94872e821f0a99829e8ecea26f718655cdfed020ece863ae8fb03abb5fd9ca85

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WhiffLess_0.1.2_x64_en-US.msi
Size 20.6MB
Sample260922-sggxtagh84
SHA256 94872e821f0a99829e8ecea26f718655cdfed020ece863ae8fb03abb5fd9ca85
MD5 47f37d2371229cb8416b9157363d22bf
SHA1 49a583ca5185eba0a58e4fe066f0b72bc5167e6e
SHA512 a6894fa38b3e83341268de2c29b41d8d47cd8337a56db1d2a1c8d5ce6092e99e22e92b870da58762c182f977c745637e52f96e7385a8100987d7880410df089a
SSDEEP 393216:4Z8EnPYuqUJtxVUcHpZitlUeDNsaq26WvEuldAbxsNQpgC6DzXftVRGft:4r7qUJDRri7Rst260EUcx5KzXftLGf
TLSH
T1562733977E84A612C846BDB794FF17789A376D040504DC1B329672FDCAF02F02A696CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4236	desktop.exe

Loads dropped DLL 1 IoCs

pid	Process
1728	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	desktop.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WhiffLess\desktop.exe	msiexec.exe
File created	C:\Program Files\WhiffLess\Uninstall WhiffLess.lnk	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5adad1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5adad1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{725EBAE9-B6C2-46FF-BB93-57ADC2BD6348}	msiexec.exe
File created	C:\Windows\Installer\{725EBAE9-B6C2-46FF-BB93-57ADC2BD6348}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{725EBAE9-B6C2-46FF-BB93-57ADC2BD6348}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5adad3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B713D8A48223B1E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA8E55E593E5824A7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5BE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1970009210693AB0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5C7FB1B0A0117F1.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3024	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EABE5272C6BFF64BB3975DA2CDB3684\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\Version = "65538"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\ProductIcon = "C:\\Windows\\Installer\\{725EBAE9-B6C2-46FF-BB93-57ADC2BD6348}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B14719B7ADD6685284229A181D19D4B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EABE5272C6BFF64BB3975DA2CDB3684\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList\PackageName = "WhiffLess_0.1.2_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\PackageCode = "B1CB71E10171DC84A82CB7F3A49E481C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B14719B7ADD6685284229A181D19D4B\9EABE5272C6BFF64BB3975DA2CDB3684	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EABE5272C6BFF64BB3975DA2CDB3684	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EABE5272C6BFF64BB3975DA2CDB3684\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\ProductName = "WhiffLess"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EABE5272C6BFF64BB3975DA2CDB3684\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EABE5272C6BFF64BB3975DA2CDB3684\MainProgram	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	msiexec.exe
4104	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3520	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3024	msiexec.exe
Token: SeSecurityPrivilege	4104	msiexec.exe
Token: SeCreateTokenPrivilege	3024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3024	msiexec.exe
Token: SeLockMemoryPrivilege	3024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3024	msiexec.exe
Token: SeMachineAccountPrivilege	3024	msiexec.exe
Token: SeTcbPrivilege	3024	msiexec.exe
Token: SeSecurityPrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeLoadDriverPrivilege	3024	msiexec.exe
Token: SeSystemProfilePrivilege	3024	msiexec.exe
Token: SeSystemtimePrivilege	3024	msiexec.exe
Token: SeProfSingleProcessPrivilege	3024	msiexec.exe
Token: SeIncBasePriorityPrivilege	3024	msiexec.exe
Token: SeCreatePagefilePrivilege	3024	msiexec.exe
Token: SeCreatePermanentPrivilege	3024	msiexec.exe
Token: SeBackupPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeShutdownPrivilege	3024	msiexec.exe
Token: SeDebugPrivilege	3024	msiexec.exe
Token: SeAuditPrivilege	3024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3024	msiexec.exe
Token: SeChangeNotifyPrivilege	3024	msiexec.exe
Token: SeRemoteShutdownPrivilege	3024	msiexec.exe
Token: SeUndockPrivilege	3024	msiexec.exe
Token: SeSyncAgentPrivilege	3024	msiexec.exe
Token: SeEnableDelegationPrivilege	3024	msiexec.exe
Token: SeManageVolumePrivilege	3024	msiexec.exe
Token: SeImpersonatePrivilege	3024	msiexec.exe
Token: SeCreateGlobalPrivilege	3024	msiexec.exe
Token: SeCreateTokenPrivilege	3024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3024	msiexec.exe
Token: SeLockMemoryPrivilege	3024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3024	msiexec.exe
Token: SeMachineAccountPrivilege	3024	msiexec.exe
Token: SeTcbPrivilege	3024	msiexec.exe
Token: SeSecurityPrivilege	3024	msiexec.exe
Token: SeTakeOwnershipPrivilege	3024	msiexec.exe
Token: SeLoadDriverPrivilege	3024	msiexec.exe
Token: SeSystemProfilePrivilege	3024	msiexec.exe
Token: SeSystemtimePrivilege	3024	msiexec.exe
Token: SeProfSingleProcessPrivilege	3024	msiexec.exe
Token: SeIncBasePriorityPrivilege	3024	msiexec.exe
Token: SeCreatePagefilePrivilege	3024	msiexec.exe
Token: SeCreatePermanentPrivilege	3024	msiexec.exe
Token: SeBackupPrivilege	3024	msiexec.exe
Token: SeRestorePrivilege	3024	msiexec.exe
Token: SeShutdownPrivilege	3024	msiexec.exe
Token: SeDebugPrivilege	3024	msiexec.exe
Token: SeAuditPrivilege	3024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3024	msiexec.exe
Token: SeChangeNotifyPrivilege	3024	msiexec.exe
Token: SeRemoteShutdownPrivilege	3024	msiexec.exe
Token: SeUndockPrivilege	3024	msiexec.exe
Token: SeSyncAgentPrivilege	3024	msiexec.exe
Token: SeEnableDelegationPrivilege	3024	msiexec.exe
Token: SeManageVolumePrivilege	3024	msiexec.exe
Token: SeImpersonatePrivilege	3024	msiexec.exe
Token: SeCreateGlobalPrivilege	3024	msiexec.exe
Token: SeCreateTokenPrivilege	3024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3024	msiexec.exe
Token: SeLockMemoryPrivilege	3024	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3024	msiexec.exe
3024	msiexec.exe
4236	desktop.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3024	msiexec.exe
4104	msiexec.exe
1728	MsiExec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1728	4104	msiexec.exe	89
PID 4104 wrote to memory of 1440	4104	msiexec.exe	95
PID 3024 wrote to memory of 4236	3024	msiexec.exe	98
PID 4236 wrote to memory of 3520	4236	desktop.exe	99
PID 3520 wrote to memory of 456	3520	msedgewebview2.exe	100
PID 3520 wrote to memory of 2292	3520	msedgewebview2.exe	101
PID 3520 wrote to memory of 2292	3520	msedgewebview2.exe	101
PID 3520 wrote to memory of 2292	3520	msedgewebview2.exe	101
PID 3520 wrote to memory of 2292	3520	msedgewebview2.exe	101
PID 3520 wrote to memory of 2780	3520	msedgewebview2.exe	102
PID 3520 wrote to memory of 4644	3520	msedgewebview2.exe	103
PID 3520 wrote to memory of 4644	3520	msedgewebview2.exe	103
PID 3520 wrote to memory of 4644	3520	msedgewebview2.exe	103
PID 3520 wrote to memory of 4328	3520	msedgewebview2.exe	104
PID 3520 wrote to memory of 4328	3520	msedgewebview2.exe	104
PID 3520 wrote to memory of 4328	3520	msedgewebview2.exe	104
PID 3520 wrote to memory of 4328	3520	msedgewebview2.exe	104
PID 3520 wrote to memory of 4328	3520	msedgewebview2.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WhiffLess_0.1.2_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\WhiffLess\desktop.exe
  "C:\Program Files\WhiffLess\desktop.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=desktop.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4236.3244.4613694570041848327 /pfhostedapp:27a66601451a81a752eb9627f3f3fb75cefdff38
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView /prefetch:4 /pfhostedapp:27a66601451a81a752eb9627f3f3fb75cefdff38 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffc62325fd8,0x7ffc62325fe4,0x7ffc62325ff0
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1700,i,10427820136289365658,17115073220352382597,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:27a66601451a81a752eb9627f3f3fb75cefdff38
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1860 --field-trial-handle=1700,i,10427820136289365658,17115073220352382597,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:27a66601451a81a752eb9627f3f3fb75cefdff38
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1700,i,10427820136289365658,17115073220352382597,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27a66601451a81a752eb9627f3f3fb75cefdff38
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1700,i,10427820136289365658,17115073220352382597,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:27a66601451a81a752eb9627f3f3fb75cefdff38 /prefetch:1
      4⤵
      PID:4328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8ACF15E07D329E927D75DCD4D24EA86B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1728
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5adad2.rbs

Path C:\Config.Msi\e5adad2.rbs
Size 9KB
SHA256 a68a88dd0b101c4aeff12296fe99648d40ebca730be4d8cfbac92b418999b873
MD5 a34db268ea737f8e85ca5242ca1d6f46
SHA1 747cee934a417aa6e9f21d2e20fc766a90ad2abe
SHA512 da2f96dccb47d4e606ed81617023f1384e7446e023cff307237781abf2bf5d116f22804f10e582d0854506f0bbd259eeb31539f692c1bc3d0f7b5db783932ec0
SSDEEP 96:smH9vGj7KAPmCoCnPdPGXUyijcCOTl5UyijcCgjohPDPtaTltOK45POib15PADhK:pdvGj7KMoCwEn/GYn/8uRE31W6iHkpU
TLSH
T17A22F003A60083E3F8972B35C70317643BF3E3D5A3186327598DA62C7F5B7A44A6A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.exe

Path C:\Program Files\WhiffLess\desktop.exe
Size 43.9MB
SHA256 6da1c2b32a64d8009ad4cdfb288a161409b755ae8ae7eaff02d7cddf84d924fe
MD5 34a2182c46e953465a22693309e565ab
SHA1 322d7228505ee7971708dfe1d410fda725e2ca2b
SHA512 1dc947aadfbe25edcabdf99374d19e3081a39072290f4003776c2445240f5a88fb3f6a47a473288f0fc1a1eca62b440387894384eea8439721b843845deb7817
SSDEEP 786432:DxCL7IYcz6id+jKHpBgX4ErHd9/PisthzvLOCxEEs:dCL7IYc2i147lPmCe
TLSH
T1A0A75A107A9BA86DD15AC474834B4A635E3030CB1B39B9FF44D486793FAABF45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhiffLess.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhiffLess\WhiffLess.lnk
Size 1KB
SHA256 116ac55158ed4982f6102748be6ad31227fa932de347fa9434fc4614290cf88c
MD5 b5e1b1c2ae8bd8ea390a8cc47369462a
SHA1 583ec1c70a1d1eb568cd8e8e353d91938e05fe81
SHA512 cf3b9efcc80b662c2ce14ce46b89facf60835b48590ba756e8731ef52505264d3f4b95df1b328fc2d41058aa88f469d6fbf4a0b7b0fecf5a1f2f0d121aec706d
TLSH
T1C541D3109AE62F2AE3B24B355B7305219A35F801FD604B7E80C742950EB8210D979F6B
MD5 SHA1 SHA512 TLSH

Submit Download

WhiffLess.lnk~RFe5ae8bb.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhiffLess\WhiffLess.lnk~RFe5ae8bb.TMP
Size 1KB
SHA256 308ba242e3275c8e14ffaf916c767f3a2baa7c05a29854d64d922f9e46bbc868
MD5 28d2befe77ca17517898e0d1fe1fe399
SHA1 cfc7facf5ff13379a26c534938029ff01777cf08
SHA512 a15effd170776843c1f3ef86d49ca220d2a2e9b1ea27381cf4c0781d24a27e9e6e709ad5bf7b6b36c7c09ffaf2c8e19fa0ed19442dfee3dd4739d10cb3ad9ba7
TLSH
T1DA41C4145BE62F2AE3B257395B730621DB35F801BD604F7E80C742950AB4210E979F6B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI181D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI181D.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0f36118c400089b1545c138db57b505deab5015b527d002677062d9a0a91df3f
MD5 2d02ca76495df4df1fee26ed88845224
SHA1 93df4763b8065a78a9f99bafe92c040aa1aaaf73
SHA512 4badcaf4b168381de873a6629a5ad89a6c0cb911f5a82fa9e8f85806d94bc0ea32a49cd85bf288782fd4bd12f913d00239eab7bdf37e5e5f6d5a974673497819
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4afc00c23215e758760d56a61b84d0f35307238d78825439326b282d25c3ff10
MD5 1414d01fc1766c71749efcec8b78f6ca
SHA1 cfd5b089ec6bd4a9cece5a75926229cc7dae18db
SHA512 c49ba947e3c735359aad4500ca1147e7c0c4af9f882fff59280f1e0e6cb1be9482e8fe7e49a3955aca55a72daf0501ac00ea50d293fde41320f0df8ebc278e50
TLSH
T1EFD0126237830679C01030731502A10C0A05D20B410A4080A429991D5A548541D02843
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3eb943c6-c66e-4ebd-a344-57869e878ad1.tmp

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\3eb943c6-c66e-4ebd-a344-57869e878ad1.tmp
Size 6KB
SHA256 1e0123c5015af48e9a5681084689ba77b9852e565471883c19dd9cf8f6a9856e
MD5 33a04f62b98e937208fc3fbdf4791f03
SHA1 a8e36294a0913b675ef462beb26e74a500c86dd2
SHA512 78c76afa166f1427bad4043263aae9ce4cd8b70d36a5754e5bd3cbf3c203f7954a6a3844077617e2933a0335e8099eb47d58256161d99a1dba1086755310200a
SSDEEP 96:stu/dM+l0cIMVb9wkTo5h16Z0Ts7/x+6MhmuecJ/NS1ejeIK+g4x28XM1C7K:st2OY0GgQonTsV+Fd/EQjUgG6K
TLSH
T1F7D1B5029E28797B5CC6F109BA29BB57E2F99031B0D11E58E7FC462C08DA6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2440cbf1efc579a930843e9077008635f5299569d4939d859782dd6341855c3a
MD5 9a19d1f4608b5b4eb140d1a851fb3ffe
SHA1 90a711b67bcfa8304e036095847832e17eaf20ea
SHA512 27a5d5f62215ba0f47cee2fd1566af606b9004abaa31b674e3af5f4c33b79ac28ed8b983c4e73446197332a10965f10351fbb84b40063195d8f104e243882b47
TLSH
T1F0A0026D9252C003D1051BB225D112C176724B295A238B1F6595017888587905102890
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b6ef3.TMP

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b6ef3.TMP
Size 48B
SHA256 1232b22204fe9ca0c277a9fe29d0da8ba7121479654c0ea49f872d235c4af312
MD5 8b90832b1096b5fd306c34aa39dd4dff
SHA1 257fa8b6092eadc3af80bbf24a0ffbf951cae864
SHA512 1bdfe8ad94afa79e45d9d784c378a41def593ce87218c0fe3006b0edf65c7efa06d2f720a839cc474343b95e89d6aa685208a3b11c324fd103eb9bf888adf7e1
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Local State
Size 2KB
SHA256 90ff65ecd892107a9dcb020544bd4311ea6cf083c1ce7f86316c011012778e40
MD5 39be9788d19004e048737c3679094232
SHA1 a084dd36fa36c69b8e0ac6ba730ad82fd48f14ea
SHA512 4b3c41fb00f832a41cdf9175cb595ee2dcb5f7e5a53dbd300f770e672b723c01cc851a607f6fb65b361147ac618511af1eb70f8c9fce213a8508fcbc34d15c25
TLSH
T11C51B633A854763BA4E2990479467F57DEB9C1A6EA822F60A9EC070800DF55D3747C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Local State
Size 3KB
SHA256 ea63e2b97c022ef6868e7f5f2ab1c8c4597a18d6966ee554a8f8da6b9e3659da
MD5 3a11e522ae9997bed52d9d4f372abc68
SHA1 e022e325b959065374105765a6e1c188e03a6d53
SHA512 35708b7a78f5e8510b497f663bd6e2f38e9066eaeb5ed33f2bb0b1e39ea9beee781e0e03a151253dbc7230cb43a9c13d66a0165ab75cef909c7ea993946109c0
TLSH
T17D71953BA9A4A53B59E2990579863F46BBE58137E5C17FA4D5EC0F0C00DB3982353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Local State
Size 16KB
SHA256 98d83b502265c7dcada0e5b93620e1d44e1d50999d2e4c44a905e61849f80a84
MD5 e612827383e082d7da9bea938ccde5b6
SHA1 68c082898bdacc35054972b85e4b02d127e57ef5
SHA512 c42a8b55b185869be4956bb313e55d70c4bede3454d9129b9dd056c9e1f4bb31fd014c70b5cea0cf5e645c7f139e07c150abad6762496cdd0f844dc524dcfbcf
SSDEEP 384:I+aQikB+z/xvxjg/qhEMNBSDvmlwudlW9zv:H/UxvxjgC+3uIFv
TLSH
T1C6729D2E95A87E37A1F3E50479091F8BDBF894B290C16AB449BC6F0A06DB3D41307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b1a2c.TMP

Path C:\Users\Admin\AppData\Local\com.whiffless.desktop\EBWebView\Local State~RFe5b1a2c.TMP
Size 1KB
SHA256 c5377a2b8ededf8f2ad8eafbd6b69b4d0ae20bf9fb5dc911a6df0c6e400333ff
MD5 e27e4c138392e46c89e2a0709d843f78
SHA1 051d0b68dda293028d6366438a334cfaf2268706
SHA512 d3ae504deb5d8865ac89a0736a8713736e41e245cf9a49eb23a4603da39351178d8d1c7f1684ab734502bb5ee8447c3e325c7ae4f20b9a5a05c361fb8f560057
TLSH
T19C31607AD8A46636B8C179462102BF9FAEB481BBD2415F54B4DC860800EB54D7A6F932
MD5 SHA1 SHA512 TLSH

Submit Download

e5adad1.msi

Path C:\Windows\Installer\e5adad1.msi
Size 20.6MB
SHA256 94872e821f0a99829e8ecea26f718655cdfed020ece863ae8fb03abb5fd9ca85
MD5 47f37d2371229cb8416b9157363d22bf
SHA1 49a583ca5185eba0a58e4fe066f0b72bc5167e6e
SHA512 a6894fa38b3e83341268de2c29b41d8d47cd8337a56db1d2a1c8d5ce6092e99e22e92b870da58762c182f977c745637e52f96e7385a8100987d7880410df089a
SSDEEP 393216:4Z8EnPYuqUJtxVUcHpZitlUeDNsaq26WvEuldAbxsNQpgC6DzXftVRGft:4r7qUJDRri7Rst260EUcx5KzXftLGf
TLSH
T1562733977E84A612C846BDB794FF17789A376D040504DC1B329672FDCAF02F02A696CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 20aa8614c2d730dbb70519f74a944fcc8c3a8fc0c43610a2027af624cc67f10b
MD5 ff196f15e6034a0f577f69dcd744eaaf
SHA1 3e5986b4b73d04fae3ed831d1d3a3c0718319fe5
SHA512 64d7f1f193f7fdeae5b83d9706e8817df7068bc833c9f96f1b800db45a8ea036e68b501857b1f03ea96366b9254b2e91504c1e563130998cd2f524b4f6d7f29e
SSDEEP 24576:OFo3DMPfdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:kHo
TLSH
T11357B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{aa59bd99-1564-463c-846a-8a1f387e5228}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{aa59bd99-1564-463c-846a-8a1f387e5228}_OnDiskSnapshotProp
Size 6KB
SHA256 39adffbddcf5a7744be83a52ea76a5c318ef7a5b5e418010821fb7054bd8e158
MD5 23032b5e11eded936b7c2e73b3ce2cd4
SHA1 3289d934303817d502e83d72c2ca13e3bfc9e919
SHA512 35c95fd239e8de3d068788b93eed10d0c8be7afb4b9449e879200e7d749d48f419f8e4b8a3b2127b52afd5b49063463e4cd6109c601cd25b922c782e6f2e28e3
SSDEEP 96:FX3P6Zvvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:lPgb++uVmN
TLSH
T1B3D1880C5AF54711E2B3AB7129F18557A877B811EF33CB8E0198238E6670910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2292-70-0x00007FFC84280000-0x00007FFC84281000-memory.dmp

Download

memory/4328-155-0x00007FFC84280000-0x00007FFC84281000-memory.dmp

Download