Analysis
- max time kernel
25s - max time network
41s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
Nativ_x64w.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
40 seconds
Behavioral task
behavioral2
Sample
Nativ_x64w.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
40 seconds
General
- Target Nativ_x64w.msi
- Size 41.4MB
- Sample261014-qpr2msdv5n
- SHA256 c379bb06199382062f9718f250e4364a0b8a13395fea4b38032efea9f6a9e7b2
- MD5 303a0a9c9c5f35a124f96d4a6c23670e
- SHA1 4f98de11d600b57f6c8cc47df9c5fce6c8a08d04
- SHA512 1b35d8881a308aae3613442194f71a311bba40b5efced359b1137893cbb2f762333890d63f751112924f5027f10a1955ea9c9641d8bb1fb237c6242357ed3f5a
- SSDEEP 786432:DXUHYig67WcWR3wSINkUA2AtS7Z1OewwS1gpGo+V2E060ZMlbnNCZODiB401/J:DXUzTWRgSAt0+ufwIop+V2EOZmNCqr
- TLSH T1D09733207D7BB539D144107607BEBE7557127C122BFAC18369A2BE2F247E9F087B6182
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 1288 MsiExec.exe 1288 MsiExec.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 2396 msiexec.exe 7 2396 msiexec.exe 8 2396 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2396 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2396 msiexec.exe Token: SeIncreaseQuotaPrivilege 2396 msiexec.exe Token: SeSecurityPrivilege 464 msiexec.exe Token: SeCreateTokenPrivilege 2396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2396 msiexec.exe Token: SeLockMemoryPrivilege 2396 msiexec.exe Token: SeIncreaseQuotaPrivilege 2396 msiexec.exe Token: SeMachineAccountPrivilege 2396 msiexec.exe Token: SeTcbPrivilege 2396 msiexec.exe Token: SeSecurityPrivilege 2396 msiexec.exe Token: SeTakeOwnershipPrivilege 2396 msiexec.exe Token: SeLoadDriverPrivilege 2396 msiexec.exe Token: SeSystemProfilePrivilege 2396 msiexec.exe Token: SeSystemtimePrivilege 2396 msiexec.exe Token: SeProfSingleProcessPrivilege 2396 msiexec.exe Token: SeIncBasePriorityPrivilege 2396 msiexec.exe Token: SeCreatePagefilePrivilege 2396 msiexec.exe Token: SeCreatePermanentPrivilege 2396 msiexec.exe Token: SeBackupPrivilege 2396 msiexec.exe Token: SeRestorePrivilege 2396 msiexec.exe Token: SeShutdownPrivilege 2396 msiexec.exe Token: SeDebugPrivilege 2396 msiexec.exe Token: SeAuditPrivilege 2396 msiexec.exe Token: SeSystemEnvironmentPrivilege 2396 msiexec.exe Token: SeChangeNotifyPrivilege 2396 msiexec.exe Token: SeRemoteShutdownPrivilege 2396 msiexec.exe Token: SeUndockPrivilege 2396 msiexec.exe Token: SeSyncAgentPrivilege 2396 msiexec.exe Token: SeEnableDelegationPrivilege 2396 msiexec.exe Token: SeManageVolumePrivilege 2396 msiexec.exe Token: SeImpersonatePrivilege 2396 msiexec.exe Token: SeCreateGlobalPrivilege 2396 msiexec.exe Token: SeCreateTokenPrivilege 2396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2396 msiexec.exe Token: SeLockMemoryPrivilege 2396 msiexec.exe Token: SeIncreaseQuotaPrivilege 2396 msiexec.exe Token: SeMachineAccountPrivilege 2396 msiexec.exe Token: SeTcbPrivilege 2396 msiexec.exe Token: SeSecurityPrivilege 2396 msiexec.exe Token: SeTakeOwnershipPrivilege 2396 msiexec.exe Token: SeLoadDriverPrivilege 2396 msiexec.exe Token: SeSystemProfilePrivilege 2396 msiexec.exe Token: SeSystemtimePrivilege 2396 msiexec.exe Token: SeProfSingleProcessPrivilege 2396 msiexec.exe Token: SeIncBasePriorityPrivilege 2396 msiexec.exe Token: SeCreatePagefilePrivilege 2396 msiexec.exe Token: SeCreatePermanentPrivilege 2396 msiexec.exe Token: SeBackupPrivilege 2396 msiexec.exe Token: SeRestorePrivilege 2396 msiexec.exe Token: SeShutdownPrivilege 2396 msiexec.exe Token: SeDebugPrivilege 2396 msiexec.exe Token: SeAuditPrivilege 2396 msiexec.exe Token: SeSystemEnvironmentPrivilege 2396 msiexec.exe Token: SeChangeNotifyPrivilege 2396 msiexec.exe Token: SeRemoteShutdownPrivilege 2396 msiexec.exe Token: SeUndockPrivilege 2396 msiexec.exe Token: SeSyncAgentPrivilege 2396 msiexec.exe Token: SeEnableDelegationPrivilege 2396 msiexec.exe Token: SeManageVolumePrivilege 2396 msiexec.exe Token: SeImpersonatePrivilege 2396 msiexec.exe Token: SeCreateGlobalPrivilege 2396 msiexec.exe Token: SeCreateTokenPrivilege 2396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2396 msiexec.exe Token: SeLockMemoryPrivilege 2396 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2396 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2396 msiexec.exe 464 msiexec.exe 1288 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 464 wrote to memory of 1288 464 msiexec.exe 90 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Nativ_x64w.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2396
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4FAB07451C9E5D61A79F7CC8244DD968 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1288
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:984
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 417238E68A90BAF1BF70A6437C3A80292⤵PID:5056
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Symen\eNativ\concrt140.dll
- Size 325KB
- SHA256 8864e0b73408cc267a1a23b758ba36740a9a65e7ae0d75c86e3eda4f0730c799
- MD5 efb4a3f8ffaa4f5b01838bfbc0860aef
- SHA1 48112b71a07395c3cac6b457acf0a5c1a06062f2
- SHA512 3a1c17a1afd23ad3313e340e8adee81909a8750f2fd6fd1e7252ef96bd87fdbb9d6839a8939242af21cc040583385458b5fa1d59f3b1e1b0d4ef13cc6f751883
- SSDEEP 6144:8g68362IMNDOrxZcJGIsYzdNmAjOdud7BfygnWzgKmxvm9I:8K6QN0c4ILsz0u9I
- TLSH T18664189A7B544CE2E923D13A8553854BF3F2B8406B22D3CB0265439E6F637D0D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Symen\eNativ\msvcp140.dll
- Size 604KB
- SHA256 6b1184d2226366c1504fdd7c307066a6c72c606fc3007d8591119b9211f93984
- MD5 5d2728bede4841dc65ab364987fdebe7
- SHA1 c2999c99db5ce3fbc7bdeca7abf5175bbc9e2b08
- SHA512 157e64e62cc08ca7eb60fc9194758d97a2ff52ffb82d8b4924353df453186da2e13225964d24181e82f6698fc6e2c2e09c139c0cdaad5633becb3526b69174af
- SSDEEP 12288:3uXIeBezM69Rnjuyie48zzRW+IJ6Cr6gfNCHwxQ1S9O6gWQEKZm+jWodEEViaCC:4IeBOM69Rnjuyie48zzRW+IJ6Cr6gfNy
- TLSH T136D40927A75945B5E062E37891C38316D7F17C058322E3C742A6E27D6FA73C4AB3B660
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Symen\eNativ\ucrtbase.dll
- Size 413KB
- SHA256 e09060d54a6a3e353112d48cc4ac621cdff751fc815b8d9f119d3cf2a07dd303
- MD5 8dcd11be0f20fb5c6875a0a10f1cc13d
- SHA1 d44a7c2846a8416196010d144d189268c8d9b99a
- SHA512 3116072d5f7bb71a3591f81b0c953c1ec2bd0ae922821392a601a2a732d60a6cad9051083b0a62f15234221e5de5f101866043d4cc1d802776826eff781757dd
- SSDEEP 6144:PiWDQ7cdTKEbFMV/QxASEiH663GTnb+5sQz04r4vpfKX9q:PiWDQ7ubs/QSPpTnMzmpfKNq
- TLSH T1AD947D75A66D10BAD17B607DD89B240FEA727412436056CF02AB4FF68B3BEC911373A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Symen\eNativ\vcruntime140.dll
- Size 83KB
- SHA256 58e437ff49e77bffdb2ceca6c375160e779b0f43d9ffca4c2b1dbb8d4937451a
- MD5 d5d9432a97cf932a0cddd707d4ee2698
- SHA1 59ff5524bd5924261ca5c3502e12b3d04b073bd8
- SHA512 29a5b5487506b2c452558b7a02c699b26f3907307f23d7364f4c6adc49190f0f817f5ac49e7e2221733257ac736d30468f1a1c3aaf0ff873e6fc22f94809126a
- SSDEEP 1536:RlE0EMIk1vPl4IHCaDWH1hk3djxMXnZYXNecbZd++dKBE:RygPziaGWHMXn2ecbZdP
- TLSH T1A3837B457AA442BAD06B9134C1B28E07FB76F481873147CF03B956AE0F53BE18F39A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Symen\eNativ\vcruntime140_1.dll
- Size 58KB
- SHA256 a14f6babddad53a5825a3aa7070bb4e58e217b1c49c3a0b9fee4688769d2f4db
- MD5 056f6805affab5b67435a1471e7cb34e
- SHA1 45db767d8cbd26fa4b885ddbf35ccf4253f35371
- SHA512 1bcf29f6b4d7bd205a4f257e4bf5bf22aa44fbfbb913d7f0d34156fe484735b07d8fd207285850c870cb60e27533bc788549f8b946dfe323cbd5f955d1cde2f5
- SSDEEP 1536:rBr87uWFLpedpvpzSZ1vpzUZSC4dezFmf6:KuyLpely/I8i
- TLSH T1B5435BD057384082E9AB99B0C1E6EE577D3CF7D20B50959B06A1E1981E537C1FB3D22E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 765B
- SHA256 bdb981577674bdb34cbd8c13cc21f8d7ce11172fc2a936e750001dd2a18033eb
- MD5 4ab57b2c7415bda9ee1f85249e9a30c4
- SHA1 d7a030d6a8c9f390196169ef9c5017687e5d31a3
- SHA512 564c88c861e592477604f55cdb4188f63c96485752622dda94fccd9680b7b56115eb3d6cf1cbf7b487627a3b057f716d3726c2a5b327bd57452d464eeea1d1b8
- TLSH T1F80170AA0C9B2081FF0463638939E5B2250070A271E623C3FA36D6FC0C04FEB5B3C825
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_EE0814F9AB79547EC716492A6DCD9DB9
- Size 638B
- SHA256 fcc7428d36ba3547696f7656538e6187f7a6d595cc6ac2c4a56cd0ecbdda74e7
- MD5 30cb6c9e36afb07a0b7e872f8c4ba1af
- SHA1 c67e00286e28b1d25e1268e1d79e6c9b662d7458
- SHA512 973a4f52a9aead6600dead20372fad3c3152057f648152e70945d8a990d82d0d51b66c3c3059c04e0bb94c6d8f4fa6dd7436b141728c7b41e641685fdc0232b4
- TLSH T1A8F06877CDB8A400B48444411D557CCB111178D278C6E057745E4F444BA47BDD659934
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 1KB
- SHA256 412619f97c6ba75ddeb3e89d000c902ae655d2659decaadf25e6bb8150a10ec3
- MD5 09c1ae5debc9c94e031266562af0b96e
- SHA1 f500c85726cf70554da8c686ea25f1eb5978f0cf
- SHA512 4be7d6e3c8db77b6d6de53702a38e139903266371032287bf5c6a68dca5ccd24ccf1af6685198b5cecfb405aa941e394d30d7983b8e16ccf1cec8440bb7313bd
- TLSH T13731E9D7ABB43A101E090CD4D45D8F72ACF136E1B1359DB838A64096D896FE06C4980D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 484B
- SHA256 42f5e58274706d08d2179ad8dd14a1ff2a22f9961884935130fc07fcb13b7c25
- MD5 f9d0594cbd256816fc2eb0af24f1ca0d
- SHA1 d766cccbcd79be2ccfd3f825977ddea8adcc14f7
- SHA512 75cd7823ae5637c0d02d453e2c4bff7d8ba381eb8200e86be4838f0b97d107cc5e85aadee6b375b28d3561f2372136029b83312948b862b9931efaf2bd510fb4
- TLSH T152F055204ABA413EF13A9C7559D4A423EC56F2132400D67A0A660309AB0AE0888824AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_EE0814F9AB79547EC716492A6DCD9DB9
- Size 488B
- SHA256 994d3c2ebda4b71507fcb75631bdbdadef20df2ac2b5d099d908aeb0db5b32d4
- MD5 598fe493a12ff3a9ac54ec181f4643ec
- SHA1 1c262cf43fae9c8cb875952f4a1ff86c3b59fbde
- SHA512 7d9d1430257422c3c630f89c8bbd0dca31a0fb104c6cb3835b9c203d157e758dd28b6890653385afc2290e4144ebcfa05ed7f66703cb1181878893adfddc8324
- TLSH T1F7F0A3287AFA01AFD470F97506D98192BD55F1243805515E53D1070DDB07E01DC72E9E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 482B
- SHA256 cca2f7c39e6c6b3e08ca2d87e50322c2a522da76bf8f7ce07e04129c4f891cba
- MD5 336fe7775176e14a0c5c60f553ca7836
- SHA1 f3b0deeb40781ffc45b445bc69e696454124ae58
- SHA512 f3c187d57ce86a3466389450653f9db5008c688b0e4ce76c290a62421253670008f95867c09c4b2671203fe44ba25bb4ecab46e8e753bae037f264c2353081a5
- TLSH T1CCF0AB246578021DE0376E75CBD8F127CD7DFB147845016B0A23070A660BA42CE9197A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI52C9.tmp
- Size 231KB
- SHA256 82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9
- MD5 def1669123bc5bd8e9a3a93e7f68b58c
- SHA1 101e1f6e9795672319543b9e69f9cb62a3d55055
- SHA512 b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c
- SSDEEP 3072:A7jfONyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYS:IRzCLbY92NLmPUj/u4yQ7wJ
- TLSH T108346C2136D4DA32E4E321B456BCE63119BEF4705B70C2C7A3941BEE9EA96C09B34717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nwmedia\nwmedia.dll
- Size 18.5MB
- SHA256 10fb9249bdb19ab7a1f0a8773348019728fdb9cdf7194bad58c6d5ed8241c06e
- MD5 b889c73c4b91207ec82a699677924cae
- SHA1 e85eb9fabfc4c0f37089c4f8dc18e24b145c9d7e
- SHA512 7b0d6e2d8420e402696e4e2623f040e4d70919418fae7c6014feb8438cde8743a6effe68255af789014b43aa0a9ec4cdaedbb55deaab02cbf2f8bc03b69e9262
- SSDEEP 98304:AD0KvRW+RgKCz8dfB8ITq2piWfQXPZQqviAxM/yMMvut+SjTVizFP26jVZ4nwBFp:K0KvWz8fBhqerYPBjVZ4nwkvTs
- TLSH T1D217071563268A16D5E733B4E5C31621A371BC43BB25B7D7959BF2340E933CCA2B38A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nwmedia\nwmedia.exe
- Size 6.0MB
- SHA256 2cef1e5dbed9901880d01f8ab69e28446c08b31c0715e86fa6a82bd27022d36e
- MD5 a3e315f1ff844867c4342d43d4078f69
- SHA1 b185fd56729f5186512b83b9d6a68252ca4a566b
- SHA512 022fd09d471f875a6cef0099025dd6ae0401e53008e30a874cd9b4ae1f80643924f4b6c8380c6cf06b8a868fbae0da46a7752c8eb013292dfae9d2633c048194
- SSDEEP 49152:yM9WY+RGtlqYkVwASO+9DelnHhlREz1GrSFnJxop0tQDMwZtgvCBPqYu4wEOTrBR:y2yLlm2pwIBkzV
- TLSH T11C567B6DA6BC015590FAC1EDC386A127E7B1305A43B01ADF5D2587F61F63EE026BEB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ed89b0b7162b84208894224d886cecc7af433a171c9b10908d71248bfe7fadc1
- MD5 40ba0a203998f166b552eedebf040b27
- SHA1 5f99096a7a3da79c3b13d02581849bfb83696fd0
- SHA512 77af7b6a5512a850f4aa0af688a544af517cdec8954bac82114a3d5e9bd7c8335e88bb6449773105eb76f6664fbaa2dea6ecee709878815079675c9037117171
- SSDEEP 24576:vFo3DMP/doO/vvTL/SQPvCFg/L+F07osEiJdNiBH5KBq5YOfc4h2PW1+ruv:dHI
- TLSH T1B757A12436F92200E7B79E3DA8F06A634D3A7D5B9C15DE8D45411B8E0822F71E872F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4ce6d49b-88d8-4200-8a99-15869f649d27}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0a99eda2bf4d97ca7d21f96b43a3a00917bbc2608e4c711cc9c632e1117c3d3d
- MD5 e5828882745cc033e6468d87bbe6ea9c
- SHA1 ab57a1b3738e3a00a0bed330c54d3e481835e2da
- SHA512 cd11d192b7208214f25e07075fd6027eb482421adb6f9e7d2e32bfececa10ff721c0f00ff87831f2555bd5a6ab25b69e38cbe99c02a00081f007402c2e112dba
- SSDEEP 96:FoQnc1BXaqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Vngb++uVm
- TLSH T11DD1870C5AF54711E2B3AB3229F18557A877B811EF33CB8E0198238E2631910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH