Overview

overview

8

Static

static

3

Phish.exe

windows10-2004-x64

8

Phish.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/06/2026, 22:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Phish.exe
  • Size 33.8MB
  • Sample260625-2w2efafx5v
  • SHA256 fc4fc5613d89e5306b2df299a1ff67d252a94e08ba3dd729379e19aaf0ff671f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
costuradefense_evasiondiscoverypackerpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Costura .NET executable packer 1 IoCs

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 28 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Phish.exe
    "C:\Users\Admin\AppData\Local\Temp\Phish.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Phish.exe
      C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Phish.exe -package:"C:\Users\Admin\AppData\Local\Temp\Phish.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\Phish.exe" -waitingforchildprocess
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D71D0C48-969E-4980-B461-CE1A2B2920C6}
        3⤵
        • Executes dropped EXE
        PID:3744
      • C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6749F4CA-0C1A-48AF-8E90-1FC17A70B589}
        3⤵
        • Executes dropped EXE
        PID:2688
      • C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FC14DBCA-14D0-4BDE-823E-3CFB038A935B}
        3⤵
        • Executes dropped EXE
        PID:2784
      • C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{51253083-9F58-4E19-B751-092CF209E32E}
        3⤵
        • Executes dropped EXE
        PID:3616
      • C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB12F949-53B4-48D4-A176-0714E0A90B22}
        3⤵
        • Executes dropped EXE
        PID:876
      • C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B58CA00-3073-4939-B53A-97166397F101}
        3⤵
        • Executes dropped EXE
        PID:5536
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /c C:\Windows\TEMP\ZOHOAS~1\INVOKE~1.BAT -path "C:\Users\Admin\AppData\Local\Temp\Phish.exe" > C:\Windows\TEMP\ZohoAssist\InvokeMeetinglog.txt 2>&1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5604
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec /i C:\Windows\temp\ZohoAssist\ZA_Access.msi INSTALLER_PATH="C:\Users\Admin\AppData\Local\Temp\Phish.exe"
          4⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:4132
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3868
    • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe
      "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe" install
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe
        "C:\Program Files (x86)\ZohoMeeting\UnAttended\\\7z.exe" x "C:\Program Files (x86)\ZohoMeeting\UnAttended\\\ZohoMeeting.7z" -o"C:\Program Files (x86)\ZohoMeeting\UnAttended\\" -y
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2456
  • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe
    "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe" run -SessionType URS -productID 1
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5192
    • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
      -productID 1 -URS_REQUEST -wsn assist.zoho.com -check_urs_preferences -urs_pref_timeout 90
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:264
    • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
      "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe" -productID 1 -URS_REQUEST -wsn assist.zoho.com -urs_pref_timeout 90
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:6008
  • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe
    "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2692
  • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe
    "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe" run -SessionType URS -productID 1
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
      -productID 1 -URS_REQUEST -wsn assist.zoho.com -check_urs_preferences -urs_pref_timeout 90
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5172
    • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
      "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe" -productID 1 -URS_REQUEST -wsn assist.zoho.com -urs_pref_timeout 90
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3408
    • C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Toolsmanager.exe
      "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Toolsmanager.exe" -dc com -tools_token 79c2259a486ab4d48444dca2f2e19d2b7b79c666ba3cb830bb545a5d96dbebe62f266965ddff9d0a3309b90428444088cd41105be572df8ecb6f5d6e1f6a58b0f312b87ada9602366ae793fd0cbe5069
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\system32\conhost.exe
        \\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 24 --signal 0x680 --server 0x6a0
        3⤵
          PID:3832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe
          3⤵
            PID:3004
          • C:\Windows\system32\conhost.exe
            \\?\C:\Windows\system32\conhost.exe --headless --width 80 --height 24 --signal 0x6a0 --server 0x658
            3⤵
              PID:4316
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              3⤵
              • Badlisted process makes network request
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:2564

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59b4a1.rbs
              • Path C:\Config.Msi\e59b4a1.rbs
              • Size 35KB
              • SHA256 7e086e6318a2abf384c3f7a976138661adc98e7a6308b36e888799647ca607de
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.dll
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.dll
              • Size 1.1MB
              • SHA256 25a52dd0a38f58001779b12e84c2937aa52a922a4db9c43fa89214f11a3f4766
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe
              • Size 265KB
              • SHA256 54353ea62390f3151fc9dd9cadc86694e17d7d75a7ee6e39ca6285fa4bfb7336
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AssistLogo_white_border_32.ico
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\AssistLogo_white_border_32.ico
              • Size 14KB
              • SHA256 dd72cc36c3e664913059cc64a852fe673a8b6eb264632fefae20649a27e999d4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZADeployer.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe
              • Size 6.5MB
              • SHA256 b0c09192bf5925717b7f04a3aeebe22f79389aef7eddb7ed52338d12fb14f9a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZohoMeeting.7z
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z
              • Size 25.3MB
              • SHA256 4f280714af8dcf5ee85933052a7827ae1e4e7fc840e546d9e3dae45f36b1aeec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ClientSocket.dll
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ClientSocket.dll
              • Size 3.2MB
              • SHA256 d285cbb665349d2a6af7f0c24d2d85f72ab5035a69959d6d9eb31da898343d05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentApplicationResources.properties
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources.properties
              • Size 15KB
              • SHA256 69f4db49ffb502944417b233366031fd1485ca8dcdafcba94730fd1019ea7bc1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Settings.conf
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Settings.conf
              • Size 60B
              • SHA256 fdd7b9237db53968ea67662b40be859718b4249593346bde3acbbe74f85b228a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ToolsIQ.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ToolsIQ.exe
              • Size 465KB
              • SHA256 7082baed8924a67f8d5e6e2be7605384793d2bca691168c21b1d9b675d298fb0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              URSCredentialProvider64.dll
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider64.dll
              • Size 548KB
              • SHA256 e7be2116ad1fdf0948aae10a96c4c2a125aea8d2a9ebebca47f5f18a0efac054
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZAService.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAService.exe
              • Size 7.1MB
              • SHA256 e170d2480d2b914f1a071d26eef421833122faef24976d7d3df997bbd23a4fb6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZA_Bulk_Deployment_Manager.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Bulk_Deployment_Manager.exe
              • Size 846KB
              • SHA256 c0d67305bc438c2810afe2f3f6dd54868f05546ec3afdd3bae8cc813d1d6eded
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZA_Upgrader.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe
              • Size 6.2MB
              • SHA256 65840edea17ddc88998ff6ecb8566c50bfabc125a94a7efdc5d1a80af3f018b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ZohoTray.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoTray.exe
              • Size 6.5MB
              • SHA256 1c26894a4736ddcd96c8b0138471f0f19950d4cf1f99e4008d197548e17aec47
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              agent.exe
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent.exe
              • Size 14.5MB
              • SHA256 ad3b378b89b0aa5795f31f1f7e71086bdfcbba3fc930e6248bc340d5eb9dffd1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              license.rtf
              • Path C:\Program Files (x86)\ZohoMeeting\UnAttended\license.rtf
              • Size 51KB
              • SHA256 6e29c59f8e107b61d26eca465ea8eaa421998af223496253bacd0c761bb99222
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Proxy.conf
              • Path C:\ProgramData\ZohoMeeting\Proxy.conf
              • Size 59B
              • SHA256 cde86c1956e6ad3cf88c114acddb9209b509fc20b2506b6c88ba90c8c8a059dc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LogFileTray.log
              • Path C:\ProgramData\ZohoMeeting\log\LogFileTray.log
              • Size 14KB
              • SHA256 05c7c4ac568a54fc126d03b82a29c1353b8fbb2680d160151e20ca738233442b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ISBEW64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\ISBEW64.exe
              • Size 215KB
              • SHA256 18b2ed4d6780f2b3469a25a6f89440948e4f89005f3050418dfeeccae229d2a8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DIFxData.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\{95F1F02B-F4AB-4851-A5BF-ADDD20AA2D58}\DIFxData.ini
              • Size 84B
              • SHA256 6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              FontData.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\{95F1F02B-F4AB-4851-A5BF-ADDD20AA2D58}\FontData.ini
              • Size 37B
              • SHA256 a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932
              • MD5 SHA1 SHA512
              Submit Download

              _isres_0x0409.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\{95F1F02B-F4AB-4851-A5BF-ADDD20AA2D58}\_isres_0x0409.dll
              • Size 1.8MB
              • SHA256 3915698c45f46b27eb28881fca651d7672f90e15ca2110fd8093e1a467ef3a6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isuser_0x0409.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\{95F1F02B-F4AB-4851-A5BF-ADDD20AA2D58}\_isuser_0x0409.dll
              • Size 958KB
              • SHA256 5de4e8c590915a571b64eab52f3ee22fa29491061a9f996b8f33ffe6f9bde03e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              isrt.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{38E9AEA0-2718-4248-A74E-7E829B97A975}\{95F1F02B-F4AB-4851-A5BF-ADDD20AA2D58}\isrt.dll
              • Size 1.1MB
              • SHA256 e5b8371c09ab79573c600d2a557e99510b581abbca3c8f8d2c940855f551ccb2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              0x0409.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\0x0409.ini
              • Size 22KB
              • SHA256 cdb316d7f9aa2d854eb28f7a333426a55cc65fa7d31b0bdf8ae108e611583d29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ISSetup.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\ISSetup.dll
              • Size 1.5MB
              • SHA256 0d439c92b38c24654df022a06ae0cb6f8acc36e066f10d9313afe7dde3260974
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Phish.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\Phish.exe
              • Size 903KB
              • SHA256 f0991d413ccb253a009f8e3d39498d6a6006a1485d462e388f62765bdb6fef7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data1.cab
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\data1.cab
              • Size 30.2MB
              • SHA256 bc34a085cbf9fce2e9d1fec1fe3ae55242fd4bb44ac7fafc3c75a1a1deceabf5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data1.hdr
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\data1.hdr
              • Size 12KB
              • SHA256 78363a48e39391a1c12a8eabcc8a4d145f9fbe56de2bbbaec4049f40c624138c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data2.cab
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\data2.cab
              • Size 819B
              • SHA256 e3b50d2dfed02af2e49acdb9c5e777a709e20402565356f57f41d9f524b127eb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              layout.bin
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\layout.bin
              • Size 550B
              • SHA256 b34f092d6d8fb692df4085ecf1b287d1d679972a055147fff0c47b3373614d2c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              setup.inx
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\Disk1\setup.inx
              • Size 236KB
              • SHA256 d6e44667762da6fdd4a906a474d43bf45ce924a7cc5b5848d56f98986b07c330
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{9B00ACFB-B600-46E2-87BA-7F8A876CF929}\setup.ini
              • Size 2KB
              • SHA256 6b49b797abc63a86d782a22c3112a5852dc35631d50d8661464e3ec9fe75fe43
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              InvFE5.tmp
              • Path C:\Windows\Temp\ZohoAssist\InvFE5.tmp
              • Size 2KB
              • SHA256 7340b02d9cceedc996840a050cb4ab21254c1c2f8ac3993a78c33bb9b1ca53df
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ZA_C3A.tmp
              • Path C:\Windows\Temp\ZohoAssist\ZA_C3A.tmp
              • Size 29.5MB
              • SHA256 a2de4d950dce96be94a5656d08a7d6426734ae703eadb78285bc56aa1b0dff9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              metadata-2
              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 26.1MB
              • SHA256 40ed46f16fa46fc9bb0462d9a75e552890f78dd4d4e1427de8230c919c261282
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {9ac9a2f4-3a72-48da-90fd-65a12c1d8a90}_OnDiskSnapshotProp
              • Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9ac9a2f4-3a72-48da-90fd-65a12c1d8a90}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 83237352e7342658682780f128079531befb5790f3ef4369a93d1535fe4e8c3f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1456-160-0x0000023A48B90000-0x0000023A49534000-memory.dmp
              Download

              memory/2564-318-0x000001EF721F0000-0x000001EF72212000-memory.dmp
              Download

              memory/2564-321-0x000001EF72600000-0x000001EF72648000-memory.dmp
              Download

              memory/4504-99-0x0000000006270000-0x0000000006437000-memory.dmp
              Download