Overview
overview
10Static
static
5Gereksinim...ll.bat
windows10-2004-x64
7Gereksinim...ll.bat
windows11-ltsc_2024-x64
7Gereksinim...64.exe
windows10-2004-x64
7Gereksinim...64.exe
windows11-ltsc_2024-x64
7Gereksinim...86.exe
windows10-2004-x64
7Gereksinim...86.exe
windows11-ltsc_2024-x64
7Gereksinim...64.exe
windows10-2004-x64
3Gereksinim...64.exe
windows11-ltsc_2024-x64
3Gereksinim...86.exe
windows10-2004-x64
3Gereksinim...86.exe
windows11-ltsc_2024-x64
3Gereksinim...64.exe
windows10-2004-x64
3Gereksinim...64.exe
windows11-ltsc_2024-x64
3Gereksinim...86.exe
windows10-2004-x64
3Gereksinim...86.exe
windows11-ltsc_2024-x64
3Gereksinim...64.exe
windows10-2004-x64
4Gereksinim...64.exe
windows11-ltsc_2024-x64
4Gereksinim...86.exe
windows10-2004-x64
4Gereksinim...86.exe
windows11-ltsc_2024-x64
4Gereksinim...64.exe
windows10-2004-x64
4Gereksinim...64.exe
windows11-ltsc_2024-x64
4Gereksinim...86.exe
windows10-2004-x64
4Gereksinim...86.exe
windows11-ltsc_2024-x64
4Gereksinim...64.exe
windows10-2004-x64
4Gereksinim...64.exe
windows11-ltsc_2024-x64
4Gereksinim...86.exe
windows10-2004-x64
4Gereksinim...86.exe
windows11-ltsc_2024-x64
4Gereksinim...er.bat
windows10-2004-x64
3Gereksinim...er.bat
windows11-ltsc_2024-x64
3Gereksinim...gs.vbs
windows10-2004-x64
5Gereksinim...gs.vbs
windows11-ltsc_2024-x64
5Gereksinim...ol.exe
windows10-2004-x64
5Gereksinim...ol.exe
windows11-ltsc_2024-x64
10Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 04:37
Behavioral task
behavioral1
Sample
Gereksinimler ROVİDA/AIO/install_all.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Gereksinimler ROVİDA/AIO/install_all.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
Behavioral task
behavioral3
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral6
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral7
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
Gereksinimler ROVİDA/Checker.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
Gereksinimler ROVİDA/Checker.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
Gereksinimler ROVİDA/Defender Control/Defender_Settings.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
Gereksinimler ROVİDA/Defender Control/Defender_Settings.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
Gereksinimler ROVİDA/Defender Control/dControl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
Gereksinimler ROVİDA/Defender Control/dControl.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
31 signatures
150 seconds
General
- Target Gereksinimler ROVİDA/AIO/vcredist2005_x64.exe
- Size 3.0MB
- Sample260823-e88mysxwe1
- SHA256 0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- MD5 56eaf4e1237c974f6984edc93972c123
- SHA1 ee916012783024dac67fc606457377932c826f05
- SHA512 f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP 49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
- TLSH T17DE5331262D08137F6E3A7F11AEC9DB31631FE932AB2161A0212687F5CA73E4517C71E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4060 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 1612 msiexec.exe 26 1612 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe - Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20260823054737860.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738126.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054737782.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738094.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738094.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738157.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737860.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737923.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738126.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738126.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054737923.0 msiexec.exe File opened for modification C:\Windows\Installer\e595df5.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737782.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80CHT.dll msiexec.exe File created C:\Windows\Installer\e595df9.msi msiexec.exe File created C:\Windows\Installer\e595df5.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737860.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737923.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737923.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054737860.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737782.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737782.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737860.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80CHS.dll msiexec.exe File created C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80ITA.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738001.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738126.1 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738157.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737923.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738126.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738141.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738141.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737923.0\mfc80.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738094.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738126.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738141.0 msiexec.exe File opened for modification C:\Windows\Installer\MSI8082.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737860.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738157.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738094.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738126.2\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054738126.2 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054737923.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738126.2\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\MSI641F.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054738001.0\mfc80DEU.dll msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1612 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 56 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 940 msiexec.exe 940 msiexec.exe 940 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1612 msiexec.exe Token: SeIncreaseQuotaPrivilege 1612 msiexec.exe Token: SeSecurityPrivilege 940 msiexec.exe Token: SeCreateTokenPrivilege 1612 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1612 msiexec.exe Token: SeLockMemoryPrivilege 1612 msiexec.exe Token: SeIncreaseQuotaPrivilege 1612 msiexec.exe Token: SeMachineAccountPrivilege 1612 msiexec.exe Token: SeTcbPrivilege 1612 msiexec.exe Token: SeSecurityPrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeLoadDriverPrivilege 1612 msiexec.exe Token: SeSystemProfilePrivilege 1612 msiexec.exe Token: SeSystemtimePrivilege 1612 msiexec.exe Token: SeProfSingleProcessPrivilege 1612 msiexec.exe Token: SeIncBasePriorityPrivilege 1612 msiexec.exe Token: SeCreatePagefilePrivilege 1612 msiexec.exe Token: SeCreatePermanentPrivilege 1612 msiexec.exe Token: SeBackupPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeShutdownPrivilege 1612 msiexec.exe Token: SeDebugPrivilege 1612 msiexec.exe Token: SeAuditPrivilege 1612 msiexec.exe Token: SeSystemEnvironmentPrivilege 1612 msiexec.exe Token: SeChangeNotifyPrivilege 1612 msiexec.exe Token: SeRemoteShutdownPrivilege 1612 msiexec.exe Token: SeUndockPrivilege 1612 msiexec.exe Token: SeSyncAgentPrivilege 1612 msiexec.exe Token: SeEnableDelegationPrivilege 1612 msiexec.exe Token: SeManageVolumePrivilege 1612 msiexec.exe Token: SeImpersonatePrivilege 1612 msiexec.exe Token: SeCreateGlobalPrivilege 1612 msiexec.exe Token: SeBackupPrivilege 1744 vssvc.exe Token: SeRestorePrivilege 1744 vssvc.exe Token: SeAuditPrivilege 1744 vssvc.exe Token: SeBackupPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeBackupPrivilege 1884 srtasks.exe Token: SeRestorePrivilege 1884 srtasks.exe Token: SeSecurityPrivilege 1884 srtasks.exe Token: SeTakeOwnershipPrivilege 1884 srtasks.exe Token: SeBackupPrivilege 1884 srtasks.exe Token: SeRestorePrivilege 1884 srtasks.exe Token: SeSecurityPrivilege 1884 srtasks.exe Token: SeTakeOwnershipPrivilege 1884 srtasks.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe Token: SeTakeOwnershipPrivilege 940 msiexec.exe Token: SeRestorePrivilege 940 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1612 msiexec.exe 1612 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3636 wrote to memory of 1612 3636 vcredist2005_x64.exe 89 PID 940 wrote to memory of 1884 940 msiexec.exe 98 PID 940 wrote to memory of 4060 940 msiexec.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1612
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1D80A7E4C32FC8360A1490BA8AE758A02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4060
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1744
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 312KB
- SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
- MD5 77a9bff5af149160775741e204734d47
- SHA1 7b5126af69b5a79593f39db94180f1ff11b0e39d
- SHA512 bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
- SSDEEP 6144:t4hYeVCicX007FZ+S33LibEvo5axZHkfKu96hXp8V0EuZo5YemLDwcEmW6Y:GYGC3kw2bEwAxZgZ96hLEuZo5YemHiv
- TLSH T12A6423111FE40F1ACCF4D3123D659AD90504FAEE092D9D2395B7BE838D2E1F6858CB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 3.0MB
- SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
- MD5 6dbdf338a0a25cdb236d43ea3ca2395e
- SHA1 685b6ea61e574e628392eaac8b10aff4309f1081
- SHA512 6b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
- SSDEEP 49152:HgdGyDmDdLz8tDP2KlMTCXoVwEf2pH+uNn4qfKzi2elcvEwXLEMjP4Y9CM:QYeP22Meyf2pH+xqiNkiEwXvQY9B
- TLSH T1C1E5F1427616E272E148A2300757CA5C7EBE73D127637A4D33EC271899AB6EEC33914D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI641F.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- TLSH T193D20A93BA2494B3DD9031B101EE591652DEC7324B1598E36F1A0ECBBE74DC2DBB118B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 86c27cce42c91479e65fab84ba11af13ae3e1755cf25d47df9e683e443498c7f
- MD5 075f93c5ff6b04481d79443851659ad8
- SHA1 7b7f3117883ab78e938ffabe2b8e137018684792
- SHA512 17684073a93941959ce494d7e53aac1eed7a4ec7cb00e65e3767adc65dbea0bf11a718b7945742965dd703182e2dc5d68e101f20b7ea7b786cc77561b523a58d
- SSDEEP 24576:Uu8m+1ztdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:6
- TLSH T14D47A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d518fa53-4dc9-46df-8416-e9ea41b29391}_OnDiskSnapshotProp
- Size 6KB
- SHA256 cbeb977bdafb53921ddc7231ef779a6d8c953d3013b29c6f88bdb3ceb2b460b8
- MD5 10225abb721d364727d8153cccd229a1
- SHA1 5bc1fbb73d67bc8b88083844a0e2c8e2eae08419
- SHA512 4e2252fd43ddcc5b5fbdc48b32c34fe902291db7a4516160fc3ee77b7ab32c0764bb7c9b4ad02ce6eeb913f4c3e403960bc57eb2693cb147dfb934b2e04c1504
- SSDEEP 96:FlmvWMcWDvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:3mdJb++ZVm
- TLSH T18CD179085AF54311E2F3AB7228F14557A877B911EF33CB8E0198638E6670910F835F5B
- MD5 SHA1 SHA512 SSDEEP TLSH