Overview
overview
7Static
static
3Server/W2K...06.msi
windows10-2004-x64
7Server/W2K...06.msi
windows11-ltsc_2024-x64
7bxndcox.dll
windows10-2004-x64
3bxndcox.dll
windows11-ltsc_2024-x64
3bxndcox.dll1.dll
windows10-2004-x64
3bxndcox.dll1.dll
windows11-ltsc_2024-x64
3bxndcox.dll2.dll
windows10-2004-x64
3bxndcox.dll2.dll
windows11-ltsc_2024-x64
3bxndcox.dll3.dll
windows10-2004-x64
3bxndcox.dll3.dll
windows11-ltsc_2024-x64
3bxoisco.dll
windows10-2004-x64
3bxoisco.dll
windows11-ltsc_2024-x64
3wdfcoinsta...7..dll
windows10-2004-x64
3wdfcoinsta...7..dll
windows11-ltsc_2024-x64
3wdfcoinsta....1.dll
windows10-2004-x64
3wdfcoinsta....1.dll
windows11-ltsc_2024-x64
3Server/W2K...ia.exe
windows10-2004-x64
7Server/W2K...ia.exe
windows11-ltsc_2024-x64
7Server/W2K...iw.exe
windows10-2004-x64
7Server/W2K...iw.exe
windows11-ltsc_2024-x64
7Server/W2K...up.exe
windows10-2004-x64
7Server/W2K...up.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:14
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server/W2K3_W2K8/DrvInst/BDrv5706.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
bxndcox.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bxndcox.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
bxndcox.dll1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
bxndcox.dll1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
bxndcox.dll2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
bxndcox.dll2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
bxndcox.dll3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
bxndcox.dll3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
bxoisco.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
bxoisco.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
wdfcoinstaller01007..dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
wdfcoinstaller01007..dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
wdfcoinstaller01007.1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
wdfcoinstaller01007.1.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
Server/W2K3_W2K8/DrvInst/instmsia.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Server/W2K3_W2K8/DrvInst/instmsia.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Server/W2K3_W2K8/DrvInst/instmsiw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Server/W2K3_W2K8/DrvInst/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral22
Sample
Server/W2K3_W2K8/DrvInst/setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Server/W2K3_W2K8/DrvInst/setup.exe
- Size 621KB
- Sample260809-wvsg9atbnb
- SHA256 4c60d55da2e93c0fedbc991cf97e3b912628de359afd06d3347c30cb0791f846
- MD5 64c8de941312ab23b904026500a2982c
- SHA1 628f439ad8830294fb9ebc1db953015e59635490
- SHA512 b660f49aec09954e82ba47ad515d46dd9a9fe12e9a870588b06021a3ce416bc4a9d6a2e8ad788fecdd5d3afbe93ccf8c86b34e0232bba580e56056319260fde9
- SSDEEP 12288:nGRDU5ervjUo9BEgfYoIpKYSc53an9lpGN4VGtTRIMFYtmxGF9jB:nGRmervjUoDEgfnImcJaBhotTRTFFxG9
- TLSH T123D48D123DB0C133E56280B0D99E9B78E6F99C714C25888777C8A91D6DB2993D72372F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
pid Process 2428 MsiExec.exe 2428 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 5168 MsiExec.exe 2428 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI8B7D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8BDD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8D94.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI89C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A23.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8BBD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI91AB.tmp msiexec.exe File created C:\Windows\Installer\e5a8406.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a8406.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI87A0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8AB0.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2340 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2340 MSIEXEC.EXE Token: SeSecurityPrivilege 4228 msiexec.exe Token: SeCreateTokenPrivilege 2340 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2340 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2340 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2340 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2340 MSIEXEC.EXE Token: SeTcbPrivilege 2340 MSIEXEC.EXE Token: SeSecurityPrivilege 2340 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2340 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2340 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2340 MSIEXEC.EXE Token: SeSystemtimePrivilege 2340 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2340 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2340 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2340 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2340 MSIEXEC.EXE Token: SeBackupPrivilege 2340 MSIEXEC.EXE Token: SeRestorePrivilege 2340 MSIEXEC.EXE Token: SeShutdownPrivilege 2340 MSIEXEC.EXE Token: SeDebugPrivilege 2340 MSIEXEC.EXE Token: SeAuditPrivilege 2340 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2340 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2340 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2340 MSIEXEC.EXE Token: SeUndockPrivilege 2340 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2340 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2340 MSIEXEC.EXE Token: SeManageVolumePrivilege 2340 MSIEXEC.EXE Token: SeImpersonatePrivilege 2340 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2340 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2340 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2340 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2340 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2340 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2340 MSIEXEC.EXE Token: SeTcbPrivilege 2340 MSIEXEC.EXE Token: SeSecurityPrivilege 2340 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2340 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2340 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2340 MSIEXEC.EXE Token: SeSystemtimePrivilege 2340 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2340 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2340 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2340 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2340 MSIEXEC.EXE Token: SeBackupPrivilege 2340 MSIEXEC.EXE Token: SeRestorePrivilege 2340 MSIEXEC.EXE Token: SeShutdownPrivilege 2340 MSIEXEC.EXE Token: SeDebugPrivilege 2340 MSIEXEC.EXE Token: SeAuditPrivilege 2340 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2340 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2340 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2340 MSIEXEC.EXE Token: SeUndockPrivilege 2340 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2340 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2340 MSIEXEC.EXE Token: SeManageVolumePrivilege 2340 MSIEXEC.EXE Token: SeImpersonatePrivilege 2340 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2340 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2340 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2340 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2340 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2340 MSIEXEC.EXE 2340 MSIEXEC.EXE - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2340 MSIEXEC.EXE 4228 msiexec.exe 2428 MsiExec.exe 5168 MsiExec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1236 wrote to memory of 2340 1236 setup.exe 88 PID 4228 wrote to memory of 2428 4228 msiexec.exe 90 PID 4228 wrote to memory of 5736 4228 msiexec.exe 96 PID 4228 wrote to memory of 5168 4228 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\setup.exe"C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst\BDrv5706.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\Server\W2K3_W2K8\DrvInst" SETUPEXENAME="setup.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F543104EE50240BD469D15B078E00FC C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2428
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5736
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AC4B3A3019B29ECC8A86B56740A1AE752⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5168
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIEF38.tmp
- Size 57KB
- SHA256 ad12108b637a3856615ab58f612954258c2581ba92d59ab339c668a603f452a8
- MD5 4990e2c6714019b91bcc07f2f98e2241
- SHA1 a9c099a983d488517c470b1a37a2f894b6af25e0
- SHA512 124377bbf8c8ed4adafff9ddfc2461b31c794e7059821ddf9c613eb7e5d8850895de68d21954afbd96e9ce2fa25f83510ca02c0fe48924ae120b2ccab1473d4d
- SSDEEP 768:w0J8+QCTqaxxKkUmFVSarTJym3OZESrcIFK/GLRbNV:2CTqYttXDJT+lcFG1L
- TLSH T13A436C127AD200B7D78A4B3164E69F279F3F7A441FE114839FB1499A2D367E0573A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF10E.tmp
- Size 97KB
- SHA256 eaa050f1a41d238f9b684392d13592b49738c9135031356bc9bd8cc0593946d1
- MD5 b2a18dcf9668ae6b39e7ac02f0917378
- SHA1 8943148bb1f0642fce269db02548fc1252ff3aa6
- SHA512 85369132e49d88076e8346d632260bd0df25e8017d6f7a0d353a1bd181615107fd06bd7e3c03057971978afb45fdafcbba2321316a21ac0a8cf27254f621e32b
- SSDEEP 1536:7VgNTb67hb2MwFTKySgE6bSKychyc/jVznTFk1:mb67hvw++SKychyc/jVzT
- TLSH T1B6A39E517A9042BADA8D153028AACB7B977DB9A00FE180C3DF75EB5D1C717A0E237247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\FixForUpgrade.exe
- Size 76KB
- SHA256 eb5195c16020d86e52d89eb7f424d9ffbfeec1ce7020c8c0b45a336dc9b04f5f
- MD5 f6b518f1368635a4da80611a15149ff5
- SHA1 27cedb26a41f9bad29f6f22fda784766ae4c51ee
- SHA512 781ec426ab8d4769ed721ea5c3b31a4747634f15e877c0b848e8c1ffa4b1db81a6a0eb46eac1ae888b2b288140badfb5edc76dff5e62c5b810b4aa1d9b98bc13
- SSDEEP 1536:7pSieitci6BDu0u9cfczy15c5e5ZjlBWNTtIIY93oX:NSi18DI9ece15c5e5ZjlBWNTtIIY93oX
- TLSH T104737D9376D10472E796047140A26735377BBA310A768997C718EEFE6D32950EB3B30B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\NetXtremeII.xml
- Size 2KB
- SHA256 12205eb05cb1da87ea640ca2e679d2225131d3321ba01360deece23123fd48da
- MD5 558cffdbe952ebe84fa8386a834891cf
- SHA1 c25c75d40d0c45ebedced51a5e95f3faf7467179
- SHA512 0019d7d637f4c6358f624264e808dd165cbad633c848460b06b19b21a8f129f6339804ed0ce91467e272faeca4a622c0dadc22d2fdf299ab122a670f5c9ff1ac
- TLSH T1A05154C8FAEA6199857019B388AD77E87E2BFC4329611234B4C17E7BC7C44835F9056D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bmapi.dll
- Size 572KB
- SHA256 a7a0edaade37fd47e225edb6bd6fcb50ebcbce6965ceca9438b500b2bceee9f4
- MD5 631f74c453f64c190cffd670b7c8630b
- SHA1 a2ab22bacece0ef7f1d13c7dd7cf789560f77f25
- SHA512 67d3c3625e7335d38201946e626ad513c5dc50710ffaa9720c8f4d0edc4f6cb4a17b2406c5e1b990b0883bd34ce869c91ef0d2f253c50610fd5c80586678894f
- SSDEEP 12288:S7uacShQ5Q+JxBtLP3nyPdWTzMnpqFruD:4QrGdvqFE
- TLSH T1DCC46D02FB81C8F8D95525340C6BDBFA06367A495D168753B7E0CF7FB8325A2963A348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxdiag.inf
- Size 25KB
- SHA256 8de63311632e82f45ee45b0114df0b658a85161b87f1168ab37081a6cbc14fdb
- MD5 1340a889865024496ed8d9f35a94f4dc
- SHA1 2d0c3e3fcb66d904b098067afb9eca6379891107
- SHA512 1a404d6c640e8de631938851c3517bce911197acb8b8f01344a3abc701df9874770aa4ec9e9e6b41fe323b87cd353144b52aa842bd0a44b1d5f8fc835855ed1a
- SSDEEP 192:WaiDugiQPugiQkR6YunWe3cp55RxtN8ydgTtx123WEY1s/fzqxKBU7PgZHf3Luxh:3RTeJj
- TLSH T115C22879260B7D19B5060CB5380D64CAAC1C984BD7D099E8FBD33DE9E9ADD0D9206F38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxnd.inf
- Size 155KB
- SHA256 49cd9d5f1f5fccf6e989a00fa76cf1ed431a6ca6b874c730470fc5ed69cd62c5
- MD5 b227417404dcf327eaece2e1aea1a529
- SHA1 dbe9c5b841b083fab541b373fe080119843e1dcb
- SHA512 8c19f01ceac62af9568c1d518cf82a86dfab7001f288b91d484d8801b6a711d825da5c17803c84dd3cb7ea6d1c2d49ea1e5e5e3c87bafa19295827662ae45a3c
- SSDEEP 1536:Qb8hf+/G83wPKImvV12hpirTdvDo7vPmiGmmL761DDIZ7qD2z2GnXVziDOwY2345:mmk
- TLSH T13CF3BB78A10A5D52228B5EE87E6148E3ED041444BB719DE07BEE2FE9F38CF4D525DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxois.inf
- Size 9KB
- SHA256 6d132b3b03f24eeffcf8fc323ca1625862b833cb0cbb48f373b065d4a2b78141
- MD5 b5cd6f065f9dd3c70f3198a1c3320168
- SHA1 a3cb00e98274dc2fb77160332becc37138032eaa
- SHA512 00b458d30928be93bbe40c085684abb212941484009835ac0f3389087e5720859b1e9cae1038002f535a7efc1668fc07575b19e5b6b6efe99764f802622155c6
- SSDEEP 192:uon5HJ6Mk3IUsoLFs+u/q8IQHNfxHs7rCNJxQpsgZSu0b1l+h+8M:uon5p6Mk3IUsoLFs+u/q8IQHNfxHs7rc
- TLSH T12D22196276EA130CF4B339C9E9F2807BEA35F4759979869E40A4470F17E2D4048927BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\bxvbd.inf
- Size 22KB
- SHA256 6d21883c8757555cbb99f85c313b8e316fc69523733bba6e07fdb05075329f93
- MD5 d70de7b03d96e0ea6edc6ffd9d722acb
- SHA1 776f80843115ac151172ef1917d44f6a8f313e33
- SHA512 28acae8fa3900d1fbf3e7ff779ca93d996b81575f0431904fa92a7b8b914b407c82249ad628b63bc996f52a0af9721475ff7a1ad288d6d06db92b81757a63e0a
- SSDEEP 384:jssoBoQoVo5oLocoPoVEwCO6DxX/6R5O7sjPuRZioktuaaRUdkCLpt7B0uww8Xei:1oBoQoVo5oLocoPoQaGQnEW8
- TLSH T107A2523C830E7E22725BA5DE99589CE789586402369055B837DF3EF983EED0CE1AF044
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\difxapi.dll
- Size 316KB
- SHA256 34998dc12e70cd7ddbf9a190ee52835dbe73488eab37c0be7916e0931a754feb
- MD5 0d34eac4381f959aa6c2d369e84477bc
- SHA1 d97a2c8988333991e046c8fc2623b2783c97d27d
- SHA512 f99ed949b2adedf793a03fffff365adc5933ea57852e0ec0546a30d1c723fca7624168861c0036b5c75334f3299fa09344bc04d365de768b32e656e7f043346a
- SSDEEP 6144:M3+rEo4fNwSQCT4YNjtMWDnYPWsjfVnnSSNbcQSbyS4p:w+rEo4lWYNjJbYtdnp75Sy
- TLSH T108643A21A7E8C939F4F226B8147C566205BEB8705FB0C6CF3394466D5E3AAD09934F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DA8EC3DF-5853-4C1A-AFB9-2CC267D671EB}\evbd.inf
- Size 118KB
- SHA256 da82880ec6147f86e610aa849f6d2a47f642c1467ad4037dd12072a6c33d3743
- MD5 d6b63628fd740d96986dab65a3136bcf
- SHA1 f067bc026d13ceb7a5cabe1b5cf7d20221ab7a2f
- SHA512 7be9d69ffe26d68b82cbd16a99c8cc839ee7c5bf2d4ebf813fbbd4dae6b886ecca4b5cc96fe6ae08d5bfd4d19a82116fbe06e779c2927a25b707464e0ef76409
- SSDEEP 1536:Ug844EdBWgzDBFf4y+IQMbGSRSFe/i9ZzhSi9iGSxRyjNz0SJhh3ESDJ5FqR92Tz:9Ev
- TLSH T1A9C3DD38B34ABD20758B2EEE7E0558E6C8146405B5A068F4B7DB2FE4E3CDD0D825EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI87A0.tmp
- Size 332KB
- SHA256 88d10962e8ea3c5174091f8e1e59eef26d13fb51ef39e46f2392487d60bc0e72
- MD5 0235726153e863dabfd61d192f007194
- SHA1 0fe2d11786630b57ddb90434b7d0f41064df9724
- SHA512 34de402329cba74b28530b441297b84cbbc6fe939a02499a9c19be2df696f42d3ac26d4f73c885a90130a232f428d11b90d4281b627eb8281215b599007df8aa
- SSDEEP 6144:UlgckbUytqwy/7Inoj+3QCPmCj4rzKq7ifZ88O:BckbUytqwE7GCCeCj4r9
- TLSH T117747C52E6D100F1E64E15B011FB633B9E3985C963A2C2A3CF96ED66CC13D91E33664E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 30ca048d4b1d3a6027e153426e20751a8360f0f86600597c70ccaf6019eff25c
- MD5 5ee38650592ea098eb2bf1944a275103
- SHA1 dfd7b376617609f736fd6fdf067bfa192c449e3f
- SHA512 62c6f64ccdf8d38e54970496c6826d47f9214f5f4c60890c1bcbbb19425e024d259f11f38ff7f87cac0608d9188d1ecc299b8c26cb6f5cde8fe0d4e66325ff64
- SSDEEP 24576:tFo3DMPPdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0ua:HHY
- TLSH T11B57A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{96addea3-0cc7-4559-8b16-dfea347df394}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6148de1b36f5d70363c75fd75c1d05799637ebadd8b7be127b0e876719cb025d
- MD5 bf0a3d89599769afd29c5f132f4342c2
- SHA1 b577c8e12c73cc9a8b67266860405c399fd775f3
- SHA512 15d58ba1b8cf9e6a3f5f9803b9512d98e2df9f607460b678bd41dfb688dd618b35419985d870a306f4e2fc8e0f4b5c590f20ef32c70f97a4a754915c39eedce2
- SSDEEP 96:FHjk0Xvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:pjpb++uVm
- TLSH T1DDD176085AE54711E2B3AB3128F14557A877B911EF33CB8E0298238E6671A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH