dd6f8beb12881c9b79c7d8c7f77cf51e46c8487075c48cdeef15931c83ddeea1

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3574378_7_-setup.msi
Size 2.8MB
Sample261014-arablsdh72
SHA256 dd6f8beb12881c9b79c7d8c7f77cf51e46c8487075c48cdeef15931c83ddeea1
MD5 018a6bd5fc2b1d22acca0ff02c9382f2
SHA1 7693259820510d893dadabbd699a02267d4f0aba
SHA512 ef7d60cd51af3d301b1f23daa549105abf4f8f3570a37041227da3ea37a614e9ff095db5563ad81fae916f5ac01518f77c939d19d79085dfa26da303f4227962
SSDEEP 24576:2KpWLp6Z7xXlJ8fN3n4+1HHL3v/cI8YnXFccfpje4KVwhBML:2sWL64fN34+9r3v/PbXF1je4wwhBg
TLSH
T1BAD52C736990600652B1A8EABEBD5E77694F340D101A958EFED30B8EE51E6FD0803D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3192	powershell.exe
13	3192	powershell.exe
14	3192	powershell.exe
15	3192	powershell.exe
16	3192	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3192	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
12	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4620	wscript.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFAD1185B872850A0.TMP	msiexec.exe
File created	C:\Windows\Installer\e598d44.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E86FED96AA1D4E1.TMP	msiexec.exe
File created	C:\Windows\Installer\e598d42.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598d42.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9FAA3A41-1455-4307-85BE-07FD866F98AC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFA406300C23DC619.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9253.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE37CFD2BCECF9936.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4168	msiexec.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3600	cmd.exe
2584	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1232	msiexec.exe
1232	msiexec.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4168	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4168	msiexec.exe
Token: SeSecurityPrivilege	1232	msiexec.exe
Token: SeCreateTokenPrivilege	4168	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4168	msiexec.exe
Token: SeLockMemoryPrivilege	4168	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4168	msiexec.exe
Token: SeMachineAccountPrivilege	4168	msiexec.exe
Token: SeTcbPrivilege	4168	msiexec.exe
Token: SeSecurityPrivilege	4168	msiexec.exe
Token: SeTakeOwnershipPrivilege	4168	msiexec.exe
Token: SeLoadDriverPrivilege	4168	msiexec.exe
Token: SeSystemProfilePrivilege	4168	msiexec.exe
Token: SeSystemtimePrivilege	4168	msiexec.exe
Token: SeProfSingleProcessPrivilege	4168	msiexec.exe
Token: SeIncBasePriorityPrivilege	4168	msiexec.exe
Token: SeCreatePagefilePrivilege	4168	msiexec.exe
Token: SeCreatePermanentPrivilege	4168	msiexec.exe
Token: SeBackupPrivilege	4168	msiexec.exe
Token: SeRestorePrivilege	4168	msiexec.exe
Token: SeShutdownPrivilege	4168	msiexec.exe
Token: SeDebugPrivilege	4168	msiexec.exe
Token: SeAuditPrivilege	4168	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4168	msiexec.exe
Token: SeChangeNotifyPrivilege	4168	msiexec.exe
Token: SeRemoteShutdownPrivilege	4168	msiexec.exe
Token: SeUndockPrivilege	4168	msiexec.exe
Token: SeSyncAgentPrivilege	4168	msiexec.exe
Token: SeEnableDelegationPrivilege	4168	msiexec.exe
Token: SeManageVolumePrivilege	4168	msiexec.exe
Token: SeImpersonatePrivilege	4168	msiexec.exe
Token: SeCreateGlobalPrivilege	4168	msiexec.exe
Token: SeBackupPrivilege	4232	vssvc.exe
Token: SeRestorePrivilege	4232	vssvc.exe
Token: SeAuditPrivilege	4232	vssvc.exe
Token: SeBackupPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe
Token: SeTakeOwnershipPrivilege	1232	msiexec.exe
Token: SeRestorePrivilege	1232	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4168	msiexec.exe
4168	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4168	msiexec.exe
1232	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 5524	1232	msiexec.exe	94
PID 1232 wrote to memory of 3600	1232	msiexec.exe	96
PID 3600 wrote to memory of 2584	3600	cmd.exe	98
PID 2584 wrote to memory of 1132	2584	cmd.exe	100
PID 1132 wrote to memory of 4712	1132	powershell.exe	101
PID 4712 wrote to memory of 1532	4712	csc.exe	102
PID 2584 wrote to memory of 4620	2584	cmd.exe	103
PID 4620 wrote to memory of 3192	4620	wscript.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4168

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5524
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" /min /wait cmd.exe /c call "C:\Users\Admin\AppData\Local\fokiwjNN\QDNUDqlZ.bat" "C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\System32\cmd.exe
    cmd.exe /c call "C:\Users\Admin\AppData\Local\fokiwjNN\QDNUDqlZ.bat" "C:\Users\Admin\AppData\Local\Temp\3574378_7_-setup.msi"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -w h -c "$q=[char]34; $d='public static class N {[System.Runtime.InteropServices.DllImport('+$q+'kernel32.dll'+$q+')]public static extern System.IntPtr GetConsoleWindow();[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern System.IntPtr GetAncestor(System.IntPtr h,uint g);[System.Runtime.InteropServices.DllImport('+$q+'user32.dll'+$q+')]public static extern bool ShowWindow(System.IntPtr h,int n);}'; Add-Type -TypeDefinition $d; $c=[N]::GetConsoleWindow(); $r=[N]::GetAncestor($c,2); if($r -eq [IntPtr]::Zero){$r=$c}; [void][N]::ShowWindow($r,7)"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fdsfgguu\fdsfgguu.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4712
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C75.tmp" "c:\Users\Admin\AppData\Local\Temp\fdsfgguu\CSCFB7BCBBC25F241948678993D6D31289E.TMP"
        6⤵
        
        PID:1532
  - - C:\Windows\System32\wscript.exe
      wscript //B //nologo "C:\Users\Admin\AppData\Local\Temp\b11789.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\fokiwjNN\QDNUDqlZ.bat');$i=$r.LastIndexOf('REM#');&([scriptblock]::Create($r.Substring($i+4)))"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598d43.rbs

Path C:\Config.Msi\e598d43.rbs
Size 8KB
SHA256 6576d297530ffd1419805b67914ba98028d092c5f8ad897d39430c607fe40faf
MD5 b78e66029ab1be0a42f209efe8540c29
SHA1 b2ee8fd1596e85c26cdd38a93b23138732e08944
SHA512 a98ba39290850a3e37d20417c2dada1a0682c8ed568c622f3f5dbbc5d63176f6a61f687dc011b683aa6988b6fbbd7e3b0ca86657a3b379216115ba7249ff557b
SSDEEP 192:tiOSQFo7nqWIQqWEUnJOiZLxCV//DzpgYpK0bK/dg:ti1Hquq6zC
TLSH
T1B4021241F69180E6E8981770CB2727B07BB2D7ACD710735F648E86788F0379ACE891C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb16fc26d6dea892fc8389bae32d21416cc8c83478c0d3c0b7a9dc389930a34b
MD5 133767997026f1c2d2309b7e6bc3eb55
SHA1 091b79a7513200e15c6bcf1c1c520aca0d53a1f5
SHA512 a59732776c50bbfe4b8aed01aee854ce172751570afdbcba080c3550d7b40613865604295f536df39a2b06b094f125b9b690760b936850d0ca4d0578bae73c66
TLSH
T108215733F3CC8624DC9A403650CEAC1136B687DB409ECE6BBB84D544B42F689DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

RES9C75.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9C75.tmp
Size 1KB
SHA256 340518709fce2e840f15f1590286663e11f77adc865b070fa2ea64feec02a930
MD5 92a62b3035a68e2dc28896f5267f0cc6
SHA1 fdab6aaccce694f6a10d72082d9cec408a2e2a52
SHA512 9b6c0fc839c7e54d3b604cae31b1a950932d28d023bcab2a18c06d3edd270bd292d383786e5b5fb33106387e29ae96900e339dcee86da939561eb60b3b65088c
TLSH
T17021C20583ED471FF0774B3279F6076F9665FD65EF61979A444002282C41600EEB0EB6
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_juw1fmis.p5y.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_juw1fmis.p5y.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b11789.vbs

Path C:\Users\Admin\AppData\Local\Temp\b11789.vbs
Size 175B
SHA256 a37ecd480b44bf715fc30be4f744e50efe937e62817c15e3a9439417cf7e4dfe
MD5 ebbb3743cc9ff8f26666145af45ca31a
SHA1 2c1e742bd23e050ad763e813de26bd410c2061d0
SHA512 3401b368adf0fe77b5ef806fada946b914dd518ed2a3a48d65489c53b23c747eee8edf9982d69955ee90e44b53f2ca3dbdff9f5861b8fd16c5ff3d47cbac1723
TLSH
T157C0C006751CA58C0703C01F40E9B9188C93F204010022137AB0CA157400190819104F
MD5 SHA1 SHA512 TLSH

Submit Download

fdsfgguu.dll

Path C:\Users\Admin\AppData\Local\Temp\fdsfgguu\fdsfgguu.dll
Size 3KB
SHA256 3d92f189144b82cbc8971041f06a53b6688a34fd1c54dfb3cdcaea878c048dca
MD5 9008b387dbb069246467bcec1720d26b
SHA1 5d425d85e241e10a2f388c3e984895811e347f67
SHA512 46319d4a4e31f8e0f5e023f9a3159a79ebae3b310757a50e9109ce1f3dbbaed2414a2df919d2f6bdac3dce8ea1473c15a5869f204444381eadf75d8c2436e5ff
TLSH
T1A351BB2793E84A6BF47B4734AEF3471727A4FC10AF73575E19804229AC617548A31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

QDNUDqlZ.bat

Path C:\Users\Admin\AppData\Local\fokiwjNN\QDNUDqlZ.bat
Size 79KB
SHA256 6488ea5e3503e26276168b2e1079b2ecd84bc2796d2febdf57011452dcdc7b1d
MD5 059dc9f350cd079c3f7e2678b20cf15d
SHA1 30ce569f35635737b6af1e150a7c21d26d450320
SHA512 2c07da452a9cc6532e069f8292b2097b9160a84a169e972eeb37f9de1a6fc8643a037fd23ec5d60705f3fe4dfd91c87779148e2fc1338124ed3301ec5ef5d726
SSDEEP 192:t/wotqohpicvoKojoLjiNjimjisjiiZZo/6VE3aETqb/EDwE1dcEguUVE9pswGXK:9E1cgQL
TLSH
T1CD830E15333E4AEC5B48711C84288FDBA94B431BD80866E745F048B9A7CFE83A765BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e598d44.msi

Path C:\Windows\Installer\e598d44.msi
Size 2.8MB
SHA256 dd6f8beb12881c9b79c7d8c7f77cf51e46c8487075c48cdeef15931c83ddeea1
MD5 018a6bd5fc2b1d22acca0ff02c9382f2
SHA1 7693259820510d893dadabbd699a02267d4f0aba
SHA512 ef7d60cd51af3d301b1f23daa549105abf4f8f3570a37041227da3ea37a614e9ff095db5563ad81fae916f5ac01518f77c939d19d79085dfa26da303f4227962
SSDEEP 24576:2KpWLp6Z7xXlJ8fN3n4+1HHL3v/cI8YnXFccfpje4KVwhBML:2sWL64fN34+9r3v/PbXF1je4wwhBg
TLSH
T1BAD52C736990600652B1A8EABEBD5E77694F340D101A958EFED30B8EE51E6FD0803D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d8e2fa554772a69cdda04e1ba58cebde752d3a93699b41e82c846eeb3ee95e3a
MD5 e9d302a2525ceebba1ba82700c741a96
SHA1 c897540acff93d8d23ece8ba69fd5e86a7f64dc3
SHA512 3b952a8f0273cecd6744e422d3b4e401891069c47b148dc6278ec1b06380574ac940c40f87565d4785e0a0f709a6958d3fc7829acabb3811c26c79d3c992e888
SSDEEP 24576:YFo3DMP9doO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKes:4HM
TLSH
T1AD57042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{de0e24e9-1f8e-4d7b-b2c4-7b657e5dc06b}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{de0e24e9-1f8e-4d7b-b2c4-7b657e5dc06b}_OnDiskSnapshotProp
Size 6KB
SHA256 b4cd2a179a080d2b2dda9636203cc61440a2e2018b1fc940314fb508fd7cf21b
MD5 de67f544595265b033cb90667fa51b51
SHA1 4133637cc83412702f78b4c1cbfa036faa12e4cb
SHA512 a4a10942fa90df8693940830d338c87d9099a3c8f1fe48017873e1f9c93698cb14cee7adc5c0a721684bddde094865cdd5c290d24d0972c012ec6f84ace52a85
SSDEEP 96:FQhFIvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:uYb++uVm
TLSH
T155D176184AF54711E2B3AB7128F18557A477B812EF33CB8E0198238E6671910F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCFB7BCBBC25F241948678993D6D31289E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fdsfgguu\CSCFB7BCBBC25F241948678993D6D31289E.TMP
Size 652B
SHA256 4f783bdbe5858de13c4418d6a08174fb24d14dcd64033178abaaa5e7a1edf783
MD5 7564a1b25229b8779417988e6bc6a90c
SHA1 b132c732cb517d0e4de67216d68b00b552324131
SHA512 baa95385081d01b087608fa741a4c0c42de707b90bfe82f9da21cb1568eb03dde966c56cf2a2f161f361baed8e31c06ea099829c28124c1e36db1ea876cf4f96
TLSH
T1DCF0300A63F8020EF1F78B30B9F543A3916AFC66DE3293ED544003592C645108561FB1
MD5 SHA1 SHA512 TLSH

Submit Download

fdsfgguu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fdsfgguu\fdsfgguu.0.cs
Size 382B
SHA256 42706b4746dc80e36b32b6c85865604af5d31b57467671860ef7722aef4e64c0
MD5 e8a57df085b6a0c42350072108b2087c
SHA1 50f043ec7ff8d2f41a16069a1f69baa37d556f82
SHA512 c657d649b03ecb7ca057b0fb3a04cbee1253a9902d36045c7aa9c40693559218c8c27fc604b06786e1ba44d59be73e39677aec7a708b095b3ca36dcfb03f8eb0
TLSH
T1A0E09224979BEC3901C2081B6C56D0AC9677822822B8BE01F2E75315CECB00A27372A0
MD5 SHA1 SHA512 TLSH

Submit Download

fdsfgguu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fdsfgguu\fdsfgguu.cmdline
Size 369B
SHA256 bb969df148a07bc0cef3fbaae6206ced35c1c6e0147a850ea91871316b2a55dc
MD5 45b257ca2e8874b027488e4ead5b08cb
SHA1 655cf08478d0ac9c6e392583d8a2baab02923616
SHA512 0417a5201dd7fa4a86927c7592b92cfe58ecdc33935bf19dc374fefc15b88dbd8eeebfa6e6404c425ca20b83b729bbc9d1cc66744722d5f56226952f2df63388
TLSH
T118E0C63A4647C27D21FE120B226ACEACC273078339C13F8C90C0840DE1672083BE2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-9-0x000001B92CDE0000-0x000001B92CE02000-memory.dmp

Download

memory/1132-24-0x000001B92CE50000-0x000001B92CE58000-memory.dmp

Download

memory/3192-43-0x000002674B270000-0x000002674B272000-memory.dmp

Download

memory/3192-53-0x000002674BAD0000-0x000002674BB4A000-memory.dmp

Download

memory/3192-58-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3192-59-0x000002674ADF0000-0x000002674AF1F000-memory.dmp

Download

memory/3192-41-0x0000000140000000-0x0000000140166000-memory.dmp

Download