5ba8e0109fbf8198e49ec8ea7877c3ec34aba8c6748120a6a9ee583adb2433b1

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_5ba8e0109fbf8198e49ec8ea7877c3ec34aba8c6748120a6a9ee583adb2433b1.msi
Size 10.2MB
Sample260626-nf1lbaax71
SHA256 5ba8e0109fbf8198e49ec8ea7877c3ec34aba8c6748120a6a9ee583adb2433b1
MD5 ee80c74b1cbdbbe0a1590fe3666f9054
SHA1 41d99b1853a7e6b99f10bcc61939635dcb836222
SHA512 27fdb4ffd2a94616f32a6bd8bbbc188a1a0cdb0130f74a5be11131570dfa1e2579d1c305aa4185f61124c7c0502723d24b0c692ac7eac0d6086425d10c7497db
SSDEEP 196608:E5LmCKBWJxONXVy2SxI4BYU1gVw0gSHC7JwMPBkCE8i1msP3n4uFZEOhExa:E5L/UVyfxBBYU1WwtSUPy8iN/Hya
TLSH
T161B633523BEDCD3BE38E0832847B47A92621FE14671081CB3748BC6DAD712DAB975B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
5280	WINDBVER.EXE

Loads dropped DLL 4 IoCs

pid	Process
4368	MsiExec.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2768	ICACLS.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Run\Deserved = "C:\\Windows\\SysWOW64\\rundll32.exe /sta {0D348B06-08D7-46C0-9FC1-F750CF0B8558} OneWay"	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1120 set thread context of 5280	1120	rundll32.exe	107

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0D40AD01DF4C4D40.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF863B867876DEC57D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA3E.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e59b55c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b55c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4DCB56D8-7A59-4F82-A517-76CC3BCB492F}	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3996	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5280-102-0x0000000000400000-0x000000000153A000-memory.dmp	innosetup
behavioral2/memory/5280-104-0x0000000000400000-0x000000000153A000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c0864d100437b2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015c0864d10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015c0864d1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35c0864d100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65c0864d100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\OptimizedDrive\\Damned.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\InprocServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\ProgID	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\ProgID\ = "Alsothis.Wom"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\Programmable	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\TypeLib	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\Implemented Categories	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\InprocServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\VERSION	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\VERSION\ = "1.0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\WOW6432Node\CLSID\{0D348B06-08D7-46C0-9FC1-F750CF0B8558}\ = "Alsothis.Wom"	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
204	msiexec.exe
204	msiexec.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	204	msiexec.exe
Token: SeCreateTokenPrivilege	3996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3996	msiexec.exe
Token: SeLockMemoryPrivilege	3996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3996	msiexec.exe
Token: SeMachineAccountPrivilege	3996	msiexec.exe
Token: SeTcbPrivilege	3996	msiexec.exe
Token: SeSecurityPrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeLoadDriverPrivilege	3996	msiexec.exe
Token: SeSystemProfilePrivilege	3996	msiexec.exe
Token: SeSystemtimePrivilege	3996	msiexec.exe
Token: SeProfSingleProcessPrivilege	3996	msiexec.exe
Token: SeIncBasePriorityPrivilege	3996	msiexec.exe
Token: SeCreatePagefilePrivilege	3996	msiexec.exe
Token: SeCreatePermanentPrivilege	3996	msiexec.exe
Token: SeBackupPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeShutdownPrivilege	3996	msiexec.exe
Token: SeDebugPrivilege	3996	msiexec.exe
Token: SeAuditPrivilege	3996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3996	msiexec.exe
Token: SeChangeNotifyPrivilege	3996	msiexec.exe
Token: SeRemoteShutdownPrivilege	3996	msiexec.exe
Token: SeUndockPrivilege	3996	msiexec.exe
Token: SeSyncAgentPrivilege	3996	msiexec.exe
Token: SeEnableDelegationPrivilege	3996	msiexec.exe
Token: SeManageVolumePrivilege	3996	msiexec.exe
Token: SeImpersonatePrivilege	3996	msiexec.exe
Token: SeCreateGlobalPrivilege	3996	msiexec.exe
Token: SeBackupPrivilege	5536	vssvc.exe
Token: SeRestorePrivilege	5536	vssvc.exe
Token: SeAuditPrivilege	5536	vssvc.exe
Token: SeBackupPrivilege	204	msiexec.exe
Token: SeRestorePrivilege	204	msiexec.exe
Token: SeRestorePrivilege	204	msiexec.exe
Token: SeTakeOwnershipPrivilege	204	msiexec.exe
Token: SeRestorePrivilege	204	msiexec.exe
Token: SeTakeOwnershipPrivilege	204	msiexec.exe
Token: SeBackupPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	4824	srtasks.exe
Token: SeSecurityPrivilege	4824	srtasks.exe
Token: SeTakeOwnershipPrivilege	4824	srtasks.exe
Token: SeBackupPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	4824	srtasks.exe
Token: SeSecurityPrivilege	4824	srtasks.exe
Token: SeTakeOwnershipPrivilege	4824	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3996	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3996	msiexec.exe
204	msiexec.exe
4368	MsiExec.exe
1120	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 4824	204	msiexec.exe	94
PID 204 wrote to memory of 4368	204	msiexec.exe	96
PID 4368 wrote to memory of 2768	4368	MsiExec.exe	97
PID 4368 wrote to memory of 5672	4368	MsiExec.exe	99
PID 4368 wrote to memory of 1500	4368	MsiExec.exe	101
PID 1500 wrote to memory of 6068	1500	wscript.exe	102
PID 6068 wrote to memory of 2892	6068	cmd.exe	104
PID 6068 wrote to memory of 1120	6068	cmd.exe	105
PID 1120 wrote to memory of 5280	1120	rundll32.exe	107
PID 1120 wrote to memory of 5280	1120	rundll32.exe	107
PID 1120 wrote to memory of 5280	1120	rundll32.exe	107
PID 1120 wrote to memory of 5280	1120	rundll32.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_5ba8e0109fbf8198e49ec8ea7877c3ec34aba8c6748120a6a9ee583adb2433b1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0AD5F96D5AD08E586EBD1C7391080AFE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2768
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5672
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" Check.wsf
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg.exe import "C:\Users\Admin\AppData\Roaming\OptimizedDrive\filetext2.txt" && C:\Windows\SysWOW64\rundll32.exe /sta {0D348B06-08D7-46C0-9FC1-F750CF0B8558}
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6068
    - - C:\Windows\SysWOW64\reg.exe
        
        reg.exe import "C:\Users\Admin\AppData\Roaming\OptimizedDrive\filetext2.txt"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2892
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe /sta {0D348B06-08D7-46C0-9FC1-F750CF0B8558}
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1120
      - C:\Users\Admin\AppData\Roaming\SoftHelp\WINDBVER.EXE
        
        C:\Users\Admin\AppData\Roaming\SoftHelp\WINDBVER.EXE
        6⤵
        Executes dropped EXE
        
        PID:5280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files.cab
Size 10.0MB
SHA256 aba53ac926aec982a32be2012d84e931a4499d8bbc5c5c652fe3928c1132c134
MD5 23179b38e5f7f63cd8962aa335f9ed74
SHA1 3c080bfa2d5ff741b6ab42e8f7eac16251e312d4
SHA512 3063222ad18282d5cb8bc9e5a1289cb8c42bf1154db4da2b3a4090a78081369ec18fdea2fc103ca33cea586715af188755fc8587e09fdbd1e68860acb059fbc3
SSDEEP 196608:G5LmCKBWJxONXVy2SxI4BYU1gVw0gSHC7JwMPBkCE8i1msP3n4uFZEOhExaD:G5L/UVyfxBBYU1WwtSUPy8iN/HyaD
TLSH
T1C4B6339B67BD8C7BE3999C35883706C9AA21F308B74502C6374DD8AFACD211D79A5D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Check.wsf

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\Check.wsf
Size 12KB
SHA256 7fd2a7e4824e8865bfc506cd3895719ff68d082910b619917fd09941ab96542a
MD5 cc2bd784448979a036a7e9e9a8db02c6
SHA1 ab0e7ab2806f9c2df4e42520c6cb995e63621d1c
SHA512 36f5c4a44958c2145abb301be31a821456f1ec14f440615007fb5a9ef6f850dba3c019cf4cd26877f4f42f26bf73ed667e0bf7c184c5dd410c49d199f53fee74
SSDEEP 96:obFCybiC4bFCpbFCpbFCpbFCpbFCpbFCpbFCXlYdJj/DP8x7TzMa/RUhRO0G6ini:2OJXPKYa/RSHinAdLjcgqJQP
TLSH
T12542B98F604F52F989FBCB636906ED79D23C411392601404784DC1A70FB6BE6927A6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Damned.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\Damned.dll
Size 28KB
SHA256 6d8bbe9c45a9380f0312740bd154bbdb88aca4183ab6aa7e15eb2b652f33c8e6
MD5 dadcbd96fbc67634350408903490193d
SHA1 0f797f3d5ce9bb0a6fd0b8208ab17a97ba165de1
SHA512 c97a987b98c0407f62e84f23ef62b232cabd13f48488803be19462d60969b18456b28169902c374ab5cafb9547dc83e9809a944997fb9867671bc6c977ee87fa
SSDEEP 192:5JBA+sfQwz0pD7NsHnQeh5dFV97Bh3LehID9T/A6QZsFDBKW3:5jA+HZD7NmdbNZ9T/QqDL3
TLSH
T131D2C515B2CBD17BE29846B11E22D7EC2105BE106FC2CA5F71ECB75EBF7A1008560B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

File.dat

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\File.dat
Size 22.2MB
SHA256 09ea472f714a42d886fb0f64aff72a609db0edd672ab11f6dbfe0bfc4a5ba637
MD5 e9d076e4573733f0913a212617c71668
SHA1 f41b161b895cd791f2b078aa7692c316d7d3142c
SHA512 1c340625401de6a6b197ca32af0bb611cce9bec9dd7ea3dabd8fa1bb0a71b6c63cd9710615a88bdf85aa299be4af84eb4c2feb1aa8603c7a305e1fb81e6422f8
SSDEEP 196608:/Tl7GoY91x9Rxa+TCOfVqYh17qK+qmHUTroka5XifcT/I2neSKIGLPiT:u91L2+uONqYh17DjmH95ScT/X3RGLPiT
TLSH
T14137BC7DFCD2AF1631666D14152CC9979E8378CF222553A029FE30F13D4A19FF9898A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FoxEnd.dll

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\FoxEnd.dll
Size 1.1MB
SHA256 68dcb7b0ddb39c45cc340bb52b69961a3865aa533ca8a49c22a7f0e3ad66a51e
MD5 343c755fd6fe653b80d16c0af280f147
SHA1 eeeba78eba7c24abc1e69c5951db09d7ba4b4259
SHA512 391fbe26f274f144daa437081d140ebe49c26bdfff437254faa516f5adeb53d51e48260cdb4e0e103f10ee7e87f31b870e41de604aba2649ec84695cba946619
SSDEEP 12288:N7YJIB0xPwLjCTo2jkGnY3IXS4dsgK9eRGYNo3ec6k+USVhgUmM6suTwfikQ2qjz:N8WB2c15dwPHDOJ0GnSdbu6G3
TLSH
T149453B4F35F72F68EE9A8F3F13005E1485EA98440145F727A18036A6BBCAE471B879D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINDBVER.EXE

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\WINDBVER.EXE
Size 30KB
SHA256 8778bb953ffead733b53de1b4ac040061fd93e5bee5223893ca4e1dc7b0fea02
MD5 73a5552a933e15b0a6fe13bb573e90d3
SHA1 5eb98f8a26d30db716a67f152efb8281b330f194
SHA512 ac08e2cd25a622dce54a0911f832604cda335837aec6f7d324fb486fa104b3ef1466affaedf85541719418fec76d9de89f61fa5cd7d0694e99f7278018179cea
SSDEEP 768:oQ3n4ZtMHykJk+1ALBCGgF2NuC9IuSLe:7vYB1gsNdIuo
TLSH
T180D20912E750580FF1F3C4B06636877A5A77BD751620A84BA3D0698F26316C1EE2D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filetext.txt

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\filetext.txt
Size 972B
SHA256 a00b65160712a5df3dd0d3432b182b1d5fe88995a17e9d7cca15f47467b678e7
MD5 8690d10c0b7401ce3319d874baf72565
SHA1 b0f94ebfc632f2b3c4679d0a2856ddd13ecf546a
SHA512 5e45456d16b78cd6195da6654353179e6e927e4364404261efbfad46e140af1b7553de7c4ef70cedeed085dc36ac1d734b8b64b4a5f47a25682906b5fc45320d
TLSH
T181110860E1D7678A6DD1939442106CCA2AC363F9A5570DE4EE48A3003028C9E037F2EF
MD5 SHA1 SHA512 TLSH

Submit Download

newdev.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\files\newdev.exe
Size 66KB
SHA256 1675b87be879b45739c08d9098ef754526ce032ea054ad754b2fef3efaff6ab1
MD5 dc429f2be514b7b7bcfe7b8a8964a763
SHA1 9dda39bf8da3537d225216ab43a5fde6d1a15ad3
SHA512 1f22f21a4ee72cbc8462e78fdfeb349af59115be4490355620c8681d7786cf2795f1eddbdcc039b88dd80731f7bc3de119652b0748dd1111bee62d8955777d66
SSDEEP 1536:Xa0rJZgsk92caJfFrGUUUUUUUUUUUU3+K:Xa0rACfJh
TLSH
T11063F9C9F244866BECE4DBFCD2BDD7148B68B9904B14B9C37D40274A45BCACE7868D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\msiwrapper.ini
Size 362B
SHA256 2a54256fe6d439e5d5d34c27d188b0022d75c03bbf294be02be022e9a0a71d05
MD5 37de29638f3e1cecf90b96fac0199602
SHA1 5a32aff8b4708377f6972f8e172efe339f9509e9
SHA512 bfff14bf62cb933a5b0e7dd607621f2509b14246ced91de956aae816d9efbb56db6f974fa56af8ce9bfc65f999c48e45fbe889710261bc4c1c3d584b847533c9
TLSH
T102E0866A3BD42224B0B3CF60E9B254C1BE697C503C11806C60D6110A4D92F86DDF332D
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-4f0c7b6d-8d41-4795-b339-954f28684da9\msiwrapper.ini
Size 1KB
SHA256 564053335b9e8a8c5a69aa22f3f05ae3199679d02091c1a7616339d5c85f6f35
MD5 f8c329a316bab72801829280ac1baace
SHA1 46ea6b8bf8a6df1eee5db2c863e443aab507307d
SHA512 8c6b59157cb3a4881b45e6f274a24918fd7bcb434e6adf5ad2a2652ef925fb476e4cb32558da2a5bb50cfd8461ae36956f95ca36ad69216c266de7ac00f003a4
TLSH
T1CA21D5246FE81035F2F79E94EFF55482AF667C633D11AC0E10C112490AB2E59EDB3729
MD5 SHA1 SHA512 TLSH

Submit Download

filetext2.txt

Path C:\Users\Admin\AppData\Roaming\OptimizedDrive\filetext2.txt
Size 1024B
SHA256 59ef710a66df5a06852ce9b4a70d077b2e1e506ed8be5349da9c30edc1cf4242
MD5 554f3ac4a7cb34a486fedd07cbd8f351
SHA1 69c3f2567f1bf364bc46616b221f617573490f1a
SHA512 26fe8562c9148dc426f70682ebc38999c9c6d13429277eae11cdc9392549c05d30866b188ded9cffe1f6416f6875c368176933615a71f55717c6f949bacbb21f
TLSH
T1BF112960E1C7A7896DD1939442106CCA5AC363F8A5A70EE4EE48A340342CC9E037F1EF
MD5 SHA1 SHA512 TLSH

Submit Download

MSIBA3E.tmp

Path C:\Windows\Installer\MSIBA3E.tmp
Size 208KB
SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
TLSH
T1F1246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b2ad47c243d113a00288955e1feeeb0c44354640196edba4b21f3ef2214750ab
MD5 da9191eb9bd8acc753ab56e868c2f3d6
SHA1 2453dab06573955e9442fe9485064cf795ac0de5
SHA512 edaacba75150b14af465c8eb18257221e1413450723315c4266b391dba70bba9fc0100fbf0a300fb40a9c9708d6d056ea6edf4f9d78a5b97d39297a6ce7f5751
SSDEEP 24576:3Fo3DMPLdoO/vvTL/iA7bSlgvr+xwLcY0GdJNW1jtu1a5MKr84h2bCx6fur:5H4
TLSH
T15157A12436F92600E7B79E7CACF06A234D3A7D5B9C15DE8D45411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1ec07023-fbb9-4ec3-9ad9-01499df5aa0d}_OnDiskSnapshotProp

Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1ec07023-fbb9-4ec3-9ad9-01499df5aa0d}_OnDiskSnapshotProp
Size 6KB
SHA256 d87404021a9d5d702b2d251f1140867cd81ce6f201660868c158fc933f77f9f8
MD5 4ae4065bad7956046fa877b51845ad54
SHA1 bb440a54cfdd50faa31db652458984c81055cc4d
SHA512 d6a80a70e9a12ad040270a838d920689490a081a6e1fde8d284dc320552eef3d727284209345852b9d56abfeb936e1bd9ab73d99acd3e257348da0899e9a98b1
SSDEEP 96:FxnDDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:fLb++uVm
TLSH
T169D166085AF54711E2B3AB3128F18557A877B951EF33CB8E0198238E6671A10F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-18-0x000001E4E83A0000-0x000001E4E8D44000-memory.dmp

Download

memory/1120-97-0x0000000003DA0000-0x0000000003EBE000-memory.dmp

Download

memory/5280-102-0x0000000000400000-0x000000000153A000-memory.dmp

Download

memory/5280-104-0x0000000000400000-0x000000000153A000-memory.dmp

Download