Analysis
- user interaction
yes - max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 15:04
Behavioral task
behavioral1
Sample
file.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target file.msi
- Size 8.2MB
- Sample260722-sfrevsxdlf
- SHA256 23845c79a0d27642e5d4ae36ae1c246ba4455346b5910b45e5bba3d0a80044c3
- MD5 979d3e4e42f165e9e3838a03f05cdd43
- SHA1 a6fc411b635f56a3e22cfee6998c515b9da28726
- SHA512 3c52ff5c3119c6fafb2d46b3f55adf9b0b3f0ede81c8878447694169b0ea72eb3af4fe4afe22ec86b828a110eaf086b3aa8e39f204fb46b0298bcc43cbe10455
- SSDEEP 196608:KxFr494Ac84hP1KgzvXpExbfByyWlrHKCtVsJwVb8hXx3:Ur39LbXIbpylpXtVCwKhXx3
- TLSH T1BE86338A9D132316CA0BD3FF2947FB5946792CD5822B540D7718B31C2E3A6DE972D2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2292 notepad++.exe - Loads dropped DLL 7 IoCs
pid Process 2292 notepad++.exe 2292 notepad++.exe 2292 notepad++.exe 2292 notepad++.exe 2292 notepad++.exe 2292 notepad++.exe 2292 notepad++.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFF278444B74317676.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF12724810F677B462.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF86021D6EB9276BA7.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DDF13824-1FA0-4E5A-8453-FB6A23E145A4} msiexec.exe File created C:\Windows\Installer\e59a33d.msi msiexec.exe File created C:\Windows\Installer\e59a33b.msi msiexec.exe File opened for modification C:\Windows\Installer\e59a33b.msi msiexec.exe File created C:\Windows\SystemTemp\~DF87F6AC05251FEDFF.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAF70.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5364 msiexec.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3340 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1860 msiexec.exe 1860 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5364 msiexec.exe Token: SeIncreaseQuotaPrivilege 5364 msiexec.exe Token: SeSecurityPrivilege 1860 msiexec.exe Token: SeCreateTokenPrivilege 5364 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5364 msiexec.exe Token: SeLockMemoryPrivilege 5364 msiexec.exe Token: SeIncreaseQuotaPrivilege 5364 msiexec.exe Token: SeMachineAccountPrivilege 5364 msiexec.exe Token: SeTcbPrivilege 5364 msiexec.exe Token: SeSecurityPrivilege 5364 msiexec.exe Token: SeTakeOwnershipPrivilege 5364 msiexec.exe Token: SeLoadDriverPrivilege 5364 msiexec.exe Token: SeSystemProfilePrivilege 5364 msiexec.exe Token: SeSystemtimePrivilege 5364 msiexec.exe Token: SeProfSingleProcessPrivilege 5364 msiexec.exe Token: SeIncBasePriorityPrivilege 5364 msiexec.exe Token: SeCreatePagefilePrivilege 5364 msiexec.exe Token: SeCreatePermanentPrivilege 5364 msiexec.exe Token: SeBackupPrivilege 5364 msiexec.exe Token: SeRestorePrivilege 5364 msiexec.exe Token: SeShutdownPrivilege 5364 msiexec.exe Token: SeDebugPrivilege 5364 msiexec.exe Token: SeAuditPrivilege 5364 msiexec.exe Token: SeSystemEnvironmentPrivilege 5364 msiexec.exe Token: SeChangeNotifyPrivilege 5364 msiexec.exe Token: SeRemoteShutdownPrivilege 5364 msiexec.exe Token: SeUndockPrivilege 5364 msiexec.exe Token: SeSyncAgentPrivilege 5364 msiexec.exe Token: SeEnableDelegationPrivilege 5364 msiexec.exe Token: SeManageVolumePrivilege 5364 msiexec.exe Token: SeImpersonatePrivilege 5364 msiexec.exe Token: SeCreateGlobalPrivilege 5364 msiexec.exe Token: SeBackupPrivilege 2428 vssvc.exe Token: SeRestorePrivilege 2428 vssvc.exe Token: SeAuditPrivilege 2428 vssvc.exe Token: SeBackupPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5364 msiexec.exe 5364 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5364 msiexec.exe 1860 msiexec.exe 2292 notepad++.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1860 wrote to memory of 1808 1860 msiexec.exe 94 PID 1860 wrote to memory of 3340 1860 msiexec.exe 97 PID 3340 wrote to memory of 2292 3340 cmd.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\file.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5364
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1808
-
-
C:\Windows\system32\cmd.execmd.exe /c start /min "" "notepad++.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\ProgramData\scrcpy\notepad++.exe"notepad++.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59a33c.rbs
- Size 52KB
- SHA256 b285de9b08387397e9178195dfbaa985cd5542fccf40a310670dda33c56b6fe8
- MD5 b9295af8db9dbfde5ab60fb305938c48
- SHA1 83c60f6d7c7a609ecf3f0eeff48d593ad270c6ac
- SHA512 0a6f035b27a42549ffded011136799c43fcd3dd109bc9a09c50881ce8d865519b21e96ed0d3d2bbfd4323f254ae69e027e6e9628157f56a16c3516458184ca2b
- SSDEEP 768:CljFTyUWinZO+VhlD7MsbhVPGgNT0nysvScx/2lGCd8wQgTYAFbajmgy:KjdXw+VcshVPW2lN7
- TLSH T19E33B9666E0B43C1990326F40B8DB419EF56D9725E88083E7CFDD62F8814FE4893EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\config.xml
- Size 8KB
- SHA256 d63bfacbd4ccdbfc4d5afc472daf710aea8a9e996dce811b7ab3792dfc735b5c
- MD5 a9b662064aa42e7ab615a940d00a0b39
- SHA1 1010cd904b0f7d2d0d4c2c38cf3b69bec39529dd
- SHA512 cba0b608db0bc49ee9a2b490482634c132366907b036499b2f1493525dc07e283371e9bb9153b4e35fbad2827777b641cd61565543dc1fd7e9aa33a3f2a433f0
- SSDEEP 192:yVRADaTueX5jJDQI7Tu3HZGoKhXYOorWcDA1:yVuD4ueXNiI7Kw7oFrWt
- TLSH T14B02000EA09C1F26A67342A1D7EF0D04BF466AF3910A238EB47D3176DFAB5404E57276
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\contextMenu.xml
- Size 4KB
- SHA256 cee7492b0f600d952da489f4b097896c47217959e1597f2529d5004fe1eb08aa
- MD5 611c43523fc4fd8f00c42181a7c61a8c
- SHA1 c1bcb78b277358bc528ecca3a6554c0140e82d16
- SHA512 99280c7e089c4c593e6801ce2655dc0d981b62df9f613567682f4be05a40ee3b816264c6c60d67b4ee6c7477ffc5b5a392ad722121b10377bf0601cb6643e403
- SSDEEP 96:NG9IVd03FsQ+f/A+f/v+f/B+f/h+f/h+f/H+f/TVxSjL/XYD6Fsg66J6618hIIHm:ZP03FsQ+f/A+f/v+f/B+f/h+f/h+f/HJ
- TLSH T1BEA17D1A79647F1E6AE401399FFA5C84235ACA74F32C9861EC2D357F0EC794542FBA80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\langs.xml
- Size 530KB
- SHA256 f75074b80a8bebaf6d4ea5a694bf4848b3fb46caf7a42e346d677b2607e2f15b
- MD5 a27b581fca5f6c3ff4af605d4531d9e8
- SHA1 2fec9564e59bfdf0aed11b076ad2b768972c7bf7
- SHA512 7ed937306ffa716dfbbc4908cb9a2288dc7f2c2b0d65333e8b311886a9dede6f4186d6bd9d18cc033e000e2102f619eeac3430972e630540ae323ec26a0519cf
- SSDEEP 12288:OcsiMklPKHhAFYWSLNLGb30KNhsaO3p3qu6OvwLKgNQrFimA4fEgJb:dMk+AFYWSLNLGb30KNhsaO3p3qu6Ovwc
- TLSH T1AEB46D0658944C2748D365B9F9ABB7829A24D083635CD690FFFCC62D6FC34D982B72C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\notepad++.exe
- Size 8.1MB
- SHA256 448cb98a3fa0a80a44f225c50e8de83ef7deecf1b3537a16b9e2d61361c625d8
- MD5 ac81184a542c5aa67fe449d61e5b869a
- SHA1 5f8feb8211f20a845e82139ae2f2103556499563
- SHA512 b818958ff19080fc17e463ba33c84604c47e5af58178e0c1d7c1ce654db3ebe60193e5bb4d0d2a5809c696ba2112203ead709c37363ccdb7ac850930ec841df9
- SSDEEP 98304:jU6PfG6fKUhYTNAnDM/zupf7qjFxiSKXHOCc:jU2rnOTNADKzuUiROCc
- TLSH T11E86AE5373E941ECE0BBD1798A568963D7727C550332ABDF01A099395F23AE04E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\Config\converter.ini
- Size 646B
- SHA256 5b0a08439e8e93817772f84e1098f14152d9da36c2601a0600ddaae6f61359d0
- MD5 f07150054a6afff4d8e9d58899167722
- SHA1 e092cd960ab728667d91b37d64a02d7f6821518b
- SHA512 8c86aa4c058a8ab5fd26f21cacc8ddaffa8ce6012bb329d3c5b817da00b4b43018a575c768d1921c6eeab7537f172c7cb3de658b014365ea52fb3c87547182b9
- TLSH T13CF04EE77FC81639403103E135149363D92841BA7526183E24B4EA59531BE24A36FCFC
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\scrcpy\plugins\Config\nppPluginList.dll
- Size 222KB
- SHA256 0cc254d97eaa3b8be81f8d56a5666d03d9ac4eaa3f7c39c76b28a3be5b2cfda4
- MD5 373c70bf895d4dae12118c4e128aa2e1
- SHA1 670f03561fe0411cce1d81a9074c7f40565d58f7
- SHA512 52ba926d2f4e54aaaec9b4c4d6503e7fed74278848c49b94c68cbeea86787c6321a053adbeeb6c3393c765bef0c0f8b48ebb189d73cabeb43b289affba1d1a47
- SSDEEP 3072:mv1iPBpIBo7A0q366/JmMt9l0edbu99OtwaR+hWKfaY3C+8zEBNJh4mDSjmQilwO:Y+BqqRq36o3TtwaR0Wk52CJQoz
- TLSH T186243957B38C90EBCA6603B29835DA45F33EE64D5780CEDFA42104085E937F24B7BA65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\NppConverter\NppConverter.dll
- Size 203KB
- SHA256 1c3e8ab21cacc6b9976476c93b852997bca676e095f20deb50475fcd98650237
- MD5 967cd37d501af534a349dddeb60f3666
- SHA1 b414429bb7b869aa26a8d5802ceb0e47a93006d3
- SHA512 c7a9db7c7e62812f1bfbc76ca62072db2de3c605b737d0d798a8cfbbeac3773119b6f6d5bcd5bf59968478957a02fcea4598c7f4bf08b29c0630199960e432dd
- SSDEEP 3072:pbSjl3Uv0jMZvlZwMb2yahffcW1JSAuX1G+mbsRgyvYWQizwN:lS1y0jSYIy+mLpbsRjYXyE
- TLSH T1BE149E55B3A900BAEC679178C9974A06F6727C5107609BDF03A04379EF2F3E0563EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\NppExport\NppExport.dll
- Size 239KB
- SHA256 a2330c4e57c0c7cdd8f2342ed5aa30f45ad3a64b7cb559236014f8b738bda156
- MD5 e233d960af59d20538b9392d2b75507f
- SHA1 39afee457168525eb2172842595399c872bf663d
- SHA512 38a7d39e429b01ca0810ebabd950ef60b4fa257bb08ba657b846220e205a89073efd4f6a387411fc7b535238dd7c020b9d82bc0ee372292d44ffe7eb65b0a599
- SSDEEP 3072:amw8KKNcxnT5d32I+XkJViKqrWx+Luqp4Btpbwh:a/KqxnTCZkJVi4xfqGtu
- TLSH T1A534EE6163EA1104F7FB6FB76EF2A084DAB579B15976C21E1168C00F2C75F81E8A4732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\NppExport\tdwp.dll
- Size 163KB
- SHA256 d11bc43f45c3775fed2b577650d54b72976228a4a0ed283028cd08891f27221f
- MD5 4c4b419cc30b3fe4018384ef710527e3
- SHA1 ba3415c7f9ddaad781c5dcd251e58d4f16ab9988
- SHA512 9eb61ec8ed3ca2ae59285ef0bc472ed98e6459405c7c646dd67dadad0bdb180b3c3a8c3e729a2fd744b4b891f1ecbb47abe652313af2d7347b03d563dcc91c81
- SSDEEP 3072:ISLmFFXlWWXEFrWwP3vRHmd3Yn1vC1mrzPDrJMTYwdd:pQnEFrv/sFYn1TLKd
- TLSH T1FBF36C1BB2A500FBE5678678C5A36606F37274110B249AEF03914A7A1F23BD19D7F722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\plugins\mimeTools\mimeTools.dll
- Size 146KB
- SHA256 93c8f12d24d67db1dd00375c1bdbf7eb3d16f7829a60d65d8945c84bebc6c204
- MD5 b41d7e68523e230beed80f4d09630df7
- SHA1 b410e3ac1bd9f97b97e70250a2d29a723a947bb6
- SHA512 b34c093edc99baeeae62a4197648347721885ed4636af46fa6cd639336994703a86ff1ff311da73cfb332c41f3e0778ddc0553485d0529b216e574a1b232451b
- SSDEEP 3072:1EQ1wXuVQpt5gQFDnJUhFJN5uq5Ms65PZJXb7Zizwa:1EAOpXX3aJvGfXROL
- TLSH T16EE36B9773E500ABE177C238C9934A15E7B27C115B609BEF07A4825A1F237D19E3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\session.xml
- Size 192B
- SHA256 9220559ffd78e2819c163663a057cdaffb97dd10372c2d37219279ea2eb4bc26
- MD5 7c14c3b2236b0ab27bce229cdfc4412c
- SHA1 a857c698a7677958d23a15dd63f1054b2657522d
- SHA512 4ed5da2aa78e1ea3561ca257a931701de5a3d7de871dadba32cf45b0a89cc78e7dd67a94ef882a5f5d6044d1a9e08670b7efcbd86f6a24300d2aa313ef1efada
- TLSH T103C0121420E0A97306715D2091BA88D5EB6870F314916181714C4A530FA64D959FF82A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\scrcpy\shortcuts.xml
- Size 2KB
- SHA256 4e7bc3a7a30fe8e84c17d23e9741fadfe1071d77bf44d07df92fee387d78e93b
- MD5 8ef8c82903443784f576b351feaf1b1e
- SHA1 4de6990aad0e2d30468c03320d8bb180498edb8d
- SHA512 a31226f5bf9df74a3f40e7cdfa3518d6a8601bbe8493af66838e8f2540fda6df8bf41b65476775ac1b3d96577f54bcad9a16d2705988f658f85363842bf2a45a
- TLSH T1AF51BE0636AD7E8A8343085F57FD5C5C27765E2B3F461782B0FA7833859AC710E94175
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\scrcpy\stylers.xml
- Size 227KB
- SHA256 a482b77c52fd06d66460d50581a00ff4e2670c0f3abe5d452e27c67fe3ea45c0
- MD5 136fe962f5cb7e36fb73f3dfa80fd62b
- SHA1 c49d371bbedc6b24dc9f33e4fa6841df32c10caf
- SHA512 f95f9995089b3cd93873185595d920ed53b838ba0733c93538a93c946b91829f51020d8934e131181ecc345742a99ca7f2471746425afc444aa94d1a5aef226a
- SSDEEP 384:OM7D8VpozibLr9R89iJQ0AcMm7SkQytIZpA0zU4oBeVUnvM1yvhcvroeLyZelBcf:OMY0iJfLMA0zLXUnudyZelKRXiMU1s
- TLSH T1C834550990444F59CA1640186F43A98E4E1F77F72E681CB1B66F2933EBD2DAB54073AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\updater\gup.exe
- Size 1.3MB
- SHA256 3cabd8d13eb863047fd354d6732407ce1b6b62d09b8bc840670c64854478851e
- MD5 7819887cbbebd2891d7fcab032f47062
- SHA1 d7ea0e8376adaa521289831bb031a7816ba8a9cf
- SHA512 3ef809155710ceb2d8039f865731be86036da8207ce41cce94da39c091c120d8cf8f581f7f5f0054180e92699d1fb35b4291a18a047abba4a3c48029fea3ea53
- SSDEEP 24576:jK0j1AE3c2wIl2pOfEdPkb5qQ7sbdtFaN1cYEA6+MhJcZOOy2pPTrURf:G0jH3cj62UM6p4bdtFaN1cYEA6+SJapm
- TLSH T1A7559F55A7A401E9D1E7C178C6428A1BEBB2B4451370A7DF07988EAA3F13BE15F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\userDefineLangs\markdown._preinstalled.udl.xml
- Size 6KB
- SHA256 d686a666d17b38fe523ce0f477cf8f6468b1cd341f80c8e2cc06a70b617c959b
- MD5 b425e9323bcb0be39e182ff9fe881bff
- SHA1 f5a151d39c8a79f6a4ca189141f0180c56d7c1bf
- SHA512 c0421a9acbbeaad3409b0cc81dd99d33d74b18d81792803300705035e2f22139a15dcab3bf4e543c48da399d48ad922caed59d2dbeb93c9b89d8af9e5815fbeb
- SSDEEP 192:y1VhOpiLM1eMDr+JNejAUeQVFgDeQeleneReiA+5AmAiAC4UeieoeoevegAT2:yHhOpiLM1eMd1DPXyV
- TLSH T1F1D18045C1C44F1D8F26E42C1F93D44EAA0BB1E73A251D6CB6BF2173B361865584B2AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\scrcpy\userDefineLangs\markdown._preinstalled_DM.udl.xml
- Size 6KB
- SHA256 49857fab550093b68419e1a7df3bdeb103477c038effbc5782350c28124aaeed
- MD5 0e6a6b54ccb2032d94bfc8389e81e0fe
- SHA1 397c4a4f4e615dac0dd85a63fffbe39b930ee82d
- SHA512 c128d673cf86d7a6d4cb9af9ecaeae132700ebdf9a9bfc3505cc430528ad696d430b1f1d8021db4b4dbf6f5549849dc0c0b55921f692ef060319bfdc8e419cd2
- SSDEEP 192:y16hOpiLM1eMDr+JNeScx0cWcHclcGcBcCcfcFcbcRcCccclcRcOcicmcYcqcqcA:yIhOpiLM1eMwI0JUGVKdo+YWV3K6JVBT
- TLSH T1BAD14F48C1C54F1D8F27A42C1F97D809A94BB2F72E151E8CB67F213377618A5588B2AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59a33b.msi
- Size 8.2MB
- SHA256 23845c79a0d27642e5d4ae36ae1c246ba4455346b5910b45e5bba3d0a80044c3
- MD5 979d3e4e42f165e9e3838a03f05cdd43
- SHA1 a6fc411b635f56a3e22cfee6998c515b9da28726
- SHA512 3c52ff5c3119c6fafb2d46b3f55adf9b0b3f0ede81c8878447694169b0ea72eb3af4fe4afe22ec86b828a110eaf086b3aa8e39f204fb46b0298bcc43cbe10455
- SSDEEP 196608:KxFr494Ac84hP1KgzvXpExbfByyWlrHKCtVsJwVb8hXx3:Ur39LbXIbpylpXtVCwKhXx3
- TLSH T1BE86338A9D132316CA0BD3FF2947FB5946792CD5822B540D7718B31C2E3A6DE972D2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 eca39fa7bd8d56407ba3137d97a126f33a7fc931c39d46b5332d16bd96e1b129
- MD5 397fcaf23bb5f0286c73d196d359be62
- SHA1 f667d066055e89201ba5d09600e4d94e7629b53e
- SHA512 c23f976ae7f7322b457bea70aefd95f0658551daae793438d4af31ba6a38bbd911e6c2214b46f3e8b4d2210101cc5dc9d380a890e14ce5621289685ad7e02037
- SSDEEP 24576:wFo3DMPWdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:bH0
- TLSH T1B157B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ff09be46-d590-4919-9dce-dd0a0e3e602a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e767100dd3743094d5594bde016fdd2941e305aa598bbc3dd1f9214a54eb7b27
- MD5 a9d9b859aba92caaa9d036b5a9aa35e1
- SHA1 8b5be938868aa6fc71698d3b9923cc9d39ba3168
- SHA512 cec742adb4c3f7b5ebe205e8842f3378b9e6e9f50b2dc6815ab0cf6f8cdd9fc56fcd404fc1890b50547fa8fd1696fb607e5e65539b80fe6cb0b7154266d396fc
- SSDEEP 96:F8qSW5mxUlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:6UEUl/b++uVmN
- TLSH T142D188084AF54711E2F3AB3229F14557A877B911EF33CB8E0298638E6670910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH