94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Home Days.msi
Size 28.2MB
Sample260420-brzryabs3x
SHA256 94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004
MD5 7e62d287bd12d989627c8b4be312961d
SHA1 231db2731cf32a73e0c74b5d1777b81693468215
SHA512 7f28268188d00e9bf2d554a784e28f12aad70397f8d448a19f43dfae515f8c2089ecfd74f481038c41d961bf527effbd81c2af7349b1e29dfa5660478b590703
SSDEEP 786432:elPJgjvnm74hR/4QzYhbYSS8PiDF2uTbXHSaC:etJGejkDFTXXHSa
TLSH
T19B5733D6E0774FD7E42ADA31D9365EF486913C208F9988336E34B72419B3BF0663A446
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1672	fVqRvQvGjggjLRLgKigg.exe
4192	fVqRvQvGjggjLRLgKigg.exe

Loads dropped DLL 1 IoCs

pid	Process
4192	fVqRvQvGjggjLRLgKigg.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{514173B6-1200-4374-8125-B908ABF446B2}	msiexec.exe
File created	C:\Windows\Installer\e5833a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58339e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3505.tmp	msiexec.exe
File created	C:\Windows\Installer\e58339e.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fba334cb82b6afae0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fba334cb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900fba334cb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1afba334cb000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfba334cb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	fVqRvQvGjggjLRLgKigg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4596	msiexec.exe
4596	msiexec.exe
4192	fVqRvQvGjggjLRLgKigg.exe
4192	fVqRvQvGjggjLRLgKigg.exe
4192	fVqRvQvGjggjLRLgKigg.exe
4192	fVqRvQvGjggjLRLgKigg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2044	msiexec.exe
Token: SeSecurityPrivilege	4596	msiexec.exe
Token: SeCreateTokenPrivilege	2044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2044	msiexec.exe
Token: SeLockMemoryPrivilege	2044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2044	msiexec.exe
Token: SeMachineAccountPrivilege	2044	msiexec.exe
Token: SeTcbPrivilege	2044	msiexec.exe
Token: SeSecurityPrivilege	2044	msiexec.exe
Token: SeTakeOwnershipPrivilege	2044	msiexec.exe
Token: SeLoadDriverPrivilege	2044	msiexec.exe
Token: SeSystemProfilePrivilege	2044	msiexec.exe
Token: SeSystemtimePrivilege	2044	msiexec.exe
Token: SeProfSingleProcessPrivilege	2044	msiexec.exe
Token: SeIncBasePriorityPrivilege	2044	msiexec.exe
Token: SeCreatePagefilePrivilege	2044	msiexec.exe
Token: SeCreatePermanentPrivilege	2044	msiexec.exe
Token: SeBackupPrivilege	2044	msiexec.exe
Token: SeRestorePrivilege	2044	msiexec.exe
Token: SeShutdownPrivilege	2044	msiexec.exe
Token: SeDebugPrivilege	2044	msiexec.exe
Token: SeAuditPrivilege	2044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2044	msiexec.exe
Token: SeChangeNotifyPrivilege	2044	msiexec.exe
Token: SeRemoteShutdownPrivilege	2044	msiexec.exe
Token: SeUndockPrivilege	2044	msiexec.exe
Token: SeSyncAgentPrivilege	2044	msiexec.exe
Token: SeEnableDelegationPrivilege	2044	msiexec.exe
Token: SeManageVolumePrivilege	2044	msiexec.exe
Token: SeImpersonatePrivilege	2044	msiexec.exe
Token: SeCreateGlobalPrivilege	2044	msiexec.exe
Token: SeBackupPrivilege	2532	vssvc.exe
Token: SeRestorePrivilege	2532	vssvc.exe
Token: SeAuditPrivilege	2532	vssvc.exe
Token: SeBackupPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeBackupPrivilege	1112	srtasks.exe
Token: SeRestorePrivilege	1112	srtasks.exe
Token: SeSecurityPrivilege	1112	srtasks.exe
Token: SeTakeOwnershipPrivilege	1112	srtasks.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe
Token: SeTakeOwnershipPrivilege	4596	msiexec.exe
Token: SeRestorePrivilege	4596	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2044	msiexec.exe
2044	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1112	4596	msiexec.exe	91
PID 4596 wrote to memory of 5044	4596	msiexec.exe	93
PID 5044 wrote to memory of 1672	5044	wscript.exe	94
PID 1672 wrote to memory of 4192	1672	fVqRvQvGjggjLRLgKigg.exe	96
PID 4192 wrote to memory of 744	4192	fVqRvQvGjggjLRLgKigg.exe	97
PID 4192 wrote to memory of 3388	4192	fVqRvQvGjggjLRLgKigg.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Home Days.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\system32\wscript.exe
  wscript.exe //B //E:vbscript "CpHhpZBLlvx.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe
    "C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe" "C:\Users\Admin\AppData\Local\eFZHHK\rUpUtbpPeqPsRcv"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe
      C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        
        PID:744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        5⤵
        
        PID:3388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58339f.rbs

Path C:\Config.Msi\e58339f.rbs
Size 9KB
SHA256 3d2c0d8823eaaeb94fd47718eb2a23fb27699aefcfdc33f7cb063141d58fb2ca
MD5 a73dd2c8559f382ea027df60f4153309
SHA1 2ea9201dee723b0b47dbbcf17bb483d19878e2cd
SHA512 5cab904bbcb8c98a24441eb6aa2fef61a4721d1241afae4a18625772ac6336443b949d4ee12b37a0d50d1f30436d4054418ae9e8a670a5e01c08d45fe415e4dd
SSDEEP 192:dssDRdYe+VcvIWOI7IWOaFEvr/FLWP+hGZ3zpI0K5en+wI:dxDPvJvao4
TLSH
T18B123F82BA50D1D2E49D3732C6131F593BF7A2E6D713771F044886284F137C9DEAA88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2qg1ct21vemszwx4.node

Path C:\Users\Admin\AppData\Local\Temp\2qg1ct21vemszwx4.node
Size 373KB
SHA256 420470634f5cf449e7835827ffe2d60393a1bde789275cde108b70f28ab39fd4
MD5 f70d796e1e7a4ca917b680d723fef9d1
SHA1 e29e02b1ef99350e0f267b4a609ae42ead6e0c81
SHA512 9243c4f89b1f6c0b94c72c5d809bfe37333b8bd939c1509abc5395fa63a523d3f277a8116ffd8674a8343546eb51f45f8daeca557108de3b3ca1dd0f67549f42
SSDEEP 6144:HVX6t4JL4+kQhPe71JaYG5VwYNc/fCfpoBPklUQsLXMuq9P31qDlBaHBRoyT:HVXDc+ksPe7rQ3wYX+BPkeQsLXHqgBER
TLSH
T1DD84AE1A72E40CB4E9A7927D88534A0AE7F3BC124B60D7CF03A0966A9F377D0953E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CpHhpZBLlvx.vbs

Path C:\Users\Admin\AppData\Local\eFZHHK\CpHhpZBLlvx.vbs
Size 593B
SHA256 e310e638cf53e8200bb4ba7f21a708fd66c3e1b9b0aba8d302a614c567c0cddb
MD5 4302bf331131858b7769d60f0ef08bab
SHA1 87afe1749a46c5703ae10f6258994442c2ed2515
SHA512 18cd2976fb500403d27cdcc4dce07241269f1ee29d69b8d67da712067bd3c04ad5e727cb4f2199278c95e979b18f7196d1450115b378e225836eddf015bc0291
TLSH
T111F0413B6805C0BB80711AB3DC83081CCC7081932CFA94776E4DACBE0A07E753328003
MD5 SHA1 SHA512 TLSH

Submit Download

rUpUtbpPeqPsRcv

Path C:\Users\Admin\AppData\Local\eFZHHK\rUpUtbpPeqPsRcv
Size 307KB
SHA256 10767cc438958f763b6c3336b4c02b79c7779cb413c76c4fda393a6b9681f2a2
MD5 83358502d129a076947b766342320b3f
SHA1 aac359def3cc4aba9487df7d3582d1409ec72bf6
SHA512 bffef2bd6243290c1724eaf3302817a508dae2349ecf81eed13ec985a3862c8f1930fc4857262378e9ba6e57ef53be8a94da4feca0e32d9023134c915798ae04
SSDEEP 6144:wBKSbv6V98zMcCzfF3MqwfHUaGvXYRZYMAm:wBKSbiV98gbMqwfHUpYTYm
TLSH
T16464C860A382AC94110F6FA3FB1AE4F5EF0F2F3E345119DFC4292D51A66D919A6E1730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuSuHXEkf

Path C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
Size 2.5MB
SHA256 0f22d105dea8b3597d9e7925a3298e16a53b945f5f72cef9ca8cc71bcacbc5f2
MD5 23556e0aff3e2b74ec2ab8891ee0f9b6
SHA1 7490021599ecfed1b9c3c0695bd396464779b353
SHA512 b6d214f89aa592401d1db77b8728798764fc36d7771ff3e70e57b783a184ad3c17c0ad9bd06c4efc719f860170f13f1d9f651846fd2130017eca7578cfb472a6
SSDEEP 24576:y/VVfqdP29FAuF8emfeIdSL7HxzmlkA+x9/iiNwQOFDug6yItAVHmzOFKcSOTyud:yekTj8emf/SLpOiTOguacDxez5rP9DLQ
TLSH
T1E7C533500F660D7A096C871615BF5F0A0BB21F91C46DF4EF87E3B68E15ABB440A2F8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuSuHXEkf

Path C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
Size 1.8MB
SHA256 611072b2e1a50ad66d5f3c4dcd2d9beeb6bf6d97ff3a049374859c62e0f203d2
MD5 a503993b6a7500bebb67f75c1c62d7d5
SHA1 ca2e78113dd6bf27d28e2afa0dbb9dc6ee4bae49
SHA512 1946670e2858f0aea5434ab9bd27eb4731396b3915b0a6bd580a34f5ca48177a75def1e63c2ec096bf751efa0fd48522d130c0f862de8aefc7f06bab9399ced1
SSDEEP 49152:yenB12d9D7LN5H/yaNAZ1Kpb4Y4LExemh+FeI2L9v:4
TLSH
T1FE95BFCDB48F64D4B5E587F46FDE7F6ACAA710D32C81FD0E702092744E1057A9A9E828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuSuHXEkf

Path C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
Size 1.8MB
SHA256 b6b0ef9bc71380745bad281d09ac7ef69fc4feb304c7c5608e7484aa839e1481
MD5 f618899b478a859c2f93953e0e256b4e
SHA1 4d6e96efc44ea6f1f32c732ee464e00bc28ac193
SHA512 33ffd5035279a92edf653176e2eaf544b2b50484f58e5e9cf00ec4637189aab019eca580c30990fee4dcdccd1e1536193e1c434103e3ac0c747a456d378c87b0
SSDEEP 49152:NDRUriSBrO/B12d9D7LN5H/yaNAZ1Kpb4Y4LExemh+FeI2L9v:M
TLSH
T120959ECDB08F64D4B4E68BF56BDA7F6ACAA710D32C91FD0E702092744E1057A9B9D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58339e.msi

Path C:\Windows\Installer\e58339e.msi
Size 28.2MB
SHA256 94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004
MD5 7e62d287bd12d989627c8b4be312961d
SHA1 231db2731cf32a73e0c74b5d1777b81693468215
SHA512 7f28268188d00e9bf2d554a784e28f12aad70397f8d448a19f43dfae515f8c2089ecfd74f481038c41d961bf527effbd81c2af7349b1e29dfa5660478b590703
SSDEEP 786432:elPJgjvnm74hR/4QzYhbYSS8PiDF2uTbXHSaC:etJGejkDFTXXHSa
TLSH
T19B5733D6E0774FD7E42ADA31D9365EF486913C208F9988336E34B72419B3BF0663A446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 425c3d5d82d17b205ecdb4d30ee3ec8d622a415476bac2970a7aa25fef427efc
MD5 36ab81186f6bb36c37c16464d8fe4def
SHA1 f37c09c7433111a043d2ea21f701dffa105aaee1
SHA512 d793847922fc9ea8702d254ec7947d37a1acc4b3765e7fd68244b08ec026879ead3d3e6fcdc9cbad434e6264db7479dbecde30529803743a889afb0b39b454e0
SSDEEP 24576:Ku8m+1zXdoO/vvTLr2du42aJc0EDV1tSRrmNfSs110ac+6kgo/l0VLmxI:e
TLSH
T1C047B12436F92200E7B79E3CA8F0AA634D3E7D5B9C159E8D45411B4E0921FB1E873F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7e81dca2-0646-46a6-a389-3283071c9c71}_OnDiskSnapshotProp

Path \??\Volume{cb34a3fb-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7e81dca2-0646-46a6-a389-3283071c9c71}_OnDiskSnapshotProp
Size 6KB
SHA256 4c366c5bbfcbf82f213500d98dd3c6d3dd41c6cb38b9cc5603d533465bc04f30
MD5 ebec92327d608c7853e2eb8212c18621
SHA1 34bc2b1de241951647ee87af1194ac0e9e88dce6
SHA512 6c51372d0a5a8142407229287c95e24b07a1fa43d92d82055f76679340a2d8e26f62855b6e1ffcf47876ae6a012585099331a72f64236d05a203eb42ad319d7b
SSDEEP 96:FQ3JsaN6NBtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:sJsa6b++ZVm
TLSH
T15FD189085AF54711E2B3AB7129F18557A877B811FF33CB8E0198238E6670A10F976F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4192-48-0x00007FFE37700000-0x00007FFE38204000-memory.dmp

Download

memory/4192-65-0x00007FFE37700000-0x00007FFE38204000-memory.dmp

Download

memory/4192-66-0x00007FFE37700000-0x00007FFE38204000-memory.dmp

Download

memory/4192-69-0x00007FFE37700000-0x00007FFE38204000-memory.dmp

Download

memory/4192-68-0x00007FF76AA90000-0x00007FF76F10F000-memory.dmp

Download

memory/5044-33-0x00000184207C0000-0x00000184207CC000-memory.dmp

Download