Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 21:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6d0f25c8f8946c32f9ed3a202b063fc7cbd21f72359fae82eca4676083635c1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6d0f25c8f8946c32f9ed3a202b063fc7cbd21f72359fae82eca4676083635c1.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target f6d0f25c8f8946c32f9ed3a202b063fc7cbd21f72359fae82eca4676083635c1.msi
- Size 27.5MB
- Sample260517-1ml3qag14j
- SHA256 f6d0f25c8f8946c32f9ed3a202b063fc7cbd21f72359fae82eca4676083635c1
- MD5 436a17dc338d1aeb52b0a1d3ac71ed64
- SHA1 89cd29e3a2914ca447f5249b0f02cbfd7aae5a41
- SHA512 d95a0aa6462189f1059480e73aaede587abf50f904a52f3994f1977324bc5a50af11ee786cde931fc9599443ee72ad24797f4d408e3420847de8c025144914a5
- SSDEEP 393216:BfN5vGHbAcBOAyiJNX4z8UmMFH+5s2y9upRbI3IxElbXzGV/7HeNiOt8a0d:NeHbxBOAyia/B85sMpoLXzG1HUTt8b
- TLSH T1545733C89552E6A3DD775D30D4A49549E07AAE642E43C82AB7F83153A9F3FC033BA017
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2008 oaLwnuwVPgXS.exe 5356 oaLwnuwVPgXS.exe - Loads dropped DLL 1 IoCs
pid Process 5356 oaLwnuwVPgXS.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0E2E1B83-6A5A-4648-B96B-F3077979CAC8} msiexec.exe File opened for modification C:\Windows\Installer\MSI4C08.tmp msiexec.exe File created C:\Windows\Installer\e584ac2.msi msiexec.exe File created C:\Windows\Installer\e584ac0.msi msiexec.exe File opened for modification C:\Windows\Installer\e584ac0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4456 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz oaLwnuwVPgXS.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 oaLwnuwVPgXS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz oaLwnuwVPgXS.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4396 msiexec.exe 4396 msiexec.exe 5356 oaLwnuwVPgXS.exe 5356 oaLwnuwVPgXS.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4456 msiexec.exe Token: SeIncreaseQuotaPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4396 msiexec.exe Token: SeCreateTokenPrivilege 4456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4456 msiexec.exe Token: SeLockMemoryPrivilege 4456 msiexec.exe Token: SeIncreaseQuotaPrivilege 4456 msiexec.exe Token: SeMachineAccountPrivilege 4456 msiexec.exe Token: SeTcbPrivilege 4456 msiexec.exe Token: SeSecurityPrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeLoadDriverPrivilege 4456 msiexec.exe Token: SeSystemProfilePrivilege 4456 msiexec.exe Token: SeSystemtimePrivilege 4456 msiexec.exe Token: SeProfSingleProcessPrivilege 4456 msiexec.exe Token: SeIncBasePriorityPrivilege 4456 msiexec.exe Token: SeCreatePagefilePrivilege 4456 msiexec.exe Token: SeCreatePermanentPrivilege 4456 msiexec.exe Token: SeBackupPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeShutdownPrivilege 4456 msiexec.exe Token: SeDebugPrivilege 4456 msiexec.exe Token: SeAuditPrivilege 4456 msiexec.exe Token: SeSystemEnvironmentPrivilege 4456 msiexec.exe Token: SeChangeNotifyPrivilege 4456 msiexec.exe Token: SeRemoteShutdownPrivilege 4456 msiexec.exe Token: SeUndockPrivilege 4456 msiexec.exe Token: SeSyncAgentPrivilege 4456 msiexec.exe Token: SeEnableDelegationPrivilege 4456 msiexec.exe Token: SeManageVolumePrivilege 4456 msiexec.exe Token: SeImpersonatePrivilege 4456 msiexec.exe Token: SeCreateGlobalPrivilege 4456 msiexec.exe Token: SeBackupPrivilege 1808 vssvc.exe Token: SeRestorePrivilege 1808 vssvc.exe Token: SeAuditPrivilege 1808 vssvc.exe Token: SeBackupPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4456 msiexec.exe 4456 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4396 wrote to memory of 1768 4396 msiexec.exe 91 PID 4396 wrote to memory of 3596 4396 msiexec.exe 93 PID 3596 wrote to memory of 2008 3596 cmd.exe 95 PID 2008 wrote to memory of 5356 2008 oaLwnuwVPgXS.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f6d0f25c8f8946c32f9ed3a202b063fc7cbd21f72359fae82eca4676083635c1.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4456
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1768
-
-
C:\Windows\system32\cmd.execmd.exe /c "zkcmDBhoj.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\oaLwnuwVPgXS.exe"oaLwnuwVPgXS.exe" "dRNvDxROGZaCuAnGtZ.js"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\oaLwnuwVPgXS.exeC:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\oaLwnuwVPgXS.exe C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\XrEfmTt.dat4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5356
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e584ac1.rbs
- Size 9KB
- SHA256 316bf31488e081baff8e9ad26279f2a70e32632e0413c133d464d1f59da9e3d3
- MD5 cec0b8438637b364d72a7e3bc13b37c3
- SHA1 d9890c6ade4be14f0ebd58c42b8e862b1dfef18a
- SHA512 94ac4a9e8d8b5e4ad1644a15e40e0ad577e15da7d18bea2bf8391453daf509c71c293a04e04c2975a214ac4ca6a9e2819a4c322326037d3511f8ffef4fc5b4a8
- SSDEEP 96:F3tGzmNMpWFqtkrRokeEIyF3Ug6YpCsThqN3Ug6YpC6j7VJYThq4HJltSigEwLa+:F3EzKLeUG1YsI71YsrGEX0ppx
- TLSH T17C125642BA508BE1DCB9173DC217579837BBD3E9E250938B1C6885668F52B88DF481CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx37jk6fg53h0qwg.node
- Size 365KB
- SHA256 5f673966b27f453a750385c0755750200f8bebf49e4e660188b80a950d8b47ed
- MD5 3922d40ff457eae9f0ce706bc9417d53
- SHA1 c1c03bbd471030f75868401dd0cc92ff232ae83d
- SHA512 00902f02390920d6805ed4a7f0df857c9cd08d05a9c6633b886a6ebc610902ba8cda9bbb648df006526787aa6c6322b497f17585909356ea43d2786ac953f4db
- SSDEEP 6144:7VX6t4JL4+kQhPe71JaYG5VwYNc/fCfp1mQkyI3lVkLot32ndC1E/nfGbn5:7VXDc+ksPe7rQ3wYXXIyCVynrgn5
- TLSH T15C84BE1A32E40CB4E9A7927DC9534A06E7F3BC124B60E7CF03A056AA9F277D0953E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\XrEfmTt.dat
- Size 1.7MB
- SHA256 20c4f070f40c6f0cb5e6601e47345f907b38cc18c9676a02d7196d3a90b40862
- MD5 afdc5e38c7f6eaa6eb36e05901bd08a5
- SHA1 55e73423c5ba042891f36af7871f114de4762bd2
- SHA512 fbb09861be8a6bac187241c077cad40150de4de21380b8feb3a660b92ae351bc23b83b5a384a0f22140c1298c4f34239ba7dfbd380703a32a109177edb648d87
- SSDEEP 24576:zXspqpTRhyJz6dlXVmZJGnRuiP878kNzVn+IqJdOIqsv3OkJVvOG1sujLt/M1u0o:DTrcl8878kNcOC3jHvOG2uXgrwUm9Ae
- TLSH T11A852389759FF5ECA9F943B437EB7F1A86A720A21CC0F50CB020F1680E19579EA5F419
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\XrEfmTt.dat
- Size 1.7MB
- SHA256 f4b92fa99aaac8f21b030ad6575569e232bf709b403b8774910cc287788148d8
- MD5 9533e7f70faa05b89a4cff10cbb362af
- SHA1 a9a9c77828ff8c3b132c0b9c5a2bfdb2d049f26c
- SHA512 a6a56ba02c3206e8304a1c2d5074ef66d599b994dd32f52182e21dede5b666b0bf3e658eb830b9b1bd8c191b4cb4d924a1c004c462620304a8385f18e59c402a
- SSDEEP 49152:OuZxz8cPr9cofL90GX+MtVPf7vRuXgrwUm9Ae:u
- TLSH T1E5859ECDB48F60D4B8E587F56BDE7F6A85A720D32C81FD0E702092744E1057AAF9E819
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\dRNvDxROGZaCuAnGtZ.js
- Size 114KB
- SHA256 90bfbbb9e215584d613aa5b1ef762d18a76bcfca50926d25fcd9a1524fb0af72
- MD5 28bb0736ceb7567a64a0c876800ac5e9
- SHA1 f9b1b613301dff281a081cf7ef9030d3014bab7c
- SHA512 afa46f582046e8167ad0ba67aff626803d22a925b40867035ed0e1a77da058c6f91a7d03222bd1c8b2d75e39cf1716bdca0f5bf99df94381034570329e2fadd8
- SSDEEP 3072:/z6hTMUr8Wl1rfwSYJMiP+8B8Qu5fsmZpGHDumg:LGTeW77POI30mZpk/g
- TLSH T157B3B6425D69B887400FF6679920C294D94FAE3CD3C4EB7FEC35A4A8F95C5409BB2A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\xPslVJsnOwyYzkYjbi\zkcmDBhoj.cmd
- Size 80B
- SHA256 99c04836b3b202d1d9c73672f3d92794a52f3d664a92da57c1ac83173d7ca956
- MD5 b168d2e4280748b479aa799b0f6fb856
- SHA1 15b6b7d51f57ed0c2d9a653d105971545ddf137f
- SHA512 9f5ded013d141e9a67a808b642969e697ae0366077ec478492f8a3344def8e9c26aaab852c0698732135c6fa69a761b149e4df41744341c6c2ddcaa8df1ff224
- TLSH T172A012055830040430550C4C14676845BC465043C4045C41607098785C4F848E1BC0C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e584ac0.msi
- Size 27.5MB
- SHA256 f6d0f25c8f8946c32f9ed3a202b063fc7cbd21f72359fae82eca4676083635c1
- MD5 436a17dc338d1aeb52b0a1d3ac71ed64
- SHA1 89cd29e3a2914ca447f5249b0f02cbfd7aae5a41
- SHA512 d95a0aa6462189f1059480e73aaede587abf50f904a52f3994f1977324bc5a50af11ee786cde931fc9599443ee72ad24797f4d408e3420847de8c025144914a5
- SSDEEP 393216:BfN5vGHbAcBOAyiJNX4z8UmMFH+5s2y9upRbI3IxElbXzGV/7HeNiOt8a0d:NeHbxBOAyia/B85sMpoLXzG1HUTt8b
- TLSH T1545733C89552E6A3DD775D30D4A49549E07AAE642E43C82AB7F83153A9F3FC033BA017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 49daaea8545ee207143c87f6636545a6853adda98b333a198e2c2622bbcca70d
- MD5 23a39efdf49f431fac6fad306491ffde
- SHA1 e6dd5cb2ec20e7ab25e7faeb0aadca856ca2a1a7
- SHA512 a2eec66622d91a86ee9f4a34635b63a101b511f0e54ad077faaece899dac8237feaa7dc7989d7d69b9324c41b23dc9ae2cde5c48602d2ff4cb4ec042de63349c
- SSDEEP 24576:Su8m+1z7doO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:G
- TLSH T18A47C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{537d3416-d174-4244-a0f7-7625e11c4775}_OnDiskSnapshotProp
- Size 6KB
- SHA256 79bb43a781e026896ce15be46286450dc9e8cadcc1c6bbfaadd782954461b039
- MD5 a8fac711c2593ef09b15834d88e704e9
- SHA1 00bfb14d4b9c2b8ecdb58062bd8b2c1e20c233dd
- SHA512 99e503515b32ed15fdb75bcf9af667ac4078b4a6fde2983eb0a036668bcb3cba258026fad3f3cfdc1769e15deae9554fbf90ec852523f516803302367f5f2fe5
- SSDEEP 96:F93ngvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Hqb++ZVmN
- TLSH T1D3D178085AE54311E2B3AB712DF58557A477B911EF33CB8E0298638E2670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH