a9b0615c61b914fd793fe6b686263ea67f48c00d66cf23c682552c4189f07229

Resubmissions

11/10/2026, 09:25

261011-ldl9ssfc938

11/10/2026, 09:18

261011-k94chs112m8

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3574378_7_-setup.msi
Size 2.8MB
Sample261011-ldl9ssfc93
SHA256 a9b0615c61b914fd793fe6b686263ea67f48c00d66cf23c682552c4189f07229
MD5 ef1fc8fa86842f6f2fb881c652217559
SHA1 8808bd4bf7fe4b7e0f36a456a98c7c022b71312c
SHA512 c50e090909fba90e71cc6c4358582b29d77f31b417538557d956595529bd1e0571258e76638dc10d9bada60019d83c2f67a1e20bd7c20ebeb8030cb1fa218ddd
SSDEEP 49152:piAsbSegiBx8/uZcg/PM3dAOuPEnI7SCl:UAsbdbZrwn1W
TLSH
T1B4D53C636A50204552B1A9FAAEBE5D3B784F3409101AD98EFED24B4EF52D6FD4C02D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	4760	powershell.exe
13	4760	powershell.exe
14	4760	powershell.exe
15	4760	powershell.exe
16	4760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4760	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
12	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1744	wscript.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF1BAE65D0F7ECF454.TMP	msiexec.exe
File created	C:\Windows\Installer\e599e4a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8ACB378094013D7C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1CE077C2-41FC-4EA8-BB42-81D4E1712940}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA35A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA50462BB99ABE35C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e599e4a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA5032FABDFB3C8E6.TMP	msiexec.exe
File created	C:\Windows\Installer\e599e4c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2080	msiexec.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2448	cmd.exe
2848	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b02efcd1ac1ce3290000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b02efcd10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b02efcd1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b02efcd100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b02efcd100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4336	msiexec.exe
4336	msiexec.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2080	msiexec.exe
Token: SeSecurityPrivilege	4336	msiexec.exe
Token: SeCreateTokenPrivilege	2080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2080	msiexec.exe
Token: SeLockMemoryPrivilege	2080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2080	msiexec.exe
Token: SeMachineAccountPrivilege	2080	msiexec.exe
Token: SeTcbPrivilege	2080	msiexec.exe
Token: SeSecurityPrivilege	2080	msiexec.exe
Token: SeTakeOwnershipPrivilege	2080	msiexec.exe
Token: SeLoadDriverPrivilege	2080	msiexec.exe
Token: SeSystemProfilePrivilege	2080	msiexec.exe
Token: SeSystemtimePrivilege	2080	msiexec.exe
Token: SeProfSingleProcessPrivilege	2080	msiexec.exe
Token: SeIncBasePriorityPrivilege	2080	msiexec.exe
Token: SeCreatePagefilePrivilege	2080	msiexec.exe
Token: SeCreatePermanentPrivilege	2080	msiexec.exe
Token: SeBackupPrivilege	2080	msiexec.exe
Token: SeRestorePrivilege	2080	msiexec.exe
Token: SeShutdownPrivilege	2080	msiexec.exe
Token: SeDebugPrivilege	2080	msiexec.exe
Token: SeAuditPrivilege	2080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2080	msiexec.exe
Token: SeChangeNotifyPrivilege	2080	msiexec.exe
Token: SeRemoteShutdownPrivilege	2080	msiexec.exe
Token: SeUndockPrivilege	2080	msiexec.exe
Token: SeSyncAgentPrivilege	2080	msiexec.exe
Token: SeEnableDelegationPrivilege	2080	msiexec.exe
Token: SeManageVolumePrivilege	2080	msiexec.exe
Token: SeImpersonatePrivilege	2080	msiexec.exe
Token: SeCreateGlobalPrivilege	2080	msiexec.exe
Token: SeBackupPrivilege	4844	vssvc.exe
Token: SeRestorePrivilege	4844	vssvc.exe
Token: SeAuditPrivilege	4844	vssvc.exe
Token: SeBackupPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2080	msiexec.exe
2080	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2080	msiexec.exe
4336	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4960	4336	msiexec.exe	94
PID 4336 wrote to memory of 2448	4336	msiexec.exe	96
PID 2448 wrote to memory of 2848	2448	cmd.exe	98
PID 2848 wrote to memory of 2320	2848	cmd.exe	100
PID 2320 wrote to memory of 1988	2320	powershell.exe	101
PID 1988 wrote to memory of 2972	1988	csc.exe	102
PID 2848 wrote to memory of 1744	2848	cmd.exe	103
PID 1744 wrote to memory of 4760	1744	wscript.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" /min /wait cmd.exe /c call "C:\Users\Admin\AppData\Local\JYGoLQgp\hUXFhBCT.bat" "C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\System32\cmd.exe
    cmd.exe /c call "C:\Users\Admin\AppData\Local\JYGoLQgp\hUXFhBCT.bat" "C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -w h -c "$q=[char]34; $d='public static class N {[System.Runtime.InteropServices.DllImport('+$q+'kernel32.dll'+$q+')]public static extern System.IntPtr GetConsoleWindow();[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern System.IntPtr GetAncestor(System.IntPtr h,uint g);[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern bool ShowWindow(System.IntPtr h,int n);}'; Add-Type -TypeDefinition $d; $c=[N]::GetConsoleWindow(); $r=[N]::GetAncestor($c,2); if($r -eq [IntPtr]::Zero){$r=$c}; [void][N]::ShowWindow($r,7)"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cvz1c3ht\cvz1c3ht.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1988
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA975.tmp" "c:\Users\Admin\AppData\Local\Temp\cvz1c3ht\CSCEEBCA81A5EBF419E9333311F963C260.TMP"
        6⤵
        
        PID:2972
  - - C:\Windows\System32\wscript.exe
      wscript //B //nologo "C:\Users\Admin\AppData\Local\Temp\b14182.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\JYGoLQgp\hUXFhBCT.bat');$i=$r.LastIndexOf('REM#');&([scriptblock]::Create($r.Substring($i+4)))"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599e4b.rbs

Path C:\Config.Msi\e599e4b.rbs
Size 8KB
SHA256 58ef6370a6d005bf3744043cb8cf171e07761abdb66174f396446b4d3a896b5f
MD5 09716527aa07a7c7a96ee228d4b2bb94
SHA1 f7c94a86986860491d960a702379457c8f49b741
SHA512 c186b1454fc1571b8554e80fa84329f0e902ec5a1db8d42703e885ec5282dda30e06f488638950b7dfb8d3eeda887599767fc8f58de85b475442960e94c7d0b7
SSDEEP 192:Xvk9h8Y4C5gshxQFQK7I33xQFQK7P/b23xaPOLMdkkgxvops1IDx6hSMb:Xvk9h8YdxQFQK83xQFQK3yxZh3
TLSH
T18902F0007625D6E2E95D3679C20B17347BF2E3EEE312B3AB198C40244F97B885ED9196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hUXFhBCT.bat

Path C:\Users\Admin\AppData\Local\JYGoLQgp\hUXFhBCT.bat
Size 30KB
SHA256 68aa9329dcff63760ae239b0d3e295525c14207d7646f9c320831823f37e55fd
MD5 eebab39fd492ecd78ec5bd9dd655113a
SHA1 9a7a13405def8220b059b7cb0fa27abe1fb51004
SHA512 825739429dc1c29d607fd4d0ee5bb572f6d7e47078d0fbf680e370fda2d6b935a48680dbc2eb23cb18a35da1b66caec476acc839d59c5bd37ff0c9ee145c2c25
SSDEEP 384:JK9fZ0SM/yd/H/R/H/q939b9h9gZcPdhWHPaEAlRy/En77x9GwMgZTzisCc1vxzH:J5rt5/+AyGvZz8mwv2xzL
TLSH
T1D2D2D3D3036086ED96D001EAC419760309FAD56B5C6C714EBF425DEFF82D6A346AFB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2368cd63c900efc3fbaf09cd61db14265b4575184e813d8812b55e82643b39f1
MD5 5055ab6a271cf6d43ac04c911e1ce71b
SHA1 3c91fd6efe0dfd2e1fd8aaaa75a41b18c558aa31
SHA512 63a96e06cd72470fab0671f16f8af5c028016ee21768236180cf58829e1476aebc5fc3b0d3f61c5b9530c1e571f22a707921859c1b871da34dddd1efc68756ac
TLSH
T1FF215733F3CC8624CC9A403610CEAC1537B687DB409EDE6BBB84D549B42F689DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

RESA975.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA975.tmp
Size 1KB
SHA256 456b8c80b52675a43b5885af4210c520bd2b1a369dd56109c61e11cd13be971c
MD5 394f84953909f74793a5e1d6799a3f16
SHA1 84286765a44bbe0ebb2c65b614afdec03ec887b3
SHA512 bd00737441e48a34b093501da8d3290c3bd545b49c984b64861019ac0fc5574e2428d1d2d62ce053302e920eae10004df4cde6a61f1f97a3ac21bb802b2c60f3
TLSH
T17B21EF0583EC470BF073573169F6072FA568FD65DFB5976B8580022C2C01540DEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4k0ixwqn.kw1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4k0ixwqn.kw1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b14182.vbs

Path C:\Users\Admin\AppData\Local\Temp\b14182.vbs
Size 175B
SHA256 a37ecd480b44bf715fc30be4f744e50efe937e62817c15e3a9439417cf7e4dfe
MD5 ebbb3743cc9ff8f26666145af45ca31a
SHA1 2c1e742bd23e050ad763e813de26bd410c2061d0
SHA512 3401b368adf0fe77b5ef806fada946b914dd518ed2a3a48d65489c53b23c747eee8edf9982d69955ee90e44b53f2ca3dbdff9f5861b8fd16c5ff3d47cbac1723
TLSH
T157C0C006751CA58C0703C01F40E9B9188C93F204010022137AB0CA157400190819104F
MD5 SHA1 SHA512 TLSH

Submit Download

cvz1c3ht.dll

Path C:\Users\Admin\AppData\Local\Temp\cvz1c3ht\cvz1c3ht.dll
Size 3KB
SHA256 09e40cb26cf4a02c6d360ba495edbae55cfed68723edb3d6af409eb35b109333
MD5 825806d20cce868b17192a70fc2c5bec
SHA1 5d072c19666b678f28eaf4a21cbb767ef27f8f17
SHA512 9b7de870ff04caa7280541ac71b21583d96273fce54b18ea0368538085ac78446246d17f5ae1569b7dd71e3bf199647ba919e4f6fb73edd30b82865f7bb8e1a8
TLSH
T14851FB1B93E80A3BF4670730ADF307173BA4F8509B33972A1980422CAC606688E71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

e599e4c.msi

Path C:\Windows\Installer\e599e4c.msi
Size 2.8MB
SHA256 a9b0615c61b914fd793fe6b686263ea67f48c00d66cf23c682552c4189f07229
MD5 ef1fc8fa86842f6f2fb881c652217559
SHA1 8808bd4bf7fe4b7e0f36a456a98c7c022b71312c
SHA512 c50e090909fba90e71cc6c4358582b29d77f31b417538557d956595529bd1e0571258e76638dc10d9bada60019d83c2f67a1e20bd7c20ebeb8030cb1fa218ddd
SSDEEP 49152:piAsbSegiBx8/uZcg/PM3dAOuPEnI7SCl:UAsbdbZrwn1W
TLSH
T1B4D53C636A50204552B1A9FAAEBE5D3B784F3409101AD98EFED24B4EF52D6FD4C02D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f77052634ded11f95043d5add976f823a9c80dad6aafc865d942f7c8cfa2c9c4
MD5 7a5e9c549f42049aedc0291955a164a9
SHA1 38d2a3db61bc3be8daa4f7a873577b809a37f3cd
SHA512 1805a842ae26d8d1ef952c2c7f0e12eea934928dfea711f3fcd83f36552d7d302bcee6530e98daa5e8df7549ef1038fa72a1f154fe9715b0196430daa8f84e56
SSDEEP 24576:7Fo3DMPadoO/vvTL/SAffCVQ/buFUbY8kCp9NiBHpqxaZYefc4RGPW1+reP:YHo
TLSH
T15C57A22436F92240F7B79E3CA8F56A234D3A7D5B9C19DE8D05411B4E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f68a6390-2c19-45dc-b25e-aa56bae216e0}_OnDiskSnapshotProp

Path \??\Volume{d1fc2eb0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f68a6390-2c19-45dc-b25e-aa56bae216e0}_OnDiskSnapshotProp
Size 6KB
SHA256 0d84a8a6cc6adac1873b5e25437446babc3c3a62a789a597537549f83bcc9048
MD5 f306f1ff3a47b8c77e13a748d502fc9b
SHA1 572f322fc22b3f1211faec8b8f05445ed6c88813
SHA512 5764c502d45f793a007855057a558b57c500d60e1d854d12667070f6a759a0d296510224ab0500720694b2e9f18d8a0a66d8beefb8272456b83b496956ac4cb0
SSDEEP 96:FMVqofzdvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:uVRb++uVmN
TLSH
T148D1781C5AE54711E2B3AB3128F54557A877B911EF33CB8E0198238E6670910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCEEBCA81A5EBF419E9333311F963C260.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cvz1c3ht\CSCEEBCA81A5EBF419E9333311F963C260.TMP
Size 652B
SHA256 719630329358dd010f75cb14eba31e9f18cf2e575bcd5e0c67a340d91498218d
MD5 c9c3092b5ccdf7a874a170237a7e7f2b
SHA1 817fed660ee0357ed9ea1024c86f41666f561cdf
SHA512 77b2cb276ed2dbd841d81afb26f96e21763c65fa8cbbadbc823020f50baec9c17beadad5dba75e8c8d70bc4c35b72530e9659c4876321c6c36d68a6998893a63
TLSH
T15CF05E0963F8120EF0F34B30BDF64363A9A8BD65DE3297ED5440031D28649148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cvz1c3ht.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cvz1c3ht\cvz1c3ht.0.cs
Size 382B
SHA256 42706b4746dc80e36b32b6c85865604af5d31b57467671860ef7722aef4e64c0
MD5 e8a57df085b6a0c42350072108b2087c
SHA1 50f043ec7ff8d2f41a16069a1f69baa37d556f82
SHA512 c657d649b03ecb7ca057b0fb3a04cbee1253a9902d36045c7aa9c40693559218c8c27fc604b06786e1ba44d59be73e39677aec7a708b095b3ca36dcfb03f8eb0
TLSH
T1A0E09224979BEC3901C2081B6C56D0AC9677822822B8BE01F2E75315CECB00A27372A0
MD5 SHA1 SHA512 TLSH

Submit Download

cvz1c3ht.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cvz1c3ht\cvz1c3ht.cmdline
Size 369B
SHA256 097641d3df40aa8072c19cfbfa76a28dde7f1f6325c131681d92cc39bfec0690
MD5 62abf53ce1911b26f4509ac0235043a0
SHA1 08df8691590cab303eec253ef981a22f770c49e9
SHA512 bb952a3aa41069362ef67e83982c927d1c529bcaa26f2e8cacf5cfe87d6d61fad592093785c81a7237eca1a5001dfdb28e32c9fadf853b13bd5514a06ba382e2
TLSH
T179E0C02A424AC27D39DD14472169ECEEC272278329827F845440845DD02705467D3743
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2320-11-0x0000025F6A1B0000-0x0000025F6A1D2000-memory.dmp

Download

memory/2320-24-0x0000025F6A1E0000-0x0000025F6A1E8000-memory.dmp

Download

memory/4760-43-0x0000026A3AA40000-0x0000026A3AA42000-memory.dmp

Download

memory/4760-53-0x0000026A3B770000-0x0000026A3B7EA000-memory.dmp

Download

memory/4760-58-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4760-41-0x0000000140000000-0x0000000140166000-memory.dmp

Download