2557e8edfcfc1942afae895eb1c23374826da93cb8dd275d54547d1577b5e634

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
upgrade.msi
Size 4.3MB
Sample260731-blakvs1crc
SHA256 2557e8edfcfc1942afae895eb1c23374826da93cb8dd275d54547d1577b5e634
MD5 3d49fb93e7af614d1ab1859b58f645e5
SHA1 cbdf6c3e42a23d252f4f05d729eb73135c05f3ec
SHA512 73d81e11d52424212fb757498e1b9ae5e97dd70fc27208f2f8ab96b1bc4198f9f04244333a66cd38f26a9e85c4d9ac6de5afe01848235f3a874ed7f86d1b2382
SSDEEP 49152:+VXMo7olFqCa6Sog0rQLPkNlSB8jidDpdUUeCvS6cMr9Q10gQl1YyieVCC6z1eT9:akEPMiPdxwz1eq3c8g1OVp4D20FJm
TLSH
T1A126D01239FD8972DA5F0170A616BA26E61EE8E37F6248DFD3D4DC466B311C35231B82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
712	MSI429F.tmp
716	ApS.eXE
724	MSI4908.tmp
5920	HRMonitor.exe

Loads dropped DLL 11 IoCs

pid	Process
1080	MsiExec.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe
5920	HRMonitor.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFBF0B7D41D19E934E.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{66139A54-E4FA-4639-ADD9-BD32076D7113}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1AC72C58BD0E512D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI429F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e593be6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EB5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4908.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF712DCCD1A0553DD8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6E95D0EDEB153997.TMP	msiexec.exe
File created	C:\Windows\Installer\e593be6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1856	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI429F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApS.eXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI4908.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HRMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4860	msiexec.exe
4860	msiexec.exe
712	MSI429F.tmp
712	MSI429F.tmp

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1856	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeCreateTokenPrivilege	1856	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1856	msiexec.exe
Token: SeLockMemoryPrivilege	1856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1856	msiexec.exe
Token: SeMachineAccountPrivilege	1856	msiexec.exe
Token: SeTcbPrivilege	1856	msiexec.exe
Token: SeSecurityPrivilege	1856	msiexec.exe
Token: SeTakeOwnershipPrivilege	1856	msiexec.exe
Token: SeLoadDriverPrivilege	1856	msiexec.exe
Token: SeSystemProfilePrivilege	1856	msiexec.exe
Token: SeSystemtimePrivilege	1856	msiexec.exe
Token: SeProfSingleProcessPrivilege	1856	msiexec.exe
Token: SeIncBasePriorityPrivilege	1856	msiexec.exe
Token: SeCreatePagefilePrivilege	1856	msiexec.exe
Token: SeCreatePermanentPrivilege	1856	msiexec.exe
Token: SeBackupPrivilege	1856	msiexec.exe
Token: SeRestorePrivilege	1856	msiexec.exe
Token: SeShutdownPrivilege	1856	msiexec.exe
Token: SeDebugPrivilege	1856	msiexec.exe
Token: SeAuditPrivilege	1856	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1856	msiexec.exe
Token: SeChangeNotifyPrivilege	1856	msiexec.exe
Token: SeRemoteShutdownPrivilege	1856	msiexec.exe
Token: SeUndockPrivilege	1856	msiexec.exe
Token: SeSyncAgentPrivilege	1856	msiexec.exe
Token: SeEnableDelegationPrivilege	1856	msiexec.exe
Token: SeManageVolumePrivilege	1856	msiexec.exe
Token: SeImpersonatePrivilege	1856	msiexec.exe
Token: SeCreateGlobalPrivilege	1856	msiexec.exe
Token: SeBackupPrivilege	4108	vssvc.exe
Token: SeRestorePrivilege	4108	vssvc.exe
Token: SeAuditPrivilege	4108	vssvc.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	716	ApS.eXE
Token: 35	716	ApS.eXE
Token: SeSecurityPrivilege	716	ApS.eXE
Token: SeSecurityPrivilege	716	ApS.eXE
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	1260	srtasks.exe
Token: SeRestorePrivilege	1260	srtasks.exe
Token: SeSecurityPrivilege	1260	srtasks.exe
Token: SeTakeOwnershipPrivilege	1260	srtasks.exe
Token: SeBackupPrivilege	1260	srtasks.exe
Token: SeRestorePrivilege	1260	srtasks.exe
Token: SeSecurityPrivilege	1260	srtasks.exe
Token: SeTakeOwnershipPrivilege	1260	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1856	msiexec.exe
1856	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1856	msiexec.exe
4860	msiexec.exe
1080	MsiExec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1260	4860	msiexec.exe	94
PID 4860 wrote to memory of 1080	4860	msiexec.exe	96
PID 4860 wrote to memory of 712	4860	msiexec.exe	97
PID 4860 wrote to memory of 724	4860	msiexec.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\upgrade.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6758F7FD1A26EEF2954305A2E7AEF7DA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1080
- C:\Windows\Installer\MSI429F.tmp
  "C:\Windows\Installer\MSI429F.tmp" /HideWindow /dir "C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\" "C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\ApS.eXE" x "C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116.7z" -p1217242026 -o"C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\" -y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:712
- C:\Windows\Installer\MSI4908.tmp
  "C:\Windows\Installer\MSI4908.tmp" /DontWait /HideWindow "C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\\TMP116\HRMonitor.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\ApS.eXE
"C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\ApS.eXE" x "C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116.7z" -p1217242026 -o"C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\" -y
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\HRMonitor.exe
"C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\HRMonitor.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593be9.rbs

Path C:\Config.Msi\e593be9.rbs
Size 1KB
SHA256 dba95d0d77d1ea89a32ea06d1410336fd1e3169ca79b90c732a7db8a215ab8f9
MD5 7b953486ef64b833dcd81889afdf7303
SHA1 fc16765d0ebfbcffedc3b484759c0f29d607a59a
SHA512 a22bf3dd2eb0d5959919453da11e9690ca28eab9c547c926fa2f0a446837f7518fe1286375279a4b53f52f6008e724324b0d4e66f63a563622c243ce17dda7db
TLSH
T14C317D936759C7FAE549C73F3B71391A0866A120E648152BE99678982EEA0F8CDC7081
MD5 SHA1 SHA512 TLSH

Submit Download

ApS.eXE

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\ApS.eXE
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TMP116.7z

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116.7z
Size 2.0MB
SHA256 1de82a013ba0ddbcab8bc57ef447727789395833607d1c75f17c7fe8e0d4b2a4
MD5 36cf6776ca71e8000c2bf9304d082411
SHA1 22a419f01df04af98f891e8666dbacae51223d76
SHA512 b678ed467f549143cca9a3320ef42130025f9aa6d2b76129fd3b53e0a711264bde2f1638c6f5bce4e25c9fa5ac4b55ef93e40bcd093859bdbb94feb85dc1332a
SSDEEP 49152:u1wAgM0rl7K0upQPC7HpIlEFwfXMX9hZuWQ+cb:u1JgMOup/DaWF1Jm
TLSH
T1EDA533CA859F41DDAF960CA9395197B7008FC10E7522EDED0C983FA596403F4B2A77B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashHandler.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\CrashHandler.dll
Size 320KB
SHA256 d5f6777d3c60f80cafc5435ffcfe73105fddb942770c80829eff0171c56ceade
MD5 abecce2be7ffee14db79a9d0ffe9a2f8
SHA1 81efddcc2dfed94426dcc147c801ef8e986e5e4c
SHA512 6d7c85092a7002455d781060e069d8e756d0f9aa1c2e6f6b10cd215de7cea34f6bbc5f5dbac35e549d60d22fa67917f3265cda20975b7ae01710dd33ad78038e
SSDEEP 6144:uUdfGFb5VdDLJiPzoA9agRgekpOBjajoya89KWlXSl:uUE33iPR9afRmw4
TLSH
T1B4643815B6C1E414E1AF04787B25CFF85879783067A8E8877BC1BB8A1C716C68A35F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HRMonitor.exe

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\HRMonitor.exe
Size 2.4MB
SHA256 75077cd6ca03d2c106efc58f6323811eccb6c3dfe58d8150a14801a508549365
MD5 bb0ab331617c6ffc835453a8d68327a4
SHA1 c43f66d47ed418e9d57e185ec16af89748a634fa
SHA512 e53ddd6fd2e456b8f4dae53a0dcc459e715f3142868499cb05a8938b346de74df06eaba41ff25611ded1f0a481d9a87e436fc8b288ddff45d7f6236275828989
SSDEEP 49152:QBkc8erMXd/pA0SfKIh+tAkvbHXf+iRGMKDPxmZStPPDhkB4NWFLqIOQ+lHJ:QBvQoCXfPRKDQ4dDh//
TLSH
T1BAC5BF22BA8685B2D5DA02B4E417533F493A6F101B34C5CF97A03D25BF382D3A63A7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HipsDB.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\HipsDB.dll
Size 386KB
SHA256 af3cb2b733fc1311113141ffd440b0ba3c000ddfdaa9ab35be440d8cd3511936
MD5 6bdd794bbef66725c5873165ec0b1c70
SHA1 81fdb5ead5c5ea94037f7f315e7aea29de67224b
SHA512 eb99a44afcb0f84c2937008bfaaa740d644b6fe1d8985c6237f78386f5eed99e738d61f7162ed7f230f29e7ec3db0193504757d1c4f3dd432651c0730e51a392
SSDEEP 12288:9uBs2KHeo1xFS/2Aa1IbJrT8EDLuaFCM6:9utm1xy2AM0JrTNDLuaFD6
TLSH
T1F5847C01B781C136F8DE143478A4AAA3147EAA106BE385D76FB41D997C723C32F39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\LOG
Size 9KB
SHA256 de0a4fe3c6f7f960b75e88335ea0465f9135f9a14d45a917ee5970dcf42c018f
MD5 2819a293ff06cb750a1633482c8b8430
SHA1 2b30e8ba6a97847d93e3ec607835fde683a00b81
SHA512 c31be0e1ad645bc72785ad6216728a14dfc63cbc30b4030d8a396f0d432650fda6f6320f0c78cf5ffdddb259ed38dfdfbe0eb2e40a11b3693336e53a92724b65
SSDEEP 192:bJyrMES75bioKkEO8XRNrca9XC6x2E//j1keUYPmhw3Bhhk1Ymk9EAkQ:975mPkp8XLJdHpHjaeUYPmgTxVzkQ
TLSH
T173129F92BB1071CF436011192B2BCB1891D3839D6CDAA14975ECD36A65ABF150D64B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hrcomm.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\hrcomm.dll
Size 149KB
SHA256 9652b8233ba2ceb2b004d9b0aa973fd3da4ec63463e7910927c1b60ab7c88620
MD5 884e60ea8f37bd0dab26e34ac966533d
SHA1 3455fb0785e0481d61d8387ba3d6034486515947
SHA512 3f5c2843519259515aab9a1e67ba5ba700bf4f41f36e0e00d269eb11a7ffe205734950fda8fcfdb189b3f64a64dc822e1227a2e9b6004243d5e84f2f4ca36ab0
SSDEEP 3072:ImNvpFLB+Oy2lsxLo+dQv7IbMTwaiFUJQRtfNr1UM:ImNvpH+ONWo+dQmFaOr1h
TLSH
T136E38C02B980D071D4FE093C5968CB265B7FB9B0DF6088D767640AB94FB42C16F39A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jansson.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\jansson.dll
Size 166KB
SHA256 5ab560ba25605087f7a449527ad5b7a3686e1f9fca1abb0a1a7612f57cd89df2
MD5 b9aa59335a89da801ffad1af8c9b2cb3
SHA1 3a07b8bc314b024321b5a6a49ac3d57bb4568885
SHA512 58eb12fa8627a870cae63b4dd06017dc5ff196b6e003c1c3239799cc304d838dc1d82dd9451477d18bf561254b7c3c130d374d02c0bc9cfb8faa38c0bf62ddb5
SSDEEP 3072:o7bg1ffgZieuVR+NimnGIgLiEkZCbecC71cxQWkFogNpFx:ofg1ggrYhGzmE6SED/pFx
TLSH
T120F39E11B880D835D8BF1D3801B8C6720E7D3530AB6599DBA38459799FB01D1BF3AA7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcobra.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\libcobra.dll
Size 186KB
SHA256 b3734697e9634f6fbe6ed6a20bd5b179bf97a83845dc2c980c220bc8d431c73c
MD5 4300b9ac4bff3f0b8989f928d4575bc7
SHA1 b48b9a8d1ecf607a5e912c5e1d892f0a807e94fd
SHA512 79891640b29aeba4a4c9e91cdf24886484c9c1210aaa46cfb36abe93e8d965cf54d892a0351419c4b08ba72df0066ba1125671374f945e524acdccc3224c57c3
SSDEEP 3072:jGDh9HOQHaYEtqcQlF0v9TQC2mCvJzf5LUnn4EeoFwpSmJoT7RQV0+b2WWWh4Mqa:2F3aBtq1lFpVxu47IwUmgWmcmAz
TLSH
T1C8149E11F880C436D9BF1D3452FAC6B24E7CA6301F7889DBA38459355F601D2B73AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxsse.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\libxsse.dll
Size 1.2MB
SHA256 33a9e6e0f3a8a1e8e76f4549d089c1c02190c6c9c2bef5fb9d8bc7623009d4cf
MD5 ae777b978e97a9a325250087d2036d41
SHA1 f7fdf64c578a5774f3224d4a2b26449acdfea84d
SHA512 d857a316aad064170525d643408d79909f1870d55218a1c2c4e3012339465fb47b967f5ea24a818fbb398b5a1c07163274a07fa19caefbc24228cc1a24849cd1
SSDEEP 24576:gpNyrhgzQGGjPPHEsbg1j765QwmS1e6AGKIu0pmzvgua6UINvSz:gzyV9Qwu0u0bua6UINvSz
TLSH
T187456C23F9428073E4B4153096FB576B39BE9660876185CB6B88343DAD613D22F35FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logger.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\logger.dll
Size 168KB
SHA256 265a8dda15610bb468fe14b144be3e6179bf1aeb185d590d59c3e7b76f8982c2
MD5 eab4750611eeaf4ecaa4455dbad0b1f7
SHA1 b7ce8e097ea651ff183316f0668a2d46c44ee8e1
SHA512 671e7040fb1c7d1defbb735f5212986b70194f193041c781f24fb90bb51bb21f90221e9baa2b306b2d0f3e9427c29bb85a5b94bfa32f126793594245f53ddb47
SSDEEP 3072:VM3VT5y7lk5F5vtMxM3fBImXosU30WkFUu9U58yshNEuyVUZeNeMn:VM3V+lk5FPMKPrXosQnoU/eRdLMn
TLSH
T148F39D117480C872D57F1D380874CB725B3EB9209FB59ACB63985A398F601C1AF79A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\sqlite.dll
Size 905KB
SHA256 f323c011bae2a141ad31e9d494028fd9b201e1f976b2c4d48ca82790c5d7d9d4
MD5 d437537d5a704a3738034fcd4f24e06a
SHA1 b528920b03eb6ee17b1e826de6659d235d1187b5
SHA512 1f02bb2c21e8ea8b60b9ba84a8c3d291b92f6a05d533885a9c492a09508a8a40cd458e407566dd5f6ad772c7c669722a6132cb76d2e647ed1a0f72d8707ccd99
SSDEEP 24576:i3OvJkNJoVRuYf8dWDJdcjQBn1ZClpjQoFFcPk/:vkP16nskYFcm
TLSH
T14C159E22FA8280B1FDDA01F652FF5BFB5C782206472998D7B1C818A55F601E3723F656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uactmon.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\uactmon.dll
Size 189KB
SHA256 29d050a8eeb321ac2a82fa34056eed9eef609518aa2b6fd2a73ac9f4f19ed1c4
MD5 6fe5f50652ecc4eff350f9f9180f5112
SHA1 1409aa339a5ef457e0f97bd02e03f64cb02fd2e6
SHA512 a43a77844dbfd5d745282510ab1e31d1a62bd72fc4662d20409f0bf1b21e976a90ad8300acf3ee7af87202ca3afa122be72dbb06f0a4758f00281c09e27e1a0d
SSDEEP 3072:+hm5vWATm1y4mFkvJnEtilOMGX7Tpk5jZqhdUkonih:ZJdWmFysilsX7Tlh
TLSH
T188147D11F4808473D53B193456FAA6E28B7D78300B699ACF63984C6A4FB81D1F738B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usysdiag.dll

Path C:\Users\Admin\AppData\Roaming\ControlMesh Technologies B.V\ControlMesh Remote Admin\ControlMesh\TMP116\usysdiag.dll
Size 359KB
SHA256 651ae123e5d362e4c141caea427cdef2c5ec613ec6be403c4902876e4daeb729
MD5 bbfb483046de991e9fda9379db37cbbc
SHA1 42552968cef95fac29cf237e4e580fe3ba59d5e8
SHA512 20b1bb225615e7f61fdc5b9a17923cb22ada8f97db9b7e60f1a79343e0228e77886ccdbf8676b31bbab75e8c8d8cd5f252fcb11f803b0294f4ab5ec95e67812c
SSDEEP 6144:GzQIuhY7fezjNFHS13+qXVzac/G1SJ0/vvmXmOYTSDGi2EtL4XHWOShYtUWHInd8:GzQIuhY7fezjNFHS13+qXVeaJqv+XmVn
TLSH
T1C1748E11F881D032E5FA04342279DB72187C7A3067E498DBB7E409AE5EB42D1B739B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3EB5.tmp

Path C:\Windows\Installer\MSI3EB5.tmp
Size 1.2MB
SHA256 0c6cca44745499e6c642efaff90ae3ccc4a24498d34e312d81ff0c9cb2f60f2f
MD5 d21122a4373b24e450a6a8616cba7e90
SHA1 77c1eb5355705f8590e5c1d6f06851551cae4588
SHA512 0afb23982a46dbeddf03e8c652cd9d069caca9ba9a23ce2538167a4be86dfa9f3a4377e6c8e8f2fe3e9ea843904bf7796c40bf64d5f4eb4fb6ccbc52912601e5
SSDEEP 24576:MtnEC2iQQhw+S57za0CSHeWPkNlSB8jidDpO2UUeCvS6cMr9Q10gQl1YyieVCCl:irQLPkNlSB8jidDpdUUeCvS6cMr9Q10x
TLSH
T16445F81238FC5972EB1F0574A6167A26EA5EA9D3BF6208DFC2E4DC4627315C35231F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI429F.tmp

Path C:\Windows\Installer\MSI429F.tmp
Size 437KB
SHA256 9600a99a4b058aff17c30eb551dc21fa6e0c83ec787fa007f0c7f0752471804d
MD5 0e23781d610515f490d2d2c1e800eeed
SHA1 61ea46d5a8d4a4091fa0cb42ebc9570e736b59a8
SHA512 05d4b4ef02eda33ca6dae7cfc367ef3c7ffcdf765c0bf8b04393d924428d3c996f8d1d34089ca4c4aceb4a908146e0fb25b6083805d085648e5604cb46765fb9
SSDEEP 6144:XNWUD7nAzPDRKoecpro7olFgOxO7I024Q8ekajj4aafmbxobBOKE1SVVPA5FS:DnAzqKo7olFvY7I02Ye5anBkSzo5FS
TLSH
T1D8949D2179A2C037CDB241B04EBADB5A553DFDB00F61A8C7B7D42DAA59309C19B36B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 416532ac1c3e64943e4ee5e779b3e1a40508b80ecff9a044a9adb4b670f37030
MD5 e317a3ae113c8aa6340678dab04ed82f
SHA1 7ed3afd1850034e16683f94c3f5ad1ac9a768c75
SHA512 0ac48a211ff83a9c0bc7230d4775b8f3c7487a5f45ddef0247449f8b7c7ecb8f9a289a748730ad17582cb3b53500a961bb28b270df32a505e918f1085b54f463
SSDEEP 24576:jFo3DMPUdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:WH0
TLSH
T15E57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{68b2f017-c6ef-4d4f-b935-78dab863e8f8}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{68b2f017-c6ef-4d4f-b935-78dab863e8f8}_OnDiskSnapshotProp
Size 6KB
SHA256 029f4f254487e1012ac7bb98eb43a8cd9cdf7c95aabdc648891a1675621b0d67
MD5 82c2384410ffaf528a714c28592e9c39
SHA1 393682233d1b7de3f2082f87acc3b68874a60efb
SHA512 0f30332b2f46148389fdf474a70461a84497a45233359408d38d9698c5fe7a4dfe269a03fd8c6eb3e30d084ff174ec915bb55ce47b1ddbe3fb702278730d41a5
SSDEEP 96:FDwfW5mKlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:dtfl/b++uVmN
TLSH
T1A5D178081AF54711E2B3AB7129F18557A877B911EF33CB8E0298238E6671910F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download