Analysis
- user interaction
yes - max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
photocraft-0.7.0-windows-x64.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
photocraft-0.7.0-windows-x64.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target photocraft-0.7.0-windows-x64.msi
- Size 61.6MB
- Sample261012-sdlrlasz9l
- SHA256 af959a169ba0b93bdcec4df0e9dfdbac365b7759d3d74b06c3f8f96ed45ff9a0
- MD5 89d779ecead7cb91d4118c3db93f81f8
- SHA1 9aeb411c568790dde22d1c6492c3308c8741b795
- SHA512 677aa8f1b5c1586e1d034c5bb29b9bea940973c47e13d9cd278af6fbd1150c4e621d802e1f40703d306d37d3cd3a8e1d8399792c47e652f51c36e3e7fe8471bf
- SSDEEP 1572864:BN780imfsj5VA4bTWzZdWR53I7oIY1opJ:BO0wrb+TM54mopJ
- TLSH T1C8E73386B7C01468F55F053EC6BFA61587BA3D0C63D0A08E96683117DE7A760E5FB388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4364 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\PhotoCraft\photocraft.exe msiexec.exe File created C:\Program Files\PhotoCraft\photocraft-cli.exe msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI19A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C10DE45D-077A-4443-961C-8217639B66D2}\PhotocraftIcon.exe msiexec.exe File created C:\Windows\Installer\e59e622.msi msiexec.exe File created C:\Windows\Installer\e59e620.msi msiexec.exe File opened for modification C:\Windows\Installer\e59e620.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{C10DE45D-077A-4443-961C-8217639B66D2} msiexec.exe File created C:\Windows\Installer\{C10DE45D-077A-4443-961C-8217639B66D2}\PhotocraftIcon.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1232 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c7fddbefb65c088a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c7fddbef0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c7fddbef000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac7fddbef000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc7fddbef000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.avif\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Image\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell\open\command\ = "\"C:\\Program Files\\PhotoCraft\\photocraft.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pcraft\ = "Photocraft.Document" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tga msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.hdr msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.PhotoshopDocument\ = "PSD Document" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\DefaultIcon\ = "\"C:\\Program Files\\PhotoCraft\\photocraft.exe\",0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ora\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exr msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.webp msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document\shell\open\ = "Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\photocraft.exe\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.qoi msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Document msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.png\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.avif\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.psd msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdn\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tif\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.qoi\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Applications\photocraft.exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.ico msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.PhotoshopDocument msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.qoi\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\FriendlyAppName = "PhotoCraft" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.gif msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ora\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psb\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.png\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.bmp\OpenWithProgids msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ico\OpenWithProgids\Photocraft.Image msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pcraft\Content Type = "application/x-photocraft" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gif\OpenWithProgids\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.tga\OpenWithProgids msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Document\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Photocraft.Image msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ora msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\SourceList\PackageName = "photocraft-0.7.0-windows-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdr msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Photocraft.Image\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.png msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qoi\OpenWithProgids\Photocraft.Image msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\photocraft.exe\SupportedTypes\.jpg msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D54ED01CA770344469C1287136B9662D\PackageCode = "8F39D65091CECF444B66EF5717B4F0E2" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3000 msiexec.exe 3000 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1232 msiexec.exe Token: SeSecurityPrivilege 3000 msiexec.exe Token: SeCreateTokenPrivilege 