Analysis
- user interaction
yes - max time kernel
132s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RustLuma.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
General
- Target RustLuma.msi
- Size 245.3MB
- Sample260910-yfc55avfnf
- SHA256 e768d15f6f364c7a2bfa7daa2348b5438cfa7c932fea4f6d0f5f5da3031337ce
- MD5 a04cdb4ae7febdbba0498b039aa1f17f
- SHA1 6d8f16225b1d5fc27d1e58e1326baaadcf113bb9
- SHA512 e680cdefbde981641259580758adad93b6884f1e009239591f59aad16db16a1da29b3f65f0892cb4571ae15f7b2b83b4ffe41394e6a5fe1d83a24c24bb0df04d
- SSDEEP 393216:CfRNp2suyGw2mH93dP1L8+6RoXe83SgbS0zqCVWo3ZvMls3Uypdh52McaE+VxBcR:aCXKhB3xPc+pCQ2fPbjCC
- TLSH T186C89D0673E501A6E5B3E1348AA74503E773B4635731CBDB32AC43582FBBAE45A3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3348 svchost.exe 5268 powershell_core.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e587d3c.msi msiexec.exe File opened for modification C:\Windows\Installer\e587d3a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8289.tmp msiexec.exe File created C:\Windows\Installer\e587d3a.msi msiexec.exe File created C:\Windows\Installer\SourceHash{07B5FFC2-8526-4EDE-B2CB-3EEC39EB23BC} msiexec.exe -
pid Process 468 powershell.exe 772 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3612 msiexec.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5692 cmd.exe 4688 cmd.exe - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 2676 msiexec.exe 2676 msiexec.exe 772 powershell.exe 772 powershell.exe 772 powershell.exe 772 powershell.exe 772 powershell.exe 772 powershell.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3612 msiexec.exe Token: SeIncreaseQuotaPrivilege 3612 msiexec.exe Token: SeSecurityPrivilege 2676 msiexec.exe Token: SeCreateTokenPrivilege 3612 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3612 msiexec.exe Token: SeLockMemoryPrivilege 3612 msiexec.exe Token: SeIncreaseQuotaPrivilege 3612 msiexec.exe Token: SeMachineAccountPrivilege 3612 msiexec.exe Token: SeTcbPrivilege 3612 msiexec.exe Token: SeSecurityPrivilege 3612 msiexec.exe Token: SeTakeOwnershipPrivilege 3612 msiexec.exe Token: SeLoadDriverPrivilege 3612 msiexec.exe Token: SeSystemProfilePrivilege 3612 msiexec.exe Token: SeSystemtimePrivilege 3612 msiexec.exe Token: SeProfSingleProcessPrivilege 3612 msiexec.exe Token: SeIncBasePriorityPrivilege 3612 msiexec.exe Token: SeCreatePagefilePrivilege 3612 msiexec.exe Token: SeCreatePermanentPrivilege 3612 msiexec.exe Token: SeBackupPrivilege 3612 msiexec.exe Token: SeRestorePrivilege 3612 msiexec.exe Token: SeShutdownPrivilege 3612 msiexec.exe Token: SeDebugPrivilege 3612 msiexec.exe Token: SeAuditPrivilege 3612 msiexec.exe Token: SeSystemEnvironmentPrivilege 3612 msiexec.exe Token: SeChangeNotifyPrivilege 3612 msiexec.exe Token: SeRemoteShutdownPrivilege 3612 msiexec.exe Token: SeUndockPrivilege 3612 msiexec.exe Token: SeSyncAgentPrivilege 3612 msiexec.exe Token: SeEnableDelegationPrivilege 3612 msiexec.exe Token: SeManageVolumePrivilege 3612 msiexec.exe Token: SeImpersonatePrivilege 3612 msiexec.exe Token: SeCreateGlobalPrivilege 3612 msiexec.exe Token: SeBackupPrivilege 5168 vssvc.exe Token: SeRestorePrivilege 5168 vssvc.exe Token: SeAuditPrivilege 5168 vssvc.exe Token: SeBackupPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe Token: SeTakeOwnershipPrivilege 2676 msiexec.exe Token: SeRestorePrivilege 2676 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3612 msiexec.exe 3612 msiexec.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe 4964 taskmgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2492 2676 msiexec.exe 97 PID 2676 wrote to memory of 5692 2676 msiexec.exe 99 PID 5692 wrote to memory of 3348 5692 cmd.exe 101 PID 3348 wrote to memory of 468 3348 svchost.exe 102 PID 3348 wrote to memory of 4688 3348 svchost.exe 103 PID 3348 wrote to memory of 5268 3348 svchost.exe 105 PID 5268 wrote to memory of 772 5268 powershell_core.exe 107 PID 772 wrote to memory of 2376 772 powershell.exe 111 PID 2376 wrote to memory of 1032 2376 csc.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RustLuma.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3612
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2492
-
-
C:\Windows\system32\cmd.execmd.exe /c start /b svchost.exe2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\SystemService_6135\svchost.exesvchost.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 3348).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "4⤵
- Command and Scripting Interpreter: PowerShell
PID:468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe" /f"4⤵
- Executes a command shell one-liner
PID:4688
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $member = '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);'; $type = Add-Type -MemberDefinition $member -Name \"Win32ShowWindow\" -Namespace Win32 -PassThru; $hwnd = (Get-Process -Id 5268).MainWindowHandle; if ($hwnd -ne [IntPtr]::Zero) { $type::ShowWindow($hwnd, 0); } "5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xv2iq4lt\xv2iq4lt.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC53F.tmp" "c:\Users\Admin\AppData\Local\Temp\xv2iq4lt\CSC9CE4B29653E46B0955541B23C61CCC.TMP"7⤵PID:1032
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5168
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵PID:1716
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1984
-
C:\Windows\System32\s0ygao.exe"C:\Windows\System32\s0ygao.exe"1⤵PID:5148
-
C:\Windows\System32\s0ygao.exe"C:\Windows\System32\s0ygao.exe"1⤵PID:1236
-
C:\Windows\System32\s0ygao.exe"C:\Windows\System32\s0ygao.exe"1⤵PID:5900
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e587d3b.rbs
- Size 8KB
- SHA256 d835a35f66e8b966b027165f8e463e811ef4a6f7e0847412f1852a5b1c657a1a
- MD5 b20190a58f88822c3218a7a725009964
- SHA1 fff38c636544196d8a3450f76433b886af2424a6
- SHA512 e47423fdf526b62700f8b14ddc5dabaddaf06297b352454d28e2ef57b3ea983166c6cdcc7b059cb165148063189f370ed4fc758be27c07295dd736dda4870bc4
- SSDEEP 96:WvM+pmIlewclCUNrw7COThqPUNrw7CgjjsmA6ThqlHVlPz9FwE1M+VGAC1p6BjgM:WVeX1NEGGVNEGy90Tk1pwvP
- TLSH T16F023141B64086E9ECB6173AC31B13547777D3E99321A34F195E84288F52BEEDB890CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.system
- Size 14B
- SHA256 ca92d528b506d4f2bda0fc384f0bfa580fd0081c8706f482cb608146a6703773
- MD5 fb551e74f7cea3df1a0f6609954d4a51
- SHA1 f99f3d97f10e46e064bf59cc8cec8ad232e57c43
- SHA512 47f6b8ad7775f142f52ab3124345233546fa3e437c5c1eaa9650abab70c7778ce5f3c9f19bb91b4286d23c769810257c80f1ae2e5ecabf53f680a00fcfb92107
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SystemService_6135\svchost.exe
- Size 44.9MB
- SHA256 c823547f1d226b0d9b95444e89adacf2eeec728d9ecb8720785b6320b28b03e0
- MD5 9eda4584114a4b9b3f24c9e881ffc1fa
- SHA1 a6098cedc6f1312f281ae2989b4d18cd49aa0123
- SHA512 52b38083da1f8bfeb75f7a832a3de4c61aef83c01c15a3bd605990bdca327af17bf3f9c2c2dd5e4b74c53158b3e9ca47a3f761ffe774daef48618600abca1f9d
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfc:sMguj8Q4VfvcqFTrYe/Wy/
- TLSH T14CA79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RESC53F.tmp
- Size 1KB
- SHA256 a4306bf743f38788426ba35ca5ec9ea27e61dfcf38a033df36500b2c351f0ed8
- MD5 b43fd426caafac7708323cb98bb06d22
- SHA1 618aa45574c30cc8d6350b2eaaf8caa3d16a440c
- SHA512 8874072fa74ef1ff0944daa162d2d36a74b2f57f1f9b83e00186020704ec3c4503ba07cdc77df0eddc52aec01f8d092f9397ac3479b2788fc318da5dae566c04
- TLSH T10821CC0593E9871FF07367326DF6072FE234FDA49FA1935B458011282C51544EEB0E72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxnu405l.nyn.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\xv2iq4lt\xv2iq4lt.dll
- Size 3KB
- SHA256 6b20bdca26dc1c47800b37e7234b348f6efdb8ef0f28ac36a5d2d85ff6650071
- MD5 709e97944b8e13d5c9fa29fb79d59519
- SHA1 789ad0fdd9070574543d4127312f6b152849c382
- SHA512 d6a6a3f695aa528ecae2fa9c53891566087bf520317c370da99599ef20c6dc294e09f1ad4e64b8da92950503c6b2da06e091473b0a9c03389545531cd3ef7257
- TLSH T1D051CC1AA7E8462BE0770734AEF3436637A4F850ABA3932D49904228AC116646D31FB1
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 26e257adb322673817d12f8aeb11a6d615e854f51df7e32d5abbc4375739ac97
- MD5 e0f45221c2d8a65981741acc2e134df0
- SHA1 4782d715ec7935c857a2d9ecbb57805bf74a6adb
- SHA512 cdee732e4033834c6e89f2f42d5c237a9cc22dde2ad90d5e51ffa66f2c1995bca1d68c756ebea8f4e7ff83bd712cb8e85ea884023127057eec4dd54468022651
- SSDEEP 24576:Mu8m+1z/doO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:o
- TLSH T18C47C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fbe9d840-e421-42a4-87f9-a718c99542e3}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f108d6cd150bddb575b90b5afa91b030cff85ae03e39b9022c87f4d82a181f24
- MD5 cbf8855b673d405ec0bd79079332b099
- SHA1 ca8ecd423b98b49cacabe495ad15fbc889242e8b
- SHA512 4004eada148816cae0f2eefe982f2084a32f614262fd5ef708c545c296667dad32882f80bd78b53a4f7139b2c432481e11d623ebba8eb3ccb96e12d9712724b3
- SSDEEP 96:FYGneVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:+lfb++ZVm
- TLSH T192D189185AE54311E2B3AB712DF18557A477B811EF33CB8E0298238E2670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\xv2iq4lt\CSC9CE4B29653E46B0955541B23C61CCC.TMP
- Size 652B
- SHA256 7960d57dc3348470160924a0d4c031665872c771882f399820dee692eaa4ebc4
- MD5 41a046f479ad4816b0137665c79240b5
- SHA1 bb056b55174296dc54cfe698e1e7d1a79b399f4f
- SHA512 e537224bf269e9a6b771096025590f730df24142789e1361832fccd0d8bf60bfd554e41280a55d876e110154e2b43c020a39234dc5213449ca5c06a7808adfe2
- TLSH T115F08209A3F8430EF0F35B31BDF6436391A8BC64DE7293ED1490032D6C645109962FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\xv2iq4lt\xv2iq4lt.0.cs
- Size 218B
- SHA256 531c21f32b41b8651df1f844f1a6485b19926699ff33c80de4fc70a44882394c
- MD5 841704ba97da956e81f807e77177b947
- SHA1 ba3a59add0183f3de2845a7a99713020124567b6
- SHA512 a15176ad1aa3900b90094f8a4f8e15c30947547c323fe9f2c7ef3b33eccfcbb9ca79e2b92b8f936f39b8dc365402dfbb9afcdff659212f14e9a2ffb83e56d0d2
- TLSH T11FD0A71875F359E100134C224C46F1FD76234136259E1609A6A50310EF8B00D4131E59
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\xv2iq4lt\xv2iq4lt.cmdline
- Size 369B
- SHA256 185746e70dc831bd631e7a18f94f53aacba7912300afb7aa8131f04f3bd9826b
- MD5 11e23f67ad518519f2b2fb390897bc61
- SHA1 c56fbb2f13d9e30ea7eb0a89906a1eca8df95838
- SHA512 f1433e6a5891ee2d72a69c6f18687d7b95c49701b4a55e961a3d024cea21e658079f3c0bf7399a46c14bf141a75d204ba892d8a1d492aa2a82b0b3b05f3135b5
- TLSH T171E0C02A42C6C27E31DD1417256DC4ACE2720F832944BF845080481DD017040A7E1761
- MD5 SHA1 SHA512 TLSH