Overview
overview
7Static
static
3Server/W2K...06.msi
windows10-2004-x64
7Server/W2K...06.msi
windows11-ltsc_2024-x64
7bxndcox.dll
windows10-2004-x64
3bxndcox.dll
windows11-ltsc_2024-x64
3bxndcox.dll1.dll
windows10-2004-x64
3bxndcox.dll1.dll
windows11-ltsc_2024-x64
3bxndcox.dll2.dll
windows10-2004-x64
3bxndcox.dll2.dll
windows11-ltsc_2024-x64
3bxndcox.dll3.dll
windows10-2004-x64
3bxndcox.dll3.dll
windows11-ltsc_2024-x64
3bxoisco.dll
windows10-2004-x64
3bxoisco.dll
windows11-ltsc_2024-x64
3wdfcoinsta...7..dll
windows10-2004-x64
3wdfcoinsta...7..dll
windows11-ltsc_2024-x64
3wdfcoinsta....1.dll
windows10-2004-x64
3wdfcoinsta....1.dll
windows11-ltsc_2024-x64
3Server/W2K...ia.exe
windows10-2004-x64
7Server/W2K...ia.exe
windows11-ltsc_2024-x64
7Server/W2K...iw.exe
windows10-2004-x64
7Server/W2K...iw.exe
windows11-ltsc_2024-x64
7Server/W2K...up.exe
windows10-2004-x64
7Server/W2K...up.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:14
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
bxndcox.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bxndcox.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
bxndcox.dll1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
bxndcox.dll1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
bxndcox.dll2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
bxndcox.dll2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
bxndcox.dll3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
bxndcox.dll3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
bxoisco.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
bxoisco.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
wdfcoinstaller01007..dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
wdfcoinstaller01007..dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
wdfcoinstaller01007.1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
wdfcoinstaller01007.1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
Server/W2K3_W2K8/DrvInst/instmsia.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Server/W2K3_W2K8/DrvInst/instmsia.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Server/W2K3_W2K8/DrvInst/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral22
Sample
Server/W2K3_W2K8/DrvInst/setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Server/W2K3_W2K8/DrvInst/BDrv5706.msi
- Size 2.2MB
- Sample260809-wvsg9atbnb
- SHA256 c93bf45510ebc3512320152d0608c4bddecd14dfc0da952f8ef4372875f9d75d
- MD5 20c1120f086918b8eb821cb01ef73a96
- SHA1 03f926e0eb8eca903fb3469141be27ee9ad4c76e
- SHA512 c8fabec5c7a82c9ceb394a52e8d0b9a4318298a89b28935889e01727933879c75d2ef0c0d0adc28f51454327803bd85b0ee154d3658a487ef4543409f15ba99b
- SSDEEP 24576:K3y6blFNjiH1QsQrGdvqFE7fombxrKwE7XCTmeFdYydp71:K3yClFNjiH1QxamKxWwgWYyZ
- TLSH T1F1A58D21F281CC71E1861AB4186A87F649347840AF7186D3B7DDEFEDAB7AD44923E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
pid Process 4288 MsiExec.exe 4288 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4820 MsiExec.exe 4288 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC457.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC348.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC416.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC437.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC64C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID8AC.tmp msiexec.exe File created C:\Windows\Installer\e59bde7.msi msiexec.exe File opened for modification C:\Windows\Installer\e59bde7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC029.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC153.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2448 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2448 msiexec.exe Token: SeIncreaseQuotaPrivilege 2448 msiexec.exe Token: SeSecurityPrivilege 4092 msiexec.exe Token: SeCreateTokenPrivilege 2448 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2448 msiexec.exe Token: SeLockMemoryPrivilege 2448 msiexec.exe Token: SeIncreaseQuotaPrivilege 2448 msiexec.exe Token: SeMachineAccountPrivilege 2448 msiexec.exe Token: SeTcbPrivilege 2448 msiexec.exe Token: SeSecurityPrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeLoadDriverPrivilege 2448 msiexec.exe Token: SeSystemProfilePrivilege 2448 msiexec.exe Token: SeSystemtimePrivilege 2448 msiexec.exe Token: SeProfSingleProcessPrivilege 2448 msiexec.exe Token: SeIncBasePriorityPrivilege 2448 msiexec.exe Token: SeCreatePagefilePrivilege 2448 msiexec.exe Token: SeCreatePermanentPrivilege 2448 msiexec.exe Token: SeBackupPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeShutdownPrivilege 2448 msiexec.exe Token: SeDebugPrivilege 2448 msiexec.exe Token: SeAuditPrivilege 2448 msiexec.exe Token: SeSystemEnvironmentPrivilege 2448 msiexec.exe Token: SeChangeNotifyPrivilege 2448 msiexec.exe Token: SeRemoteShutdownPrivilege 2448 msiexec.exe Token: SeUndockPrivilege 2448 msiexec.exe Token: SeSyncAgentPrivilege 2448 msiexec.exe Token: SeEnableDelegationPrivilege 2448 msiexec.exe Token: SeManageVolumePrivilege 2448 msiexec.exe Token: SeImpersonatePrivilege 2448 msiexec.exe Token: SeCreateGlobalPrivilege 2448 msiexec.exe Token: SeCreateTokenPrivilege 2448 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2448 msiexec.exe Token: SeLockMemoryPrivilege 2448 msiexec.exe Token: SeIncreaseQuotaPrivilege 2448 msiexec.exe Token: SeMachineAccountPrivilege 2448 msiexec.exe Token: SeTcbPrivilege 2448 msiexec.exe Token: SeSecurityPrivilege 2448 msiexec.exe Token: SeTakeOwnershipPrivilege 2448 msiexec.exe Token: SeLoadDriverPrivilege 2448 msiexec.exe Token: SeSystemProfilePrivilege 2448 msiexec.exe Token: SeSystemtimePrivilege 2448 msiexec.exe Token: SeProfSingleProcessPrivilege 2448 msiexec.exe Token: SeIncBasePriorityPrivilege 2448 msiexec.exe Token: SeCreatePagefilePrivilege 2448 msiexec.exe Token: SeCreatePermanentPrivilege 2448 msiexec.exe Token: SeBackupPrivilege 2448 msiexec.exe Token: SeRestorePrivilege 2448 msiexec.exe Token: SeShutdownPrivilege 2448 msiexec.exe Token: SeDebugPrivilege 2448 msiexec.exe Token: SeAuditPrivilege 2448 msiexec.exe Token: SeSystemEnvironmentPrivilege 2448 msiexec.exe Token: SeChangeNotifyPrivilege 2448 msiexec.exe Token: SeRemoteShutdownPrivilege 2448 msiexec.exe Token: SeUndockPrivilege 2448 msiexec.exe Token: SeSyncAgentPrivilege 2448 msiexec.exe Token: SeEnableDelegationPrivilege 2448 msiexec.exe Token: SeManageVolumePrivilege 2448 msiexec.exe Token: SeImpersonatePrivilege 2448 msiexec.exe Token: SeCreateGlobalPrivilege 2448 msiexec.exe Token: SeCreateTokenPrivilege 2448 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2448 msiexec.exe Token: SeLockMemoryPrivilege 2448 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2448 msiexec.exe 2448 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2448 msiexec.exe 4092 msiexec.exe 4288 MsiExec.exe 4820 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4288 4092 msiexec.exe 90 PID 4092 wrote to memory of 2716 4092 msiexec.exe 96 PID 4092 wrote to memory of 4820 4092 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\BDrv5706.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2448
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A3AB7B17FD77ECB233C3D919A4E1A229 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2716
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B87194F9EA916DB1C4E9269FB5C385E32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4820
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI213A.tmp
- Size 57KB
- SHA256 ad12108b637a3856615ab58f612954258c2581ba92d59ab339c668a603f452a8
- MD5 4990e2c6714019b91bcc07f2f98e2241
- SHA1 a9c099a983d488517c470b1a37a2f894b6af25e0
- SHA512 124377bbf8c8ed4adafff9ddfc2461b31c794e7059821ddf9c613eb7e5d8850895de68d21954afbd96e9ce2fa25f83510ca02c0fe48924ae120b2ccab1473d4d
- SSDEEP 768:w0J8+QCTqaxxKkUmFVSarTJym3OZESrcIFK/GLRbNV:2CTqYttXDJT+lcFG1L
- TLSH T13A436C127AD200B7D78A4B3164E69F279F3F7A441FE114839FB1499A2D367E0573A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI23BC.tmp
- Size 97KB
- SHA256 eaa050f1a41d238f9b684392d13592b49738c9135031356bc9bd8cc0593946d1
- MD5 b2a18dcf9668ae6b39e7ac02f0917378
- SHA1 8943148bb1f0642fce269db02548fc1252ff3aa6
- SHA512 85369132e49d88076e8346d632260bd0df25e8017d6f7a0d353a1bd181615107fd06bd7e3c03057971978afb45fdafcbba2321316a21ac0a8cf27254f621e32b
- SSDEEP 1536:7VgNTb67hb2MwFTKySgE6bSKychyc/jVznTFk1:mb67hvw++SKychyc/jVzT
- TLSH T1B6A39E517A9042BADA8D153028AACB7B977DB9A00FE180C3DF75EB5D1C717A0E237247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\FixForUpgrade.exe
- Size 76KB
- SHA256 eb5195c16020d86e52d89eb7f424d9ffbfeec1ce7020c8c0b45a336dc9b04f5f
- MD5 f6b518f1368635a4da80611a15149ff5
- SHA1 27cedb26a41f9bad29f6f22fda784766ae4c51ee
- SHA512 781ec426ab8d4769ed721ea5c3b31a4747634f15e877c0b848e8c1ffa4b1db81a6a0eb46eac1ae888b2b288140badfb5edc76dff5e62c5b810b4aa1d9b98bc13
- SSDEEP 1536:7pSieitci6BDu0u9cfczy15c5e5ZjlBWNTtIIY93oX:NSi18DI9ece15c5e5ZjlBWNTtIIY93oX
- TLSH T104737D9376D10472E796047140A26735377BBA310A768997C718EEFE6D32950EB3B30B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\NetXtremeII.xml
- Size 2KB
- SHA256 12205eb05cb1da87ea640ca2e679d2225131d3321ba01360deece23123fd48da
- MD5 558cffdbe952ebe84fa8386a834891cf
- SHA1 c25c75d40d0c45ebedced51a5e95f3faf7467179
- SHA512 0019d7d637f4c6358f624264e808dd165cbad633c848460b06b19b21a8f129f6339804ed0ce91467e272faeca4a622c0dadc22d2fdf299ab122a670f5c9ff1ac
- TLSH T1A05154C8FAEA6199857019B388AD77E87E2BFC4329611234B4C17E7BC7C44835F9056D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bmapi.dll
- Size 572KB
- SHA256 a7a0edaade37fd47e225edb6bd6fcb50ebcbce6965ceca9438b500b2bceee9f4
- MD5 631f74c453f64c190cffd670b7c8630b
- SHA1 a2ab22bacece0ef7f1d13c7dd7cf789560f77f25
- SHA512 67d3c3625e7335d38201946e626ad513c5dc50710ffaa9720c8f4d0edc4f6cb4a17b2406c5e1b990b0883bd34ce869c91ef0d2f253c50610fd5c80586678894f
- SSDEEP 12288:S7uacShQ5Q+JxBtLP3nyPdWTzMnpqFruD:4QrGdvqFE
- TLSH T1DCC46D02FB81C8F8D95525340C6BDBFA06367A495D168753B7E0CF7FB8325A2963A348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxdiag.inf
- Size 25KB
- SHA256 8de63311632e82f45ee45b0114df0b658a85161b87f1168ab37081a6cbc14fdb
- MD5 1340a889865024496ed8d9f35a94f4dc
- SHA1 2d0c3e3fcb66d904b098067afb9eca6379891107
- SHA512 1a404d6c640e8de631938851c3517bce911197acb8b8f01344a3abc701df9874770aa4ec9e9e6b41fe323b87cd353144b52aa842bd0a44b1d5f8fc835855ed1a
- SSDEEP 192:WaiDugiQPugiQkR6YunWe3cp55RxtN8ydgTtx123WEY1s/fzqxKBU7PgZHf3Luxh:3RTeJj
- TLSH T115C22879260B7D19B5060CB5380D64CAAC1C984BD7D099E8FBD33DE9E9ADD0D9206F38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxnd.inf
- Size 155KB
- SHA256 49cd9d5f1f5fccf6e989a00fa76cf1ed431a6ca6b874c730470fc5ed69cd62c5
- MD5 b227417404dcf327eaece2e1aea1a529
- SHA1 dbe9c5b841b083fab541b373fe080119843e1dcb
- SHA512 8c19f01ceac62af9568c1d518cf82a86dfab7001f288b91d484d8801b6a711d825da5c17803c84dd3cb7ea6d1c2d49ea1e5e5e3c87bafa19295827662ae45a3c
- SSDEEP 1536:Qb8hf+/G83wPKImvV12hpirTdvDo7vPmiGmmL761DDIZ7qD2z2GnXVziDOwY2345:mmk
- TLSH T13CF3BB78A10A5D52228B5EE87E6148E3ED041444BB719DE07BEE2FE9F38CF4D525DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxois.inf
- Size 9KB
- SHA256 6d132b3b03f24eeffcf8fc323ca1625862b833cb0cbb48f373b065d4a2b78141
- MD5 b5cd6f065f9dd3c70f3198a1c3320168
- SHA1 a3cb00e98274dc2fb77160332becc37138032eaa
- SHA512 00b458d30928be93bbe40c085684abb212941484009835ac0f3389087e5720859b1e9cae1038002f535a7efc1668fc07575b19e5b6b6efe99764f802622155c6
- SSDEEP 192:uon5HJ6Mk3IUsoLFs+u/q8IQHNfxHs7rCNJxQpsgZSu0b1l+h+8M:uon5p6Mk3IUsoLFs+u/q8IQHNfxHs7rc
- TLSH T12D22196276EA130CF4B339C9E9F2807BEA35F4759979869E40A4470F17E2D4048927BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxvbd.inf
- Size 22KB
- SHA256 6d21883c8757555cbb99f85c313b8e316fc69523733bba6e07fdb05075329f93
- MD5 d70de7b03d96e0ea6edc6ffd9d722acb
- SHA1 776f80843115ac151172ef1917d44f6a8f313e33
- SHA512 28acae8fa3900d1fbf3e7ff779ca93d996b81575f0431904fa92a7b8b914b407c82249ad628b63bc996f52a0af9721475ff7a1ad288d6d06db92b81757a63e0a
- SSDEEP 384:jssoBoQoVo5oLocoPoVEwCO6DxX/6R5O7sjPuRZioktuaaRUdkCLpt7B0uww8Xei:1oBoQoVo5oLocoPoQaGQnEW8
- TLSH T107A2523C830E7E22725BA5DE99589CE789586402369055B837DF3EF983EED0CE1AF044
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\difxapi.dll
- Size 316KB
- SHA256 34998dc12e70cd7ddbf9a190ee52835dbe73488eab37c0be7916e0931a754feb
- MD5 0d34eac4381f959aa6c2d369e84477bc
- SHA1 d97a2c8988333991e046c8fc2623b2783c97d27d
- SHA512 f99ed949b2adedf793a03fffff365adc5933ea57852e0ec0546a30d1c723fca7624168861c0036b5c75334f3299fa09344bc04d365de768b32e656e7f043346a
- SSDEEP 6144:M3+rEo4fNwSQCT4YNjtMWDnYPWsjfVnnSSNbcQSbyS4p:w+rEo4lWYNjJbYtdnp75Sy
- TLSH T108643A21A7E8C939F4F226B8147C566205BEB8705FB0C6CF3394466D5E3AAD09934F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\evbd.inf
- Size 118KB
- SHA256 da82880ec6147f86e610aa849f6d2a47f642c1467ad4037dd12072a6c33d3743
- MD5 d6b63628fd740d96986dab65a3136bcf
- SHA1 f067bc026d13ceb7a5cabe1b5cf7d20221ab7a2f
- SHA512 7be9d69ffe26d68b82cbd16a99c8cc839ee7c5bf2d4ebf813fbbd4dae6b886ecca4b5cc96fe6ae08d5bfd4d19a82116fbe06e779c2927a25b707464e0ef76409
- SSDEEP 1536:Ug844EdBWgzDBFf4y+IQMbGSRSFe/i9ZzhSi9iGSxRyjNz0SJhh3ESDJ5FqR92Tz:9Ev
- TLSH T1A9C3DD38B34ABD20758B2EEE7E0558E6C8146405B5A068F4B7DB2FE4E3CDD0D825EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC029.tmp
- Size 332KB
- SHA256 88d10962e8ea3c5174091f8e1e59eef26d13fb51ef39e46f2392487d60bc0e72
- MD5 0235726153e863dabfd61d192f007194
- SHA1 0fe2d11786630b57ddb90434b7d0f41064df9724
- SHA512 34de402329cba74b28530b441297b84cbbc6fe939a02499a9c19be2df696f42d3ac26d4f73c885a90130a232f428d11b90d4281b627eb8281215b599007df8aa
- SSDEEP 6144:UlgckbUytqwy/7Inoj+3QCPmCj4rzKq7ifZ88O:BckbUytqwE7GCCeCj4r9
- TLSH T117747C52E6D100F1E64E15B011FB633B9E3985C963A2C2A3CF96ED66CC13D91E33664E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 6df419f9c4605eba9428f5ab96d8e43162c5478c36f4943e98d58b6549397782
- MD5 9f42d0c38284a23097c5b95389dd9487
- SHA1 ce1f3a80b4213677fb3c55c9d5214e50d0b70885
- SHA512 97a7fa47f81e8e1d6b082bc8c34202c0b76a026e1cb84dfa9ed7d012d6626772c3acfcf7aaf8d66ae8a20dd905a4e29c335ccc3e0f8ea476190d21a5388667d7
- SSDEEP 24576:LFo3DMP7doO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:lH0
- TLSH T11D57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{76ce34d7-4167-4af8-93cb-b4b93420056c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f8ffd475c64cd3dfa9b4a320b265fee1f0ed2e9a5e17a1a7ef272a00833e60b0
- MD5 c4b7a88cd9a7c93e069da4aba96c6535
- SHA1 b94d4ace4f4f81267d0ffb3e4e68ac4c9e64049a
- SHA512 6cc99b73968a4964ec41c7cf75ffd50219e1a7b1045124e5867cd96893757db09b8acf4c2d456ca272aec97326df3adc4a7020d40fecb946dc940d5dca60d7d2
- SSDEEP 96:FEkW5muBlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:2T7l/b++uVm
- TLSH T184D187085AE54711F2B3AB3229F18557A877B911EF33CB8E0198238E2671910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH