f50e646c981792abbf7af405b5322d1ba89bdbcb6338ad7f9d0fce8d50ec90e2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68993.msi
Size 1.2MB
Sample261014-pg3yhavtft
SHA256 f50e646c981792abbf7af405b5322d1ba89bdbcb6338ad7f9d0fce8d50ec90e2
MD5 a3e85556efecb0cdd043ba9bebf7b1aa
SHA1 e7e83240418b7875f4d70a0ce9d2437d0fed5c51
SHA512 1889d7b05cce9c2510f69fd0f0322dbf2ba07aa26f1041296d081e6a6c76dede552b936d1fde8a32a3e0dbe0fcd11dcd4bdfb5958e998ab2051e59db6c55a47b
SSDEEP 24576:A6NkRIJOHhUhXfrG84Zta9gqMlI+0ts9S2hIQA74+uYa/3AQEY:rBhzx4+9vMlI3s9SGMP6hp
TLSH
T12345CFA45B595FB9EBC42FF902EF1E5C36768D2287207AC488E5B1E11C372C1F48895E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
35	4692	powershell.exe
37	4692	powershell.exe
39	4692	powershell.exe
41	4692	powershell.exe
43	4692	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
34	ipinfo.io
35	ipinfo.io

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{368EA563-3236-432D-804A-94258480C2A7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16DA.tmp	msiexec.exe
File created	C:\Windows\Installer\e590b45.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e590b41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e590b41.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4692	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3304	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3360	PING.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3360	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
560	msiexec.exe
560	msiexec.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3304	msiexec.exe
Token: SeSecurityPrivilege	560	msiexec.exe
Token: SeCreateTokenPrivilege	3304	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3304	msiexec.exe
Token: SeLockMemoryPrivilege	3304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3304	msiexec.exe
Token: SeMachineAccountPrivilege	3304	msiexec.exe
Token: SeTcbPrivilege	3304	msiexec.exe
Token: SeSecurityPrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeLoadDriverPrivilege	3304	msiexec.exe
Token: SeSystemProfilePrivilege	3304	msiexec.exe
Token: SeSystemtimePrivilege	3304	msiexec.exe
Token: SeProfSingleProcessPrivilege	3304	msiexec.exe
Token: SeIncBasePriorityPrivilege	3304	msiexec.exe
Token: SeCreatePagefilePrivilege	3304	msiexec.exe
Token: SeCreatePermanentPrivilege	3304	msiexec.exe
Token: SeBackupPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeShutdownPrivilege	3304	msiexec.exe
Token: SeDebugPrivilege	3304	msiexec.exe
Token: SeAuditPrivilege	3304	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3304	msiexec.exe
Token: SeChangeNotifyPrivilege	3304	msiexec.exe
Token: SeRemoteShutdownPrivilege	3304	msiexec.exe
Token: SeUndockPrivilege	3304	msiexec.exe
Token: SeSyncAgentPrivilege	3304	msiexec.exe
Token: SeEnableDelegationPrivilege	3304	msiexec.exe
Token: SeManageVolumePrivilege	3304	msiexec.exe
Token: SeImpersonatePrivilege	3304	msiexec.exe
Token: SeCreateGlobalPrivilege	3304	msiexec.exe
Token: SeBackupPrivilege	4532	vssvc.exe
Token: SeRestorePrivilege	4532	vssvc.exe
Token: SeAuditPrivilege	4532	vssvc.exe
Token: SeBackupPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeBackupPrivilege	2468	srtasks.exe
Token: SeRestorePrivilege	2468	srtasks.exe
Token: SeSecurityPrivilege	2468	srtasks.exe
Token: SeTakeOwnershipPrivilege	2468	srtasks.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeBackupPrivilege	2468	srtasks.exe
Token: SeRestorePrivilege	2468	srtasks.exe
Token: SeSecurityPrivilege	2468	srtasks.exe
Token: SeTakeOwnershipPrivilege	2468	srtasks.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3304	msiexec.exe
3304	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2468	560	msiexec.exe	101
PID 560 wrote to memory of 3120	560	msiexec.exe	103
PID 3120 wrote to memory of 4692	3120	MsiExec.exe	104
PID 3120 wrote to memory of 3360	3120	MsiExec.exe	105
PID 4692 wrote to memory of 4224	4692	powershell.exe	108
PID 4224 wrote to memory of 3388	4224	csc.exe	109
PID 4692 wrote to memory of 3268	4692	powershell.exe	110
PID 3268 wrote to memory of 2324	3268	csc.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\68993.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3304

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4D7E7E6E20D3E7B8E646117ACCD775EB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\68993.msi"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iqzxxcyh\iqzxxcyh.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1543.tmp" "c:\Users\Admin\AppData\Local\Temp\iqzxxcyh\CSCC813E402CFEB46BDBE1D695E32D5B81.TMP"
        5⤵
        
        PID:3388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wsplo0rz\wsplo0rz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1757.tmp" "c:\Users\Admin\AppData\Local\Temp\wsplo0rz\CSC37E6B0126BAC4363B860485B38DB8DA.TMP"
        5⤵
        
        PID:2324
- - C:\Windows\System32\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e590b44.rbs

Path C:\Config.Msi\e590b44.rbs
Size 8KB
SHA256 096fc2dd3040b1797665d6021f3f1dbb4e66affa85026d1f6c574817c08d0837
MD5 d7389139dc933132527c7a4ec1d4e2cb
SHA1 42f06de1f4f2bcddfc8fbee888364064db037ee7
SHA512 76fdd35511560cc62b6e679e9444a2bb02584462a1571456413fd524581d9900511639e569acf61acf515001a3028f7ebb31b43d8b5ca644abb645c03f23c486
SSDEEP 96:YkL39lNexAvfUTFw+CsThq6UTFw+C6joSV27ThqVH+ApfeFfuqxyLZCUip1Bo2GB:YM9eeM5w9Ig5w9fBpUipo
TLSH
T1DD020142B750C1A3F99E1B36C3872B1877B6E6F9A615335B089A816C0F03B4C9F5A5C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

705546.ps1

Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
Size 104KB
SHA256 a2dc869315cb001d31dbdaefca85d2b33f80de8a974eaf7659ade521d8ee8512
MD5 b32c0d0db8767055d6ca4a99366df943
SHA1 e221c811df1b1b76b60f7f136fc5a1606e7f2528
SHA512 16b09bec50b634f0446c379da3cbc5da7e4b04cdf271838f79ac5baae1143b0e63953692894c18d35e2f6565001f7436f1eec85dd16b3cf9a18e8b2f4306b981
SSDEEP 384:ez5B8+n7SBiA8+nXRiiXT7lN78elnli2LXqiAVT2tqckS94mLQKd1mC6jMxVGHpd:ed
TLSH
T1B8A346A457491FBAEBD42FC942EF5E5C367659328B207AC4C8E5B0E11C273C1F88895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1543.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1543.tmp
Size 1KB
SHA256 2fd6bc52452600b1d0f9a6d489f5bfb0832e26cd1a681a71467dc0c4a4288edd
MD5 0355c342fadb91cf912841b29059886d
SHA1 5f4a2358ffc35190422eb3dc975efdea4119b02b
SHA512 99418236c650e2d42b628ea8525021bd3208617965ae20b1b1401aa0f55ebcbfa0e520f4cd882dec3bfc6b648759dc84d517b18c331446024646277c43d54b6b
TLSH
T1D821A80593E9871FF0B31B3179F6172BA669FD55EFB2535B844002282C41600EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES1757.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1757.tmp
Size 1KB
SHA256 3254fbe54da182c7685bbd198055a813fd4c86a9b6a8e30f475bface78ef26bb
MD5 7587d3fdff6c02ff32e944085384f432
SHA1 bb10152fc4dab13d70baf1a19c71ffa673e14dbf
SHA512 c7ecc7db9007c95eca2bd8fdc3daac096d1cf9b403562acf88041d266ed8d32ffd20f3258f733e2206a523d4db2b6f332a230ea6ef9b5e6cb2c8d45e63765543
TLSH
T1FC21890593F8471FF0734B3069E6171BA26DFD55EFA2539B844042282C41504EEA1FB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cuhpu04d.a0r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuhpu04d.a0r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

iqzxxcyh.dll

Path C:\Users\Admin\AppData\Local\Temp\iqzxxcyh\iqzxxcyh.dll
Size 4KB
SHA256 48dee03fad9219136977dd3c0740448dc50b0803ae3c8728f6b366858ec49fde
MD5 305485ba033de21b77714cc6227edeb4
SHA1 1d0ffa999c22d9dec30a4cbb4afe58d277e284fa
SHA512 22ef27cc86ba8c6e41054d811a78f2254e50c71e591d5570a0e9f70546df456381613e26d5ed5e12cac0deb65cf0a34f953e80d636f1f80e901b6456af560fee
SSDEEP 48:6sFgezd6kVMxAEG8zS95e37eJ0/dkt4d06nOl9cseBZ1ulQa3Mq:pqezd6r/ma/Vk2d3wuK
TLSH
T18F917312ABE40653E47B073469F303165BB6B4509FE307DF098946197C7299A1E76FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsplo0rz.dll

Path C:\Users\Admin\AppData\Local\Temp\wsplo0rz\wsplo0rz.dll
Size 5KB
SHA256 5348da8b2207efecb2419b64c43508f341bdf27df8fbf44c62b2ff34ff1f535b
MD5 12f480aae2b12c9e3ce06fb1e15b93ca
SHA1 e688b5cc8b5f3318a5f1ad7902912b6dbdeac0d8
SHA512 345c7ec85666eefcd693fe25416adaa0702a2cad84a0f25c08f7fbba6d38e9ddd3ce872f789b22d5bc2282a708c111044a1fb09bc21838f3fb8c945e9829afea
SSDEEP 96:HEQPxDCKmoJKyDnn9n1CFVw0tUZa9XyNvK:HVPJD91CPXm8yc
TLSH
T1AEC1E50D9BCC90A3D4FF0B7829F30306B6B4E5948FE237AB119441B02CA19D149A27B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590b45.msi

Path C:\Windows\Installer\e590b45.msi
Size 1.2MB
SHA256 f50e646c981792abbf7af405b5322d1ba89bdbcb6338ad7f9d0fce8d50ec90e2
MD5 a3e85556efecb0cdd043ba9bebf7b1aa
SHA1 e7e83240418b7875f4d70a0ce9d2437d0fed5c51
SHA512 1889d7b05cce9c2510f69fd0f0322dbf2ba07aa26f1041296d081e6a6c76dede552b936d1fde8a32a3e0dbe0fcd11dcd4bdfb5958e998ab2051e59db6c55a47b
SSDEEP 24576:A6NkRIJOHhUhXfrG84Zta9gqMlI+0ts9S2hIQA74+uYa/3AQEY:rBhzx4+9vMlI3s9SGMP6hp
TLSH
T12345CFA45B595FB9EBC42FF902EF1E5C36768D2287207AC488E5B1E11C372C1F48895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 616676b60f530e04c50ab62e1d47af79f8efbf3cb6f96d5793f4008312297d35
MD5 44c39dea8f6f1fff4f37e5e4352f102e
SHA1 ddbfab5532ee1eb31fd242eaae198e13bd76c779
SHA512 1f983dba83169f01614932a827cc5cbd2d3458266f6d9be3b35faee56eedb2d8421b7ba7cc233c8b753fb2796571607f29f901f6ea29f75674ba83ae9df6008f
SSDEEP 24576:4u8m+1ztdoO/vvTLr28epm649lUTE1MCQKGN+Ttl00aNOrFhIvVlk63xJ:O
TLSH
T19D47902837F92200E7F79E3D68F06A234D3A7D5B9C199E8D45451B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{bdbff406-b1aa-45f5-8aee-136ff2002270}_OnDiskSnapshotProp

Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bdbff406-b1aa-45f5-8aee-136ff2002270}_OnDiskSnapshotProp
Size 6KB
SHA256 7887bd827edb3d06ad8defdc1db09595a93d0288210f1294525d30f5a2607317
MD5 0122f652970670c604cec55c220354b0
SHA1 29daeacbe59733dafc655389a63a4e3da9cbabfb
SHA512 3a75b5adebfc58805b26744936987c3cab7eef68426c20f7ad22d5975bb040c1577452387cce45c0b133a493842b9cdab1b41d5f897236bbace3afddf52cd94b
SSDEEP 96:Ff7640vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Zpub++ZVmN
TLSH
T1EDD177085AF54711E2B3AB3229F14557A877B811EF33CB8E0198238E2630A14F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC813E402CFEB46BDBE1D695E32D5B81.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iqzxxcyh\CSCC813E402CFEB46BDBE1D695E32D5B81.TMP
Size 652B
SHA256 fa4150d6ac78edb293357df534899e20826cef1e49918f05a6f0952e09c2cbef
MD5 eacdbb422f6b80536b1e4397b2b60f17
SHA1 20eb9dc0b68d355c67846e81158d881b49b53822
SHA512 9284298c5f8b0fb3539e64f1211f6ef0d12cc6bc3b2dce9c2c7ed36cca9280a5f2c48aa4b584426e5c439b07a0c6f4ef82dafe0fada2e2c36930e9cd6172d1aa
TLSH
T1CCF05E09A7F8420EF0F34B30BEF6436395A9BC64DE3293ED2844031D28659109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iqzxxcyh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iqzxxcyh\iqzxxcyh.0.cs
Size 2KB
SHA256 e2e315328abb8c24770da9d56a1d6e28aa2a18bb6f4937bcf5f3407c2385f739
MD5 743eaf0faaa108bc0861f98f68675875
SHA1 b37f470d3d2413f527f4940ffc485fbddc42746c
SHA512 070372257fee26210d378c1562db6e677c4d71a4fd2cda5bd28e35ae610c6842cdaebe5b65cab4cc1e0a64b0a8cc53fa3bdb263e584cae926fa017083b605a15
TLSH
T1F941A810E9468B9386FBA6BA8B80A459F273A23703E16902FC8C5B413F5647053F5F91
MD5 SHA1 SHA512 TLSH

Submit Download

iqzxxcyh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iqzxxcyh\iqzxxcyh.cmdline
Size 369B
SHA256 40e8f8e1daa6fcefbcbf8db94af09ec1765da0b55466c9ed44fadbd88c53fde6
MD5 c34ba3a5d273d084c982844936a6c37f
SHA1 56e1e1d3df1ed0749e819db60d80fb870fdc308a
SHA512 357eefdbaaee7c1451fc0e37bd624f49b94c39177e0342bebf20eedac239b44712b982ec6dc2ce8f12c02a06dc5e70de2a88cdca798e3fdf21f18d8d6dd72056
TLSH
T15FE0C02A4656C2BD09ED3007316AD4ACC672078729D03FCC60584E4ED01F01027D1B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSC37E6B0126BAC4363B860485B38DB8DA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wsplo0rz\CSC37E6B0126BAC4363B860485B38DB8DA.TMP
Size 652B
SHA256 e2172bec843797bebd26b99e1e68e72ea29343108271d8783378acb53bf72604
MD5 0a64eb85826e7e5d9edc88e4735b1789
SHA1 bb34a4a2b1f9f713e718993eba932ca1e515feaf
SHA512 1e2b563ac158affb0d6865d66f1c509c9cf0b2055ee670b476561976ec851574961313fa94dd52a78a4f6e0f479afcc36b32bb8fd26484c8ed1125db345193be
TLSH
T1ADF05E0AA3F8020EF0F34B30BDF643A791ADBC64DE32A3ED1480435928645109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wsplo0rz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wsplo0rz\wsplo0rz.0.cs
Size 5KB
SHA256 03a6072ea3dd875263b45a843ea2f529e6ad081776af16cf7c709730c3b4862d
MD5 a41790cd479aeec830c64502dec4ed3a
SHA1 53a8b11daf346699eee85e6d8d881b0c4bcfa85a
SHA512 4dbed83e249116a88ffc2951e1335f3badf4f1e88e041431f770fc9cf8f3787f06a7acc1231a4eac31b87cc208ecbc132dc63bf6958449ff338a0ff2d2014e6c
SSDEEP 96:Jo1ZjdcXrVlCGYIVVayfHzvKrESOcGQi9LqMbrJY+DJ+rJfxwLQR:uKXraGfVgmzirE/n9LqMbrJR+NfxsQR
TLSH
T130B11309131156C60BB6BA6D8FA59428FA07C43302E53B21BF7D44701F6681EA677FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsplo0rz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wsplo0rz\wsplo0rz.cmdline
Size 369B
SHA256 7329cb3c5f0eed719ab3d00e9eb5cd738cac7fe8047efb720c752395afa7e09c
MD5 31c78c7c010afe4a80bf2953b50c124f
SHA1 7d9a4268060f101e6af344deea5689f76441ba7b
SHA512 88f4fc9738a75adc78adb027af6655e51ac51e7479ff9a4e677b16c130bd61693da46bdf4002e2f04695688231f24666f1f2d329f54bf73c2a45c778b6f68917
TLSH
T1D9E0263A5296C7FD29ED500F226BC5ECF2B2C78729957F84B150C46DE0270096BD3796
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4692-29-0x0000018869D50000-0x0000018869D58000-memory.dmp

Download

memory/4692-53-0x0000018869D70000-0x0000018869D78000-memory.dmp

Download

memory/4692-54-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/4692-8-0x0000018869D80000-0x0000018869DA2000-memory.dmp

Download

memory/4692-56-0x000001886A2C0000-0x000001886A2C2000-memory.dmp

Download

memory/4692-67-0x000001886A7A0000-0x000001886A81A000-memory.dmp

Download

memory/4692-72-0x0000000140000000-0x0000000140119000-memory.dmp

Download