7a8eb344adaf1d1eb6834060d7ed5e4853f822a285d8b8e20d9ccb037c2a498d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ogulniega.Minecraft_0.0.8_x64_en-US.msi
Size 7.3MB
Sample260805-sam59aam6z
SHA256 7a8eb344adaf1d1eb6834060d7ed5e4853f822a285d8b8e20d9ccb037c2a498d
MD5 7a26ae0ea9c394daf51f0dc9bb301127
SHA1 bf5d84c8c3a3c8ab43a343b078c4c73095b61ddf
SHA512 33c2d1b5e55731082096b6975a1f52e47325da11b12848de1ce9a2cb7d07df8526b305864433edabdb9f5ed3f6e871d4fffdc5a3327d67dce83efebdb496d5b5
SSDEEP 196608:wzBHPjgUwzBUCtKko+33XYwqKPDTMOSx8V:MBHbwtMkoAIwqKPvdS2
TLSH
T168763359B9084932E4A92835161F6F018B747DF467A87EA38738B30D3F743E195B34EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4860	Ogulniega Minecraft.exe

Loads dropped DLL 1 IoCs

pid	Process
2460	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ogulniega Minecraft.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Ogulniega Minecraft\Uninstall Ogulniega Minecraft.lnk	msiexec.exe
File created	C:\Program Files\Ogulniega Minecraft\Ogulniega Minecraft.exe	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59e9aa.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{3B8E38E2-51F0-461A-AA92-9550B87197CB}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59e9ac.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDC6D08EC216215A4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B8E38E2-51F0-461A-AA92-9550B87197CB}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86EDFE03BDCDFA49.TMP	msiexec.exe
File created	C:\Windows\Installer\{3B8E38E2-51F0-461A-AA92-9550B87197CB}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE244283633B1154.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF009157EA18BB0B98.TMP	msiexec.exe
File created	C:\Windows\Installer\e59e9aa.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5268	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2E83E8B30F15A164AA2959058B1779BC\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\Version = "8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\ProductIcon = "C:\\Windows\\Installer\\{3B8E38E2-51F0-461A-AA92-9550B87197CB}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1EE3A6EAA1F1CFD50857396B4ACB2C7F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1EE3A6EAA1F1CFD50857396B4ACB2C7F\2E83E8B30F15A164AA2959058B1779BC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2E83E8B30F15A164AA2959058B1779BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\PackageCode = "E87A29923DA829A4DA93DF955FF18B24"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2E83E8B30F15A164AA2959058B1779BC\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\ProductName = "Ogulniega Minecraft"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2E83E8B30F15A164AA2959058B1779BC\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList\PackageName = "Ogulniega.Minecraft_0.0.8_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E83E8B30F15A164AA2959058B1779BC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2E83E8B30F15A164AA2959058B1779BC\ShortcutsFeature = "MainProgram"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4736	msiexec.exe
4736	msiexec.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe
4860	Ogulniega Minecraft.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4452	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5268	msiexec.exe
Token: SeSecurityPrivilege	4736	msiexec.exe
Token: SeCreateTokenPrivilege	5268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5268	msiexec.exe
Token: SeLockMemoryPrivilege	5268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5268	msiexec.exe
Token: SeMachineAccountPrivilege	5268	msiexec.exe
Token: SeTcbPrivilege	5268	msiexec.exe
Token: SeSecurityPrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeLoadDriverPrivilege	5268	msiexec.exe
Token: SeSystemProfilePrivilege	5268	msiexec.exe
Token: SeSystemtimePrivilege	5268	msiexec.exe
Token: SeProfSingleProcessPrivilege	5268	msiexec.exe
Token: SeIncBasePriorityPrivilege	5268	msiexec.exe
Token: SeCreatePagefilePrivilege	5268	msiexec.exe
Token: SeCreatePermanentPrivilege	5268	msiexec.exe
Token: SeBackupPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeShutdownPrivilege	5268	msiexec.exe
Token: SeDebugPrivilege	5268	msiexec.exe
Token: SeAuditPrivilege	5268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5268	msiexec.exe
Token: SeChangeNotifyPrivilege	5268	msiexec.exe
Token: SeRemoteShutdownPrivilege	5268	msiexec.exe
Token: SeUndockPrivilege	5268	msiexec.exe
Token: SeSyncAgentPrivilege	5268	msiexec.exe
Token: SeEnableDelegationPrivilege	5268	msiexec.exe
Token: SeManageVolumePrivilege	5268	msiexec.exe
Token: SeImpersonatePrivilege	5268	msiexec.exe
Token: SeCreateGlobalPrivilege	5268	msiexec.exe
Token: SeCreateTokenPrivilege	5268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5268	msiexec.exe
Token: SeLockMemoryPrivilege	5268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5268	msiexec.exe
Token: SeMachineAccountPrivilege	5268	msiexec.exe
Token: SeTcbPrivilege	5268	msiexec.exe
Token: SeSecurityPrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeLoadDriverPrivilege	5268	msiexec.exe
Token: SeSystemProfilePrivilege	5268	msiexec.exe
Token: SeSystemtimePrivilege	5268	msiexec.exe
Token: SeProfSingleProcessPrivilege	5268	msiexec.exe
Token: SeIncBasePriorityPrivilege	5268	msiexec.exe
Token: SeCreatePagefilePrivilege	5268	msiexec.exe
Token: SeCreatePermanentPrivilege	5268	msiexec.exe
Token: SeBackupPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeShutdownPrivilege	5268	msiexec.exe
Token: SeDebugPrivilege	5268	msiexec.exe
Token: SeAuditPrivilege	5268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5268	msiexec.exe
Token: SeChangeNotifyPrivilege	5268	msiexec.exe
Token: SeRemoteShutdownPrivilege	5268	msiexec.exe
Token: SeUndockPrivilege	5268	msiexec.exe
Token: SeSyncAgentPrivilege	5268	msiexec.exe
Token: SeEnableDelegationPrivilege	5268	msiexec.exe
Token: SeManageVolumePrivilege	5268	msiexec.exe
Token: SeImpersonatePrivilege	5268	msiexec.exe
Token: SeCreateGlobalPrivilege	5268	msiexec.exe
Token: SeCreateTokenPrivilege	5268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5268	msiexec.exe
Token: SeLockMemoryPrivilege	5268	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5268	msiexec.exe
5268	msiexec.exe
4860	Ogulniega Minecraft.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5268	msiexec.exe
4736	msiexec.exe
2460	MsiExec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2460	4736	msiexec.exe	90
PID 4736 wrote to memory of 1248	4736	msiexec.exe	96
PID 5268 wrote to memory of 4860	5268	msiexec.exe	99
PID 4860 wrote to memory of 4452	4860	Ogulniega Minecraft.exe	100
PID 4452 wrote to memory of 1488	4452	msedgewebview2.exe	101
PID 4452 wrote to memory of 4048	4452	msedgewebview2.exe	102
PID 4452 wrote to memory of 4048	4452	msedgewebview2.exe	102
PID 4452 wrote to memory of 4048	4452	msedgewebview2.exe	102
PID 4452 wrote to memory of 4048	4452	msedgewebview2.exe	102
PID 4452 wrote to memory of 4728	4452	msedgewebview2.exe	103
PID 4452 wrote to memory of 4656	4452	msedgewebview2.exe	104
PID 4452 wrote to memory of 4656	4452	msedgewebview2.exe	104
PID 4452 wrote to memory of 4656	4452	msedgewebview2.exe	104
PID 4452 wrote to memory of 1228	4452	msedgewebview2.exe	105
PID 4452 wrote to memory of 1228	4452	msedgewebview2.exe	105
PID 4452 wrote to memory of 1228	4452	msedgewebview2.exe	105
PID 4452 wrote to memory of 1228	4452	msedgewebview2.exe	105
PID 4452 wrote to memory of 1228	4452	msedgewebview2.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Ogulniega.Minecraft_0.0.8_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Program Files\Ogulniega Minecraft\Ogulniega Minecraft.exe
  "C:\Program Files\Ogulniega Minecraft\Ogulniega Minecraft.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Ogulniega Minecraft.exe" --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4860.5444.3194849528340861889 /pfhostedapp:606e0854d16556e2f66a0fb7865ced1f5d313a4a
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView /prefetch:4 /pfhostedapp:606e0854d16556e2f66a0fb7865ced1f5d313a4a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff26105fd8,0x7fff26105fe4,0x7fff26105ff0
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView" --webview-exe-name="Ogulniega Minecraft.exe" --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,9046532631605560402,2662080991201705174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:606e0854d16556e2f66a0fb7865ced1f5d313a4a
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView" --webview-exe-name="Ogulniega Minecraft.exe" --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1956 --field-trial-handle=1776,i,9046532631605560402,2662080991201705174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:606e0854d16556e2f66a0fb7865ced1f5d313a4a
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView" --webview-exe-name="Ogulniega Minecraft.exe" --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1776,i,9046532631605560402,2662080991201705174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:606e0854d16556e2f66a0fb7865ced1f5d313a4a
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView" --webview-exe-name="Ogulniega Minecraft.exe" --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3288 --field-trial-handle=1776,i,9046532631605560402,2662080991201705174,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:606e0854d16556e2f66a0fb7865ced1f5d313a4a /prefetch:1
      4⤵
      PID:1228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 757989EDFA20D55BD99AA71BF9B4AA86 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2460
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e9ab.rbs

