Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
Transwiz.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Transwiz.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target Transwiz.msi
- Size 2.8MB
- Sample260723-ppf4psyena
- SHA256 511c2c0908883bc9d05295e5145b767f2633461c93a31d1cb8d765ee09cdd801
- MD5 cf1dd0006c422c2c85c46a6fe4506406
- SHA1 da48ec07cea7407b6b2d38dbb54d2cd472bd7563
- SHA512 9145083d1253ad96d67156015e8e567851178b80e0c8c3f6090a30e80846e83cc96dfa4ff8fafe0fe28190ec9a0625821607ded78925baeb35fe77b7585be3c8
- SSDEEP 49152:fx3AY5aeGDcQ8KmLVR97uAHSvVPcAANEoW7SAmEzkGl7KMGzu7dhlwe50Qe2:GYTGDP8KmHHSVAvW7SAhxQMG67Zwe6r
- TLSH T106D5F1217286C53BD56E05703A2EEA5A513ABF700BB1C4E7A3D8EA3E19735C15331F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4976 licfldr.exe - Loads dropped DLL 7 IoCs
pid Process 3452 MsiExec.exe 3452 MsiExec.exe 3452 MsiExec.exe 3452 MsiExec.exe 3452 MsiExec.exe 3452 MsiExec.exe 5096 MsiExec.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4332 msiexec.exe 19 4332 msiexec.exe 21 4332 msiexec.exe 26 4332 msiexec.exe 39 4332 msiexec.exe 44 4332 msiexec.exe 52 3764 msiexec.exe 58 3764 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe msiexec.exe File created C:\Program Files (x86)\ForensiT\ForensiT Transwiz\Transwiz User Guide.pdf msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\e593c34.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6BE1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C8E.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{383D9D2E-C4B5-4684-A0A2-CF80B7110354}\DataMigrationVista.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI6FBF.tmp msiexec.exe File opened for modification C:\Windows\Installer\e593c34.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI64DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6CED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6DB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6E76.tmp msiexec.exe File created C:\Windows\Installer\e593c38.msi msiexec.exe File created C:\Windows\Installer\SourceHash{383D9D2E-C4B5-4684-A0A2-CF80B7110354} msiexec.exe File opened for modification C:\Windows\Installer\{383D9D2E-C4B5-4684-A0A2-CF80B7110354}\DataMigrationVista.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI6B92.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4332 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language licfldr.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 25 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\42D9AF30FFB97CC4FA4CCD63C218A469\E2D9D3835B4C48640A2AFC087B113045 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\PackageName = "Transwiz.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2D9D3835B4C48640A2AFC087B113045 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2D9D3835B4C48640A2AFC087B113045\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\PackageCode = "C77C430B710C6294E82B88FDF6F133B6" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\Version = "18023499" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\42D9AF30FFB97CC4FA4CCD63C218A469 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings licfldr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\ProductName = "ForensiT Transwiz" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\Language = "2057" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2D9D3835B4C48640A2AFC087B113045\ProductIcon = "C:\\Windows\\Installer\\{383D9D2E-C4B5-4684-A0A2-CF80B7110354}\\DataMigrationVista.exe" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3764 msiexec.exe 3764 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4332 msiexec.exe Token: SeIncreaseQuotaPrivilege 4332 msiexec.exe Token: SeSecurityPrivilege 3764 msiexec.exe Token: SeCreateTokenPrivilege 4332 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4332 msiexec.exe Token: SeLockMemoryPrivilege 4332 msiexec.exe Token: SeIncreaseQuotaPrivilege 4332 msiexec.exe Token: SeMachineAccountPrivilege 4332 msiexec.exe Token: SeTcbPrivilege 4332 msiexec.exe Token: SeSecurityPrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeLoadDriverPrivilege 4332 msiexec.exe Token: SeSystemProfilePrivilege 4332 msiexec.exe Token: SeSystemtimePrivilege 4332 msiexec.exe Token: SeProfSingleProcessPrivilege 4332 msiexec.exe Token: SeIncBasePriorityPrivilege 4332 msiexec.exe Token: SeCreatePagefilePrivilege 4332 msiexec.exe Token: SeCreatePermanentPrivilege 4332 msiexec.exe Token: SeBackupPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeShutdownPrivilege 4332 msiexec.exe Token: SeDebugPrivilege 4332 msiexec.exe Token: SeAuditPrivilege 4332 msiexec.exe Token: SeSystemEnvironmentPrivilege 4332 msiexec.exe Token: SeChangeNotifyPrivilege 4332 msiexec.exe Token: SeRemoteShutdownPrivilege 4332 msiexec.exe Token: SeUndockPrivilege 4332 msiexec.exe Token: SeSyncAgentPrivilege 4332 msiexec.exe Token: SeEnableDelegationPrivilege 4332 msiexec.exe Token: SeManageVolumePrivilege 4332 msiexec.exe Token: SeImpersonatePrivilege 4332 msiexec.exe Token: SeCreateGlobalPrivilege 4332 msiexec.exe Token: SeBackupPrivilege 1220 vssvc.exe Token: SeRestorePrivilege 1220 vssvc.exe Token: SeAuditPrivilege 1220 vssvc.exe Token: SeBackupPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeBackupPrivilege 636 srtasks.exe Token: SeRestorePrivilege 636 srtasks.exe Token: SeSecurityPrivilege 636 srtasks.exe Token: SeTakeOwnershipPrivilege 636 srtasks.exe Token: SeBackupPrivilege 636 srtasks.exe Token: SeRestorePrivilege 636 srtasks.exe Token: SeSecurityPrivilege 636 srtasks.exe Token: SeTakeOwnershipPrivilege 636 srtasks.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe Token: SeTakeOwnershipPrivilege 3764 msiexec.exe Token: SeRestorePrivilege 3764 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4332 msiexec.exe 4332 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3764 wrote to memory of 636 3764 msiexec.exe 107 PID 3764 wrote to memory of 3452 3764 msiexec.exe 110 PID 3764 wrote to memory of 5096 3764 msiexec.exe 111 PID 3764 wrote to memory of 4976 3764 msiexec.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Transwiz.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4332
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D635268A924399BEA5A7A84C2577863B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 039C58863F17A04CC5FAD9CD898BEC00 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5096
-
-
C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe"C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe" -tf2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4976
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e593c37.rbs
- Size 9KB
- SHA256 4cf2e7fd3fe84b8c3956bb7a525315579836b292a6191ea7eb91841267051515
- MD5 9c7a579c8af1fd7731e1add844ebf40e
- SHA1 8b48f82820d0f60044cd8232c740ef6171d32d4f
- SHA512 fccbb02a1109bb9395c3e779724af18c6276acd9b29e3ca891039eb71f47a311a85d98c032fad47d2aada3f281159187be7dc63eb685e055ef823e76d8f6b62f
- SSDEEP 96:y4LcKOJJzrH91iflRevE5M5gowUWXiqCpThqTZwUWXiqC3j7X5jJThqjH4PQ5izl:yyHOpIflReOoPr5JqPr5DzYju9p0s
- TLSH T1C0125001760041E6E8D32BB8C75B1A563BA7C6DC5309134B029C4DAABF967D82EB526F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ForensiT\ForensiT Transwiz\licfldr.exe
- Size 78KB
- SHA256 00bcc6ba3e27fa3a3f1b9418749fbbe8d5c2c5537c346e27ae9f7ea5bb988e11
- MD5 4b312a18215e358f06308d2acbbbe103
- SHA1 f9ad535e9e146709d0d48a5c90c8fedd8099cec4
- SHA512 2413315f2df2e9a708a318ffea10af6655870460676504b7c27350432c003f2a97404103238e63992676c55d5c39549d4ac2e2df0ee5bd2cf99c3969cc9b2949
- SSDEEP 1536:PyFdYr1PhVEg4i5BfjfLHdHTrYk6PRZdHCHWJ5xWmq+XCMo1sWucdxTSGzWkMo:BDH4i5BbfLHp6PRZdHCHWM+SMoHxBzWq
- TLSH T1A9734A4375D18871EAB21D316870CAB56E3FB9215F648E6B2788023D4F306D19D39F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ForensiT\Transwiz\Deployment Files\Transwiz.config
- Size 799B
- SHA256 f8ce6f4572b696e7c96e0606c48ba206f2528857a290c8e0b576207ca08e37a6
- MD5 ef93c2754f599188af96d1cb2c04aa6c
- SHA1 efdb8fdc56d1f3dd9eda517ecc8fda785ba5a6e4
- SHA512 989a3b0290478348fc6a7d0d0114a479dff00b8794b688d3a9d48151228af660f05d50c5aca69ab5e2998b134048f6c35520652a972ced076d39c2b7c541de27
- TLSH T17B014817C88C90352870128279B0C516EBE7ACA7696E0B60748105CF7FF600C64AB456
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ForensiT\Transwiz\Deployment Files\Transwiz.exe
- Size 1.8MB
- SHA256 7b557a3d47416e5e15964ac00161bcc3eb9bf97617085501c0ef60a1b4f3795e
- MD5 471ce7e66c5c66f1cde267d0dabbfe8e
- SHA1 e52a84149b200dd6e6e6866a6ffab02fcd834479
- SHA512 d2feb4448402d6ef9393cb6ccbef483518ffbb5de3f04c1252e062259ad4a3d4984e0e11a9f769a2a2f774027ad590e6a9534c1803e60ebc3d019fe0db15560b
- SSDEEP 49152:37qPyadnSeWsfGegJrOhKUMAhhsO+xhygTaAwJUyL:36dnSNrOhKUQzTwJUc
- TLSH T159958D207A959131FAB211305578AA758E7DBC302F2985DF6384762E9E307D2DE3C72B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECF3006D44DA211141391220EE5049F4
- Size 83KB
- SHA256 cb475a4e8c19de2a423bead1fdb8154df368d300ee5fd279785a032e099a051d
- MD5 87dbd7d9fde124b47c9387ece78d87d3
- SHA1 480729fbb7886e613cdbd0532be33bd8a4b1eb37
- SHA512 a45f25bb18f60285514bb57ec140cf69bea66f982ef93ca83200143f0b3860303a1209ac410339c134eb066f9f1b01ddab617373b4234788510e8abab7944d45
- SSDEEP 1536:zlbomQGLbyTiads4s4LBlSm94s4HHuQAiAjCzx25r:pbosL2TFs3W12se1Abj2I
- TLSH T16083ECDCAC5539D76145A2B1C88B4EEBDDB2B58533D2D41A92A54F014822FCEDEE80F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECF3006D44DA211141391220EE5049F4
- Size 170B
- SHA256 13dab305979413534f89c091db7a486e3522ab49574c6241cb681c9b1cb50a6a
- MD5 7d156800be5a902c4b9ef96c31e23219
- SHA1 69b8f7698d2c1a7b5344a4ae922a84099494fd88
- SHA512 5444a7342bade3a5f1df59d7413550e10143de7fb2bc9825be31c1ee7f1afedf455d4cdc577456aabd3f395bbbaf734ddb6102667df73e57bf94a7c6e5db5ef7
- TLSH T18EC09B401B540755F4350E3D644217915B159565ED5BC3D18F7011095D1AF54DD75D31
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI64DA.tmp
- Size 392KB
- SHA256 d9a307d175c72ea0922296f0686ab5a2a72f67e3c8c848e6623cb36aeaddf2ef
- MD5 36e2edbde4f98a27f31fef1932d51e95
- SHA1 2a1f68bf48449c2de57f825e6906968522328aaf
- SHA512 f39a6e5370725593f088bbcb913ac9d752f64a3e02f34f8df2d1584b0378c6343c9c79fd64c3234bc4e89af8dc10b27251587487d9d56f510c8a155d3d5f4ff6
- SSDEEP 6144:7/rR/uJIB3iq00wWg9n9Z2P0ZF22C6EZuQAODRVKgdwacrT:fRsILHg9n9YP0OluQHVzwacv
- TLSH T1AD847C20B2D6C83AD57E55B03A2CD99F41297EA60B72C4EBD3D81D1F09729C25635F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6E76.tmp
- Size 380KB
- SHA256 91c94656fb4d2b4a9386a4ddafda0548f75b09fbb6b6e888578ed4f4f40e28c9
- MD5 1afe13cc96584e1862ca42124785289f
- SHA1 d366ea0993157ec5813f344a156916c7a7a19a58
- SHA512 6a89efc3408c436ea6bb1ca55b8da7249bc94f5c6e6f64072f41e41c575030032396a547e72f54f99e56c200ea3e249a9631c684883580b80e05c16185b828b7
- SSDEEP 6144:ri9dOUQhgGV3HdqJpGDDgP2UKFMzd1EHJut10nkCkFK99S8DAOVe4JVxIdVGhsvJ:29dOU8gaeGDXMzdKHJ6jK9E8Dx7cV9Xs
- TLSH T1CC845A30A246C936D97E0534393CCA2B51693BB15FF2C4EBA3D89A6E49734C24631F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e593c34.msi
- Size 2.8MB
- SHA256 511c2c0908883bc9d05295e5145b767f2633461c93a31d1cb8d765ee09cdd801
- MD5 cf1dd0006c422c2c85c46a6fe4506406
- SHA1 da48ec07cea7407b6b2d38dbb54d2cd472bd7563
- SHA512 9145083d1253ad96d67156015e8e567851178b80e0c8c3f6090a30e80846e83cc96dfa4ff8fafe0fe28190ec9a0625821607ded78925baeb35fe77b7585be3c8
- SSDEEP 49152:fx3AY5aeGDcQ8KmLVR97uAHSvVPcAANEoW7SAmEzkGl7KMGzu7dhlwe50Qe2:GYTGDP8KmHHSVAvW7SAhxQMG67Zwe6r
- TLSH T106D5F1217286C53BD56E05703A2EEA5A513ABF700BB1C4E7A3D8EA3E19735C15331F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 3a56813f0db5ba26cd148bcdb997662671dc0c71f75e673769936b0cc816e19b
- MD5 86038cdfabd88a4acca3c431aa3750bf
- SHA1 6c328a4fc7fb6f090ad1e771511e31561dd72e6f
- SHA512 f6a9cc63fab806771188f28096005cefe6114291ab295020dc3eee53ed90eec1b40b898a2b77561c75a1f29c51a9e3d3ea348566644c1dbefcc56206afe3c5e4
- SSDEEP 24576:4u8m+1zmdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:B
- TLSH T1D347E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f4cb3784-ee8e-4097-910c-e6a93d9e8dca}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e84f4a5d37e4811dd0a167f41e8f5141c111369f803590abfd6e91ac5c269b2e
- MD5 d60e6b8762b69d0d150033b1d379cd20
- SHA1 ec37b77c7786ae99daf51342b36cc10886640b6d
- SHA512 c3c0793b084589ebade0d9843cb40adc72ab82063ef9367a254f19656eaa57f602dd28c641506f888b30e2b5b48bf44ad8825b2b061d71fda564dc30a30dead9
- SSDEEP 96:Fr3mcAXvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:136b++ZVmN
- TLSH T19AD178085AF54711E2B3AB3129F14557A877B911EF33CB8E0298238E2670910F975F5B
- MD5 SHA1 SHA512 SSDEEP TLSH