87af763c615245b837d35acffea498f73f59f28fb556c1c5731450a62be3b554

Analysis

max time kernel
37s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
put.msi
Size 5.8MB
Sample260828-wblwcs1fmd
SHA256 87af763c615245b837d35acffea498f73f59f28fb556c1c5731450a62be3b554
MD5 dcc074dad2d13e2818677d95887b5cf1
SHA1 3915005625ed007b3865c615a93827b0661b04c4
SHA512 ec47bd3ceabcf271295c152509a7f02e00bc4f2dfc94e94c8f2818a5dc48eb454d4d0d7f85efa6c633e243429f4e78373509b238a02fcb5614923336b97ce42d
SSDEEP 98304:36EEHAm3p4Lv1ri2VYcz5+vQVCAswB+3pEc/nLB3gks/s5kml6AliZAyIFkMezij:36Exm3ps1O5czowS/nLekRtkAlV/bez
TLSH
T14A5633B6B38DDB37DA0A2B355227C3E02B254C504BF391566514F6E90C35BF866FA8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6120	put.exe
3044	put.tmp

Loads dropped DLL 1 IoCs

pid	Process
3044	put.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001100000001c554-74.dat	upx
behavioral2/memory/4700-88-0x00007FFE29180000-0x00007FFE29538000-memory.dmp	upx
behavioral2/memory/4700-90-0x00007FFE29180000-0x00007FFE29538000-memory.dmp	upx
behavioral2/memory/4700-91-0x00007FFE29180000-0x00007FFE29538000-memory.dmp	upx
behavioral2/memory/4700-202-0x00007FFE29180000-0x00007FFE29538000-memory.dmp	upx
behavioral2/memory/4700-205-0x00007FFE29180000-0x00007FFE29538000-memory.dmp	upx

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D8E9E65B-1492-4280-835F-968774D9CFC2}	msiexec.exe
File created	C:\Windows\Installer\e5978a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5978a1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA262A75B88A01031.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1662648C98991F91.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F0A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5978a5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA033A2FF259838A5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF098C52092A9144F8.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1096	msiexec.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe
2168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	put.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	put.tmp

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c569-17.dat	innosetup
behavioral2/memory/6120-19-0x00000000009A0000-0x0000000000AA4000-memory.dmp	innosetup
behavioral2/memory/6120-32-0x00000000009A0000-0x0000000000AA4000-memory.dmp	innosetup
behavioral2/memory/4728-47-0x00000000009A0000-0x0000000000AA4000-memory.dmp	innosetup
behavioral2/memory/6120-57-0x00000000009A0000-0x0000000000AA4000-memory.dmp	innosetup
behavioral2/memory/4728-86-0x00000000009A0000-0x0000000000AA4000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
356	timeout.exe
2328	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	msiexec.exe
3692	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1096	msiexec.exe
Token: SeSecurityPrivilege	3692	msiexec.exe
Token: SeCreateTokenPrivilege	1096	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1096	msiexec.exe
Token: SeLockMemoryPrivilege	1096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1096	msiexec.exe
Token: SeMachineAccountPrivilege	1096	msiexec.exe
Token: SeTcbPrivilege	1096	msiexec.exe
Token: SeSecurityPrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeLoadDriverPrivilege	1096	msiexec.exe
Token: SeSystemProfilePrivilege	1096	msiexec.exe
Token: SeSystemtimePrivilege	1096	msiexec.exe
Token: SeProfSingleProcessPrivilege	1096	msiexec.exe
Token: SeIncBasePriorityPrivilege	1096	msiexec.exe
Token: SeCreatePagefilePrivilege	1096	msiexec.exe
Token: SeCreatePermanentPrivilege	1096	msiexec.exe
Token: SeBackupPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeShutdownPrivilege	1096	msiexec.exe
Token: SeDebugPrivilege	1096	msiexec.exe
Token: SeAuditPrivilege	1096	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1096	msiexec.exe
Token: SeChangeNotifyPrivilege	1096	msiexec.exe
Token: SeRemoteShutdownPrivilege	1096	msiexec.exe
Token: SeUndockPrivilege	1096	msiexec.exe
Token: SeSyncAgentPrivilege	1096	msiexec.exe
Token: SeEnableDelegationPrivilege	1096	msiexec.exe
Token: SeManageVolumePrivilege	1096	msiexec.exe
Token: SeImpersonatePrivilege	1096	msiexec.exe
Token: SeCreateGlobalPrivilege	1096	msiexec.exe
Token: SeBackupPrivilege	4876	vssvc.exe
Token: SeRestorePrivilege	4876	vssvc.exe
Token: SeAuditPrivilege	4876	vssvc.exe
Token: SeBackupPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1096	msiexec.exe
1096	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1096	msiexec.exe
3692	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3436	3692	msiexec.exe	94
PID 3692 wrote to memory of 6120	3692	msiexec.exe	96
PID 6120 wrote to memory of 3044	6120	put.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\put.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3436
- C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe
  "C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Users\Admin\AppData\Local\Temp\is-X6UQ8CTPAG.tmp\put.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-X6UQ8CTPAG.tmp\put.tmp" /SL5="$A0270,5514702,1003008,C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3044
  - - C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe
      "C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe" /VERYSILENT /PASSWORD=2a1d5672-bfd2-43d7-9e1c-3997e9977c56
      4⤵
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\is-KYR4NMZ1O9.tmp\put.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KYR4NMZ1O9.tmp\put.tmp" /SL5="$400B2,5514702,1003008,C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe" /VERYSILENT /PASSWORD=2a1d5672-bfd2-43d7-9e1c-3997e9977c56
        5⤵
        
        PID:5708
      - C:\ProgramData\GoldDeepPink\FnHotkeyUtility.exe
        
        "C:\ProgramData\GoldDeepPink\FnHotkeyUtility.exe" --webview-exe-name=SearchHost.exe
        6⤵
        
        PID:4700
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2492
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 3 /nobreak > nul && del /f /q "C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:2168
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 3 /nobreak > nul && del /f /q "C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe"
      4⤵
      Executes a command shell one-liner
      PID:1580
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5978a4.rbs

Path C:\Config.Msi\e5978a4.rbs
Size 8KB
SHA256 3e8cd6a3a1ec4e64b9ac3427d0e1bec79f7c9c41a0497cecb5ef9a61832e30b3
MD5 ce7b73a832c4c3396cba315ca7e94567
SHA1 c7a793a8af18352c0b0235a7a709dc17797539f7
SHA512 a997e90d3b5406647fca4719c43c92aa31365f19e058326afaf3aea1818eafce322352c927acb8bd1eef6f5155be0d7dc938378a7d60fdee29b2b861455364fa
SSDEEP 96:4nZsXiHfsiHfmC73DjUp6E5CsThqAUp6E5C6jbCaSThq3HD/orxsWi89mQ9NCtpe:4phmC/QncIKncJlWtpe
TLSH
T1B5025601B259C1D2E8FA1B35C7171B0C3BF2D3D5E220A387144E84241F97FDAAB5E98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FnHotkeyUtility.exe

Path C:\ProgramData\GoldDeepPink\FnHotkeyUtility.exe
Size 1.3MB
SHA256 2728e26af764a64dd31f6df20bad9ce68f27a1c54628abf7353a62f5e67a9dff
MD5 ac01b1efe9bdd6c127bcb489765e935d
SHA1 2ba7bbcf28c0171e51bd31ed8f4c9695134de3dc
SHA512 3ada07d1a35e80f726229ca3266eabc296500853274cc04be76d59461a80fc9ee8a1bc28678a20423f1fcf0ff194de5b629452250dd5be7a08c25bf52df84a35
SSDEEP 24576:RHGG1DQA1jJiCmuz8OPzbWFa4WbaMrres:R2A1lXyQbWFbw
TLSH
T10355271263F90058F1F3AB7AAEB69161DA37BC992A31C49F4540B11D0D3BB91DAB4733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\ProgramData\GoldDeepPink\MSVCP140.dll
Size 571KB
SHA256 a68a9ac35aa1e183fe3bd9e7144259631530db07502112a339e5e1c8dccc9a31
MD5 990a590eb079f420946fde91975798b9
SHA1 e78619eea4699bbb24a32051842ae15a971f7107
SHA512 6ccf8b198986de3478411233514803b22750560da419cbcb052ff963ebfea40386d54db6c335d7cd771503eb93693b872ff3c1bf39385eabc7fdd06ca40f6296
SSDEEP 12288:jSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQN:jUStZaQEKZm+jWodEE9CQN
TLSH
T18EC41A13B75905A0E195E3B8A1878306D7F1BC4A8312A3C792FBD6AD2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\GoldDeepPink\VCRUNTIME140.dll
Size 101KB
SHA256 5dc711b1f190df5b1257b92883e9c3f10cb4e953591da13dd50d9f0c7a4af695
MD5 c5bc6d2136f51d438af4dbe8ef8103d1
SHA1 186e176ad2df3df728acd5c5b0dee6dcdf036e80
SHA512 2ae122c612882a4a5f16bd5c69e5ed4b3e5e87d52f979d2e0e34254f397c63ae1dbeb5ab64c35c640b17d626aa4feafc6927f745102e1ac13f1837f1e665eeaa
SSDEEP 1536:m3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8E/4xPcj888iiBg9z:m66dsFeeBGPj1L6LGY+ecboCN78iZ
TLSH
T1CAA3AE8567A801A6D46BD030C1E1DE47FE35B2C6473046DF03A9D6AE0F53BE29B39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\ProgramData\GoldDeepPink\VCRUNTIME140_1.dll
Size 46KB
SHA256 e30874ceaf6b8dfe72ba67e5c1f21027d79cb3a873a32eb12c5ed89bfa660d1f
MD5 f17586db47571622455a6f57fecdda53
SHA1 5ca5ef3ca3eb244174a5b912b6c7ea607247e6eb
SHA512 d942964b65b1df656025b848ed2f6b423c6cdffd6626855b7f39a7152fc4ffa20672214e7c0ff1075130363127a5db35b98831ada51596d4d322387a7d0a0708
SSDEEP 768:Ime4gSbOzTRU2RESkCW89wf9fV49zBA9USp9HPisSg:cO0r9KfWzB4Dx5P
TLSH
T1BD236CE5A7781043E86BD974C0D76F27BD38F6D21B90A28B0665D1480E537D0AB3D32B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ludp.dll

Path C:\ProgramData\GoldDeepPink\ludp.dll
Size 1.6MB
SHA256 a62f73b7cef738ebd9963744665aa85772b428aef214f07f8112ff3816b09241
MD5 084f247502e6054ada4a65a8935a4396
SHA1 1794e9b5e818cbcc378f48cdc336e055020fa321
SHA512 f1fcddbe75d98ad5d1d7d3951730d0451663aab00a355ad38298a33e36df7be057f9cddc97e38fab9368a804b97c3af6893eaa84b25b16fab21e692fad45fe47
SSDEEP 49152:/Gtlq7kjBH5M5QMSA7i57S3OD8CK6Iwg:JA0iSe
TLSH
T110757D0AB6B801B9D1A7C1788A57990BE7B174061F74A7DF12A0479E2F33FE1563E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkvol.dll

Path C:\ProgramData\GoldDeepPink\spkvol.dll
Size 10.7MB
SHA256 ca662b08c6e6ee168181db58a2afccef40a2395b4dbb2f6298f1a51f8fbd7363
MD5 ddaf41d4fac2759da075c3c767392753
SHA1 5392bfef89412ff45e3c93c2c07872acb285f92e
SHA512 30949dc956e5289ee6982acec0a3731d211b6264c6f220521d4e873c796e0155fb5932e0556abdb3bf37eff35f9739bb9f79d677fba3447f295c58a98a4202f1
SSDEEP 49152:VCyjLPebsS9FJ57L+T9IMa3f6DNytPxzwx9UNLJqWmhhhDIunWnycOgCgzjm:UyvC5Ff68tPxsxaJN6DWnycO46
TLSH
T144B633D474EE89F4F822283AB83F360BDD4D8F98762AE63056119D3733DD56351263A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

put.exe

Path C:\Users\Admin\AppData\Local\Programs\Internal Software\put\put.exe
Size 14.4MB
SHA256 0c3623af1f079fb9a98fecc6b13a4ce202903c7db31d5c98aca5416f8aa6b7e7
MD5 b30e3ffe2d880cc1cce5f7ec0f79877d
SHA1 c98cace95ece322197bcc14b9207b96ec16b933f
SHA512 97fd1be556d880ea4ad21cbc9a6d04fede0e484f300082263925d6fd720014a9805155a8c84aad1890c0541783958f2e3ffc0b90a2b3c6a38cee9fb94a25a3b4
SSDEEP 98304:6AX7jME6A+IRn0IyfU9WrjAi9QNglpsXyeq7Evfw30HE0m/giLGYcVR+ZChagH6d:ZAq+IRTysQjA1XHfw3l0TxvVRP/aez
TLSH
T1D3E60133A2ED61FBE0590B39157392155E377F3169238D0D96F038E8DB35FA0292BA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 125B
SHA256 7d916624e0b9c4614d2cdb98469bee2aafa3efc5091ea5eb58c4fa9d5d123474
MD5 c74fa1aa6698e10744e96b22d2e982fd
SHA1 940ee8d9e1f07e793cf94e11274361d756abe469
SHA512 f439c32fc34d92be397e5ae149c2dc66cfbf49e2341f0c33e214f7d73d25ac24bf1ba03af7d66156864ac3fdfeb25a9f6d7b859b3d2fc4b226a4b69b59677579
TLSH
T1D8B0929ADC51C49C37B2F8B783005A54AEB748288B490213B2CA818E5985A088A4B7F1
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 743B
SHA256 f1b14a71921e7d2f3fe602181a5963c13a3273cf6c1fc0ecd75c7716cd13e60e
MD5 6e9ce01c1e510b1d95f373b70c01bd3f
SHA1 cc3c2eb848fe0a113b0b21401b255bba2e948add
SHA512 8ae94ec5db16663e89692f071079dcf9ef6600d859e013c7b4d687583dc7e9f0f9e3111564e8062ea648c561b0aaaabebb82d2a0ffddec36387a34b66d6bcf95
TLSH
T11C019C03BCC6D82E1140DCD39361B66C9CE980049BDE27479B80D88C75C591EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1017B
SHA256 e86913a91130ab0c10933b38165d0b9f12767d3bd40d9d44ff88b3bb78a6ea56
MD5 0edc579d7a30ef2063d590cdbedc9083
SHA1 d00bba51289ed54e1919aa47399a77618c888350
SHA512 57a1232024177a137cc3359b6d2ad061f0a63ced1bb006912a3afe0ba2bda969a83e6025a1f84c618d0a222d47161a3551e69236993077496e20aba4c0dc7ea3
TLSH
T1F0117B02BCC5D82E1140E8E39361B66C9CE484049BCE2B429B85D98C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 0068a4a72aab33a8d2bc35540c3a8a599a7d732403c1eba25099bd36cb7e52e4
MD5 5efec0f2551ce976a755f1a907e093b0
SHA1 eac0619cc54120372c0cad96ee64c3786f3dd6f2
SHA512 82614ee775123b53eb63049a0f48ad8c308774149f4dffa028b7152f3b008281e5739efd70c7ad8806b9e1dcbda129153f6ff4d179d60dc0cb1394d02ff32158
TLSH
T127317B03FDC6D82E1200ACD39361E66C98F54408ABCE2B469B44D84CB5C695EF5CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 62be10b6a2df77f9fe433d442fa88037aa54d8d03c0d724c4ea33fcd22ffcec2
MD5 e67c814e1e161fa5ae6cd0375822d4bd
SHA1 3e41ee7c93c0eb4a916fe1b602bb183c0f57dcb5
SHA512 715815ca30a096a6472bfa75d8e6f53139bb39e127a5f5109e7f1a3882fd84a8dd0f2583ff4f0f367358e2e1efabf2d1230afbe141050f4da38156a9d275d44f
TLSH
T127317C02FDC6D82E1100BCD39365E66C98E484489BCE3B569B44DC4C798685EF6DF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 d27f96039b9ea69fad7e8d13e7731b309b5d6e14069823fdbfd297471aaefb9f
MD5 eec7fba9d856774c81a54521df0e8a9d
SHA1 69c84db70861cc2632cab70fcb01590dd6986b7f
SHA512 5b3b9365ee67ec9284f3e3675e4762dfc5373ef2bbd5c1838d61901ec41189da4935ac57251e77db471c98aa6edb891c561f834c5474017b2e773eb6f3159195
TLSH
T1CF410F43F8C5D81E1614B8C3E311A62C99F445A99BCE3B426B88C88C74CA42BB3CE357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 d704ffb6ca7288d6995b724b5c1a68b67dec5f20aebaacd2c97c8f4b765d11a7
MD5 05d6264b18860f8bfb76fe4b7d5fd361
SHA1 a3a24cd09cbfb900c58f280dc49544f2711e99d8
SHA512 fd2ad5df308e62ffc79bdeb87343483084fb34a91a7152bf9eea208c432a48f3485773edcfe10144009e8b1348f4a5e2fc79653ff0e123560e7976076047bce2
TLSH
T160512187F8C5D81E0B14F8D2F312951C99F084A99FCA27415789D88D78CA52BB3CE3A7
MD5 SHA1 SHA512 TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-VXTJAV7KE4.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

put.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-X6UQ8CTPAG.tmp\put.tmp
Size 4.3MB
SHA256 bf22e5bc562e529c8a7cdd8093f22cd56ba1acd6215ab6e93b6e3fc268e7bb41
MD5 f384bb365558f13b6f32b484227f47fc
SHA1 9746e31c699432f7ea85765f6d5247005686d672
SHA512 af9de26212fee760926b114c8939feada7a7e1861a250a90e9c2293c5f599a913d63d651bec9adcfa8ed29201c6719d037af1f34dce4617e76d1889238c6aa1c
SSDEEP 49152:zoPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lO4333Vas:zgw26xBij3QG+ddr9/OzGbRwL333v
TLSH
T112265C13B2DC653BE4661B3B4837A6485D3B7F302A168C4A6AF43DDC4E35F406D26A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5978a1.msi

Path C:\Windows\Installer\e5978a1.msi
Size 5.8MB
SHA256 87af763c615245b837d35acffea498f73f59f28fb556c1c5731450a62be3b554
MD5 dcc074dad2d13e2818677d95887b5cf1
SHA1 3915005625ed007b3865c615a93827b0661b04c4
SHA512 ec47bd3ceabcf271295c152509a7f02e00bc4f2dfc94e94c8f2818a5dc48eb454d4d0d7f85efa6c633e243429f4e78373509b238a02fcb5614923336b97ce42d
SSDEEP 98304:36EEHAm3p4Lv1ri2VYcz5+vQVCAswB+3pEc/nLB3gks/s5kml6AliZAyIFkMezij:36Exm3ps1O5czowS/nLekRtkAlV/bez
TLSH
T14A5633B6B38DDB37DA0A2B355227C3E02B254C504BF391566514F6E90C35BF866FA8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 cc6f60104b62aa6d3d5311cb20c207eca7e4200ef7bb1b82713b994b0ce34991
MD5 d7bb5078ad2956799464457699ae5911
SHA1 fc1e55fffa3f4cdce638b0f91cca859e974aaf07
SHA512 4f1e16a606e90d2ac9c7e69a8d5c813a7edaacf77661ce6c8c85ac047a0622053efe9a9ec53b03d6b3f2c39c3eaa969db318ebb9881904ac22830ee38165acb0
SSDEEP 24576:/Fo3DMPLdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+j:BHI
TLSH
T14F57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0617c8e4-d627-4eaa-9d1e-b135b9e7a804}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0617c8e4-d627-4eaa-9d1e-b135b9e7a804}_OnDiskSnapshotProp
Size 6KB
SHA256 b1936d137fb08d4cf4da973d462d3855540e14a4b38faee75cbec5f2a79cf3df
MD5 c11d467b9947ab003b09562f8071d673
SHA1 e54efc1ecefb205679ab3fb27bc851aec8fad7d3
SHA512 bd18f3b38741ba509853f1b48aaf27de7eb35d8bcffc39612551bd3ab16e40d6489df849c42961e7a47502ef956f04efc08260ebe37b57c359ec2db4c37556ed
SSDEEP 96:FlyI0bsvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:aInb++uVm
TLSH
T155D188185AF54711E2B3AB3228F18557A837B911FF33CB8E0198638E6671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3044-33-0x0000000000150000-0x00000000005B2000-memory.dmp

Download

memory/3044-53-0x0000000000150000-0x00000000005B2000-memory.dmp

Download

memory/3044-44-0x0000000000150000-0x00000000005B2000-memory.dmp

Download

memory/3044-37-0x0000000000150000-0x00000000005B2000-memory.dmp

Download

memory/3044-35-0x0000000000150000-0x00000000005B2000-memory.dmp

Download

memory/4700-88-0x00007FFE29180000-0x00007FFE29538000-memory.dmp

Download

memory/4700-176-0x0000000140000000-0x0000000141C92000-memory.dmp

Download

memory/4700-91-0x00007FFE29180000-0x00007FFE29538000-memory.dmp

Download

memory/4700-92-0x0000000140000000-0x0000000141C92000-memory.dmp

Download

memory/4700-89-0x00007FF722560000-0x00007FF7226B4000-memory.dmp

Download

memory/4700-205-0x00007FFE29180000-0x00007FFE29538000-memory.dmp

Download

memory/4700-202-0x00007FFE29180000-0x00007FFE29538000-memory.dmp

Download

memory/4700-90-0x00007FFE29180000-0x00007FFE29538000-memory.dmp

Download

memory/4700-201-0x0000000140000000-0x0000000141C92000-memory.dmp

Download

memory/4700-182-0x0000000140000000-0x0000000141C92000-memory.dmp

Download

memory/4728-86-0x00000000009A0000-0x0000000000AA4000-memory.dmp

Download

memory/4728-47-0x00000000009A0000-0x0000000000AA4000-memory.dmp

Download

memory/5708-85-0x00000000002C0000-0x0000000000722000-memory.dmp

Download

memory/6120-57-0x00000000009A0000-0x0000000000AA4000-memory.dmp

Download

memory/6120-32-0x00000000009A0000-0x0000000000AA4000-memory.dmp

Download

memory/6120-19-0x00000000009A0000-0x0000000000AA4000-memory.dmp

Download