f6a7c04b628d55916dd781057051d702b96b9c76c31d44921fc70c2c24cbb94f

Analysis

user interaction
yes
max time kernel
57s
max time network
59s
platform
windows11-21h2_x64
resource
win11-20260911-uk
resource tags

arch:x64arch:x86image:win11-20260911-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
02/10/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EZFN-Hybrid-Setup.msi
Size 8.8MB
Sample261002-rmyxvazcpf
SHA256 f6a7c04b628d55916dd781057051d702b96b9c76c31d44921fc70c2c24cbb94f
MD5 84f9a89ebabf369150e45a7a592a21d3
SHA1 78edb230f3210bcda259d35642396aa31b561143
SHA512 88541ed4255a0602376992a30341b22a6f899998fe86ad0aa71371661d3eb93aabb57e33173b385dea6fa5f113345fd1e8824f1ced9f551d5c983f18419a0aa1
SSDEEP 196608:f9oKX8c38E+Ar3C48oCHo11EhUZP1YihV0KxDtOtlk1:GM3v3WoCI11EhUAiQKhtOtlk
TLSH
T1EC9633ABBEA0E527C5A12D36513DEB91A82A7C041346E60733C172DDE4F21F09BA7DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4564	netsh.exe
2624	netsh.exe
2084	netsh.exe
4148	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
3160	hybrid.exe
3628	WinDivert64.sys

Loads dropped DLL 2 IoCs

pid	Process
2984	MsiExec.exe
3160	hybrid.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hybrid.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	hybrid.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\EZFN Hybrid\hybrid.exe	msiexec.exe
File created	C:\Program Files\EZFN Hybrid\WinDivert.dll	msiexec.exe
File created	C:\Program Files\EZFN Hybrid\WinDivert64.sys	msiexec.exe
File created	C:\Program Files\EZFN Hybrid\Uninstall EZFN Hybrid.lnk	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{734C806D-A134-414C-87C3-D47486D052E1}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD818BFC7F0792C2A.TMP	msiexec.exe
File created	C:\Windows\Installer\e58dd8c.msi	msiexec.exe
File created	C:\Windows\Installer\e58dd8a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF96D987705294ADEB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF10.tmp	msiexec.exe
File created	C:\Windows\Installer\{734C806D-A134-414C-87C3-D47486D052E1}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{734C806D-A134-414C-87C3-D47486D052E1}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACDEBB4BD7567600.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF949F8BFCADBFEC28.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58dd8a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
568	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hybrid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hybrid.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a0ced4dedd8b0f9b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a0ced4de0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a0ced4de000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa0ced4de000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da0ced4de000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList\PackageName = "EZFN-Hybrid-Setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D608C437431AC414783C4D47680D251E\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\ProductIcon = "C:\\Windows\\Installer\\{734C806D-A134-414C-87C3-D47486D052E1}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\59E676F021E78FC58BF6866A429F1D33\D608C437431AC414783C4D47680D251E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D608C437431AC414783C4D47680D251E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D608C437431AC414783C4D47680D251E\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D608C437431AC414783C4D47680D251E\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\PackageCode = "D21F4007EC1180F4B98EA302F4B90D9F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D608C437431AC414783C4D47680D251E\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\ProductName = "EZFN Hybrid"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\Version = "16842760"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D608C437431AC414783C4D47680D251E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\59E676F021E78FC58BF6866A429F1D33	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3228	msiexec.exe
3228	msiexec.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4920	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	568	msiexec.exe
Token: SeSecurityPrivilege	3228	msiexec.exe
Token: SeCreateTokenPrivilege	568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	568	msiexec.exe
Token: SeLockMemoryPrivilege	568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	568	msiexec.exe
Token: SeMachineAccountPrivilege	568	msiexec.exe
Token: SeTcbPrivilege	568	msiexec.exe
Token: SeSecurityPrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeLoadDriverPrivilege	568	msiexec.exe
Token: SeSystemProfilePrivilege	568	msiexec.exe
Token: SeSystemtimePrivilege	568	msiexec.exe
Token: SeProfSingleProcessPrivilege	568	msiexec.exe
Token: SeIncBasePriorityPrivilege	568	msiexec.exe
Token: SeCreatePagefilePrivilege	568	msiexec.exe
Token: SeCreatePermanentPrivilege	568	msiexec.exe
Token: SeBackupPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeShutdownPrivilege	568	msiexec.exe
Token: SeDebugPrivilege	568	msiexec.exe
Token: SeAuditPrivilege	568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	568	msiexec.exe
Token: SeChangeNotifyPrivilege	568	msiexec.exe
Token: SeRemoteShutdownPrivilege	568	msiexec.exe
Token: SeUndockPrivilege	568	msiexec.exe
Token: SeSyncAgentPrivilege	568	msiexec.exe
Token: SeEnableDelegationPrivilege	568	msiexec.exe
Token: SeManageVolumePrivilege	568	msiexec.exe
Token: SeImpersonatePrivilege	568	msiexec.exe
Token: SeCreateGlobalPrivilege	568	msiexec.exe
Token: SeCreateTokenPrivilege	568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	568	msiexec.exe
Token: SeLockMemoryPrivilege	568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	568	msiexec.exe
Token: SeMachineAccountPrivilege	568	msiexec.exe
Token: SeTcbPrivilege	568	msiexec.exe
Token: SeSecurityPrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeLoadDriverPrivilege	568	msiexec.exe
Token: SeSystemProfilePrivilege	568	msiexec.exe
Token: SeSystemtimePrivilege	568	msiexec.exe
Token: SeProfSingleProcessPrivilege	568	msiexec.exe
Token: SeIncBasePriorityPrivilege	568	msiexec.exe
Token: SeCreatePagefilePrivilege	568	msiexec.exe
Token: SeCreatePermanentPrivilege	568	msiexec.exe
Token: SeBackupPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeShutdownPrivilege	568	msiexec.exe
Token: SeDebugPrivilege	568	msiexec.exe
Token: SeAuditPrivilege	568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	568	msiexec.exe
Token: SeChangeNotifyPrivilege	568	msiexec.exe
Token: SeRemoteShutdownPrivilege	568	msiexec.exe
Token: SeUndockPrivilege	568	msiexec.exe
Token: SeSyncAgentPrivilege	568	msiexec.exe
Token: SeEnableDelegationPrivilege	568	msiexec.exe
Token: SeManageVolumePrivilege	568	msiexec.exe
Token: SeImpersonatePrivilege	568	msiexec.exe
Token: SeCreateGlobalPrivilege	568	msiexec.exe
Token: SeCreateTokenPrivilege	568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	568	msiexec.exe
Token: SeLockMemoryPrivilege	568	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
568	msiexec.exe
568	msiexec.exe
3160	hybrid.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2984	3228	msiexec.exe	80
PID 3228 wrote to memory of 1516	3228	msiexec.exe	84
PID 568 wrote to memory of 3160	568	msiexec.exe	87
PID 3160 wrote to memory of 4920	3160	hybrid.exe	88
PID 4920 wrote to memory of 2052	4920	msedgewebview2.exe	89
PID 4920 wrote to memory of 764	4920	msedgewebview2.exe	90
PID 4920 wrote to memory of 764	4920	msedgewebview2.exe	90
PID 4920 wrote to memory of 764	4920	msedgewebview2.exe	90
PID 4920 wrote to memory of 1628	4920	msedgewebview2.exe	91
PID 4920 wrote to memory of 1540	4920	msedgewebview2.exe	92
PID 4920 wrote to memory of 1540	4920	msedgewebview2.exe	92
PID 4920 wrote to memory of 3600	4920	msedgewebview2.exe	93
PID 4920 wrote to memory of 3600	4920	msedgewebview2.exe	93
PID 4920 wrote to memory of 3600	4920	msedgewebview2.exe	93
PID 3160 wrote to memory of 4564	3160	hybrid.exe	94
PID 3160 wrote to memory of 2624	3160	hybrid.exe	96
PID 3160 wrote to memory of 2084	3160	hybrid.exe	98
PID 3160 wrote to memory of 4148	3160	hybrid.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EZFN-Hybrid-Setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files\EZFN Hybrid\hybrid.exe
  "C:\Program Files\EZFN Hybrid\hybrid.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hybrid.exe --webview-exe-version=1.1.8 --user-data-dir="C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=uk-UA --mojo-named-platform-channel-pipe=3160.2380.4793163335600431275
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffced8eb078,0x7ffced8eb084,0x7ffced8eb090
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView" --webview-exe-name=hybrid.exe --webview-exe-version=1.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1652,i,5158113378419233313,10652606321280980645,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:2
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView" --webview-exe-name=hybrid.exe --webview-exe-version=1.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2008,i,5158113378419233313,10652606321280980645,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView" --webview-exe-name=hybrid.exe --webview-exe-version=1.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,5158113378419233313,10652606321280980645,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView" --webview-exe-name=hybrid.exe --webview-exe-version=1.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=uk_UA" --always-read-main-dll --field-trial-handle=3584,i,5158113378419233313,10652606321280980645,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3600
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall delete rule "name=EZFN Hybrid Interceptor (In)"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4564
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall delete rule "name=EZFN Hybrid Interceptor (Out)"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2624
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule "name=EZFN Hybrid Interceptor (In)" dir=in action=allow protocol=TCP localport=50078,50081
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2084
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule "name=EZFN Hybrid Interceptor (Out)" dir=out action=allow protocol=TCP localport=50078,50081
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9840852DE78D1744586F5B866A970BF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3452

C:\Program Files\EZFN Hybrid\WinDivert64.sys
"C:\Program Files\EZFN Hybrid\WinDivert64.sys"
1⤵
- Executes dropped EXE
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58dd8b.rbs

Path C:\Config.Msi\e58dd8b.rbs
Size 10KB
SHA256 97262f834aabd6463dccf3b67ae4ebf7b41c6f6569d5b88ebc00bf31b807241d
MD5 e18a8ced0006ee922435d273994bfea9
SHA1 d93462bb7e06bab7ee93fa8c30d3a78629337d16
SHA512 ca12745187b0952ff0aed65be83f8cae2fbde2f5173e1c05e81dc4e4a5c45e2a1ee2cf39328740635112b0dce2378f97e5d2e481fd80d1b03755e461bd3ec9aa
SSDEEP 192:RBVRjzL5cJZritGCa0+l+hGo+h+4OuPwILA/hILAslILAQxWILA9iBYvlGwqJp5O:R7RjzLCJZritI+T+7AYAbAiAkW
TLSH
T1F0322F01A615C2D2F6D77B35CB0B2B1237B2DBC55700738B09CE91209F973995FA899B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\Program Files\EZFN Hybrid\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Program Files\EZFN Hybrid\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hybrid.exe

Path C:\Program Files\EZFN Hybrid\hybrid.exe
Size 21.5MB
SHA256 0d4b1c147527b61f192749b95c0fbc6974f3e6d50c8931b3ade3de27789a6c89
MD5 56c9813b726b3219256d62dccf53c735
SHA1 9fd18255277f123e522a7dff750243da71574dbb
SHA512 699b930d37a71009842d315978f2492dbfea1086634132319427236457bb46ff3f8c53aa1d136b82cbbf4654fe6186d86603dbbd6233028e9210c93be043d748
SSDEEP 196608:+mJRTnf87YC9zl7kvqQwDWi37RIYtFw1DglE4UNap:+687YC95ky1r7+ymDglE4np
TLSH
T1073728157B5B99ACD19AC87083468AB30E2170DB0A36B9FF44C452393F7DBF46F28259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Hybrid.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Hybrid\EZFN Hybrid.lnk
Size 1KB
SHA256 6017ce65599880caf542bce7028a1da759a908693bd72bfface479a3f6a2671c
MD5 f6e2b4fc1da86e79e6ceaab7e820b2c6
SHA1 1e4a0315aff9e5fdfb156db6fcdf8280c193a4ab
SHA512 03223473173888fc0c72c94a5edaf859eba11f5c036fb66fbe940a277b048836e470b4751050382bbf4a74a15cef89d011c9102feebacfa68ac2de32ace7afce
TLSH
T11241026057990B1BE7F24E759D1317954271FC01E3784F2B81C582C50874601DA6CF7E
MD5 SHA1 SHA512 TLSH

Submit Download

~ZFN Hybrid.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Hybrid\~ZFN Hybrid.tmp
Size 1KB
SHA256 ef84c5b8099d4d007d58da0a0dec98dfe5ab25deb924159527946e2bf78c6016
MD5 ed413a39ebd33b50b65ce4a6542f6be4
SHA1 d8e9635b3e770880cebdb5948c0ded4a2a01e328
SHA512 13bc204bcbbb44ca394058642e8c001465712129f71f46875460fd65ef113ccaf3c97bf7cc0bd5b9825921002c2f4a9a5ce762cf57d0377d7c83b12c8660e801
TLSH
T18D41CC2067990B5BE7F24A76992256AA4261FC05E2784F2B81C582C40874601DA6CF7E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9FD5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9FD5.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

181b6fdd-a5d7-46e7-9116-1d009ea58608.tmp

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\181b6fdd-a5d7-46e7-9116-1d009ea58608.tmp
Size 4KB
SHA256 cee9d10e2998bd6c90e8f2f3f9ba2fbdc15bfe52203415e3dcb2fd9dc591bbce
MD5 426c6ceac7e4e4c403260a55a0a70eb0
SHA1 b47fbfc1030193b91d3d6344b0c5a91778f15d11
SHA512 f60c517b9793749bda806f0553a7d203efcb26833cd063ff8ce8c513e830c4eb59ed1ab9c1674ca97e10c1933eada36f8290631c014e54b59f173d0f1fb18a6a
SSDEEP 96:zuVbNkCuf4i+P8Frh/cInURoDotoJ5yEp+DyBsrL6m+Z40ZWV1T26Ma:zQbNbbiTooDUCxpYSsr9UCB
TLSH
T1F091B432A568B9774DE29A42B9463B03A6B55127E4D53FA8DAED0F0C01EB3D91303C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bb12a86-d984-4739-a2cb-ab683d336b1b.tmp

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\6bb12a86-d984-4739-a2cb-ab683d336b1b.tmp
Size 3KB
SHA256 748b01f8e37d0ec5f9d24247dd4c32722b008cf02de9ec6e7653a41f8b68a388
MD5 b8c9672f106f30a55d1e8ae1eb121975
SHA1 4260640719eacef3e335b725f84e69e90c3637d2
SHA512 01690a338522ae969c844f6b0407e2635abeea6b5a8c056be9278b332498e7c442a09fd1e84107707e2068c107308022c9dc8be40ea75562d2b1a0bc717a11e0
TLSH
T10E719532A968B9774EE29A41B9863B03B6755227E5D53FA8D9ED0F0C01DB7D81303C17
MD5 SHA1 SHA512 TLSH

Submit Download

73e07a10-4e10-4dec-be62-1b4535de7b2b.tmp

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\73e07a10-4e10-4dec-be62-1b4535de7b2b.tmp
Size 2KB
SHA256 eaec89d19c81da0ee907aad407e1fc3b1306aa27ddeb591c62f5600621a1efc3
MD5 82a8a76a5f0662a630fbec581f90f738
SHA1 bc0289e9a3ade02f045e29c0068f0be66523b6ad
SHA512 0b8ef8ad418c12f7da214c125d76820051e9a0add20923c3cc33e69a98358d5a238b545f39be1b81491546c9cf0d524c159541396e77f292cd405c4d93a0e9f3
TLSH
T18B51E933AD18BA778EE2464579067F13DA355267A5921F94E9ED0B0C00EF69C1303C27
MD5 SHA1 SHA512 TLSH

Submit Download

7fbaae35-be34-4f57-8c88-036181d9f859.tmp

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\7fbaae35-be34-4f57-8c88-036181d9f859.tmp
Size 1KB
SHA256 fc9ec62d188e53b56ce0c0b5f03ee023c540daf19c3c8ff62e1ce7245880758f
MD5 e5bd42e08a3bc2994226375a740ad0a2
SHA1 81e8837d41843248352a4e9f94a41b3ad19c183b
SHA512 39ddd0c7641aeffd1febdbaeb227a763ee3f94f23f798a5298556f05588333e82a9f40c3fcb97a15bf6a6fc76735f08d623949b434fbc4ea68829b5c82ba1a9d
TLSH
T13931B533D9987B76ADD166827202BA439D31112B90910E4CA5EE061801EBACD062BD23
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1b094a7428dce17357f9e55492e8368178bf8b27d0adb30078d3f17ffd11be8b
MD5 cf14b3a4dd706541e74f2a8e542081cd
SHA1 0d6f2c6498cc091fa74be98e183dbfc2c75c6c1f
SHA512 98faf148090cb040cd6298fa0775ff5c201e613debfdf62aef029c75be1bc347774553da7da2b3aff32eff7867099808f2c48001996fdf026118e97168b197c8
TLSH
T1AFD0121737814578C01038B34442710A3980D50F410D41006428C51E1E144500907841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bcc4c6f330c27db4e5a79dac27c51cf7b62ebe5413372b85a8f4b77f663d7f93
MD5 61835c06e8c909f1e5de22a1b5aabcdf
SHA1 df9559ac725feded648747b6fd070a596e97fc57
SHA512 e0aee8833aee339dfcec73cb4eb6946782793e159bda5202690e23b68ed6baca5219f2c8a32176379eddaff720319bac2df07851babbdc632769cde84343b532
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 cb78b91f87ad43e63d5ca40973134bd8103b6e8e0785b23ebb3e4bc99085ad3c
MD5 9e2739946dd172e28100ca7f9199c1ee
SHA1 f7299a17046abb39892a3d1229e729d28b489123
SHA512 d0dc6afef9feffd4ca849724b423ce4bda687dd33a8462a2303c4326a8b748e84a3d6aea1a52987178a6664b61b62cfe5ecd563cc6e339d2975379a63992e46d
TLSH
T1FEA0026949C15523D1100772A5C64AB63630583813174F1A45D581F4FC72391AA410D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 28d7b1c2240f865b377e2627e6b2b7b4d8aacadb481019bbf93d652045cb601b
MD5 7f53051006f2708c5dc2b1fcb3be8a4c
SHA1 5fc465dad640fea7221f1213c1af5bcb7d8f0095
SHA512 a536601043956ea28e1701d9e220a9f40c157a2b00a97b57e61664ce15872522ff2c9c391b6ade5e29ea5246036b6c43a3e1e38c560ff4da1dfc3c10b3761350
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\EBWebView\Local State
Size 1KB
SHA256 0479bfaeecd12668262c1fb11ef718dced391b5b24e7fd5f1b6b2cc92ae26110
MD5 eeed31dc461beeef3f89bac3ee8068e0
SHA1 81014dbe083dd5a5a9be6f81c256e174ba8b617e
SHA512 d8cda2f5b5eebe2caf36de404178b83ebe684f4263f253c8bafd9c50ccb1c4ebea7a3f9651b61e01b5804079532681c62b15349cf4235d7d9fe925d8179552db
TLSH
T1CD218433C898BA76BED15592B202B7476D31526B91944E1CF5EE021802EBEDD473BC33
MD5 SHA1 SHA512 TLSH

Submit Download

diagnostics-health.log

Path C:\Users\Admin\AppData\Local\com.ezfn.hybrid\diagnostics-health.log
Size 93B
SHA256 0c23df53d5bc121f273b844a112ad0227e5aae6587a10c783da777fdf1454ad0
MD5 45610f96a5b8e03c2b1fbe266205cc31
SHA1 1e1c6893c61bf64c8bec155e425721ac481bf0e5
SHA512 6405af6085c321775697a8b7a6bf5dfbc6a7e8305d2aa17d105238b0ab29b01ce7e7cd7bedff90483039cbcc4ce15a3e21aef3ed303bc667bb67b54e5fd61fad
TLSH
T139B01200620420150F4433225410C586C5430C20380413E203E3534B443A5718481810
MD5 SHA1 SHA512 TLSH

Submit Download

e58dd8c.msi

Path C:\Windows\Installer\e58dd8c.msi
Size 8.8MB
SHA256 f6a7c04b628d55916dd781057051d702b96b9c76c31d44921fc70c2c24cbb94f
MD5 84f9a89ebabf369150e45a7a592a21d3
SHA1 78edb230f3210bcda259d35642396aa31b561143
SHA512 88541ed4255a0602376992a30341b22a6f899998fe86ad0aa71371661d3eb93aabb57e33173b385dea6fa5f113345fd1e8824f1ced9f551d5c983f18419a0aa1
SSDEEP 196608:f9oKX8c38E+Ar3C48oCHo11EhUZP1YihV0KxDtOtlk1:GM3v3WoCI11EhUAiQKhtOtlk
TLSH
T1EC9633ABBEA0E527C5A12D36513DEB91A82A7C041346E60733C172DDE4F21F09BA7DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 6341b743492f59a555851a5ec2e0ad9f3603a1aa71c2c89c8dd60b31485c08b5
MD5 f6ca6ebd735095d1f67dd51187ca3aeb
SHA1 6c63d8a9f4ad014b35cff50ba16065b86a896a96
SHA512 a818eff840112e447604f6153c7d2c0463bc95c5a33cfa49e9237556ca650dc547883283f281d4ac37122b1920613431c2a08d86ad29c0b8014642924c58e25d
SSDEEP 24576:J2gmSp1PdoO/vvTLrmAuhUHqf6JrQYkq2WTdXJEwpbaIkM0VoLBnrd6nh:/
TLSH
T19B47A12436F92240E7F79E7CA8F06A234D3A7D5B9C199E8D45411F4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{043f4dd9-e18d-443c-976f-58f82244cd7a}_OnDiskSnapshotProp

Path \??\Volume{ded4cea0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{043f4dd9-e18d-443c-976f-58f82244cd7a}_OnDiskSnapshotProp
Size 6KB
SHA256 06b1c9ee02b00bf5f02fa0769917ee55e3a4fc344a19b2e2ac77c607c52c617f
MD5 7236a2394f57a251f8fe50f0ee8d8365
SHA1 5360363bd96a3e09064adc7b6e950294f8909649
SHA512 13f8dbf1b323b3592ad3c2e8cf398c63d3b09d9cd2d18c6abddd47aa665839b1e57761965c16fdb91a6327619e0d9f4dc13dada6fce335cca60ec4c6453467ea
SSDEEP 96:FX7lJvvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:l7Bb++ZVm
TLSH
T1EFD189085AE54711E2B3AB7128F18557A877B911EF33CB8E0298638F6670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-80-0x00007FFD0DBE0000-0x00007FFD0DBE1000-memory.dmp

Download

memory/3160-278-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3600-177-0x00007FFD0DBE0000-0x00007FFD0DBE1000-memory.dmp

Download