3f3bbdf2aef4cda3f18bd1ee7f4357a96b995fd78d98e8fd0889fd3bb592b453

Analysis

max time kernel
44s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TinyWall_x86.msi
Size 1.8MB
Sample261113-psep2sby9l
SHA256 3f3bbdf2aef4cda3f18bd1ee7f4357a96b995fd78d98e8fd0889fd3bb592b453
MD5 b37ede3695ae4073e25ac4274df3701e
SHA1 c617307d2d608e0d01430c66898a3f2eb4e792f6
SHA512 31f60e90c460efbac00c69d925a5d64e5856655ec29c0a479bcf0c4cdeaa4e916dba916099d91c52aaf9eba7c5f935424a745497f33e873d845c254547a868fb
SSDEEP 49152:7fBON1yhidUFyBDZ3i4x+LMWvZgkj4mb8+:7wIhg4yTbx+Dv8m
TLSH
T15785DF01384989B8C56A0BF152AACD545E39AF18136BC49F73467EB8FE737601639FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1676	msiexec.exe
5	1676	msiexec.exe
7	1676	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
5020	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1676	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	5924	msiexec.exe
Token: SeCreateTokenPrivilege	1676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1676	msiexec.exe
Token: SeLockMemoryPrivilege	1676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1676	msiexec.exe
Token: SeMachineAccountPrivilege	1676	msiexec.exe
Token: SeTcbPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeLoadDriverPrivilege	1676	msiexec.exe
Token: SeSystemProfilePrivilege	1676	msiexec.exe
Token: SeSystemtimePrivilege	1676	msiexec.exe
Token: SeProfSingleProcessPrivilege	1676	msiexec.exe
Token: SeIncBasePriorityPrivilege	1676	msiexec.exe
Token: SeCreatePagefilePrivilege	1676	msiexec.exe
Token: SeCreatePermanentPrivilege	1676	msiexec.exe
Token: SeBackupPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeShutdownPrivilege	1676	msiexec.exe
Token: SeDebugPrivilege	1676	msiexec.exe
Token: SeAuditPrivilege	1676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1676	msiexec.exe
Token: SeChangeNotifyPrivilege	1676	msiexec.exe
Token: SeRemoteShutdownPrivilege	1676	msiexec.exe
Token: SeUndockPrivilege	1676	msiexec.exe
Token: SeSyncAgentPrivilege	1676	msiexec.exe
Token: SeEnableDelegationPrivilege	1676	msiexec.exe
Token: SeManageVolumePrivilege	1676	msiexec.exe
Token: SeImpersonatePrivilege	1676	msiexec.exe
Token: SeCreateGlobalPrivilege	1676	msiexec.exe
Token: SeCreateTokenPrivilege	1676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1676	msiexec.exe
Token: SeLockMemoryPrivilege	1676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1676	msiexec.exe
Token: SeMachineAccountPrivilege	1676	msiexec.exe
Token: SeTcbPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeLoadDriverPrivilege	1676	msiexec.exe
Token: SeSystemProfilePrivilege	1676	msiexec.exe
Token: SeSystemtimePrivilege	1676	msiexec.exe
Token: SeProfSingleProcessPrivilege	1676	msiexec.exe
Token: SeIncBasePriorityPrivilege	1676	msiexec.exe
Token: SeCreatePagefilePrivilege	1676	msiexec.exe
Token: SeCreatePermanentPrivilege	1676	msiexec.exe
Token: SeBackupPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeShutdownPrivilege	1676	msiexec.exe
Token: SeDebugPrivilege	1676	msiexec.exe
Token: SeAuditPrivilege	1676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1676	msiexec.exe
Token: SeChangeNotifyPrivilege	1676	msiexec.exe
Token: SeRemoteShutdownPrivilege	1676	msiexec.exe
Token: SeUndockPrivilege	1676	msiexec.exe
Token: SeSyncAgentPrivilege	1676	msiexec.exe
Token: SeEnableDelegationPrivilege	1676	msiexec.exe
Token: SeManageVolumePrivilege	1676	msiexec.exe
Token: SeImpersonatePrivilege	1676	msiexec.exe
Token: SeCreateGlobalPrivilege	1676	msiexec.exe
Token: SeCreateTokenPrivilege	1676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1676	msiexec.exe
Token: SeLockMemoryPrivilege	1676	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1676	msiexec.exe
5924	msiexec.exe
5020	MsiExec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 5020	5924	msiexec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TinyWall_x86.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 70B3AC1C71C5C28385B0E2650F1A8524 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5020
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1725EBD29C265D2BDB3068A99DE1127D
  2⤵
  PID:5692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 710EAB079C2A4CCBA828C2427F517FD6 E Global\MSI0000
  2⤵
  PID:4392
- C:\Program Files (x86)\TinyWall\TinyWall.exe
  "C:\Program Files (x86)\TinyWall\TinyWall.exe" /install
  2⤵
  PID:1432
- C:\Program Files (x86)\TinyWall\TinyWall.exe
  "C:\Program Files (x86)\TinyWall\TinyWall.exe" /autowhitelist
  2⤵
  PID:5620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3604

C:\Program Files (x86)\TinyWall\TinyWall.exe
"C:\Program Files (x86)\TinyWall\TinyWall.exe"
1⤵
PID:5556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59dc6d.rbs

Path C:\Config.Msi\e59dc6d.rbs
Size 260KB
SHA256 d7848fba611f43c02946eae87b8d62d090e7360652e45a7ee75207a5dc7c2b17
MD5 43000da7479ac248a42777dc85de87b3
SHA1 c87b4dcb608a7c31d2442b96cc52d81d6812d624
SHA512 a46a05c539eb26367bbe167fdb4238eac1550d51c93ea76fd153904913070374438fb230378e0296bc4521e67104609bdbeac346e8c9d5f13ca22bf755e962e1
SSDEEP 3072:/UXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3bu1:/Uqhy8VKU3hvZUy+ppHEsuB/qu1
TLSH
T14F44AF127584807EFBFB09329A2A9A716F3DF6280B50C59EC3844C1F5E619C16BB3767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Program Files (x86)\TinyWall\Microsoft.Bcl.AsyncInterfaces.dll
Size 21KB
SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
MD5 48efe61d6ca3054309907b532d576d2a
SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
TLSH
T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Program Files (x86)\TinyWall\System.Buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Program Files (x86)\TinyWall\System.Memory.dll
Size 137KB
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
TLSH
T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Program Files (x86)\TinyWall\System.Numerics.Vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Program Files (x86)\TinyWall\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Program Files (x86)\TinyWall\System.Text.Encodings.Web.dll
Size 76KB
SHA256 56e8129fac97678f70fb16c734172ef77f17a607057e6c71b983c656d42aa545
MD5 559e4696b7cc3bee0eeb39a4f911b79e
SHA1 64b1d19e121e2e4c6e6d6169ae710fea3795b211
SHA512 b7a27aa98462dbf353b2a6fbb35cbdf135827fcc21a8e192949b26375c708cc78eeeb813ec1c35942821bdbd65cdd64f295c2c229f4ab977b1b68f22398d7167
SSDEEP 1536:xOOuOOOoODVoXY9BnEfIuOxvW8RebroNKa8kzDW2zb:bDGXmnEAuOx+8RebrooaPDRf
TLSH
T170736C1167888A3ECB6E063478748174A7B4EFDB5233F7832896794917733C8E6193A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Program Files (x86)\TinyWall\System.Text.Json.dll
Size 503KB
SHA256 730223a471e76a3d857a4b70f4e02a5c02a260dadb431421c335b5b1a85295e1
MD5 769bfb5ccb1fdddc2c3f843ef025a90b
SHA1 393ab0ff3b2ec6d8b207f44e2cddbbdb1b00d64d
SHA512 217203c0f94ed8da70fb5b09d602cb92116a998bcce5aff35f76d940048bd748db17c285ba28a19886ddcb4df3fb427c9e0ad93a5accf53c0c4276ff6c8daf8f
SSDEEP 12288:ERIKchfMjooqRACgBhAjKJgHAk6E8zzsceI8irwEwMW4yy:ERtchfMjooqRACgBhAjKJgHAk6E8zzsm
TLSH
T1AEB45B1063E86A2BD6EF5732E47490519B7AE85773E7DB4F2408A8FE58C27518C037A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Program Files (x86)\TinyWall\System.Threading.Tasks.Extensions.dll
Size 25KB
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TinyWall.InstallLog

Path C:\Program Files (x86)\TinyWall\TinyWall.InstallLog
Size 257B
SHA256 bfdc7b16023db09c2efb022f7382cfa25e21147b3d0472dc3fff647db3b0265e
MD5 5c0a49013488f086cf344a063c10d542
SHA1 2974bed6c80845b8582dff4ef1614c42840636ac
SHA512 bb2f5dd28fb2e084945c1e8a0cf6904beed9c025a06ab1e64021b40819ad6e9d60dd539c5ae04a30d22aeb1d1a84309a1b997f805f413e9a8e98af855d9e5568
TLSH
T147D0621F49C593D8A661679A3FD31C8191455D05366404A9B3A94B0BA5B7A2052782E2
MD5 SHA1 SHA512 TLSH

Submit Download

TinyWall.InstallLog

Path C:\Program Files (x86)\TinyWall\TinyWall.InstallLog
Size 651B
SHA256 691090dd6cae0eeaed07e93c38c5c5bd0746d1b4b8c380805a16b4a3dfef617c
MD5 edec7a986db657168ebb2e871499fd74
SHA1 02e81d47718f5af011937b597ace0148f6a34337
SHA512 92fead65cd8003ce8afc8f13249cfda7fdaae593b4eb7c13e56f292f413926e3c779bc71f77c3643ad28f74a8092d5e43121439ba9a14d6240e20e34c4816057
TLSH
T10DF0621F49C593E8A7A127AA3FC31D8151454C153A6404ADF3BA4B0BA9F7A3452786E3
MD5 SHA1 SHA512 TLSH

Submit Download

TinyWall.exe

Path C:\Program Files (x86)\TinyWall\TinyWall.exe
Size 1.2MB
SHA256 c4703f1389efbc5c6df1c28fb7b83374e2b5861f07d2946b1356a7dbe554d826
MD5 0e5ac0c1734a492020655ad013519c37
SHA1 1fab1b6d076c7d2ecc3595788aa8cba09df2c568
SHA512 9f5b208f393df188ab7868d66b61fa5e84a75406b0c5679ec71734ffba6d89d51f45549053e5b2d8321253e33244c90ac2fef462a718cf8250e82dc4982932e7
SSDEEP 24576:I25g4YUE1qIrQVW2ww1rA9Tj2HPaX7TjuM:M4YUE1zcVccMCvyHt
TLSH
T156456C2173B9520EC4BE0B78283951C99BF9BD1ABB64DF4D5458B64C6EB33438B017A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TinyWall.exe.config

Path C:\Program Files (x86)\TinyWall\TinyWall.exe.config
Size 1KB
SHA256 41a61ea0054272f85c9381e2d8ce042bb419657d5c37cc71ee7b8d6bef9a6abf
MD5 25eba3b6c048161bc25a345b024ec981
SHA1 b9d5cbb0357ed0a77cdeba5dc0d2b3cacedf3bef
SHA512 d35a6daa5e7a02cf1e4b5a33c20bd38ab671722fbae1da057915482d9ee6ec54a91c9456c25beaaac61c0ab47aea458693e3860837bebdbd5f9fca6a3e221067
TLSH
T10F11C22194C4BE9A4F7145937E779428CB6903B7288C00ACB0ED5A6B8F215DA5207273
MD5 SHA1 SHA512 TLSH

Submit Download

TinyWall Controller.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\TinyWall Controller.lnk
Size 1KB
SHA256 7af59928cc1f4cb49d9ff68d5ad364ce7c592edb3fd24b0b6530dc02dd3c876f
MD5 efae4dfa094de7d1a71cedcf6ff4e332
SHA1 ef21a8615fa5a1eebbf3cb7b3ffe86de048f69cc
SHA512 2390bb864af32d8b16ac21efce1c1f98b88d3cd4c198f29ea4c0fc8ec967a62ddb3d2ad8856295d643cea84e6c56030bde7c15c88f744c852346c33e7e08e720
TLSH
T19B41CE065FED075AE2778335BEA24922DAF2FC44E3518F6E418541461A72904D4ECF7E
MD5 SHA1 SHA512 TLSH

Submit Download

TinyWall Controller.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\TinyWall Controller.lnk
Size 1KB
SHA256 6ff30c1503f71c4ad198b820bd9d88fcb92877a8cdf0aa353bd2de754c1153fc
MD5 eed21697158b1a19bdf1ea634cd2c847
SHA1 e1c6cd835c3fdb38864f8953aa7645f474a1cd4e
SHA512 f071f62a6f6ac77a4f122781ab2b904e2ad7f9a7fc58aa38a7965511da4016ab97577644fcfbcbd30bad577f67651148768231a6c888c066d633e914ad43878e
TLSH
T1DE41EB026BED035AF2779331BEA20922DAF2FC44E3418F6E408901462972904D4ECF7B
MD5 SHA1 SHA512 TLSH

Submit Download

TinyWall Dev Helper.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\TinyWall Dev Helper.lnk
Size 1KB
SHA256 ac7a395228d95ac440ad842db26a57c973242c7fa65265698837928fff254d21
MD5 d9dab44a47d2c3deb64f72ac0af20e7e
SHA1 a7c31d365d8b67d52c42384673c84c1951f6e677
SHA512 6133c9f3eee77e0e49529345b3957c0d3c4f8d015f0c8ac4ed398cde7bd3e5f3f664d910f75c566c547a9ab56de1790355e46bb2a1478c5db9fbf905caab46d6
TLSH
T12E41AC026FFD065AE2B78335BEA60922DAF2FD04E3518F6E418500461A72D04E5ECF7E
MD5 SHA1 SHA512 TLSH

Submit Download

~inyWall Controller.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\~inyWall Controller.tmp
Size 1KB
SHA256 61a1a403e29df36fd89b3549debebbfbe046a3d783ac1eb0f789062842d07701
MD5 f64366683e7dcc232a16729194099297
SHA1 1924dc1bd73cf47da8f97d0c40d81af99c280433
SHA512 d4c4834b35d02f515610d8a1c1df4540711f92b5cd94d8e942a0c1effeda6a340360e3b2f784893da81bcfc1f8d83781740795280fa73034b1ca987a2b371a64
TLSH
T19741DB026BED075AF2779331BEB20922DAF2FC45E7518F6E418901462A72904D4ECF7B
MD5 SHA1 SHA512 TLSH

Submit Download

~inyWall Controller.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\~inyWall Controller.tmp
Size 1KB
SHA256 2127f85b9a90613ad5d463961ea68a488d2a95a3688797d40cee22c831cdcec8
MD5 701881ba5b9cc435b62944471d219196
SHA1 429a08332a9385cc2f249c41223a482e9e5b1fdc
SHA512 70bbe1d1d9720af0dcf558ce9d658a643d7fa5d4b1ec3643df01dc2769531723b47f2c16b77a535fdef796fc12fdad9404280cf1a1a45b0e8925a0172ac4dcc8
TLSH
T1E441DD025BED075AF2779331BEA20922DAF2FC45E7518F6E418901462972D04D4ECF7B
MD5 SHA1 SHA512 TLSH

Submit Download

~inyWall Dev Helper.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\~inyWall Dev Helper.tmp
Size 1KB
SHA256 48f5453f84ada9e811667f94c0c35f77d40b2671c20e0bd8e517a791a2292e7a
MD5 010e0a31cb51f8b83236b6d410de437a
SHA1 3861d037d09ec57376ac85b1689fd6ce96d2c142
SHA512 cdf1de239d43a388d78181be3d9b3b1cd2312a6e9e82682468b05833ec415233cfdfe62e1bf68759a9980648f78fd2a4fdf28042459a5b6a1fad02e93857b453
TLSH
T1F4419C025BFD075AF2B79335BEA205229AF2BD45E3518F6E418501462972D04D5ECF3B
MD5 SHA1 SHA512 TLSH

Submit Download

~inyWall Dev Helper.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\~inyWall Dev Helper.tmp
Size 1KB
SHA256 7e4887e9b096a057de743eba0885366e2bd961cbefdd8c18f6bbd6c218a4f93a
MD5 05b9c2a29f532e8cd9cab72778c61436
SHA1 f92cdd009faa824c9c46452958acac4d610f6deb
SHA512 9701335d7dfc86ec7f9b4f5442f5f7b99ccce2ed5356b6367906e269ba52d495ad687af5cbaf7806824e945884c38f86a202f27cb08c350ff1a36b83ace32755
TLSH
T1374199026BFD065AF2B79336BEA209229AF2BD45E7518F6E418500461A72D04D4ECF3B
MD5 SHA1 SHA512 TLSH

Submit Download

~inyWall Dev Helper.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TinyWall\~inyWall Dev Helper.tmp
Size 2KB
SHA256 fe30b927b3397bb47561678acd6f421085f3a2d7e3b8c6a32bdd189a8fa32628
MD5 138433b10b6f639cf29132c947816cac
SHA1 333248ee462fe98ddb35ac89cf01cea53dabe3f4
SHA512 f524efeb609e690b615d110b97abe36196dcf8ffc73715422cd1fa116ecb4bf2145d826b6090daa760480f64f4125ba8ea5150cbe18fb5654ba63c408ff6a060
TLSH
T1E541CC026FFD035AF2B79331BEA209229AF2BD45E3518F6E418501462972D04E5ECF3B
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.custom

Path C:\ProgramData\TinyWall\hosts.custom
Size 388KB
SHA256 b2ded2baf60a318683343da27a5d3bc132aeb82922e2a46dfa984b54c8b3574d
MD5 1634ae19a82ad1c84fdf1a78c2ef82ec
SHA1 0fd9b9058c47b0ac529e11db28aa2a572dec4c57
SHA512 28b1aab89ce687a2eb09bda3c499d82c0ab19bef72775471cd4c5052e26291bb0848e4f778847fd0f225258a630c1f90c7a05f9e03961b05b27131b3d5800be1
SSDEEP 6144:f3FePQ6fLFsiwiddzwKygosq1R/RdNyJEs8jveftbikkjAg9rxwJ+W1p4QfmHWKC:klc79ukkvt8JpyAjL+t
TLSH
T19A84FA798A1A95ED08F7C14830BA3277D40BF4318CEAF5C78EA8D10EB57049DBAD156E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.json

Path C:\ProgramData\TinyWall\profiles.json
Size 46KB
SHA256 d7e616855b81e3c03698c5289d8ec9b60c306084ad945131e8d84a56306ef529
MD5 dd84987b99e80112754870bb96a5225f
SHA1 7702aa4efe6c2b1b107b6f23b644fcaf656493b0
SHA512 b06cba8dc59b1b6a03a75b36633d92e976235347a07d9ab50ca27bd9dc9f8c71592d5dc5aaa724487bb22d4b464edca2120fc190fae47cf596c0c0e188943ee7
SSDEEP 384:5YDE8Tw9MJ8aCEIz7zNz7zPz7zB8Z1ag6d/7hyGPUzGr0G6CGiGnVNrZt5AP:aDbeNFXz7zNz7zPz7zivH8
TLSH
T11923BB2AD1618D6F65FE7370A6660B43F2B8136F21901D4779BC825C1F7BCAA1106E8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 1KB
SHA256 cc94a2f68fd505d5a9e741b3184562283af7d596f4d1325d809a574090c65043
MD5 e854e38f567f4bbad7f8f6eb98bccda8
SHA1 07e1dd2e5ef4fde5d0813defe7c8e55ec585f34a
SHA512 623aa9c003ed7b0f71b790209b5d0252a0526d762f45326406ab2f668f1b430ff242b0bd94ee27446c5ff1114d02dceb334b6d576a17f4830c1654394837ca51
TLSH
T12F31F5BACE5C5D506A020E048FB4D1391EBAE7E0140A12C62038C8E99D21B7EBF32C0F
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_B11DCE7709684A7836D6771CEBB07349

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_B11DCE7709684A7836D6771CEBB07349
Size 2KB
SHA256 ee8cdee67f52a6483eb66e37aff41538ee93875126f87517ec2a2b045bdc1fe8
MD5 5927660747375d0bba375520b6985732
SHA1 b793e19c588f3cde9dd06cef5043b3e35e3155a6
SHA512 7090de77470f241747fc18c0d94e13cfa79929346f4523eab865da1d45c395f4da5ec853e95d4e0e873425133afdd754c77fb8f4547f0204921858413b88875e
TLSH
T1934118124F217108F1038AE2CC9CC5302DF08AF1B4405A8A396CCACF29A5B773FBA00E
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 1KB
SHA256 e450c3fbb7beea30b4c7c63a43506ebe6b771ca0109628b4aaad84fe42c9a14d
MD5 e0e15ccd59087ae7c3fb90f10d886015
SHA1 96d1fa2c15e0d765b0c43ea224b50fd40a827b3a
SHA512 5c02be9a19d729bef846772f3905ccf005e26d1dadd4d1843eee7af9173fc235cb5f1fc1c6bd9c0c3c403c8954d8c9d4fe18c4b65f52bb69e818f0be5539413e
TLSH
T1C331C85147213C550AA109804FDBE52DDEB5A1C10D30185630BCABCADC93BBF7A7840D
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 412B
SHA256 bdc440f940b10069bf65ede79741e375bbbfe53fbcd44f2eb57c5c3898b177a0
MD5 900161417594d84443448e9776d952dc
SHA1 d49a49d4335fbe754b9838214d5b78f83398d56e
SHA512 9124c9a900f3933a3d3404e25eeb59e516ec484fca12566e650d10394f3befac6a9f152fdc87ce841621615107eb923127551d2e3c71f29de26bed37ca1ee18f
TLSH
T13EE0C01430FF1119F27ACC7803ED22306E3CB2933144AAB74A9012297345D00CCF3755
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_B11DCE7709684A7836D6771CEBB07349

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_B11DCE7709684A7836D6771CEBB07349
Size 420B
SHA256 71c5cb6041cdf021fb124d906f3d95e963cc4044919b4886a9b6e0782bba76d5
MD5 94389520257f59dac0df6ca4e424362a
SHA1 6f0b77d07d63ad561ada8245641589120c35a931
SHA512 7e6be6dc5b3ce3385d74c21699b39d059b2e740111baf751dcb69ea5ea2e3a7d9f919f98c09f0726e94993f35a19be6788abf54d810533634c416c2563b031f8
TLSH
T1B9E0681839FE005EF632E8344FD9B69E4C9FF21750918B561B50620B2A0BF004D23E28
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 412B
SHA256 66ed512d2b81c0520433cd20b407d3294fe1e835201a6d9d3face0ae2054b154
MD5 3421110f6651a54261fb0ccc93e33782
SHA1 1b798fa1f6419188e5d7d56429d8e20f3f85fe14
SHA512 b292360b20f889c01e08d9f511c231961dbc7a68147dd9d458aff2cfa294bc9eb80c47134ed6dd03f63456da249c013f2c6c34a1948ef28977542c290df413ce
TLSH
T1AAE0D83812BA40A9FB34E57953C977750A2AB53B15091BA41AA046057A1BA505C56C71
MD5 SHA1 SHA512 TLSH

Submit Download

MSI842A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI842A.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE101.tmp

Path C:\Windows\Installer\MSIE101.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59dc6e.msi

Path C:\Windows\Installer\e59dc6e.msi
Size 1.8MB
SHA256 3f3bbdf2aef4cda3f18bd1ee7f4357a96b995fd78d98e8fd0889fd3bb592b453
MD5 b37ede3695ae4073e25ac4274df3701e
SHA1 c617307d2d608e0d01430c66898a3f2eb4e792f6
SHA512 31f60e90c460efbac00c69d925a5d64e5856655ec29c0a479bcf0c4cdeaa4e916dba916099d91c52aaf9eba7c5f935424a745497f33e873d845c254547a868fb
SSDEEP 49152:7fBON1yhidUFyBDZ3i4x+LMWvZgkj4mb8+:7wIhg4yTbx+Dv8m
TLSH
T15785DF01384989B8C56A0BF152AACD545E39AF18136BC49F73467EB8FE737601639FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-163-0x00000152BBD80000-0x00000152BBDA6000-memory.dmp

Download

memory/1432-170-0x00000152BBDF0000-0x00000152BBE2C000-memory.dmp

Download

memory/1432-169-0x00000152A3560000-0x00000152A3572000-memory.dmp

Download

memory/1432-165-0x00000152BC0C0000-0x00000152BC142000-memory.dmp

Download

memory/1432-151-0x00000152A17C0000-0x00000152A18FA000-memory.dmp

Download

memory/5556-195-0x000001E450580000-0x000001E450588000-memory.dmp

Download

memory/5556-192-0x000001E4505A0000-0x000001E4505B6000-memory.dmp

Download

memory/5556-197-0x000001E4505C0000-0x000001E4505CA000-memory.dmp

Download

memory/5556-200-0x000001E450570000-0x000001E45057A000-memory.dmp

Download

memory/5556-202-0x000001E4505D0000-0x000001E4505DA000-memory.dmp

Download

memory/5556-204-0x000001E468F10000-0x000001E468F2E000-memory.dmp

Download

memory/5556-205-0x000001E4505E0000-0x000001E4505E8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads