Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 02:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install_c0rd004.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_c0rd004.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target install_c0rd004.msi
- Size 8.6MB
- Sample260801-cqs4facp8s
- SHA256 8def19b3b8e15b803a22379e46a7690db76afa123e7c2dfb4ace8c654f8c697e
- MD5 b54d5e93357b12ebe8d93c951df7ba6e
- SHA1 6d91a40fa0fcb041a93816090fa9aa925f11b094
- SHA512 d814e9ae00190bdc73b9efed8c018e873fa6e1c4c01fc768d6091aecaa7a11e3c2cf6091d68d0427e6648bcdd9d4f60fb4c658ba5b13fe66e020a476ee423a1e
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshG:rBjf4vFYmROxL1
- TLSH T1E1963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1308 MsiExec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 1308 MsiExec.exe 13 1308 MsiExec.exe 15 1308 MsiExec.exe 16 1308 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e59bc51.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFE46E2256DF3A52DF.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D9042978-6444-D40B-2C07-4A301453BD6D} msiexec.exe File opened for modification C:\Windows\Installer\MSIC1D0.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0BD8C4768CCD765A.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59bc51.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF90E98E313B03FDE9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC0F5.tmp msiexec.exe File created C:\Windows\Installer\e59bc53.msi msiexec.exe File created C:\Windows\SystemTemp\~DFAB3E9B986EBF70C9.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2576 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\PackageCode = "7A3192B84059C084CB235760141F9FC3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16\8792409D4446B04DC270A4034135DBD6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8792409D4446B04DC270A4034135DBD6\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\ProductName = "CPUSD Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F625F0CC0CD8ACFACB995F759A608D16 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\PackageName = "install_c0rd004.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8792409D4446B04DC270A4034135DBD6 msiexec.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4672 msiexec.exe 4672 msiexec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2576 msiexec.exe Token: SeIncreaseQuotaPrivilege 2576 msiexec.exe Token: SeSecurityPrivilege 4672 msiexec.exe Token: SeCreateTokenPrivilege 2576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2576 msiexec.exe Token: SeLockMemoryPrivilege 2576 msiexec.exe Token: SeIncreaseQuotaPrivilege 2576 msiexec.exe Token: SeMachineAccountPrivilege 2576 msiexec.exe Token: SeTcbPrivilege 2576 msiexec.exe Token: SeSecurityPrivilege 2576 msiexec.exe Token: SeTakeOwnershipPrivilege 2576 msiexec.exe Token: SeLoadDriverPrivilege 2576 msiexec.exe Token: SeSystemProfilePrivilege 2576 msiexec.exe Token: SeSystemtimePrivilege 2576 msiexec.exe Token: SeProfSingleProcessPrivilege 2576 msiexec.exe Token: SeIncBasePriorityPrivilege 2576 msiexec.exe Token: SeCreatePagefilePrivilege 2576 msiexec.exe Token: SeCreatePermanentPrivilege 2576 msiexec.exe Token: SeBackupPrivilege 2576 msiexec.exe Token: SeRestorePrivilege 2576 msiexec.exe Token: SeShutdownPrivilege 2576 msiexec.exe Token: SeDebugPrivilege 2576 msiexec.exe Token: SeAuditPrivilege 2576 msiexec.exe Token: SeSystemEnvironmentPrivilege 2576 msiexec.exe Token: SeChangeNotifyPrivilege 2576 msiexec.exe Token: SeRemoteShutdownPrivilege 2576 msiexec.exe Token: SeUndockPrivilege 2576 msiexec.exe Token: SeSyncAgentPrivilege 2576 msiexec.exe Token: SeEnableDelegationPrivilege 2576 msiexec.exe Token: SeManageVolumePrivilege 2576 msiexec.exe Token: SeImpersonatePrivilege 2576 msiexec.exe Token: SeCreateGlobalPrivilege 2576 msiexec.exe Token: SeBackupPrivilege 2816 vssvc.exe Token: SeRestorePrivilege 2816 vssvc.exe Token: SeAuditPrivilege 2816 vssvc.exe Token: SeBackupPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeBackupPrivilege 3736 srtasks.exe Token: SeRestorePrivilege 3736 srtasks.exe Token: SeSecurityPrivilege 3736 srtasks.exe Token: SeTakeOwnershipPrivilege 3736 srtasks.exe Token: SeBackupPrivilege 3736 srtasks.exe Token: SeRestorePrivilege 3736 srtasks.exe Token: SeSecurityPrivilege 3736 srtasks.exe Token: SeTakeOwnershipPrivilege 3736 srtasks.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2576 msiexec.exe 2576 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2576 msiexec.exe 4672 msiexec.exe 1308 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4672 wrote to memory of 3736 4672 msiexec.exe 94 PID 4672 wrote to memory of 1308 4672 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_c0rd004.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2576
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1CF72F32F359068965C976806CF80FA6 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59bc52.rbs
- Size 7KB
- SHA256 170927728f6774f2f54bf525704504b088272be7c3786f6a27fd9f7836f67030
- MD5 8f83f4fca298bbb5cf1d4e0ac8d05a19
- SHA1 d4979f729a75d14cd055e652ca70c4d9bfb6053e
- SHA512 8ef6b7c60cc9c60eacaec0cabf55b5b907a9c6466b9f7ce572652a23e095ea0077fee123ba0a74b145ec10c78a361a15b75512d2071e6b792d3a7a296fe32d64
- SSDEEP 192:VvSCQklzXIIdXIW7d7A0aXWjPwE/AuKpbNxUaTEbZ1:VmkRXpXL7dc/XWjPwE/ARNxUaTEbZ1
- TLSH T132F1FC45BF0596D2EE962B35C31727243BB2D7DDA241634B0DCE80A06F0778B9ED528A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC1D0.tmp
- Size 8.5MB
- SHA256 1220a95f82c6f700b9ddf4571af4acd2169ab87bb97e7e5a664eeba1cb89d353
- MD5 9f7d316914542a17fe6b1513f362ca12
- SHA1 31db93101ce7de80716783c1ab64ad06861fa590
- SHA512 290bea1836743f406b1093b51052454c27fda41905610697e2be1245db157dc3affb77052aa0dd65fd48823b225c258ecfe7f82a2e23a5de3d079f56b95cb722
- SSDEEP 196608:n5UgPjavVwlWvlTYmGEhN8R7tw1UfLRZQhi:nBjfWvFYmROxLz
- TLSH T1A5963386B8CA67B5D19FC3B45382382EBC383791B9760D073BDD761369636213A36349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59bc51.msi
- Size 8.6MB
- SHA256 8def19b3b8e15b803a22379e46a7690db76afa123e7c2dfb4ace8c654f8c697e
- MD5 b54d5e93357b12ebe8d93c951df7ba6e
- SHA1 6d91a40fa0fcb041a93816090fa9aa925f11b094
- SHA512 d814e9ae00190bdc73b9efed8c018e873fa6e1c4c01fc768d6091aecaa7a11e3c2cf6091d68d0427e6648bcdd9d4f60fb4c658ba5b13fe66e020a476ee423a1e
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshG:rBjf4vFYmROxL1
- TLSH T1E1963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 941d5fa5476432f7e91acfa0cb0e1f02ff608bc57e53eb22b05b0de6867064b6
- MD5 c6f1047fab26e7481b9ab415e5962bc9
- SHA1 5aab0d82f988ad62185b4b675619dec87c004db0
- SHA512 870197963521cbc724501338ddf9d7c31a2132887bc64ef278a63efaab45c595d4b419ec1bad5a1c7cc465e7a9849cf79edfe436bc8fba606b9d0acc2651ae7a
- SSDEEP 24576:PFo3DMP2doO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4NuR:EHQ
- TLSH T12657F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3a0ce549-b0a6-49ac-8663-cffbe04c7e15}_OnDiskSnapshotProp
- Size 6KB
- SHA256 43d54c3a3777263d46ab07b4d89c4cb05e8ae8c50a8eb1f79e75829cdf93d40d
- MD5 3fbac1c342ecbcec2b7b35aad2bebc63
- SHA1 e0ab4a13d0415faa25635bc0aa71994d57e1c6ac
- SHA512 05e5349ae5c640065f77268a47af131ea5586a51cf8b5076b58f4c792b24c2ba206b2d6ec312c985277ce9aadd09c53c6246f2a7f61b7f2ade0d362f6023100b
- SSDEEP 96:FHYfOb9vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:KIb++uVm
- TLSH T169D187085AF54711E2F3AB3129F18557A877B912EF33CB8E0198238E6661910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH