320262f629020cab8d095efeb1853a2caf904be87f02d8f4fb21158fc760e1ae

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
playit-windows-x86_64-signed.msi
Size 2.6MB
Sample260425-3cel1aay2s
SHA256 320262f629020cab8d095efeb1853a2caf904be87f02d8f4fb21158fc760e1ae
MD5 e35e8b9616a24c8dd4eb508a941ae044
SHA1 2c38c5b59f4ac08ce2ee5a121c81288ebacfdcce
SHA512 33cf8263b1944a55652f7366e8d56fbf43901438796aba39efa39f3295322c15be8707498e573a32c10261f59d3d32cc3291a705b76cd568c74f080eb0a67159
SSDEEP 49152:yjzMwflSCLVqmqO1u1XGppIQ1ckjkrCOkPpIE6ANDVEFpmVci2wy9SIT7ZGjYTyR:ynMCSbEOGpWyckQrCbPOpFpmVci2wy9q
TLSH
T1C1D501EBBF708111C4230F799839B77C472F5E2C9A2551832F49B949EAF22C8576A5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4308	msiexec.exe
6	4308	msiexec.exe
8	4308	msiexec.exe
10	4308	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\playit_gg\bin\playit.exe	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{D5A0819F-A172-42D9-860C-2983CD1B1883}\ProductICO	msiexec.exe
File created	C:\Windows\Installer\e585eb7.msi	msiexec.exe
File created	C:\Windows\Installer\e585eb5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\{D5A0819F-A172-42D9-860C-2983CD1B1883}\ProductICO	msiexec.exe
File opened for modification	C:\Windows\Installer\e585eb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5A0819F-A172-42D9-860C-2983CD1B1883}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FAF.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4308	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007d3725990023bfe00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007d3725990000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007d372599000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7d372599000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7d372599000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Media\1 = ";CD-ROM #1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F9180A5D271A9D2468C09238DCB18138\Environment = "Binaries"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F9180A5D271A9D2468C09238DCB18138\Binaries	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Version = "1114113"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\ProductIcon = "C:\\Windows\\Installer\\{D5A0819F-A172-42D9-860C-2983CD1B1883}\\ProductICO"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AEF046202130BD4399AB6404AFE7E2D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\PackageName = "playit-windows-x86_64-signed.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Media\DiskPrompt = "Playit Installation"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F9180A5D271A9D2468C09238DCB18138	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\ProductName = "playit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\PackageCode = "252FFDB242369634EAE5CFCFBA5D793B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AEF046202130BD4399AB6404AFE7E2D\F9180A5D271A9D2468C09238DCB18138	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F9180A5D271A9D2468C09238DCB18138\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msiexec.exe
3952	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4308	msiexec.exe
Token: SeSecurityPrivilege	3952	msiexec.exe
Token: SeCreateTokenPrivilege	4308	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4308	msiexec.exe
Token: SeLockMemoryPrivilege	4308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4308	msiexec.exe
Token: SeMachineAccountPrivilege	4308	msiexec.exe
Token: SeTcbPrivilege	4308	msiexec.exe
Token: SeSecurityPrivilege	4308	msiexec.exe
Token: SeTakeOwnershipPrivilege	4308	msiexec.exe
Token: SeLoadDriverPrivilege	4308	msiexec.exe
Token: SeSystemProfilePrivilege	4308	msiexec.exe
Token: SeSystemtimePrivilege	4308	msiexec.exe
Token: SeProfSingleProcessPrivilege	4308	msiexec.exe
Token: SeIncBasePriorityPrivilege	4308	msiexec.exe
Token: SeCreatePagefilePrivilege	4308	msiexec.exe
Token: SeCreatePermanentPrivilege	4308	msiexec.exe
Token: SeBackupPrivilege	4308	msiexec.exe
Token: SeRestorePrivilege	4308	msiexec.exe
Token: SeShutdownPrivilege	4308	msiexec.exe
Token: SeDebugPrivilege	4308	msiexec.exe
Token: SeAuditPrivilege	4308	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4308	msiexec.exe
Token: SeChangeNotifyPrivilege	4308	msiexec.exe
Token: SeRemoteShutdownPrivilege	4308	msiexec.exe
Token: SeUndockPrivilege	4308	msiexec.exe
Token: SeSyncAgentPrivilege	4308	msiexec.exe
Token: SeEnableDelegationPrivilege	4308	msiexec.exe
Token: SeManageVolumePrivilege	4308	msiexec.exe
Token: SeImpersonatePrivilege	4308	msiexec.exe
Token: SeCreateGlobalPrivilege	4308	msiexec.exe
Token: SeBackupPrivilege	5952	vssvc.exe
Token: SeRestorePrivilege	5952	vssvc.exe
Token: SeAuditPrivilege	5952	vssvc.exe
Token: SeBackupPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe
Token: SeTakeOwnershipPrivilege	3952	msiexec.exe
Token: SeRestorePrivilege	3952	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4308	msiexec.exe
4308	msiexec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 6092	3952	msiexec.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\playit-windows-x86_64-signed.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585eb6.rbs

Path C:\Config.Msi\e585eb6.rbs
Size 9KB
SHA256 65464fc24c4ca007159328df2d95fdc4080d001a1eeb051e718e207037a5080a
MD5 53fa1674cef2e9a9b1c47ce02e8e1843
SHA1 cf84be80cc1bfb5e069d508b62ad04791d40067b
SHA512 5daeb644bb9363ff16697ed026ff51a73d987ca2e7f4c5e469d1b4b1f92dd01c69dee84ca907ebf2d7d760484e24ab4086da2730067db65c2c8208c3bcce47d4
SSDEEP 192:gK+QgwvEbytZQeR8I9BCI4BC+EWPyceJxMeawdwR7+V+2pJIiD13Nxcu8:gK+QgwvE+t/BCBgTQn
TLSH
T1E4124151AA1889E3E9A61738C3071F553BB3D2CAB740634F0ADC50A08F0779D5FE969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

playit.exe

Path C:\Program Files\playit_gg\bin\playit.exe
Size 4.9MB
SHA256 b2bcff05044d1b01f3d557e4fc9e8f4df4bf8fc328df3010380f82d9c7565684
MD5 9b8ea7807c36fbeff9717fd793b61475
SHA1 e1575761bdf20de22d64fbe81d697a0c7b97ed73
SHA512 f2e6bfa3b52b7c8dcc39b42cffbbbe2543bad3c68f777d37300cad05f8f99c780da091cf2d2a8d6fe8ebe47903297516727cee90092f2195210aff2bea4f8949
SSDEEP 98304:l4NQpxWgFJcqT7MPSQA13kuF55AHn+Ez:lTW8cWMXqtA
TLSH
T191364A026F9A58A9C099C874C34B8B634E1234DF0A36F5BF4AC511192FBEAF56F1D319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43FFE5C28177B37EEBE5BDCB272A0943_58C0A72F9AAC81ED0CD03DBA4A2209C8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\43FFE5C28177B37EEBE5BDCB272A0943_58C0A72F9AAC81ED0CD03DBA4A2209C8
Size 313B
SHA256 2c80a4969bd587dfe39c1c33cb5b1c049f500aa7d590f58b226c7a5c7b1160da
MD5 702ceae9aa0d2eec7e7b4a87f759f942
SHA1 9888d401be1dec5e0f87edf60208157dd63d2c50
SHA512 1eeb4dae7532205e80483a032caeb08a3a6500f477e2bd95257a87a7630d665ec4c98d3c616398f479567e5d7d5e4d112a212ac8fe5e4234e8d1031f7fec0ea1
TLSH
T1AEE07DF26425C1831A202D280DF8C873781C00C1D0CD5462327033D69C2766D660F8C4
MD5 SHA1 SHA512 TLSH

Submit Download

949D2E01833511C6366A8B529939FE66_A640373CFD567F7FA24BE1FC82025C7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\949D2E01833511C6366A8B529939FE66_A640373CFD567F7FA24BE1FC82025C7E
Size 312B
SHA256 814f31a0f1ae255352dc1e0d542c1a7524d6dea76f8ddf19ddd6e493ca9214b1
MD5 2ce0e52c103216348d8fb2fddb362de8
SHA1 d48d25d2a81c1a9cc141d556aa9aec721ebc73f4
SHA512 1efd017493ca57117adbf9cb0e3042f10ac7a5fb689e4e53c87e4ce57c43cdcff5c994bcafd5bd6c086743bc321b0f22464332977853f090b8510e93c0e5e300
TLSH
T199E07D64CB05700B0E288A886753C38C32B3048DD187400F796CB76D9A1FA3C884382C
MD5 SHA1 SHA512 TLSH

Submit Download

43FFE5C28177B37EEBE5BDCB272A0943_58C0A72F9AAC81ED0CD03DBA4A2209C8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\43FFE5C28177B37EEBE5BDCB272A0943_58C0A72F9AAC81ED0CD03DBA4A2209C8
Size 482B
SHA256 1af18c768ca71375b6fd1ed05abd72bf83b8798cfc005f6132d5cbae2d883076
MD5 1d6e9f37c3423658a9c96cb65e237a2d
SHA1 09e74c0db896f436f92809a38a719e7e8ba0d826
SHA512 54bc61ca834260b409b7db7a6ec87f29ea0bf08c10bf0ba27cd9ef7833b7f490314542a7e14f2eb6bcbc30fbcca86042967c8f1cc645d07a2c1378809557c10c
TLSH
T12EF05C2C50D9411DD036FE35CDD6A5A78905F251084156DE1522B707AA52E01ED7643C
MD5 SHA1 SHA512 TLSH

Submit Download

949D2E01833511C6366A8B529939FE66_A640373CFD567F7FA24BE1FC82025C7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\949D2E01833511C6366A8B529939FE66_A640373CFD567F7FA24BE1FC82025C7E
Size 494B
SHA256 cdab12d1aceb07909b475642b0a1e413267d34985c1f72319e974945a739d42f
MD5 705a092ec3e1c458b63558f799a016b3
SHA1 01ad8ea75d2a4cff350267504d6d0979d78977fc
SHA512 6efd4588b05968866d61f02fa7fa7dbce24eae61e271f27b3b60e43e3087179a4ad7e4911cd86e78a06c7b831d14b41bae9e93685ff50715453a3bb2beb7d7ff
TLSH
T19EF05C2C25BF411DF837EE3E86F083648D84F4630C08567A35D35601A541F41AC3357C
MD5 SHA1 SHA512 TLSH

Submit Download

e585eb5.msi

Path C:\Windows\Installer\e585eb5.msi
Size 2.6MB
SHA256 320262f629020cab8d095efeb1853a2caf904be87f02d8f4fb21158fc760e1ae
MD5 e35e8b9616a24c8dd4eb508a941ae044
SHA1 2c38c5b59f4ac08ce2ee5a121c81288ebacfdcce
SHA512 33cf8263b1944a55652f7366e8d56fbf43901438796aba39efa39f3295322c15be8707498e573a32c10261f59d3d32cc3291a705b76cd568c74f080eb0a67159
SSDEEP 49152:yjzMwflSCLVqmqO1u1XGppIQ1ckjkrCOkPpIE6ANDVEFpmVci2wy9SIT7ZGjYTyR:ynMCSbEOGpWyckQrCbPOpFpmVci2wy9q
TLSH
T1C1D501EBBF708111C4230F799839B77C472F5E2C9A2551832F49B949EAF22C8576A5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 9cee03e41bd4730aea1b6045496585dedc16f19769ec971f213cdebbd8071e68
MD5 a1f8ff3af1ce74dcf246eef81c285da8
SHA1 a384cad5510e5548df7e4db65120f5836da6003d
SHA512 5aefbab43a7d680d2aa58ba4b9c71263dd2ff7add04ffba3324608a237706cfca8ad59b2e8f45298ea8376c623e1557361fc6c1deba9e7c770e2b5ff152abf38
SSDEEP 24576:0u8m+1zDdoO/vvTLr2deomap8UkzFltiBrm9vSsll068u6kA4PFUF7WhY:k
TLSH
T15347D82836F92110E7F79E3C78F05A13893A7D579C16DE8D05811B8E0961BB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4b14fce2-8bf6-4b5b-baa9-951d2c32cebb}_OnDiskSnapshotProp

Path \??\Volume{9925377d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4b14fce2-8bf6-4b5b-baa9-951d2c32cebb}_OnDiskSnapshotProp
Size 6KB
SHA256 340c656ecd25fe4dedfc7d327875a535b7ea60a1326cebcdeeea6cb1b9e250fa
MD5 73b3814421b26f7e0b372ce38ac7bcbc
SHA1 26c0fe9d1d5c23220574df97cb2142b20fa5e5a9
SHA512 2caa85aabe1e1fa762273e473843d5443538f64f4ae00ed950330efdb024a0d3c284b8e7f1b6d5fa8f66e14e703b461ddfbaffda723d844102c1fd6a60b72247
SSDEEP 96:Fhcey2Avc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:DcAab++ZVm
TLSH
T1B3D189085AF54711E2B3AB7129F14557A837B811EF33CB8E0298238E6670910F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3952-48-0x00000230D6F10000-0x00000230D6F1C000-memory.dmp

Download

memory/4308-14-0x0000020BDC980000-0x0000020BDC98C000-memory.dmp

Download

memory/4308-47-0x0000020BDC980000-0x0000020BDC98C000-memory.dmp

Download