43cf313d9a24a7e393f2c170ee36f253732edd50a6d3f905bc8f3425f85a0702

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StepStrum-1.1.0-win-x64.msi
Size 6.8MB
Sample260901-3epvrattgs
SHA256 43cf313d9a24a7e393f2c170ee36f253732edd50a6d3f905bc8f3425f85a0702
MD5 a6ee28e98afcf5fddffd2dd3dc7a0c4b
SHA1 2b063f33890e64f8ce88d74935a117522933353a
SHA512 440cf89618b9e3cd52f081fa017c95485707829ba1e929f804e4b336f017c73e7ea018c5fcb8836887c38b4767eef2364031d89fbec7f8986f51bad0a4181683
SSDEEP 196608:nmEIzVAWn539Y1Ngcg3yewrEEcunNk0YnBxIbQ:nmBxnPY3ZiwYEkzBxIQ
TLSH
T1BA76332B7E651704DE08EDBB867F93510638DD89AA248013A853790EEDF26F82FD4CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1580	msiexec.exe
8	1580	msiexec.exe
22	1580	msiexec.exe
26	1580	msiexec.exe
29	1580	msiexec.exe
30	1580	msiexec.exe
44	1580	msiexec.exe
49	1580	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libcurl.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libgcc_s_seh-1.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libwinpthread-1.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\StepStrum.vst3	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libhardware_id_generator.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libstdc++-6.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libLicenseSpring.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\StepStrum.vst3\Contents\x86_64-win\libcrypto-3-x64.dll	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58f0f3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58f0f5.msi	msiexec.exe
File created	C:\Windows\Installer\e58f0f3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{70ACE466-C53E-43B5-98ED-B87DF87A4E21}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF26A.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1580	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\664ECA07E35C5B3489DE8BD78FA7E412\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D40CDE2DFABD124D97557FA04EE7951\664ECA07E35C5B3489DE8BD78FA7E412	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList\PackageName = "StepStrum-1.1.0-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\664ECA07E35C5B3489DE8BD78FA7E412	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\PackageCode = "6FE8B3977A0BEC549B86DC9013E1385D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\ProductName = "StepStrum"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\Version = "16842752"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0D40CDE2DFABD124D97557FA04EE7951	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\664ECA07E35C5B3489DE8BD78FA7E412\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3160	msiexec.exe
3160	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1580	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1580	msiexec.exe
Token: SeSecurityPrivilege	3160	msiexec.exe
Token: SeCreateTokenPrivilege	1580	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1580	msiexec.exe
Token: SeLockMemoryPrivilege	1580	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1580	msiexec.exe
Token: SeMachineAccountPrivilege	1580	msiexec.exe
Token: SeTcbPrivilege	1580	msiexec.exe
Token: SeSecurityPrivilege	1580	msiexec.exe
Token: SeTakeOwnershipPrivilege	1580	msiexec.exe
Token: SeLoadDriverPrivilege	1580	msiexec.exe
Token: SeSystemProfilePrivilege	1580	msiexec.exe
Token: SeSystemtimePrivilege	1580	msiexec.exe
Token: SeProfSingleProcessPrivilege	1580	msiexec.exe
Token: SeIncBasePriorityPrivilege	1580	msiexec.exe
Token: SeCreatePagefilePrivilege	1580	msiexec.exe
Token: SeCreatePermanentPrivilege	1580	msiexec.exe
Token: SeBackupPrivilege	1580	msiexec.exe
Token: SeRestorePrivilege	1580	msiexec.exe
Token: SeShutdownPrivilege	1580	msiexec.exe
Token: SeDebugPrivilege	1580	msiexec.exe
Token: SeAuditPrivilege	1580	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1580	msiexec.exe
Token: SeChangeNotifyPrivilege	1580	msiexec.exe
Token: SeRemoteShutdownPrivilege	1580	msiexec.exe
Token: SeUndockPrivilege	1580	msiexec.exe
Token: SeSyncAgentPrivilege	1580	msiexec.exe
Token: SeEnableDelegationPrivilege	1580	msiexec.exe
Token: SeManageVolumePrivilege	1580	msiexec.exe
Token: SeImpersonatePrivilege	1580	msiexec.exe
Token: SeCreateGlobalPrivilege	1580	msiexec.exe
Token: SeBackupPrivilege	3280	vssvc.exe
Token: SeRestorePrivilege	3280	vssvc.exe
Token: SeAuditPrivilege	3280	vssvc.exe
Token: SeBackupPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1580	msiexec.exe
1580	msiexec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3784	3160	msiexec.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\StepStrum-1.1.0-win-x64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1580

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f0f4.rbs

Path C:\Config.Msi\e58f0f4.rbs
Size 8KB
SHA256 db3e33916c629498c9e0321f85581d483381ae0025f2b5bcba0cc296920740b2
MD5 d8c808f660d1516d23425da5004dbfca
SHA1 2d3f9fc3707aa0445121046aa49af9aa470afdd5
SHA512 91bc97d008ec291caec3bbfc0d3b4d86ed2653436f87140f6c705e1bdaea336ae282883d49e537fc47a264212c0ec3d11313702ff002dbaa2efe5b4f33473d45
SSDEEP 192:NIbRN7QPbAQYOevomtp2I6p2FzAU9O7W0vWZB238pwxoYlOkoi:NIbRN7QPbAQYlpMpuX0lXh
TLSH
T12E126385BA5082E1F8851B3A830B7F6A3BA3D2C85F301B4F01DD96685E863546F957CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 719B
SHA256 c7fa88dfcb73126fd77c31bef314fdc3032bc4046666561db74ea50fab4e564f
MD5 eaf55528b0f5937bd8e8f316bd1cc084
SHA1 95f22f3a4fd8bbaed3b1d846bffc9c7d91b6d0f6
SHA512 b662ed48f9545b4a39b0ad121df043fc73d049473c7747eb34fbe2727c62d672351c2fe4b14fc252c8ac19d14a1ebe818b4f6ff523e7a14d1a9a94b9bb4e0b50
TLSH
T19C0199C38D3F044D1D039540DF59CA71375170E1781702A7A6B03D01A84B93D563D854
MD5 SHA1 SHA512 TLSH

Submit Download

D682FDDA10064185EC8111DC39DBA8EC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D682FDDA10064185EC8111DC39DBA8EC
Size 174KB
SHA256 f0f05b53f09f4ca2e328e2b5a13e416099f0d841d281741de27e1e628430dd22
MD5 e078987dd91ca5686fd45a187e03e15a
SHA1 641ef54e25b81185ad84c927f3a08290913f1983
SHA512 000981a345480f96f8442bcbec1faf37556840e1967160445928f862e40236f857cec1c02d9f6456b2e0821a10c4dd8752458515189e98c00cd1ee392fc04816
SSDEEP 1536:+WXWY8Kl7PKF9UeP6/13EK0T1lhlZn39zyVrZKUD6TYnjw2+7dzOwjYTan4EQSVK:+ulZrp6KCx39WxDz/+T4wYHD+4
TLSH
T1B5042C2C9C543273A549AEA1C8CEDF9BCDB1B6C523D2911F52605F811863FCE8F958B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
Size 446B
SHA256 b7c445cbef559a6e2077e499efe75bbad798f520ca8735ae9fbaff8c70c07ef3
MD5 e4a1a54d4f1469e24783665b778af320
SHA1 554171d957d88a63dc974004cee9c6d0fd17cfd6
SHA512 11bfd4840554d68b06a476e7044d10dcee3818023f3f87cea37b428dffa600dd4a3f0ad51b9c4979c014fc42484109935bf2724ffc75ddf53ddc29e534a7c564
TLSH
T1EDF0681424EB012FD4B2567D87E552B59F29F4137E0DB2AD00A51319FE07F066F31E64
MD5 SHA1 SHA512 TLSH

Submit Download

D682FDDA10064185EC8111DC39DBA8EC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D682FDDA10064185EC8111DC39DBA8EC
Size 308B
SHA256 5d58265fc2587628b58da0fb577529981cef28245f9f11634f219474d70b33aa
MD5 6446d164b2317fac929b81bc9d40c730
SHA1 0cd46cf3f3dc64cc309529162a5700d3e042f3bf
SHA512 6d74a35408d0cc0c3e0e949cc447b2d865239f4793524e1a3a1df5e77bee2e4768bd108cd856f3b24039755b22588c6999cef5f34e39253c546849b51d8fa0e8
TLSH
T1A0E0121116B55616E47A5A796DE14302FA35BC60AA028E0A066397080C6AB475C70D1E
MD5 SHA1 SHA512 TLSH

Submit Download

e58f0f3.msi

Path C:\Windows\Installer\e58f0f3.msi
Size 6.8MB
SHA256 43cf313d9a24a7e393f2c170ee36f253732edd50a6d3f905bc8f3425f85a0702
MD5 a6ee28e98afcf5fddffd2dd3dc7a0c4b
SHA1 2b063f33890e64f8ce88d74935a117522933353a
SHA512 440cf89618b9e3cd52f081fa017c95485707829ba1e929f804e4b336f017c73e7ea018c5fcb8836887c38b4767eef2364031d89fbec7f8986f51bad0a4181683
SSDEEP 196608:nmEIzVAWn539Y1Ngcg3yewrEEcunNk0YnBxIbQ:nmBxnPY3ZiwYEkzBxIQ
TLSH
T1BA76332B7E651704DE08EDBB867F93510638DD89AA248013A853790EEDF26F82FD4CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 ff1859d82109f3bb69c53054dcfb79975a48bf3ace71aeff01594efc05ffcfdc
MD5 72e1b1b970665c9a46dc5b28a3901c94
SHA1 0b756cd71b1e2c4de9778b53ce048ef52f6c2f19
SHA512 b622c79871c4b39a4104365ddea9f64110092e6761f65d00d559183cf61412c5cb7a73c653a81caee42e374867108507635b43405b97deec65bf94780a91c049
SSDEEP 24576:wu8m+1zmdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:t
TLSH
T1E947A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{48e34164-a968-4582-9cc4-d8b06e68df27}_OnDiskSnapshotProp

Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{48e34164-a968-4582-9cc4-d8b06e68df27}_OnDiskSnapshotProp
Size 6KB
SHA256 566f5f2f2c53306bfd61a136e65dcc80c7f1e09c4db8bc7c91634793fbc6cff5
MD5 96806795195b30aec168357e858457d2
SHA1 8c0342a9fa37ceb41245dfe420982b9aeac0bd97
SHA512 7c030fd0faffd7bba2936b3df2664092a64ef844e75f19b4f93c314b8eb15fb3574863ec7a850ed6f1d3cf52de1918110dbcdd264c47ebcc8eb6cf3c1ab296a3
SSDEEP 96:FHQnm3BMtOvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:om3W0b++ZVmN
TLSH
T16FD178085AF54711E2F3AB3129F18557A877B911EF33CB8E0298238E2670910F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download