e30cd4ca15529583afe0efc978f1ae3ab3a93c2400c222d0752d17900552ebb3

Analysis

user interaction
yes
max time kernel
66s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
node-v24.18.0-x64.msi
Size 31.4MB
Sample260717-emmtcset41
SHA256 e30cd4ca15529583afe0efc978f1ae3ab3a93c2400c222d0752d17900552ebb3
MD5 fa57f4fc51dbeaaea61e4acf42e39018
SHA1 f22b6b5efd4690f6293b4de8fb4f0499e8ddb1ff
SHA512 44e659e1f90c25833821e8c3c2f05579f5375b60fd2d24af0e463eeeb936754094b8424e1e1a3ae009d5710e61d98cc69b99f3fd12ed1341a165941f6835b503
SSDEEP 786432:1T/P1kg7kWjJjibUmUgZmPOTcGIfc0aGB1P3B:N/P1kg7xJjiojsMVB1P
TLSH
T10F773322F6910A26D59AC131E073D364AF767D283710469E8774E05CFE362E06BFE74A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
5112	MsiExec.exe
5112	MsiExec.exe
3984	MsiExec.exe
3984	MsiExec.exe
3984	MsiExec.exe
1736	MsiExec.exe
2584	MsiExec.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2036	msiexec.exe
7	2036	msiexec.exe
9	2036	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_trustroot.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\dispatcher\proxy-agent.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\override-set.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\dist\commonjs\node\perf.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\subset.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\encoding.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-package-arg\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\cache-dir.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\yarn.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\reify-output.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\lib\print-tree.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\x509\sct.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\untar.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\key.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\man\cssesc.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fastest-levenshtein\esm\mod.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\docs\docs\api\Connector.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\dist\commonjs\browser\perf.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\universal.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\gt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\ltr.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-help-search.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\virtual.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\utils\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mute-stream\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\api\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-edit.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\commonjs\mode-fix.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\translations\ne.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\prefix.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\target.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\dist\commonjs\path-reservations.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\core\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\debug\src\common.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-install-test.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\fs-minipass\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\file-exists.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\updater.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\docs\docs\api\Errors.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\docs\docs\api\EventSource.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\core\symbols.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\util-deprecate\History.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarn	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\tlog\entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\safer-buffer\dangerous.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\undici\lib\web\fetch\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-uninstall.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\vuln.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-address\dist\address-error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\gtr.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\to-comparators.js	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{6178C0C7-8EA8-458F-8060-E49E500A666F}	msiexec.exe
File created	C:\Windows\Installer\{6178C0C7-8EA8-458F-8060-E49E500A666F}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e58b1a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB30F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC978.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC52.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b1a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b1a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB38D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBFB3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6178C0C7-8EA8-458F-8060-E49E500A666F}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2036	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\EnvironmentPath	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList\PackageName = "node-v24.18.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\ProductIcon = "C:\\Windows\\Installer\\{6178C0C7-8EA8-458F-8060-E49E500A666F}\\NodeIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\PackageCode = "EB52C13E41F353E4F89365E222AB3847"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\npm	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\Version = "403832832"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\corepack	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\7C0C87168AE8F85408064EE905A066F6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C0C87168AE8F85408064EE905A066F6\DocumentationShortcuts	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C0C87168AE8F85408064EE905A066F6\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	msiexec.exe
3124	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	3124	msiexec.exe
Token: SeCreateTokenPrivilege	2036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2036	msiexec.exe
Token: SeLockMemoryPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeMachineAccountPrivilege	2036	msiexec.exe
Token: SeTcbPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeLoadDriverPrivilege	2036	msiexec.exe
Token: SeSystemProfilePrivilege	2036	msiexec.exe
Token: SeSystemtimePrivilege	2036	msiexec.exe
Token: SeProfSingleProcessPrivilege	2036	msiexec.exe
Token: SeIncBasePriorityPrivilege	2036	msiexec.exe
Token: SeCreatePagefilePrivilege	2036	msiexec.exe
Token: SeCreatePermanentPrivilege	2036	msiexec.exe
Token: SeBackupPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeDebugPrivilege	2036	msiexec.exe
Token: SeAuditPrivilege	2036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2036	msiexec.exe
Token: SeChangeNotifyPrivilege	2036	msiexec.exe
Token: SeRemoteShutdownPrivilege	2036	msiexec.exe
Token: SeUndockPrivilege	2036	msiexec.exe
Token: SeSyncAgentPrivilege	2036	msiexec.exe
Token: SeEnableDelegationPrivilege	2036	msiexec.exe
Token: SeManageVolumePrivilege	2036	msiexec.exe
Token: SeImpersonatePrivilege	2036	msiexec.exe
Token: SeCreateGlobalPrivilege	2036	msiexec.exe
Token: SeCreateTokenPrivilege	2036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2036	msiexec.exe
Token: SeLockMemoryPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeMachineAccountPrivilege	2036	msiexec.exe
Token: SeTcbPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeLoadDriverPrivilege	2036	msiexec.exe
Token: SeSystemProfilePrivilege	2036	msiexec.exe
Token: SeSystemtimePrivilege	2036	msiexec.exe
Token: SeProfSingleProcessPrivilege	2036	msiexec.exe
Token: SeIncBasePriorityPrivilege	2036	msiexec.exe
Token: SeCreatePagefilePrivilege	2036	msiexec.exe
Token: SeCreatePermanentPrivilege	2036	msiexec.exe
Token: SeBackupPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeDebugPrivilege	2036	msiexec.exe
Token: SeAuditPrivilege	2036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2036	msiexec.exe
Token: SeChangeNotifyPrivilege	2036	msiexec.exe
Token: SeRemoteShutdownPrivilege	2036	msiexec.exe
Token: SeUndockPrivilege	2036	msiexec.exe
Token: SeSyncAgentPrivilege	2036	msiexec.exe
Token: SeEnableDelegationPrivilege	2036	msiexec.exe
Token: SeManageVolumePrivilege	2036	msiexec.exe
Token: SeImpersonatePrivilege	2036	msiexec.exe
Token: SeCreateGlobalPrivilege	2036	msiexec.exe
Token: SeCreateTokenPrivilege	2036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2036	msiexec.exe
Token: SeLockMemoryPrivilege	2036	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2036	msiexec.exe
2036	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 5112	3124	msiexec.exe	91
PID 3124 wrote to memory of 4356	3124	msiexec.exe	101
PID 3124 wrote to memory of 3984	3124	msiexec.exe	104
PID 3124 wrote to memory of 1736	3124	msiexec.exe	106
PID 3124 wrote to memory of 2584	3124	msiexec.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v24.18.0-x64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D53B7D5046EC4EBD12B7D6398E572135 C
  2⤵
  - Loads dropped DLL
  PID:5112
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4356
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 61DA979BFA49C368722A223D34BC0082
  2⤵
  - Loads dropped DLL
  PID:3984
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F639293367BDCC91EC0475E0186749B6 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 470EC9443F54764304BCA17D7E2F5FB6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b1a8.rbs

Path C:\Config.Msi\e58b1a8.rbs
Size 810KB
SHA256 73ea3b873868b69c4a6844cb7195f9084f7d74bbbf701cd288c4c5d723ea3a71
MD5 b5b010f1cd83efb4e2abf02ceb1617f5
SHA1 2e2791f79c9a4a4778a444e254fb111d2082cb19
SHA512 bfb2121b786fe1eeef4d3b4aa2e9e7a141b0d518b620b9b08efe8a425455e0f7bfad3b59707601361da78b72f7d8909b5e034069635e40cbd11f70340208a218
SSDEEP 12288:D/IIAjA+S59nDPNWMrhl9Kmf3pZ81c3TAT+erw27WHdwLGu38M0ovCx:TW6TACd27WH+BsM07
TLSH
T14D05B5556DB088EBE51A64BAF2817434AEEC5ECB3B05487D072DC3F9DF2E67081BA105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Size 168B
SHA256 08095c9a9bb7a5e1cc5cc715b1f5bc012285370c0643085f0985d30de2b1d4b5
MD5 3c49d25e95452c187a6532ee45a9cd84
SHA1 f1cce8fbc9a8bcd33ac821507f53c4f8a0f7d17a
SHA512 40f401cbb21ca4e772d33181fe7ed248cb32820ae1ce5e72865e92a7e56678851f9b16565725f84c241a7a61bcf92a74bd8102eaaa2a3a2108a11117562d45cd
TLSH
T109C0805D8609C55AD34105478061FC14EC5F79E60CDFC41D51E4DD4FDD45050C80559B
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js website.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Size 133B
SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
MD5 35b86e177ab52108bd9fed7425a9e34a
SHA1 76a1f47a10e3ab829f676838147875d75022c70c
SHA512 3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
TLSH
T1CEC09BAD49098155D3424547C071FC48DC4E79D14CDFD45D5294DD9F5D84091C854569
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 1KB
SHA256 d11cd407d984d1ebd95a43b721f4db05485b10c721d4ea9b5feb6901b7ee739f
MD5 106dec60cdaacfd4e455a7969855cd7e
SHA1 f4d83ac77014700dd9a1a95578364b502ae63379
SHA512 48de04ac0a8bc7f6a89885871641bfa88bb258ef43291a7ebb13c26be5444dd40921f8345dd641b58d71c70e48904587fc0bcd3ffd54d310e4ada8285d2f7a07
TLSH
T14231C9534DA93451BF8399229AC484AAF470DB6A2C70491E211BE7D8540DBC7BB1804D
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 8KB
SHA256 6e40af17e6ad9035fb293add8e2cd7f858d64fc8d0020f0b74e2d7e507b8ca9b
MD5 d0e4efa5c089378c01f178fcc0066337
SHA1 2cc01572637708bbed8bb6642b26f350117bf985
SHA512 665983f7541691e1b3105e26631b37761bb2468864b9d29e3961bff1889e39e7b11ec941448680866d3dbad18e05ff12052968d6163a31ba03b246a6a479a919
SSDEEP 192:qTRJUMyfZyfBk7Fuo2s/UQ8I67UX2c0uw:ql6MpJkZqn20uw
TLSH
T10E12FCBC6A49A59790C56971CAC7AFD3CCF251A13BC1E11F45752E880468FC3DE8B782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 345fe296fe947276fc22f3a6e971fc4dd6c54869e2b898e7d5311077976c6691
MD5 a199ec033f0a1077b0f84f20bff9e427
SHA1 b5b860f87cb16bf2b747ce1c9a24c2558c249468
SHA512 ef3436c0ec9ad536f39dff5b34634a95095c73c7655bbeef006523c2ec52564e8061ea891afa795df861e184b845b32dc76c67714c20e91e4e7c88a1d7e2fc7a
TLSH
T1A2014162A53CB24945410949AA38EDCA7AB4EFD40B10382F207B61181665F016A36144
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 2b2fc052a0f9381636208d62b7eed72bd7ef6939b0396b3d955be0c875438e56
MD5 5bfcb0c095257d7193fa6309bdd245ea
SHA1 ee1d1f39408210d80a2e1e1956a31d7b02ff90dc
SHA512 bf9d5f70404e96382c82911e9e4202cd90dd6a14e0e6973c10737966d1425094ac8849a4799782906d7b2325f3a3879617fc6e56e40f32d88c3fc2af50e94105
TLSH
T1DCE0681815FEC108E3B2AD3947CA953F093FF713040866A6B6501151A81AD018D31722
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 290B
SHA256 98e6556c761071fc21a9633ff129406c9b564b242441b983809434de1db6c8a1
MD5 c744745f7a1ee63e073a426221137cf5
SHA1 f71cea6c5cfe66951ba84084c1da32c4880d84c2
SHA512 e14ef99cee104332439ea2ca516dd322eec27716a63c963e6d3d2d9da434b9c2b2be617e5e73c2556c30602aa865eb55d380f6848b1a060174d6ce06767b9110
TLSH
T15DD05E18E3F40A12F0C5C77E9DD219236976B9258A0083480FB0D3047028D5AAA70717
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 712a9b07fce11022cacd699b7bdb23830d517f0dc2e4edc6e0bbda8fc3733dea
MD5 4f4999d761ac96c8ab28b5eac482a2ab
SHA1 dac9355c269807f55245dd0fd6bdc851ededd442
SHA512 5a70f930f590525b010dce420a01223eb2d81400d1454dac0c536c065c37aeaaec7cd96919f9672e51485cbb6a349e76c5c2f28b684655a138303fb7504410e6
TLSH
T1CEE0170CA7F50A22F181CA3E56E02A23B939AE618610834817F583087938993E930317
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4AB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4AB0.tmp
Size 142KB
SHA256 07acb65ce67366b92e12ea2fa5cb9883dd9fe4416898460a87d8f5ee103499b2
MD5 8f790bba5702525be37cce8f4364f7c0
SHA1 8c81a51451fe391dc6af856dcd9daa2691ce5e9e
SHA512 d34ed61028dcc24b0305f5daf8e329de5460bda58b6a81410176763fbab038e621ab03044301c71e21b0f53301d584622eea6cb7fc847e87ed6f8aa1d98f198b
SSDEEP 3072:WqrbMw7g/wrO6sMgpZEHinwCJkLDrSYfS/:3rIrdHEHiuf0
TLSH
T1C1E35B1BB3A500BBE1B78239C9670A45E772785117609BEF03A443662F273E49D3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4BBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4BBB.tmp
Size 390KB
SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
MD5 476928c3c78e75cef1c141de94922c63
SHA1 254e46ff1e15aec93356301ad15a1cdff9655f46
SHA512 c833eb6dc6d56ce06c5aaf0e1300d8d8b85bd87e76736a9d35dec8957140ab21ba86770c92932dba30abf53fd8218fb8cd95beb3f75cb1c4812e7d25d9d5f681
SSDEEP 6144:O3TAWENBGWFraHfbz27n/e6yHdb0lLGuyI8MMggT5:O3TAT+erw27WHdwLGu38M0N
TLSH
T18B846B29F7E418EDD5B68276C4A68534FF75748C3320D5AE47A8852D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFC52.tmp

Path C:\Windows\Installer\MSIFC52.tmp
Size 342KB
SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
MD5 8795eed320191d21091350b952553175
SHA1 fdb195742e9066789e46424499f9984e5d27ca4e
SHA512 33785b2bd3514476d5bbe55df699c0724426dc2db54dd668d9e6b2c5e142e489c76e6d9faf40fe9de2437672bdf00292c694c4e444f99ac5789c636531bc72b8
SSDEEP 6144:yJ7qjBiG9tQFTT4U/zwWr3FvdBlGJWrmUgMzyFGfORG:yJ7ogGYFTG81vdBPmUgM0mOw
TLSH
T1E2745B366456303BE6F90D32F528CB706D3DB61827D8959E83E0984E38245E36BF375A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b1a7.msi

Path C:\Windows\Installer\e58b1a7.msi
Size 31.4MB
SHA256 e30cd4ca15529583afe0efc978f1ae3ab3a93c2400c222d0752d17900552ebb3
MD5 fa57f4fc51dbeaaea61e4acf42e39018
SHA1 f22b6b5efd4690f6293b4de8fb4f0499e8ddb1ff
SHA512 44e659e1f90c25833821e8c3c2f05579f5375b60fd2d24af0e463eeeb936754094b8424e1e1a3ae009d5710e61d98cc69b99f3fd12ed1341a165941f6835b503
SSDEEP 786432:1T/P1kg7kWjJjibUmUgZmPOTcGIfc0aGB1P3B:N/P1kg7xJjiojsMVB1P
TLSH
T10F773322F6910A26D59AC131E073D364AF767D283710469E8774E05CFE362E06BFE74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 411e005a1300955d4af1a8e8fcccb38e4473584026773372d3ca4eb71cb42c54
MD5 7b798699c07454da421885b7fd131b8c
SHA1 6aa2a7c672d977337d7842db7a4de62af63f69ea
SHA512 0523196b9477ff790ed4ce019309e9e1b53217e7bd54531b29a326a4ab0153171ee3bb257809fbb726a803d44a0292d23058c2e82fff0e68686d2131461415bc
SSDEEP 24576:0u8m+1zxdoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:u
TLSH
T19347C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a58afaf9-a8b5-4e01-8e2c-951ab764c47d}_OnDiskSnapshotProp

Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a58afaf9-a8b5-4e01-8e2c-951ab764c47d}_OnDiskSnapshotProp
Size 6KB
SHA256 d56cd03af494c4631668aa9988eca208f9a2f5b51e71f37c9b956abe568cabc4
MD5 8921e1035a24445312a6a53b66587efe
SHA1 21a126f9889b5d2c604f39c316048e04e49b70c5
SHA512 368cdc23b920e3c825d03ef07c8585a4d76bbd8abe43eb05781879a64174202cae9cca4abc322fe757776fc165b3168be989a3027797aa847fb0110a7ce3b003
SSDEEP 96:FuDBc7snvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:MD5b++ZVm
TLSH
T1D0D19A085AF54311E2B3AB3229F54557A877B911EF33CB8E0298238E6670A14F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download