeRestorePrivilege 4296 msiexec.exe Token: SeShutdownPrivilege 4296 msiexec.exe Token: SeDebugPrivilege 4296 msiexec.exe Token: SeAuditPrivilege 4296 msiexec.exe Token: SeSystemEnvironmentPrivilege 4296 msiexec.exe Token: SeChangeNotifyPrivilege 4296 msiexec.exe Token: SeRemoteShutdownPrivilege 4296 msiexec.exe Token: SeUndockPrivilege 4296 msiexec.exe Token: SeSyncAgentPrivilege 4296 msiexec.exe Token: SeEnableDelegationPrivilege 4296 msiexec.exe Token: SeManageVolumePrivilege 4296 msiexec.exe Token: SeImpersonatePrivilege 4296 msiexec.exe Token: SeCreateGlobalPrivilege 4296 msiexec.exe Token: SeBackupPrivilege 4668 vssvc.exe Token: SeRestorePrivilege 4668 vssvc.exe Token: SeAuditPrivilege 4668 vssvc.exe Token: SeBackupPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe Token: SeTakeOwnershipPrivilege 4144 msiexec.exe Token: SeRestorePrivilege 4144 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4296 msiexec.exe 4296 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1568 notepad++.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4144 wrote to memory of 1952 4144 msiexec.exe 95 PID 4144 wrote to memory of 4180 4144 msiexec.exe 97 PID 4180 wrote to memory of 1568 4180 cmd.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\file.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4296
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1952
-
-
C:\Windows\system32\cmd.execmd.exe /c start /min "" "notepad++.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\ProgramData\scrcpy\notepad++.exe"notepad++.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589799.rbs
- Size 52KB
- SHA256 1d2ee44a5b2faf1852e282a2f38788224833f4d868ea1c9ef9d517e26da43217
- MD5 051a4ebdbda2043defe446a1a916e3d2
- SHA1 8330e8181c368dc75ffcdd1a9b1d5baa9b54a47f
- SHA512 12b2f06e45827a1b0b98f392b0c94a0b68902763d1ef16d2d5162c2db4dbec673a3b9dc6ddc8a3992dabd98e6bf6df50a394863d4d221fa45e66fb8dd34ae51c
- SSDEEP 768:4ejFTyUWinZO+Vhlj7M2bhVPhTYScx/2lGfk:njdXw+VcOhVPy2l0k
- TLSH T14D33A9566E0F43C1994326F40B8D7418EF56D9725E88083EB8FDD62F8814FE8893EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\config.xml
- Size 8KB
- SHA256 d63bfacbd4ccdbfc4d5afc472daf710aea8a9e996dce811b7ab3792dfc735b5c
- MD5 a9b662064aa42e7ab615a940d00a0b39
- SHA1 1010cd904b0f7d2d0d4c2c38cf3b69bec39529dd
- SHA512 cba0b608db0bc49ee9a2b490482634c132366907b036499b2f1493525dc07e283371e9bb9153b4e35fbad2827777b641cd61565543dc1fd7e9aa33a3f2a433f0
- SSDEEP 192:yVRADaTueX5jJDQI7Tu3HZGoKhXYOorWcDA1:yVuD4ueXNiI7Kw7oFrWt
- TLSH T14B02000EA09C1F26A67342A1D7EF0D04BF466AF3910A238EB47D3176DFAB5404E57276
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\contextMenu.xml
- Size 4KB
- SHA256 cee7492b0f600d952da489f4b097896c47217959e1597f2529d5004fe1eb08aa
- MD5 611c43523fc4fd8f00c42181a7c61a8c
- SHA1 c1bcb78b277358bc528ecca3a6554c0140e82d16
- SHA512 99280c7e089c4c593e6801ce2655dc0d981b62df9f613567682f4be05a40ee3b816264c6c60d67b4ee6c7477ffc5b5a392ad722121b10377bf0601cb6643e403
- SSDEEP 96:NG9IVd03FsQ+f/A+f/v+f/B+f/h+f/h+f/H+f/TVxSjL/XYD6Fsg66J6618hIIHm:ZP03FsQ+f/A+f/v+f/B+f/h+f/h+f/HJ
- TLSH T1BEA17D1A79647F1E6AE401399FFA5C84235ACA74F32C9861EC2D357F0EC794542FBA80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\langs.xml
- Size 530KB
- SHA256 f75074b80a8bebaf6d4ea5a694bf4848b3fb46caf7a42e346d677b2607e2f15b
- MD5 a27b581fca5f6c3ff4af605d4531d9e8
- SHA1 2fec9564e59bfdf0aed11b076ad2b768972c7bf7
- SHA512 7ed937306ffa716dfbbc4908cb9a2288dc7f2c2b0d65333e8b311886a9dede6f4186d6bd9d18cc033e000e2102f619eeac3430972e630540ae323ec26a0519cf
- SSDEEP 12288:OcsiMklPKHhAFYWSLNLGb30KNhsaO3p3qu6OvwLKgNQrFimA4fEgJb:dMk+AFYWSLNLGb30KNhsaO3p3qu6Ovwc
- TLSH T1AEB46D0658944C2748D365B9F9ABB7829A24D083635CD690FFFCC62D6FC34D982B72C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\notepad++.exe
- Size 8.1MB
- SHA256 448cb98a3fa0a80a44f225c50e8de83ef7deecf1b3537a16b9e2d61361c625d8
- MD5 ac81184a542c5aa67fe449d61e5b869a
- SHA1 5f8feb8211f20a845e82139ae2f2103556499563
- SHA512 b818958ff19080fc17e463ba33c84604c47e5af58178e0c1d7c1ce654db3ebe60193e5bb4d0d2a5809c696ba2112203ead709c37363ccdb7ac850930ec841df9
- SSDEEP 98304:jU6PfG6fKUhYTNAnDM/zupf7qjFxiSKXHOCc:jU2rnOTNADKzuUiROCc
- TLSH T11E86AE5373E941ECE0BBD1798A568963D7727C550332ABDF01A099395F23AE04E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\Config\converter.ini
- Size 646B
- SHA256 5b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0
- MD5 f07150054a6afff4d8e9d58899167722
- SHA1 e092cd960ab728667d91b37d64a02d7f6821518b
- SHA512 8c86aa4c058a8ab5fd26f21cacc8ddaffa8ce6012bb329d3c5b817da00b4b43018a575c768d1921c6eeab7537f172c7cb3de658b014365ea52fb3c87547182b9
- TLSH T13CF04EE77FC81639403103E135149363D92841BA7526183E24B4EA59531BE24A36FCFC
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\scrcpy\plugins\Config\nppPluginList.dll
- Size 222KB
- SHA256 0cc254d97eaa3b8be81f8d56a5666d03d9ac4eaa3f7c39c76b28a3be5b2cfda4
- MD5 373c70bf895d4dae12118c4e128aa2e1
- SHA1 670f03561fe0411cce1d81a9074c7f40565d58f7
- SHA512 52ba926d2f4e54aaaec9b4c4d6503e7fed74278848c49b94c68cbeea86787c6321a053adbeeb6c3393c765bef0c0f8b48ebb189d73cabeb43b289affba1d1a47
- SSDEEP 3072:mv1iPBpIBo7A0q366/JmMt9l0edbu99OtwaR+hWKfaY3C+8zEBNJh4mDSjmQilwO:Y+BqqRq36o3TtwaR0Wk52CJQoz
- TLSH T186243957B38C90EBCA6603B29835DA45F33EE64D5780CEDFA42104085E937F24B7BA65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\NppConverter\NppConverter.dll
- Size 203KB
- SHA256 1c3e8ab21cacc6b9976476c93b852997bca676e095f20deb50475fcd98650237
- MD5 967cd37d501af534a349dddeb60f3666
- SHA1 b414429bb7b869aa26a8d5802ceb0e47a93006d3
- SHA512 c7a9db7c7e62812f1bfbc76ca62072db2de3c605b737d0d798a8cfbbeac3773119b6f6d5bcd5bf59968478957a02fcea4598c7f4bf08b29c0630199960e432dd
- SSDEEP 3072:pbSjl3Uv0jMZvlZwMb2yahffcW1JSAuX1G+mbsRgyvYWQizwN:lS1y0jSYIy+mLpbsRjYXyE
- TLSH T1BE149E55B3A900BAEC679178C9974A06F6727C5107609BDF03A04379EF2F3E0563EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\NppExport\NppExport.dll
- Size 239KB
- SHA256 a2330c4e57c0c7cdd8f2342ed5aa30f45ad3a64b7cb559236014f8b738bda156
- MD5 e233d960af59d20538b9392d2b75507f
- SHA1 39afee457168525eb2172842595399c872bf663d
- SHA512 38a7d39e429b01ca0810ebabd950ef60b4fa257bb08ba657b846220e205a89073efd4f6a387411fc7b535238dd7c020b9d82bc0ee372292d44ffe7eb65b0a599
- SSDEEP 3072:amw8KKNcxnT5d32I+XkJViKqrWx+Luqp4Btpbwh:a/KqxnTCZkJVi4xfqGtu
- TLSH T1A534EE6163EA1104F7FB6FB76EF2A084DAB579B15976C21E1168C00F2C75F81E8A4732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\NppExport\tdwp.dll
- Size 163KB
- SHA256 d11bc43f45c3775fed2b577650d54b72976228a4a0ed283028cd08891f27221f
- MD5 4c4b419cc30b3fe4018384ef710527e3
- SHA1 ba3415c7f9ddaad781c5dcd251e58d4f16ab9988
- SHA512 9eb61ec8ed3ca2ae59285ef0bc472ed98e6459405c7c646dd67dadad0bdb180b3c3a8c3e729a2fd744b4b891f1ecbb47abe652313af2d7347b03d563dcc91c81
- SSDEEP 3072:ISLmFFXlWWXEFrWwP3vRHmd3Yn1vC1mrzPDrJMTYwdd:pQnEFrv/sFYn1TLKd
- TLSH T1FBF36C1BB2A500FBE5678678C5A36606F37274110B249AEF03914A7A1F23BD19D7F722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\mimeTools\mimeTools.dll
- Size 146KB
- SHA256 93c8f12d24d67db1dd00375c1bdbf7eb3d16f7829a60d65d8945c84bebc6c204
- MD5 b41d7e68523e230beed80f4d09630df7
- SHA1 b410e3ac1bd9f97b97e70250a2d29a723a947bb6
- SHA512 b34c093edc99baeeae62a4197648347721885ed4636af46fa6cd639336994703a86ff1ff311da73cfb332c41f3e0778ddc0553485d0529b216e574a1b232451b
- SSDEEP 3072:1EQ1wXuVQpt5gQFDnJUhFJN5uq5Ms65PZJXb7Zizwa:1EAOpXX3aJvGfXROL
- TLSH T16EE36B9773E500ABE177C238C9934A15E7B27C115B609BEF07A4825A1F237D19E3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\session.xml
- Size 192B
- SHA256 9220559ffd78e2819c163663a057cdaffb97dd10372c2d37219279ea2eb4bc26
- MD5 7c14c3b2236b0ab27bce229cdfc4412c
- SHA1 a857c698a7677958d23a15dd63f1054b2657522d
- SHA512 4ed5da2aa78e1ea3561ca257a931701de5a3d7de871dadba32cf45b0a89cc78e7dd67a94ef882a5f5d6044d1a9e08670b7efcbd86f6a24300d2aa313ef1efada
- TLSH T103C0121420E0A97306715D2091BA88D5EB6870F314916181714C4A530FA64D959FF82A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\scrcpy\shortcuts.xml
- Size 2KB
- SHA256 4e7bc3a7a30fe8e84c17d23e9741fadfe1071d77bf44d07df92fee387d78e93b
- MD5 8ef8c82903443784f576b351feaf1b1e
- SHA1 4de6990aad0e2d30468c03320d8bb180498edb8d
- SHA512 a31226f5bf9df74a3f40e7cdfa3518d6a8601bbe8493af66838e8f2540fda6df8bf41b65476775ac1b3d96577f54bcad9a16d2705988f658f85363842bf2a45a
- TLSH T1AF51BE0636AD7E8A8343085F57FD5C5C27765E2B3F461782B0FA7833859AC710E94175
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\scrcpy\stylers.xml
- Size 227KB
- SHA256 a482b77c52fd06d66460d50581a00ff4e2670c0f3abe5d452e27c67fe3ea45c0
- MD5 136fe962f5cb7e36fb73f3dfa80fd62b
- SHA1 c49d371bbedc6b24dc9f33e4fa6841df32c10caf
- SHA512 f95f9995089b3cd93873185595d920ed53b838ba0733c93538a93c946b91829f51020d8934e131181ecc345742a99ca7f2471746425afc444aa94d1a5aef226a
- SSDEEP 384:OM7D8VpozibLr9R89iJQ0AcMm7SkQytIZpA0zU4oBeVUnvM1yvhcvroeLyZelBcf:OMY0iJfLMA0zLXUnudyZelKRXiMU1s
- TLSH T1C834550990444F59CA1640186F43A98E4E1F77F72E681CB1B66F2933EBD2DAB54073AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\updater\gup.exe
- Size 1.3MB
- SHA256 3cabd8d13eb863047fd354d6732407ce1b6b62d09b8bc840670c64854478851e
- MD5 7819887cbbebd2891d7fcab032f47062
- SHA1 d7ea0e8376adaa521289831bb031a7816ba8a9cf
- SHA512 3ef809155710ceb2d8039f865731be86036da8207ce41cce94da39c091c120d8cf8f581f7f5f0054180e92699d1fb35b4291a18a047abba4a3c48029fea3ea53
- SSDEEP 24576:jK0j1AE3c2wIl2pOfEdPkb5qQ7sbdtFaN1cYEA6+MhJcZOOy2pPTrURf:G0jH3cj62UM6p4bdtFaN1cYEA6+SJapm
- TLSH T1A7559F55A7A401E9D1E7C178C6428A1BEBB2B4451370A7DF07988EAA3F13BE15F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\userDefineLangs\markdown._preinstalled.udl.xml
- Size 6KB
- SHA256 d686a666d17b38fe523ce0f477cf8f6468b1cd341f80c8e2cc06a70b617c959b
- MD5 b425e9323bcb0be39e182ff9fe881bff
- SHA1 f5a151d39c8a79f6a4ca189141f0180c56d7c1bf
- SHA512 c0421a9acbbeaad3409b0cc81dd99d33d74b18d81792803300705035e2f22139a15dcab3bf4e543c48da399d48ad922caed59d2dbeb93c9b89d8af9e5815fbeb
- SSDEEP 192:y1VhOpiLM1eMDr+JNejAUeQVFgDeQeleneReiA+5AmAiAC4UeieoeoevegAT2:yHhOpiLM1eMd1DPXyV
- TLSH T1F1D18045C1C44F1D8F26E42C1F93D44EAA0BB1E73A251D6CB6BF2173B361865584B2AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\userDefineLangs\markdown._preinstalled_DM.udl.xml
- Size 6KB
- SHA256 49857fab550093b68419e1a7df3bdeb103477c038effbc5782350c28124aaeed
- MD5 0e6a6b54ccb2032d94bfc8389e81e0fe
- SHA1 397c4a4f4e615dac0dd85a63fffbe39b930ee82d
- SHA512 c128d673cf86d7a6d4cb9af9ecaeae132700ebdf9a9bfc3505cc430528ad696d430b1f1d8021db4b4dbf6f5549849dc0c0b55921f692ef060319bfdc8e419cd2
- SSDEEP 192:y16hOpiLM1eMDr+JNeScx0cWcHclcGcBcCcfcFcbcRcCccclcRcOcicmcYcqcqcA:yIhOpiLM1eMwI0JUGVKdo+YWV3K6JVBT
- TLSH T1BAD14F48C1C54F1D8F27A42C1F97D809A94BB2F72E151E8CB67F213377618A5588B2AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_C860188A505D14B36D791E9EF9A41DAF
- Size 1KB
- SHA256 64f550d2c8805d9006ca304a4ba7ea19cf793524fe5b4a9fd36b2bc0519fc9dc
- MD5 ef9be60bfd7302abfe317be55383fa58
- SHA1 6f99839f4776b68a344b007abc6a64c5bab673f9
- SHA512 687c11ba89fad5bdc802f41cb24d9bb92a77da429ebc9f9969f7ff69a4052f433ac315bd9b9d29d81ae6e6a8fa49f1b89b978e0ce25aedbb75d00eec6ee456a2
- TLSH T12931964B196E2887AB9BCE751AC26D2B747895D015FC7026303A978735143D32FA5458
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 192a672591440d3da179eeebeb8a953ad0674e2b18c5c53bdbdd26ed3c861f29
- MD5 bf4273d05168653f789b90c1ff2ef0af
- SHA1 373f05667a7262e23e9767165c0baddd2ed0ba70
- SHA512 30ed7bad91984d5fe2dd329edc70c1787f6aab7d89f507244842951d0963287596b5716f5afdc4fe12b79feb0c23fcb1e8c03e7d90d2a75e14d301a752f8c516
- TLSH T165311A270F6C19309E238D9425CCF9367870C2E26DAA26AA3124990728C47B78F1A14F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_C860188A505D14B36D791E9EF9A41DAF
- Size 548B
- SHA256 c4349c9ecc30c125038d8e8e78267bfbcb7ed163c1d747e369606558da1e7593
- MD5 094476bbdfabd2d0cc9707bae11e445f
- SHA1 85f5a2db4f5a262e1c1587109720371c6d7eca4d
- SHA512 29348daa5a9a65e0d50496d934c4f8d4fb99e1d8ee625dcdc7c6727b386fea7b2a42510a5f8033a8f39552ef7f89568e3f7ebfa8bcddcee6f7ad16cbd96adcf6
- TLSH T1EBF05930187B003FF132CBB81BC1A1863D98ED227D214A151A9C87086829E001C93A3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 98beb10480e5bf68457daa4f6a936d753d2efce835d40007c54f321cc76a9c9c
- MD5 570abe42bab068bae2b6c6dbef50f376
- SHA1 116f3e72e764711e260b6df3a7ea6ae14fa7e758
- SHA512 4ab14fb4d093f79329b2b7562238a09ab507e5fe98bb5a78d5a2c42c3162d2f674d291cf8ddebc114897c436059aef0d1a8431fe94c8a456adcd57fb921c0198
- TLSH T15CF0DC3801FA422DF4B2CABE0ED9751BA956F9037C2697662B954B4D9C28B009DA3429
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e589798.msi
- Size 8.2MB
- SHA256 23845c79a0d27642e5d4ae36ae1c246ba4455346b5910b45e5bba3d0a80044c3
- MD5 979d3e4e42f165e9e3838a03f05cdd43
- SHA1 a6fc411b635f56a3e22cfee6998c515b9da28726
- SHA512 3c52ff5c3119c6fafb2d46b3f55adf9b0b3f0ede81c8878447694169b0ea72eb3af4fe4afe22ec86b828a110eaf086b3aa8e39f204fb46b0298bcc43cbe10455
- SSDEEP 196608:KxFr494Ac84hP1KgzvXpExbfByyWlrHKCtVsJwVb8hXx3:Ur39LbXIbpylpXtVCwKhXx3
- TLSH T1BE86338A9D132316CA0BD3FF2947FB5946792CD5822B540D7718B31C2E3A6DE972D2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 bf7ada7abc731c679179053c75978062520f3f88f1a20320f3f9d36d7ba5c05e
- MD5 2ed3a043f8e4835b41985be96d1359d9
- SHA1 1a1ce4103ee982bd313a44046be42b884587a134
- SHA512 c9bf4c5fd32314d79bec6e14c6c52aad80b74610abf374a9b6631f34a001176ea1126d551d01b328a9152c97cc6057ce0cf25664b9747a27b38de18f8d97b21e
- SSDEEP 24576:Wu8m+1zqdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:r
- TLSH T17047F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ce5f478b-4901-4cf9-99a5-3eb6c9fdd8ef}_OnDiskSnapshotProp
- Size 6KB
- SHA256 faae123010e74d56b27a88a4e106a666ab71f6fe6049640f917a295533573ac9
- MD5 bffce14319787d941fab502c68e7fc80
- SHA1 2a4235961f4041dfbe160218cc5a109ce3ead28f
- SHA512 2021898b9978cadceda2abba2fd8f15b836a825ce4ce0d24c61c3b6782d61f0af6b0406dff09cd68cd1e86a77fdadde71432b9076ff5e6f48c8b013545ca128f
- SSDEEP 96:FEePSfFDvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:FI3b++ZVmN
- TLSH T1B3D19A085AF54711E2B3AB7228F14557A877B911FF33CB8E0198238E6670A14F936F5B
- MD5 SHA1 SHA512 SSDEEP TLSH