Path C:\Config.Msi\e59e9ab.rbs
Size 10KB
SHA256 362e406d8baa84158e026de7ae9d119215ae404127e936b2c229631d884814ee
MD5 99bc8489203093bbbc9d0794dae0778f
SHA1 683e2f68d15a0fdb2c705dfe824be9c84d1f9f1f
SHA512 14b9ae155cbc30a8abcdb7ab6973e5ab0aea7bd52a1c2d0e66aeafa9cc115786ac8be2e6e2eec522666974565bc6d7d095a2df0d33b4d50b61a03e8690a1bce0
SSDEEP 192:b+CFwB2Y4lVCKpRmGsRmU7FLDWDiKm4YpTL:bz+2Y4lvR6RPKmd
TLSH
T1E6220306AE1186E3F9876B39D71717103BB2E2ED6348534B05CC66BC2F42BC51FAD18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogulniega Minecraft.exe

Path C:\Program Files\Ogulniega Minecraft\Ogulniega Minecraft.exe
Size 19.7MB
SHA256 aa1ab1ece024c3cb912d2f178180ccf61c8b40d844964d6eb665f598c4f84d88
MD5 c95ed0631cdfbf60943f9487e5e2558b
SHA1 68f77de20b2aeb2316ab68d119fb959b6b9bb68e
SHA512 579438f89bc93c500b497ca475563356e920b1a25af953c1334f73c2d6b2629a0059426197dde316197617644f6ed6511031c59dee7eccb973adbf989bd6dd29
SSDEEP 196608:LWf3vNDw8tHau/xggCmLMCsVMc065Yt54hL:ynNDSulIx2tSh
TLSH
T13C2708217B5A99ACD05AC47483478A724A7130CB0B35B9FF44D896383F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogulniega Minecraft.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ogulniega Minecraft\Ogulniega Minecraft.lnk
Size 2KB
SHA256 2d1fe2775e50b44471b5efcc809f27e2613cedd63285068c7d12eb3ee1ca2328
MD5 b39543cdb783a76ba41ec2412888a758
SHA1 b8de645ca3688bd6b3e75b54d3eea794c571753f
SHA512 d0c1441daa76eb0a135aabb2b0ac5088866245f5b7719ee1507fc3fa2641ea118f9e4125af2a5bd1ec17fed3a5bc045b8545678eb6ab9009713f9917cfc91b20
TLSH
T11341AF549BD41799F3F7533E2EB10B11AE33FC02A9698FAF415142CA1AB64019978F3E
MD5 SHA1 SHA512 TLSH

Submit Download

Ogulniega Minecraft.lnk~RFe59f071.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ogulniega Minecraft\Ogulniega Minecraft.lnk~RFe59f071.TMP
Size 2KB
SHA256 52ebc0bee97e995c9b272eb3e45f91071aea1417c560936874042b22d3b5e20e
MD5 bbbb73e2b3fdc9ab43fc870c3e020ea9
SHA1 7c1e25195ed4d3ccb217ad75348a41955a7a4d53
SHA512 0ef75d63e1e1c854c251ba51d91ee75243d09f868bf50baeec8563ec5bb1d7ba793631b262281f8cae1905a0a2cf25ce020e2d1b42dc8afd0bf1ce702634c4b2
TLSH
T139419C545BE01799F3F7533E2EB20A10AE32FC02A9658FAB415243CA1AB25019975F3E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8469.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8469.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5e5372e94fbf73e9959dbd4a8bf0df57502559c445ecfe240bcfc458fc1f30cf
MD5 4c9314ab52a5ed3bc791cf857595bff0
SHA1 65b563b1e575ce444faafe47f6fbc53ddbfba1af
SHA512 a246b458ead8e2528c1783c5784f2a94acc760a239e24790d302805469e5ae6654b1d6da5f85e7afc5743e23960e019da0b1f947f5275b5a14d0b4c99d447e9e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5c199cb101a60e9df2dd074704f0dce915f54d1f25eaa736f0cc1156511bfdd2
MD5 39faca1c942256e6db9137cabfcd73a2
SHA1 eb7cd0d4b1cd68678fff0a9505a29c5714eaa00b
SHA512 11684448b011267345d0634295e7de16deb337cd0a5d81d48a0ee877bb6fd70b08fcfe92f3d3ab422aa818ee89511e14490e318200886477e5eaccf02e27e739
TLSH
T167D02233B3028338C82030332083F28C2800C20F800E8282F83CCBBE2F0C0A00E23882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 beab2e3233ebf9fc9d36ee478d1b096cab4081a9e386bc9101a694bf3be512dc
MD5 faebb547c658785f0d088306aa70c9f6
SHA1 c2cc518d8affdfe29fde7cec4d5bf19d499427bc
SHA512 46062dd1cbe586a646cee2a99ebc2aa4f16c6c0d0e72699b10e2f193ac3a3e03ff91fcb356863cc5bd6332e5eec4e6fac326f63bc46c8ddb265feb37b42d42cf
TLSH
T131D0126125008F40D33403B8F3EE12813434281201272DF489B263B1880F39633933E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5ce6.TMP

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a5ce6.TMP
Size 48B
SHA256 2012a60bcae9d6f0ab087fcc018a568240e8dbcb2eda8bed86afe6b357dbea5d
MD5 ded0d1067e85ddd2ce4d2e43ac8ad53b
SHA1 d058a47a11275d37967fd2ce5f1adfd4324ce6ba
SHA512 513d125a8cd291d28d3cb76c684caa355bf80a05feaf17a123874288712ce8ad088ec2b9507732cc8e58c33c66296b0912422cb1cf71b701536acf7a8323630f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b310f.TMP

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Network\Network Persistent State~RFe5b310f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b373566d-f275-4ce8-ab8a-0bce26ddcd6f.tmp

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Default\b373566d-f275-4ce8-ab8a-0bce26ddcd6f.tmp
Size 6KB
SHA256 0567ca2b2b1ec0c68e5011384bb94d649ac7bd0bef59a1169005266fae5627a1
MD5 326e4917bd43e24fe887ccb29be9a157
SHA1 a04908018213bab0f8ecff68762ebecc980ab66e
SHA512 4f133ff348d1e7b3100ea14321aee8fd6ff6790c0ba07f4726a974b5617ac1149ebad981fd5b1c9880dc0d1c87a0be781c11146476f75125574bead6129a58c1
SSDEEP 96:str/dM++pZpb9+kZo5h16Z0Os7/x+6MhmuecJky1ejeYK+g+j28XM1C7K:stzObS6onOsV+FdkyQj4IjG6K
TLSH
T1B9D1A7025E247DBB8CCAE119BB35BA13E2FA607174D11E68E7F9452C04DA6CD730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Local State
Size 15KB
SHA256 b6b49f6850baa2af414d32bda487af54dc482f32beb04ec875f0efe91d68bb32
MD5 8fb432330e6b67efdbf2bb128dbaaef1
SHA1 d94b1f39afd7ad500b801de502d4bb532b91b8c8
SHA512 04dc0d0e8d6623963a3139da09860fb8b65589a936d78a48b93bebba2a9bf09479488b3a7c8d64bf01e0c2b16981b103da6669927b8b39f3f035f871298e9da9
SSDEEP 384:J+aQikB+z/xvxjg/qhEmNBSgaA16dh899z/:0/UxvxjgC+vK6iF/
TLSH
T1F5729E2B98387E37D5FBE6147D591B5BCBBC94A290C26E784AFE5F1906873D81302812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Local State
Size 2KB
SHA256 0f5da63e581467367e8e7b8bedffc9afa5729dfc997024549a34e3afe6419460
MD5 8d2da225ee5004c0e4fd164ff5c45f02
SHA1 1a3c9007880ca941024f1c3b50c72c88d7c8762a
SHA512 a2bdce2e0fbbbf378d9809a36d2df73d0cbaf72516c0289dea79c2a5301c0a4bfbaa33487b3e6db6d41f2ae8b1ff3b75cea0e2a7446f1ab57dfa018de999eedb
TLSH
T17D51A5336824AB77C6EB4758BC4B3F26DE7991A1D6522F609ADE0B2801C715C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Local State
Size 3KB
SHA256 cbdcc6743864fe761670307f579b46087ca18b26b5753c33afe05599e45fe64f
MD5 0942dc57e443cc0f75637eba43ac4c62
SHA1 e8745d8bc1ecee9878f6934aab9cf4daf4ae0f3b
SHA512 cf1186724a1b54bcba230288e292bc0a9903c9fdc1e52cfc91719b450457c5bfee4f5c7c959b967c44ff0546a1539f818f51c78b57b1c8b5b694a5ee55861b8d
TLSH
T1C96187376974E93B8EE78A04B8863B16E7B55123D5813FA4D6ED0E1D01D729C2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a09b6.TMP

Path C:\Users\Admin\AppData\Local\xMelonekMaX\EBWebView\Local State~RFe5a09b6.TMP
Size 1KB
SHA256 819789627b78805cb774c58d435715c09f74c3d59e01d902bae19d3ac159990b
MD5 6aad1de0efba3761bfa58341c86a001c
SHA1 e357d9471519b71bb76235d9d81d122b45abef06
SHA512 a67094c682173875ef7dc9e78d3b71ae366b40ea586839119a41115d10edf3aad94b961fd245e341fb652c2409cf46b40f3490ea4bbdca5b085b7048b2dc4e5a
TLSH
T18E21B7B3D4209F32DDCB4345741B3A5BEE719172C2410E0462DF462902D619CA616C33
MD5 SHA1 SHA512 TLSH

Submit Download

e59e9aa.msi

Path C:\Windows\Installer\e59e9aa.msi
Size 7.3MB
SHA256 7a8eb344adaf1d1eb6834060d7ed5e4853f822a285d8b8e20d9ccb037c2a498d
MD5 7a26ae0ea9c394daf51f0dc9bb301127
SHA1 bf5d84c8c3a3c8ab43a343b078c4c73095b61ddf
SHA512 33c2d1b5e55731082096b6975a1f52e47325da11b12848de1ce9a2cb7d07df8526b305864433edabdb9f5ed3f6e871d4fffdc5a3327d67dce83efebdb496d5b5
SSDEEP 196608:wzBHPjgUwzBUCtKko+33XYwqKPDTMOSx8V:MBHbwtMkoAIwqKPvdS2
TLSH
T168763359B9084932E4A92835161F6F018B747DF467A87EA38738B30D3F743E195B34EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b3a3393cb25f504ff940aa26e75a17784f0cd501124b1290cb01022a2bba6809
MD5 bc23fc1d485e8333b1a83b2e80a5d251
SHA1 8cdb128045337c91af59c4799484e4a93dc86d50
SHA512 f233504fa06723ff5fcfaaf59908998605e0a04d594b88e131e4a225110054a2468d425a100cf0178e035460d9b6641f44717a5cd98fdbb3e1233dc10fd1c9b7
SSDEEP 24576:DFo3DMPZdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:rH4
TLSH
T17057B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{749d0ef2-56a9-4ef1-a39d-562fde91fcf4}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{749d0ef2-56a9-4ef1-a39d-562fde91fcf4}_OnDiskSnapshotProp
Size 6KB
SHA256 5acfc491facd433b7533b6d70ab13c5147b342fe64f3887c32f25312aea326c2
MD5 b839171aca4f22ec010f11c3ee434843
SHA1 5cada8bd5fe40bee4dca8283bc647e21de3e9e4c
SHA512 8f138ff4428137a2e9f065366e5be0c58a718706d087e71fbd1836a8938b30c860ef1632caaa1a46edae0958175bd46b910144fa5025c39e367b0bb830580f9c
SSDEEP 96:FsdW5mB0flDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:iQXl/b++uVm
TLSH
T1A8D189085AE54711E2B3AB3129F18557A877B811FF33CB8E0198238E6631910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-85-0x00007FFF49A70000-0x00007FFF49A71000-memory.dmp

Download

memory/4048-214-0x0000018A825A0000-0x0000018A826F9000-memory.dmp

Download

memory/4048-69-0x00007FFF49A70000-0x00007FFF49A71000-memory.dmp

Download