94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Home Days.msi
Size 28.2MB
Sample260420-brzryabs3x
SHA256 94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004
MD5 7e62d287bd12d989627c8b4be312961d
SHA1 231db2731cf32a73e0c74b5d1777b81693468215
SHA512 7f28268188d00e9bf2d554a784e28f12aad70397f8d448a19f43dfae515f8c2089ecfd74f481038c41d961bf527effbd81c2af7349b1e29dfa5660478b590703
SSDEEP 786432:elPJgjvnm74hR/4QzYhbYSS8PiDF2uTbXHSaC:etJGejkDFTXXHSa
TLSH
T19B5733D6E0774FD7E42ADA31D9365EF486913C208F9988336E34B72419B3BF0663A446
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1268	fVqRvQvGjggjLRLgKigg.exe
3332	fVqRvQvGjggjLRLgKigg.exe

Loads dropped DLL 1 IoCs

pid	Process
3332	fVqRvQvGjggjLRLgKigg.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38ED.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC68DD72284A73735.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5495E406774F3E59.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{514173B6-1200-4374-8125-B908ABF446B2}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB060A98CEE5594C1.TMP	msiexec.exe
File created	C:\Windows\Installer\e5837c6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5354F8CAAD249ECE.TMP	msiexec.exe
File created	C:\Windows\Installer\e5837c4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5837c4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	fVqRvQvGjggjLRLgKigg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	fVqRvQvGjggjLRLgKigg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3912	msiexec.exe
3912	msiexec.exe
3332	fVqRvQvGjggjLRLgKigg.exe
3332	fVqRvQvGjggjLRLgKigg.exe
3332	fVqRvQvGjggjLRLgKigg.exe
3332	fVqRvQvGjggjLRLgKigg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3404	msiexec.exe
Token: SeSecurityPrivilege	3912	msiexec.exe
Token: SeCreateTokenPrivilege	3404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3404	msiexec.exe
Token: SeLockMemoryPrivilege	3404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3404	msiexec.exe
Token: SeMachineAccountPrivilege	3404	msiexec.exe
Token: SeTcbPrivilege	3404	msiexec.exe
Token: SeSecurityPrivilege	3404	msiexec.exe
Token: SeTakeOwnershipPrivilege	3404	msiexec.exe
Token: SeLoadDriverPrivilege	3404	msiexec.exe
Token: SeSystemProfilePrivilege	3404	msiexec.exe
Token: SeSystemtimePrivilege	3404	msiexec.exe
Token: SeProfSingleProcessPrivilege	3404	msiexec.exe
Token: SeIncBasePriorityPrivilege	3404	msiexec.exe
Token: SeCreatePagefilePrivilege	3404	msiexec.exe
Token: SeCreatePermanentPrivilege	3404	msiexec.exe
Token: SeBackupPrivilege	3404	msiexec.exe
Token: SeRestorePrivilege	3404	msiexec.exe
Token: SeShutdownPrivilege	3404	msiexec.exe
Token: SeDebugPrivilege	3404	msiexec.exe
Token: SeAuditPrivilege	3404	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3404	msiexec.exe
Token: SeChangeNotifyPrivilege	3404	msiexec.exe
Token: SeRemoteShutdownPrivilege	3404	msiexec.exe
Token: SeUndockPrivilege	3404	msiexec.exe
Token: SeSyncAgentPrivilege	3404	msiexec.exe
Token: SeEnableDelegationPrivilege	3404	msiexec.exe
Token: SeManageVolumePrivilege	3404	msiexec.exe
Token: SeImpersonatePrivilege	3404	msiexec.exe
Token: SeCreateGlobalPrivilege	3404	msiexec.exe
Token: SeBackupPrivilege	764	vssvc.exe
Token: SeRestorePrivilege	764	vssvc.exe
Token: SeAuditPrivilege	764	vssvc.exe
Token: SeBackupPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3404	msiexec.exe
3404	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4964	3912	msiexec.exe	83
PID 3912 wrote to memory of 2168	3912	msiexec.exe	85
PID 2168 wrote to memory of 1268	2168	wscript.exe	86
PID 1268 wrote to memory of 3332	1268	fVqRvQvGjggjLRLgKigg.exe	88
PID 3332 wrote to memory of 3292	3332	fVqRvQvGjggjLRLgKigg.exe	89
PID 3332 wrote to memory of 4312	3332	fVqRvQvGjggjLRLgKigg.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Home Days.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4964
- C:\Windows\system32\wscript.exe
  wscript.exe //B //E:vbscript "CpHhpZBLlvx.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe
    "C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe" "C:\Users\Admin\AppData\Local\eFZHHK\rUpUtbpPeqPsRcv"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe
      C:\Users\Admin\AppData\Local\eFZHHK\fVqRvQvGjggjLRLgKigg.exe C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        
        PID:3292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        5⤵
        
        PID:4312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5837c5.rbs

Path C:\Config.Msi\e5837c5.rbs
Size 9KB
SHA256 ef2f3cd0111bf773944f47d3755cdae1fc1d8a58f678a1cbeddd4dbdb8bd6cbf
MD5 ecc4f4fcef7f92e81b14a2425d75f577
SHA1 518adedc45db4b7d0204b6cd381e0c3ed089fa0c
SHA512 0d55bbf670ea3c6ff706b505fd846bab2e98a0ff4fa62cf9794e45300bf2ebb718c89dcb2c82198cb1175cf8a77333b8bd85846bb125ffc8968a8ba2cca8661c
SSDEEP 192:Ws7pRI4C5bcvIWOI7IWOq3Eb3/FLK5S3mZ3zpgawRUZ02I:WqprvJv0gM
TLSH
T1281243427690E6E1E09C33329A171F9A3BF7D3E6DB03B72F444985680F037D8995A58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fl62jtiwsn1s4620.node

Path C:\Users\Admin\AppData\Local\Temp\fl62jtiwsn1s4620.node
Size 373KB
SHA256 420470634f5cf449e7835827ffe2d60393a1bde789275cde108b70f28ab39fd4
MD5 f70d796e1e7a4ca917b680d723fef9d1
SHA1 e29e02b1ef99350e0f267b4a609ae42ead6e0c81
SHA512 9243c4f89b1f6c0b94c72c5d809bfe37333b8bd939c1509abc5395fa63a523d3f277a8116ffd8674a8343546eb51f45f8daeca557108de3b3ca1dd0f67549f42
SSDEEP 6144:HVX6t4JL4+kQhPe71JaYG5VwYNc/fCfpoBPklUQsLXMuq9P31qDlBaHBRoyT:HVXDc+ksPe7rQ3wYX+BPkeQsLXHqgBER
TLSH
T1DD84AE1A72E40CB4E9A7927D88534A0AE7F3BC124B60D7CF03A0966A9F377D0953E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CpHhpZBLlvx.vbs

Path C:\Users\Admin\AppData\Local\eFZHHK\CpHhpZBLlvx.vbs
Size 593B
SHA256 e310e638cf53e8200bb4ba7f21a708fd66c3e1b9b0aba8d302a614c567c0cddb
MD5 4302bf331131858b7769d60f0ef08bab
SHA1 87afe1749a46c5703ae10f6258994442c2ed2515
SHA512 18cd2976fb500403d27cdcc4dce07241269f1ee29d69b8d67da712067bd3c04ad5e727cb4f2199278c95e979b18f7196d1450115b378e225836eddf015bc0291
TLSH
T111F0413B6805C0BB80711AB3DC83081CCC7081932CFA94776E4DACBE0A07E753328003
MD5 SHA1 SHA512 TLSH

Submit Download

rUpUtbpPeqPsRcv

Path C:\Users\Admin\AppData\Local\eFZHHK\rUpUtbpPeqPsRcv
Size 307KB
SHA256 10767cc438958f763b6c3336b4c02b79c7779cb413c76c4fda393a6b9681f2a2
MD5 83358502d129a076947b766342320b3f
SHA1 aac359def3cc4aba9487df7d3582d1409ec72bf6
SHA512 bffef2bd6243290c1724eaf3302817a508dae2349ecf81eed13ec985a3862c8f1930fc4857262378e9ba6e57ef53be8a94da4feca0e32d9023134c915798ae04
SSDEEP 6144:wBKSbv6V98zMcCzfF3MqwfHUaGvXYRZYMAm:wBKSbiV98gbMqwfHUpYTYm
TLSH
T16464C860A382AC94110F6FA3FB1AE4F5EF0F2F3E345119DFC4292D51A66D919A6E1730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuSuHXEkf

Path C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
Size 2.5MB
SHA256 0f22d105dea8b3597d9e7925a3298e16a53b945f5f72cef9ca8cc71bcacbc5f2
MD5 23556e0aff3e2b74ec2ab8891ee0f9b6
SHA1 7490021599ecfed1b9c3c0695bd396464779b353
SHA512 b6d214f89aa592401d1db77b8728798764fc36d7771ff3e70e57b783a184ad3c17c0ad9bd06c4efc719f860170f13f1d9f651846fd2130017eca7578cfb472a6
SSDEEP 24576:y/VVfqdP29FAuF8emfeIdSL7HxzmlkA+x9/iiNwQOFDug6yItAVHmzOFKcSOTyud:yekTj8emf/SLpOiTOguacDxez5rP9DLQ
TLSH
T1E7C533500F660D7A096C871615BF5F0A0BB21F91C46DF4EF87E3B68E15ABB440A2F8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuSuHXEkf

Path C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
Size 1.8MB
SHA256 ed51daa95d49bcdd87d59aead43149447845568f8893e52e8cce6c6fa108d727
MD5 38e38a9c4021ca709ec14a9ba54c6fad
SHA1 fe874a6e40b0c9b6c07554d794c38e25f7d72d1e
SHA512 678655c0e9f9dc0be4cbe9bd95c42a9503b5df809f5e23fb492ec44ba3bab405b55310505539d67892901f9d484c39d9e75ca1c8c44bf31a9b9ba0675298fa3a
SSDEEP 49152:y+rO/B12d9D7LN5H/yaNAZ1Kpb4Y4LExemh+FeI2L9v:D
TLSH
T11C95BFCDB48F64D4B5E587F46FDE7F6BCAA710D32C91F90E702092744E0057A9A9E828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuSuHXEkf

Path C:\Users\Admin\AppData\Local\eFZHHK\zuSuHXEkf
Size 1.8MB
SHA256 b6b0ef9bc71380745bad281d09ac7ef69fc4feb304c7c5608e7484aa839e1481
MD5 f618899b478a859c2f93953e0e256b4e
SHA1 4d6e96efc44ea6f1f32c732ee464e00bc28ac193
SHA512 33ffd5035279a92edf653176e2eaf544b2b50484f58e5e9cf00ec4637189aab019eca580c30990fee4dcdccd1e1536193e1c434103e3ac0c747a456d378c87b0
SSDEEP 49152:NDRUriSBrO/B12d9D7LN5H/yaNAZ1Kpb4Y4LExemh+FeI2L9v:M
TLSH
T120959ECDB08F64D4B4E68BF56BDA7F6ACAA710D32C91FD0E702092744E1057A9B9D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5837c4.msi

Path C:\Windows\Installer\e5837c4.msi
Size 28.2MB
SHA256 94e9c184bacfd60f5756515d39cbe3293dd8b33f5841976eafb4e64c91467004
MD5 7e62d287bd12d989627c8b4be312961d
SHA1 231db2731cf32a73e0c74b5d1777b81693468215
SHA512 7f28268188d00e9bf2d554a784e28f12aad70397f8d448a19f43dfae515f8c2089ecfd74f481038c41d961bf527effbd81c2af7349b1e29dfa5660478b590703
SSDEEP 786432:elPJgjvnm74hR/4QzYhbYSS8PiDF2uTbXHSaC:etJGejkDFTXXHSa
TLSH
T19B5733D6E0774FD7E42ADA31D9365EF486913C208F9988336E34B72419B3BF0663A446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 092dd68931e3f70d554672a96703f673b2ada141320c966fffcebbf6b55542d5
MD5 9837ff9de8c37350120b9e5ebef0e42b
SHA1 4219412050e36fce0e5d0d45b5c66e25dd77ee9c
SHA512 f36ae01755826f5157cdf6980fbdb4f93f9666836a226dd8d78fc5972089ed7defc62f446795b4c568762018ce0580cba0bb6a1f63c4608dbd95e81900f20129
SSDEEP 24576:d2gmSp1idoO/vvTLEGveR0Xaf6pEQYrVWWMN3pkP2U64EjL6o0O47CFox:u
TLSH
T13F47D12432FD2240E7F79E3D6CF0AA27493A7D5B9C159E8D45421B4E0921BB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b438734e-5aac-4f95-a5a0-29ccecf9871c}_OnDiskSnapshotProp

Path \??\Volume{a37a13d3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b438734e-5aac-4f95-a5a0-29ccecf9871c}_OnDiskSnapshotProp
Size 6KB
SHA256 bff402027d2d4d9c51ac565d25ec5c87d43f0d3d057b1cdaff261bd99746e36a
MD5 eafd44865458fe1e2d478e2707191791
SHA1 439c81221e663bc12f5a92dfd15578086f5bf076
SHA512 37ed0a36777a5085128172d7183e2019f1dc5d0ef3377e20e62d6a7607e4090f7b2a70e604d882636c655a1c930684674c3bae9a477e1aeb5e201e1f78d495dc
SSDEEP 96:FUJsaNsBvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:SJsaUb++ZVm
TLSH
T1A6D178185AE54711E2B3AB322DF18557A477B911EF33CB8E0198238E2670A10F876F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-42-0x000001E63BA80000-0x000001E63BAB1000-memory.dmp

Download

memory/2168-34-0x000001F4F6780000-0x000001F4F678C000-memory.dmp

Download

memory/2168-33-0x000001F4F4E50000-0x000001F4F4E81000-memory.dmp

Download

memory/3332-50-0x00007FF8EAD00000-0x00007FF8EB832000-memory.dmp

Download

memory/3332-63-0x0000029ECDA10000-0x0000029ECDA41000-memory.dmp

Download

memory/3332-65-0x0000029ECFCF0000-0x0000029ECFCF9000-memory.dmp

Download

memory/3332-64-0x00007FF8EAD00000-0x00007FF8EB832000-memory.dmp

Download

memory/3332-81-0x0000029ECDA10000-0x0000029ECDA41000-memory.dmp

Download

memory/3332-82-0x00007FF8EAD00000-0x00007FF8EB832000-memory.dmp

Download

memory/3404-3-0x000001CECBDF0000-0x000001CECBE21000-memory.dmp

Download

memory/3404-30-0x000001CECBDF0000-0x000001CECBE21000-memory.dmp

Download