622c26b8ff7145df37fd72578a98be1b42fd12da20f49d7eba2b23560f19690e

Analysis

user interaction
yes
max time kernel
56s
max time network
35s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/10/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68993.msi
Size 1.1MB
Sample261014-v4dvsayxfw
SHA256 622c26b8ff7145df37fd72578a98be1b42fd12da20f49d7eba2b23560f19690e
MD5 bece2027a2650c6bb75b6f6969d2202e
SHA1 3596cb11f1fd186e58c804f41c98a35782bd0617
SHA512 170e6b00722f27a5dbb1e30a87015fd325117174b02e23435b7963c4c970836fd3c05aa6816b98a11e96744f21c053137bd75b47df0fa44296d8ae71ea0da271
SSDEEP 24576:nbwdcb5GCoLcf5v38VSGxCpB4Kd4571pco3UX43a:nsdW5P8/xCpaHEXAa
TLSH
T1CD45D02095EF0D06DB4622B89632A98C0BE85C6D61CD7EEC7687F2A01CF373665D3536
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
25	636	powershell.exe
27	636	powershell.exe
29	636	powershell.exe
31	636	powershell.exe
33	636	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
24	ipinfo.io
25	ipinfo.io

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58ba62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ba62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C877FAB8-1B73-40ED-8825-FFE1BCBC6A99}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6E5.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ba66.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
636	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3364	msiexec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1616	PING.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005768639d43407d4e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838015768639d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841015768639d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f5768639d00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea715768639d00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1616	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1716	msiexec.exe
1716	msiexec.exe
636	powershell.exe
636	powershell.exe
636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3364	msiexec.exe
Token: SeSecurityPrivilege	1716	msiexec.exe
Token: SeCreateTokenPrivilege	3364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3364	msiexec.exe
Token: SeLockMemoryPrivilege	3364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3364	msiexec.exe
Token: SeMachineAccountPrivilege	3364	msiexec.exe
Token: SeTcbPrivilege	3364	msiexec.exe
Token: SeSecurityPrivilege	3364	msiexec.exe
Token: SeTakeOwnershipPrivilege	3364	msiexec.exe
Token: SeLoadDriverPrivilege	3364	msiexec.exe
Token: SeSystemProfilePrivilege	3364	msiexec.exe
Token: SeSystemtimePrivilege	3364	msiexec.exe
Token: SeProfSingleProcessPrivilege	3364	msiexec.exe
Token: SeIncBasePriorityPrivilege	3364	msiexec.exe
Token: SeCreatePagefilePrivilege	3364	msiexec.exe
Token: SeCreatePermanentPrivilege	3364	msiexec.exe
Token: SeBackupPrivilege	3364	msiexec.exe
Token: SeRestorePrivilege	3364	msiexec.exe
Token: SeShutdownPrivilege	3364	msiexec.exe
Token: SeDebugPrivilege	3364	msiexec.exe
Token: SeAuditPrivilege	3364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3364	msiexec.exe
Token: SeChangeNotifyPrivilege	3364	msiexec.exe
Token: SeRemoteShutdownPrivilege	3364	msiexec.exe
Token: SeUndockPrivilege	3364	msiexec.exe
Token: SeSyncAgentPrivilege	3364	msiexec.exe
Token: SeEnableDelegationPrivilege	3364	msiexec.exe
Token: SeManageVolumePrivilege	3364	msiexec.exe
Token: SeImpersonatePrivilege	3364	msiexec.exe
Token: SeCreateGlobalPrivilege	3364	msiexec.exe
Token: SeBackupPrivilege	2800	vssvc.exe
Token: SeRestorePrivilege	2800	vssvc.exe
Token: SeAuditPrivilege	2800	vssvc.exe
Token: SeBackupPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeBackupPrivilege	3096	srtasks.exe
Token: SeRestorePrivilege	3096	srtasks.exe
Token: SeSecurityPrivilege	3096	srtasks.exe
Token: SeTakeOwnershipPrivilege	3096	srtasks.exe
Token: SeBackupPrivilege	3096	srtasks.exe
Token: SeRestorePrivilege	3096	srtasks.exe
Token: SeSecurityPrivilege	3096	srtasks.exe
Token: SeTakeOwnershipPrivilege	3096	srtasks.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe
Token: SeRestorePrivilege	1716	msiexec.exe
Token: SeTakeOwnershipPrivilege	1716	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3364	msiexec.exe
3364	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3096	1716	msiexec.exe	96
PID 1716 wrote to memory of 3208	1716	msiexec.exe	98
PID 3208 wrote to memory of 636	3208	MsiExec.exe	99
PID 3208 wrote to memory of 1616	3208	MsiExec.exe	100
PID 636 wrote to memory of 3256	636	powershell.exe	103
PID 3256 wrote to memory of 2976	3256	csc.exe	104
PID 636 wrote to memory of 1744	636	powershell.exe	105
PID 1744 wrote to memory of 4796	1744	csc.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\68993.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3364

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 92FBD7982FFA23A62B59A404B01E514B
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\705546.ps1" "C:\Users\Admin\AppData\Local\Temp\68993.msi"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x204qzjc\x204qzjc.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0F9.tmp" "c:\Users\Admin\AppData\Local\Temp\x204qzjc\CSC64D403BE3ABA426DB662DCD53D87478.TMP"
        5⤵
        
        PID:2976
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2yfqgn3g\2yfqgn3g.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC290.tmp" "c:\Users\Admin\AppData\Local\Temp\2yfqgn3g\CSCD62A2C36E4FB405E92DFDFDB4173AD9F.TMP"
        5⤵
        
        PID:4796
- - C:\Windows\System32\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ba65.rbs

Path C:\Config.Msi\e58ba65.rbs
Size 8KB
SHA256 cdde307a40821a51ebf056376e9fec91fd6496d3b07e615456589def1e5d9ce7
MD5 c713ee493c04cc093c6dee31d877e362
SHA1 ad9fd0439916298a3d1a8db50f98c6e4f8e47c4e
SHA512 6be0051b814504a98017e18cf2e695439958c25a484563194c3e318250490a86e11b57fce97603ca91d6b908f6e7e8e161620ac9188d9d593f6e58df808c3c93
SSDEEP 192:XQewEoEdMVYw9IWVYw9dcESEAlCqEcMEAE5E7b6bWOUipIR2bP6bPZbP7bPMbPzv:XpBeVYwzVYwPFXxvcVZ6H+WZRiP+PdPk
TLSH
T1B70220017600D9B2DCAD2236CF0397D17772E2F9C621378F8A8E41549F47B988A5D5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2yfqgn3g.dll

Path C:\Users\Admin\AppData\Local\Temp\2yfqgn3g\2yfqgn3g.dll
Size 5KB
SHA256 9059db6f0dca3786cb46fa3cf8da1b159df2082b28b02e73e7281b1a9ca9a5bf
MD5 91ac10a01b5c2032cba7599a1860d8cf
SHA1 f75976323fe94b2b59201064af074b2b80eda153
SHA512 043b153c571ca96325901a752ec4096abdcc1eaf4299e2e1fedc47c26f45d32987dccfc8e7b42aa7a02b8fc4da2e52538829e7aee5dd7b1432b424e37c39c9a2
SSDEEP 96:EEQPxDCKmoJKyDnn9nhCdw0tUvea9XyNhK:EVPJD9hCdXmv9yu
TLSH
T1FEC1E41D87CC91A3D4EF0B7829F30306A6B0E9948FE3376B11A441B12DA19D249A67B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

705546.ps1

Path C:\Users\Admin\AppData\Local\Temp\705546.ps1
Size 103KB
SHA256 3891b92a825d89fb4f237fa516618a809ac6d2813a5f77e2c0702c783c71446c
MD5 92ab32372b0f7b60f423505c59e11616
SHA1 52db7093325f2df404d06708ec77525d8945fba9
SHA512 49f2a19c39d5c74a7f2d0e4fab52cb5ae2aa1029d543646a0e4e02211e54af64b4414e27a988f127baab6a39c0b1af3480543a8d8560e5db40f1e7eb32c4e990
SSDEEP 96:XWhBR3IhBR+5i0yjqbBRxGRJyVyOsnq8O0A:c/3Ih/+5i0yjqb/xGRJyVyOsnq8Oj
TLSH
T175A33B2085EF0D0ADB4522B89A32A98C0BF9506D62DD7EEC7697F1E01CE373664D3536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESC0F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC0F9.tmp
Size 1KB
SHA256 5d05fb6b4500ecdf35df3503e3b0b4e535d24a003b9a401554009ac52d4befe2
MD5 b6c022e7cf4d9dc884882bc2479b09d3
SHA1 fbf065228b6a06cd53a94e4adb35bc85b77ff9b5
SHA512 06ee4638f0d009a6cca1dcf28c484254e5b259967525bd4170a588cdcbff805c8ad773fa887a8edfafbc3d6d8aaef7979c59bbcb70266bc83e685bb9d74a442b
TLSH
T10C21C20983E94B0FF0734B3169FA175B5674FD65DF72575B848403292C41504DEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESC290.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC290.tmp
Size 1KB
SHA256 b0913363555b5d4dce7caf9d1f22e173e6d58c071f3ff10b98ae932b1dd1f55d
MD5 ba3f2a93a0245ca7e3863fd9ced1c633
SHA1 964f166e6dcba22556a3e44b199e19f7ec385a20
SHA512 02990ffd5f4ba9c97ebdf53720011270c77a9a82450400dd2d76b89827183ff5c1ef83eb31028e137d29c2a4a7f837e890230dca7c35441a21bf6da375d7cadc
TLSH
T1CC21AF0543E8471FF0739F3269F6171B9234FE59EF72575B844042292C01104EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1h1w3sw2.3zz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1h1w3sw2.3zz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x204qzjc.dll

Path C:\Users\Admin\AppData\Local\Temp\x204qzjc\x204qzjc.dll
Size 4KB
SHA256 319d9d1fbcb13658a54fe41bf458d3fafc805286968ed4b201ae2a2cdd962ce1
MD5 6c5256880478ddc64a211687243a2fa1
SHA1 2bc7dbdb0e2c9e342fe485d4bfa3c8f814b3b92c
SHA512 ba08c9ba3b56ad87105d984073b7a67dbf1f00ac7094847a853738bda17d4efc53fa85045049d24529d31519cdd48c2066a56b1422bd08f2ced5fcad5066d375
SSDEEP 48:6qFgezd6kVMxAEG8zS0e37eJIdkt4d06nOl3cseBZ1ullqa36Rq:vqezd6r/m9Tk2d3aaK
TLSH
T1CE9183666BD40617E03B473468F303175BB2F4509FE35B9F09DD461ABC719991E32BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ba66.msi

Path C:\Windows\Installer\e58ba66.msi
Size 1.1MB
SHA256 622c26b8ff7145df37fd72578a98be1b42fd12da20f49d7eba2b23560f19690e
MD5 bece2027a2650c6bb75b6f6969d2202e
SHA1 3596cb11f1fd186e58c804f41c98a35782bd0617
SHA512 170e6b00722f27a5dbb1e30a87015fd325117174b02e23435b7963c4c970836fd3c05aa6816b98a11e96744f21c053137bd75b47df0fa44296d8ae71ea0da271
SSDEEP 24576:nbwdcb5GCoLcf5v38VSGxCpB4Kd4571pco3UX43a:nsdW5P8/xCpaHEXAa
TLSH
T1CD45D02095EF0D06DB4622B89632A98C0BE85C6D61CD7EEC7687F2A01CF373665D3536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 3f3edd8de8474f8b05156af6e17a7ec453ec5f70b068c861583190d8c353b436
MD5 d2925ae3e478a08fa371368acd3202b3
SHA1 764ce5a6f7a52d18a1e03b046b8791e23e584fba
SHA512 95daf08ec45b8aafed7bb3acc0f536de2c3654aaabb52c537469664c3512f21ea150276d8917b3ea1aa593aa94bb76410c95d127222f1d7fb35b20b651477e58
SSDEEP 24576:lEpmg3MTdoO/vvTLjyQea5GOYs7hNI/2sQ4tmDsC8FKDs2eAYlDmF8xbDR:FA
TLSH
T17D47D62436FD2110E7F79E3CACF06A2749397D5BAC16DE8D05451B4E0822B71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3e2d8168-0d74-4fe4-b47e-472e2f3b79f0}_OnDiskSnapshotProp

Path \??\Volume{9d636857-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3e2d8168-0d74-4fe4-b47e-472e2f3b79f0}_OnDiskSnapshotProp
Size 6KB
SHA256 3fc1275dc7dcbcde3e9c449b3e665eefd6b9630295c0be582cf64ca0d183b049
MD5 2d548bd0c4f9910121914400ec11a24e
SHA1 409f2962e13d5cfebc943b9a29324d29daba9fde
SHA512 d62279d7ad9f5296426a1c5f873d3a35c43222fcb9760dec15f2bbd47911d53668205f62c027a3fe3b2fc6f7172d8ab9926cf42699f9d21417f4b16bc6e357b3
SSDEEP 96:FF7HH/rcvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:3jrGb++ZVmN
TLSH
T195D199185AF54711E2B3AB3129F18557A477B811FF33CB8E0298238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2yfqgn3g.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2yfqgn3g\2yfqgn3g.0.cs
Size 5KB
SHA256 1251a4da46f9b3fa3001e135d151edffe32bbebdea6239d84ddd1d6079057f29
MD5 6031620a94d1a306b87a99e3c8dd82d8
SHA1 5c53e3c894da2d37fe250f5546dba1c531b5ea44
SHA512 6cc920d5262cbf7662109ec5de4c762d324f41249bfed5ef1e35942011c6404a8aac213782e5eed8945b6efbece805aaf3f5d24d5ffcd8cfca78b29c6c1a3fa8
SSDEEP 96:Jo1XdcXrVlCGYIVVayfHzvKrESOcGQi9LqMbrJY+DJ+rJfxwLQR:wKXraGfVgmzirE/n9LqMbrJR+NfxsQR
TLSH
T15FB10209231156C60BB6BA6D9FA59428FA07C43302E53B21BF7D44701F6681EA677FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2yfqgn3g.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2yfqgn3g\2yfqgn3g.cmdline
Size 369B
SHA256 e81e573cc4502dc7045be407350e44b069822c806baa04b02d7b33b97268db20
MD5 906712a27988e1ce8b921795220c4030
SHA1 52eb8dc6cfccc0c2afe88d2d3bf9d56245fb3117
SHA512 6f9370b283e8ce55ee54df20347231c2d3aee5e3397c076b4348997c18736c396bd0efc622e64af2757103d04315effc736d9e7b496e45c3e634ad12d67fa42c
TLSH
T19AE06F2F434ACABE21ED100F22BAC4ADC6B20AC32D807F849050841EE16B00A2BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD62A2C36E4FB405E92DFDFDB4173AD9F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2yfqgn3g\CSCD62A2C36E4FB405E92DFDFDB4173AD9F.TMP
Size 652B
SHA256 bc29ce5f1b809fbad68913307fb49707d7d9746b15decfff03e0b8a18dbd260a
MD5 3ce84863e1a557da734b14101f62376f
SHA1 c428ec4d0e8785fd68d6d294a8ebc4f0243376a4
SHA512 9f7263c525793dd6ed5d43bafed14f0de95b21597a21ab18d1c1497442354c48667ac8185e08f18538b639927402893824047ff003236737c864d0a1236cc845
TLSH
T1E2F05E0963F8420EF0F38F31BDF6536391A8FD65DE3293ED5480431928645109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC64D403BE3ABA426DB662DCD53D87478.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\x204qzjc\CSC64D403BE3ABA426DB662DCD53D87478.TMP
Size 652B
SHA256 14bb0a6fd190b86f7fe23df75452960a5bcb041db2e142bc4d262186a83899ae
MD5 305b1613882f752cbf59b547e0b15d78
SHA1 b4e8b9f269e0eeb33ca73523252a01b8d60a1b39
SHA512 219038d132f0c2800f8d17ce8fba6181fbf28873cd5d77355c363c6bf4d8f5dbda908f25085e4a8fa1571b9ff1ca5bf569dc66deb282a26bbae9d124556bd881
TLSH
T1FEF0894963F8420EF0F34B31BEF543A395A8BC64DE3253ED1894031E1C645109961F72
MD5 SHA1 SHA512 TLSH

Submit Download

x204qzjc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\x204qzjc\x204qzjc.0.cs
Size 2KB
SHA256 b1a43e8c182ce096642ce5debcb6937b2c02197262be57dcd3df8dd913278577
MD5 a17eac63d1d2fb96f2aa7252528fa4bd
SHA1 419af06536109e5dc088c468b8bceb5dc2c8b47f
SHA512 c26067d3157460e0a0ce4b525f05c8dbbce3db620c7024c7306b2355e66e6c1fb9fe2e9bcd96d3c11ad866177d96600b151f3e11a5f76a2fbeb52b6edaa892bf
TLSH
T1A341B910E946CB9386F7B6BA8B80A459F273A23703E16902FC8C5B403F5647053F5F91
MD5 SHA1 SHA512 TLSH

Submit Download

x204qzjc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\x204qzjc\x204qzjc.cmdline
Size 369B
SHA256 814f5fd08901c1a47d1ce592523cd398091fceca0bff2cf399619fb21eddab5c
MD5 0fd950820f41e81fafa8305a55ba2bc6
SHA1 dcf0da3257a752a4c77e545017e971616b3b98de
SHA512 84280cf12e8eceb6ec0715bbb01b5d52d9ee3e43df2f2fa5d62a19d84ddcaf77a1e6020b113a3f7a01437dcf4dffa994f473fb2fff08e0dc97078c922603eeac
TLSH
T1B5E0203E5756CABE15DE1007216DC5ECC37207472A417F845990985ED0AB00867F1795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-43-0x0000000140000000-0x0000000140108000-memory.dmp

Download

memory/636-42-0x0000021CCAB70000-0x0000021CCAB78000-memory.dmp

Download

memory/636-45-0x0000021CCAF30000-0x0000021CCAF32000-memory.dmp

Download

memory/636-56-0x0000021CCB100000-0x0000021CCB17A000-memory.dmp

Download

memory/636-29-0x0000021CCAB50000-0x0000021CCAB58000-memory.dmp

Download

memory/636-6-0x0000021CCA060000-0x0000021CCA082000-memory.dmp

Download

memory/636-72-0x0000000140000000-0x0000000140108000-memory.dmp

Download