1232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1232 msiexec.exe Token: SeLockMemoryPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1232 msiexec.exe Token: SeMachineAccountPrivilege 1232 msiexec.exe Token: SeTcbPrivilege 1232 msiexec.exe Token: SeSecurityPrivilege 1232 msiexec.exe Token: SeTakeOwnershipPrivilege 1232 msiexec.exe Token: SeLoadDriverPrivilege 1232 msiexec.exe Token: SeSystemProfilePrivilege 1232 msiexec.exe Token: SeSystemtimePrivilege 1232 msiexec.exe Token: SeProfSingleProcessPrivilege 1232 msiexec.exe Token: SeIncBasePriorityPrivilege 1232 msiexec.exe Token: SeCreatePagefilePrivilege 1232 msiexec.exe Token: SeCreatePermanentPrivilege 1232 msiexec.exe Token: SeBackupPrivilege 1232 msiexec.exe Token: SeRestorePrivilege 1232 msiexec.exe Token: SeShutdownPrivilege 1232 msiexec.exe Token: SeDebugPrivilege 1232 msiexec.exe Token: SeAuditPrivilege 1232 msiexec.exe Token: SeSystemEnvironmentPrivilege 1232 msiexec.exe Token: SeChangeNotifyPrivilege 1232 msiexec.exe Token: SeRemoteShutdownPrivilege 1232 msiexec.exe Token: SeUndockPrivilege 1232 msiexec.exe Token: SeSyncAgentPrivilege 1232 msiexec.exe Token: SeEnableDelegationPrivilege 1232 msiexec.exe Token: SeManageVolumePrivilege 1232 msiexec.exe Token: SeImpersonatePrivilege 1232 msiexec.exe Token: SeCreateGlobalPrivilege 1232 msiexec.exe Token: SeCreateTokenPrivilege 1232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1232 msiexec.exe Token: SeLockMemoryPrivilege 1232 msiexec.exe Token: SeIncreaseQuotaPrivilege 1232 msiexec.exe Token: SeMachineAccountPrivilege 1232 msiexec.exe Token: SeTcbPrivilege 1232 msiexec.exe Token: SeSecurityPrivilege 1232 msiexec.exe Token: SeTakeOwnershipPrivilege 1232 msiexec.exe Token: SeLoadDriverPrivilege 1232 msiexec.exe Token: SeSystemProfilePrivilege 1232 msiexec.exe Token: SeSystemtimePrivilege 1232 msiexec.exe Token: SeProfSingleProcessPrivilege 1232 msiexec.exe Token: SeIncBasePriorityPrivilege 1232 msiexec.exe Token: SeCreatePagefilePrivilege 1232 msiexec.exe Token: SeCreatePermanentPrivilege 1232 msiexec.exe Token: SeBackupPrivilege 1232 msiexec.exe Token: SeRestorePrivilege 1232 msiexec.exe Token: SeShutdownPrivilege 1232 msiexec.exe Token: SeDebugPrivilege 1232 msiexec.exe Token: SeAuditPrivilege 1232 msiexec.exe Token: SeSystemEnvironmentPrivilege 1232 msiexec.exe Token: SeChangeNotifyPrivilege 1232 msiexec.exe Token: SeRemoteShutdownPrivilege 1232 msiexec.exe Token: SeUndockPrivilege 1232 msiexec.exe Token: SeSyncAgentPrivilege 1232 msiexec.exe Token: SeEnableDelegationPrivilege 1232 msiexec.exe Token: SeManageVolumePrivilege 1232 msiexec.exe Token: SeImpersonatePrivilege 1232 msiexec.exe Token: SeCreateGlobalPrivilege 1232 msiexec.exe Token: SeCreateTokenPrivilege 1232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1232 msiexec.exe Token: SeLockMemoryPrivilege 1232 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1232 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3000 wrote to memory of 4364 3000 msiexec.exe 97 PID 3000 wrote to memory of 2092 3000 msiexec.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\photocraft-0.7.0-windows-x64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1232
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 39C5DBB6D430C086D53E3E68B946B9D1 C2⤵
- Loads dropped DLL
PID:4364
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2092
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e621.rbs
- Size 14KB
- SHA256 a4248b1c05eecb0495dbbc997a190adeb98bfe07c4d5c67d5d84c0aa650d3607
- MD5 f982bf904bfb8946ea4e9456dbbb3360
- SHA1 7eb5afda740d5d4144f9d822b7cf7e7992a1640d
- SHA512 0b0bb09a41c6b76a5da8f729ac45269f89268da2d8d5f34503a5e3f9edb44f61f41da864f5105b02bb336caf1ac318780ef6a9245a00a87aa28ed7d989243e0e
- SSDEEP 192:VaYVvVlDE8SU/S6EAe8QXc/mILZXc/mZLybbQ3pA:VaYVvVlaXc/9ZXc/SasO
- TLSH T130620082B50296C2F4D71730CA1B2B553B73C3E88745538F19DC94246F8778A3EAAD4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9968.tmp
- Size 175KB
- SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
- MD5 543072c649a87e1880784b7f0effaeeb
- SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
- SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
- SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
- TLSH T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 effbb646b46815f45ca6cceffcee7f270bddd8c77b09b6b5c578e1b0db0cb421
- MD5 1a210ca75aa9a7e30c189b1c067d2f45
- SHA1 d5524018bfb9a2c39b893ce2a01033592c2fe9a2
- SHA512 6b780046b4113b18399a091affb2cefcf8c7c4ecaeac2c194bea62b5219c952d1513a763ad61fa7a74b92b29fb7efaf32e59691081e10d24ff0c8b93d5bc9461
- SSDEEP 24576:Zu8m+1zMdoO/vvTLL2G+DWKSXfEzulGSKQmNkZnVe0KHehPbYPF/egthj:6
- TLSH T19B47B42536FD2200E7F79E3C68F06A274D3A7D5BAC159E8D45411B8E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{efdbfdc7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3b08fe87-13e6-4378-8679-1dbe92bd12cd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 05f0e6336c838488c8046e422e30df5903c4935a1ab9ea1ab2c26bbbd5273cf9
- MD5 93ec0277f2ef67716981015a1c351641
- SHA1 e9f976c10159222c34b9f5ab362891cc706e347b
- SHA512 7c02b9a3bfc9298a160cd3ff01e54c44b424ba5f3532c383cad8dbffd1f5b3bbb62704e7f91c6540db437cd98e8ff4a010ab48b6617ef90e9224629ba6eb9ec4
- SSDEEP 96:Fx/FwBx+gcvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:NYxKb++ZVm
- TLSH T1B7D187085AF54711E2B3AB7229F14557A877B911EF33CB8E0298638E6670A10F835F5B
- MD5 SHA1 SHA512 SSDEEP TLSH