Overview
overview
10Static
static
5Gereksinim...ll.bat
windows10-2004-x64
7Gereksinim...ll.bat
windows11-ltsc_2024-x64
7Gereksinim...64.exe
windows10-2004-x64
7Gereksinim...64.exe
windows11-ltsc_2024-x64
7Gereksinim...86.exe
windows10-2004-x64
7Gereksinim...86.exe
windows11-ltsc_2024-x64
7Gereksinim...64.exe
windows10-2004-x64
3Gereksinim...64.exe
windows11-ltsc_2024-x64
3Gereksinim...86.exe
windows10-2004-x64
3Gereksinim...86.exe
windows11-ltsc_2024-x64
3Gereksinim...64.exe
windows10-2004-x64
3Gereksinim...64.exe
windows11-ltsc_2024-x64
3Gereksinim...86.exe
windows10-2004-x64
3Gereksinim...86.exe
windows11-ltsc_2024-x64
3Gereksinim...64.exe
windows10-2004-x64
4Gereksinim...64.exe
windows11-ltsc_2024-x64
4Gereksinim...86.exe
windows10-2004-x64
4Gereksinim...86.exe
windows11-ltsc_2024-x64
4Gereksinim...64.exe
windows10-2004-x64
4Gereksinim...64.exe
windows11-ltsc_2024-x64
4Gereksinim...86.exe
windows10-2004-x64
4Gereksinim...86.exe
windows11-ltsc_2024-x64
4Gereksinim...64.exe
windows10-2004-x64
4Gereksinim...64.exe
windows11-ltsc_2024-x64
4Gereksinim...86.exe
windows10-2004-x64
4Gereksinim...86.exe
windows11-ltsc_2024-x64
4Gereksinim...er.bat
windows10-2004-x64
3Gereksinim...er.bat
windows11-ltsc_2024-x64
3Gereksinim...gs.vbs
windows10-2004-x64
5Gereksinim...gs.vbs
windows11-ltsc_2024-x64
5Gereksinim...ol.exe
windows10-2004-x64
5Gereksinim...ol.exe
windows11-ltsc_2024-x64
10Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 04:37
Behavioral task
behavioral1
Sample
Gereksinimler ROVİDA/AIO/install_all.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Gereksinimler ROVİDA/AIO/install_all.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
Behavioral task
behavioral3
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral6
Sample
Gereksinimler ROVİDA/AIO/vcredist2005_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral7
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Gereksinimler ROVİDA/AIO/vcredist2008_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Gereksinimler ROVİDA/AIO/vcredist2010_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Gereksinimler ROVİDA/AIO/vcredist2012_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
Gereksinimler ROVİDA/AIO/vcredist2013_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
Gereksinimler ROVİDA/Checker.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
Gereksinimler ROVİDA/Checker.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
Gereksinimler ROVİDA/Defender Control/Defender_Settings.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
Gereksinimler ROVİDA/Defender Control/Defender_Settings.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
Gereksinimler ROVİDA/Defender Control/dControl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
Gereksinimler ROVİDA/Defender Control/dControl.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
31 signatures
150 seconds
General
- Target Gereksinimler ROVİDA/AIO/vcredist2005_x86.exe
- Size 2.6MB
- Sample260823-e88mysxwe1
- SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- MD5 ce2922f83fb4b170affce0ea448b107b
- SHA1 b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA512 e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP 49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
- TLSH T1DDC5331259C4D23AE0A213F45DFD2A734B3D7CA8B72027AFB78250968D262D164357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4628 MsiExec.exe 4628 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 5064 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe - Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20260823054735948.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735948.0\msvcr80.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIF7C9.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735948.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054735995.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735995.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736183.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e58f0c4.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736198.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736198.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054735948.0 msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736167.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736198.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736167.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736183.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736183.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735917.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736151.0\vcomp.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736073.0 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736183.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735917.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735948.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735995.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735995.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736198.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735995.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80ITA.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736183.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736198.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e58f0c8.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054735917.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736151.0 msiexec.exe File opened for modification C:\Windows\Installer\e58f0c4.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735948.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735995.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735995.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736198.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736151.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823054736167.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736073.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736151.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054736183.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\MSI10FF.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823054735917.0\ATL80.dll msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5064 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3380 msiexec.exe 3380 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5064 msiexec.exe Token: SeIncreaseQuotaPrivilege 5064 msiexec.exe Token: SeSecurityPrivilege 3380 msiexec.exe Token: SeCreateTokenPrivilege 5064 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5064 msiexec.exe Token: SeLockMemoryPrivilege 5064 msiexec.exe Token: SeIncreaseQuotaPrivilege 5064 msiexec.exe Token: SeMachineAccountPrivilege 5064 msiexec.exe Token: SeTcbPrivilege 5064 msiexec.exe Token: SeSecurityPrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeLoadDriverPrivilege 5064 msiexec.exe Token: SeSystemProfilePrivilege 5064 msiexec.exe Token: SeSystemtimePrivilege 5064 msiexec.exe Token: SeProfSingleProcessPrivilege 5064 msiexec.exe Token: SeIncBasePriorityPrivilege 5064 msiexec.exe Token: SeCreatePagefilePrivilege 5064 msiexec.exe Token: SeCreatePermanentPrivilege 5064 msiexec.exe Token: SeBackupPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeShutdownPrivilege 5064 msiexec.exe Token: SeDebugPrivilege 5064 msiexec.exe Token: SeAuditPrivilege 5064 msiexec.exe Token: SeSystemEnvironmentPrivilege 5064 msiexec.exe Token: SeChangeNotifyPrivilege 5064 msiexec.exe Token: SeRemoteShutdownPrivilege 5064 msiexec.exe Token: SeUndockPrivilege 5064 msiexec.exe Token: SeSyncAgentPrivilege 5064 msiexec.exe Token: SeEnableDelegationPrivilege 5064 msiexec.exe Token: SeManageVolumePrivilege 5064 msiexec.exe Token: SeImpersonatePrivilege 5064 msiexec.exe Token: SeCreateGlobalPrivilege 5064 msiexec.exe Token: SeBackupPrivilege 3932 vssvc.exe Token: SeRestorePrivilege 3932 vssvc.exe Token: SeAuditPrivilege 3932 vssvc.exe Token: SeBackupPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe Token: SeTakeOwnershipPrivilege 3380 msiexec.exe Token: SeRestorePrivilege 3380 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5064 msiexec.exe 5064 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 788 wrote to memory of 5064 788 vcredist2005_x86.exe 87 PID 3380 wrote to memory of 1772 3380 msiexec.exe 97 PID 3380 wrote to memory of 4628 3380 msiexec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5064
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1772
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9DF664DFC02F2A1B3B93231BD3AE96A12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4628
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3932
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 247KB
- SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
- MD5 cc064d4b81619991de8131a86ad77681
- SHA1 88d80d86cc20c27d7d2a872af719300bd2bb73f9
- SHA512 5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
- SSDEEP 6144:jdHDtJKx9Q5+LMfpMjU3B0QPdCtngtpoEvdpYKJFj9gGmO:xti+YLYpM45PUtgvTvdfDj9YO
- TLSH T18A4423C8D70C1D642630A1C948A55B6CCD9EA459790E35DA4282F2DE9E1D78FA0FC3F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 2.6MB
- SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
- MD5 b20bbeb818222b657df49a9cfe4fed79
- SHA1 3f6508e880b86502773a3275bc9527f046d45502
- SHA512 f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
- SSDEEP 49152:BxtG+uBvEH/sbE3EyyBU5czkhwZawV4mC5kRuhg6MmqmPAhe75LzNyS:TuVOTWBdzkkawxSh4iAhm51yS
- TLSH T1E9D5F153BA16E3A2E14862300757CA1C7D7E63E12763761D33FD2358889A6FAD33E548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF7C9.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- TLSH T193D20A93BA2494B3DD9031B101EE591652DEC7324B1598E36F1A0ECBBE74DC2DBB118B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 50f4fec4d2f284c41ce3e0c27d59cb26c6b2cc81e7af44520bead79cdfce91ef
- MD5 78f58bd146f5bd354a7624bc43fa05cd
- SHA1 78373a86486b2aeb5d8994b46e11bd36ec952514
- SHA512 5c4290a41ccd2e707f6090aeda3e95f515453bd89fc3809190fc32d447752293c3231fd498e002f856304a8f73b1042ffdd027fed8be3767c591a13e5be6fe4d
- SSDEEP 24576:Hu8m+1z0doO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:o
- TLSH T1FB47D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1297e8ac-065d-42f8-b438-5fa096246d88}_OnDiskSnapshotProp
- Size 6KB
- SHA256 889f1fd0ac0dea7d0ae65d579fe77082e159264b69f26a5fba8ad272dbe7eeda
- MD5 8a36c3fdea55bb3451f69de77f827e14
- SHA1 5cc44156f4209e6f707113711e729623cfb2ca91
- SHA512 da378d60274da6160783ac6e19fd78a551537e2eff4e9725e1f08f8cf52c72dbfacc208b9761e74dd71a279629d74c0b2a4663dfa27ef756ae8ec3185665e872
- SSDEEP 96:FIv9V2vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:2Eb++ZVmN
- TLSH T10AD188185AE54311E2F3AB7228F14557A877B911EF33CB8E0198238E6670A10F876F5F
- MD5 SHA1 SHA512 SSDEEP TLSH