f62b156c0d04a48c1898fb942e02d340fc9389085bc98aab1c8f263fd9ef5464

Analysis

user interaction
yes
max time kernel
29s
max time network
25s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IQ Optimizer-v6.7.4.0.exe
Size 63.7MB
Sample260529-pkgjnsbw5v
SHA256 f62b156c0d04a48c1898fb942e02d340fc9389085bc98aab1c8f263fd9ef5464
MD5 dafa29ddf71784b798ba7a2f2627d7b1
SHA1 dabef2bbf6518309c99cf94c06f8bb3fe8432322
SHA512 e66f1848fef76e272fdad6204719b06747dcea16bd462e798b014aff1f0cff08aee614db9e046688cf4a45738e5bf93d06c1d71bcf7463c73c12d3bd4a336d5f
SSDEEP 1572864:QNVjchuWARXNVjchuWARVpQRyhKqqPA5VfXLQNPBIFJ36OWkw2XW+ZoR0LA:OnePWSPBIJ36EXtORf
TLSH
T161E71231764DC82BE56A11B02A3DDA7A912C7D660B7108D7B3DCBD5B37758C22232E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\X:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\Z:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\A:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\B:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\M:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\T:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\U:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\K:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\L:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\R:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\S:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\V:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\Y:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\N:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\P:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\G:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	IQ Optimizer-v6.7.4.0.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Loads dropped DLL 17 IoCs

pid	Process
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IQ Optimizer-v6.7.4.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Colors	IQ Optimizer-v6.7.4.0.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e722000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	IQ Optimizer-v6.7.4.0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	IQ Optimizer-v6.7.4.0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	IQ Optimizer-v6.7.4.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	IQ Optimizer-v6.7.4.0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	IQ Optimizer-v6.7.4.0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3792	msiexec.exe
Token: SeCreateTokenPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeAssignPrimaryTokenPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeLockMemoryPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeIncreaseQuotaPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeMachineAccountPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeTcbPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSecurityPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeTakeOwnershipPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeLoadDriverPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSystemProfilePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSystemtimePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeProfSingleProcessPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeIncBasePriorityPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreatePagefilePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreatePermanentPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeBackupPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeRestorePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeShutdownPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeDebugPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeAuditPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSystemEnvironmentPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeChangeNotifyPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeRemoteShutdownPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeUndockPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSyncAgentPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeEnableDelegationPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeManageVolumePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeImpersonatePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreateGlobalPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreateTokenPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeAssignPrimaryTokenPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeLockMemoryPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeIncreaseQuotaPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeMachineAccountPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeTcbPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSecurityPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeTakeOwnershipPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeLoadDriverPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSystemProfilePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSystemtimePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeProfSingleProcessPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeIncBasePriorityPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreatePagefilePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreatePermanentPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeBackupPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeRestorePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeShutdownPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeDebugPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeAuditPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSystemEnvironmentPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeChangeNotifyPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeRemoteShutdownPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeUndockPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeSyncAgentPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeEnableDelegationPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeManageVolumePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeImpersonatePrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreateGlobalPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeCreateTokenPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeAssignPrimaryTokenPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeLockMemoryPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeIncreaseQuotaPrivilege	4520	IQ Optimizer-v6.7.4.0.exe
Token: SeMachineAccountPrivilege	4520	IQ Optimizer-v6.7.4.0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4520	IQ Optimizer-v6.7.4.0.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1320	3792	msiexec.exe	83

C:\Users\Admin\AppData\Local\Temp\IQ Optimizer-v6.7.4.0.exe
"C:\Users\Admin\AppData\Local\Temp\IQ Optimizer-v6.7.4.0.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3312

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 956D993C108D7947AF786E46E8DB6FDA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backbutton.xaml

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\backbutton.xaml
Size 1KB
SHA256 fb1c5df8785650b20612b61a66ecbda5e1ed323d6c8ac45b2ebccbe9193779f8
MD5 3dec9f3886a7d180b1da7a72541dbf81
SHA1 07f3ba034be78970a86d055daed59bf7d87f8d21
SHA512 0250b81a2795fcac69e3f2c95bdff406f01ff207e81bead96b2739f28e26dd2d97d82cccbfbd92b7141b1eabd2310db048618fef1cc5261fdff212d19bb910bf
TLSH
T12F41518481DD482862B7546C7B5390A49E5630B340248697FF7F363B5FB70AE193FD12
MD5 SHA1 SHA512 TLSH

Submit Download

background

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\background
Size 134B
SHA256 f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787
MD5 a0efb0e7b9cee25b09e09a1a64e96ba6
SHA1 0c1e18f6f5e6e5e6953e9fb99ca60fdec35d6e39
SHA512 7e53f9f564aaa529b3b15035671957c2923ec98ddee93758ea7a4c8645ee9058962078771b853e3490290fde1f57030dff5092d40d69418776ffee89f79c8a7c
TLSH
T13FC00413DDC0C403DC041170CD3D41C471004DF51305010177415DCDC50034C30C7C40
MD5 SHA1 SHA512 TLSH

Submit Download

checkbox

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\checkbox
Size 1KB
SHA256 bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3
MD5 0b044ccde7aa9d86e02a94030d744ac2
SHA1 0594ebb3737536703907ba5672ccd351c6afb98a
SHA512 dbfba793722589f1a76dbc75c9a2f3646733e4a079a6b70003716a7f7b8fa1a6a2b234ec9132f5737e91d20d460db1e29826b2d7ac740f73136975f19e336cd8
TLSH
T12531D759EB903801452DD64214F5D536EA2209888DE0A038EF9ED9520E742E2893EBDF
MD5 SHA1 SHA512 TLSH

Submit Download

frame_bottom_left.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_bottom_left.bmp
Size 66B
SHA256 384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21
MD5 1fb3755fe9676fca35b8d3c6a8e80b45
SHA1 7c60375472c2757650afbe045c1c97059ca66884
SHA512 dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3
MD5 SHA1 SHA512

Submit Download

frame_bottom_mid.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_bottom_mid.bmp
Size 66B
SHA256 205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd
MD5 71fa2730c42ae45c8b373053cc504731
SHA1 ef523fc56f6566fbc41c7d51d29943e6be976d5e
SHA512 ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f
MD5 SHA1 SHA512

Submit Download

frame_caption.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_caption.bmp
Size 206B
SHA256 0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707
MD5 8641f45594b8d413bf1da25ce59f1207
SHA1 afebb23f5a55d304d028ca9942526b3649cddb52
SHA512 86a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a
TLSH
T118D0045313C1C543FC040070050C43CC5700C535130501007FC55DCCCD031443007C41
MD5 SHA1 SHA512 TLSH

Submit Download

frame_left.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_left.bmp
Size 66B
SHA256 f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a
MD5 30384472ae83ff8a7336b987292d8349
SHA1 85d3e6cffe47f5a0a4e1a87ac9da729537783cd0
SHA512 7611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963
MD5 SHA1 SHA512

Submit Download

frame_left_inactive.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_left_inactive.bmp
Size 66B
SHA256 c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55
MD5 4b84f29fbce81aab5af97a311d0e51e2
SHA1 60723cf4b91c139661db5ecb0964deca1fc196ea
SHA512 775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1
TLSH
T13AA0041713C01D0DD004C071014C43145D00CD0F1005030D544553313DCC4D73004C44
MD5 SHA1 SHA512 TLSH

Submit Download

frame_top_left.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_top_left.bmp
Size 154B
SHA256 17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741
MD5 1966f4308086a013b8837dddf88f67ad
SHA1 1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190
SHA512 ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17
MD5 SHA1 SHA512

Submit Download

frame_top_mid.bmp

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\frame_top_mid.bmp
Size 66B
SHA256 1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee
MD5 4e0ac65606b6aacd85e11c470ceb4e54
SHA1 3f321e3bbde641b7733b806b9ef262243fb8af3b
SHA512 7b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64
TLSH
T1A2A0041733C00D01F004C0F1414D43145D00D50F1005030D544553333D4CCD53004CC7
MD5 SHA1 SHA512 TLSH

Submit Download

sys_close_hot.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\sys_close_hot.png
Size 276B
SHA256 15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033
MD5 17242d201d004bb34449aab0428d2df1
SHA1 77a332c6a6c4bfc47a2120203cfeabb8a2268a6b
SHA512 605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f
TLSH
T100D02BCB23D8BD7EC0CE87F28544A661B8F38D2D2607560558509638040E5A417613F5
MD5 SHA1 SHA512 TLSH

Submit Download

sys_close_normal.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\sys_close_normal.png
Size 225B
SHA256 bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5
MD5 8ba33e929eb0c016036968b6f137c5fa
SHA1 b563d786bddd6f1c30924da25b71891696346e15
SHA512 ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e
TLSH
T121D023CCC7C17C3EC49181F60B4C24C0ECB30DCC082756203372992567716A01300341
MD5 SHA1 SHA512 TLSH

Submit Download

sys_min_hot.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4520\sys_min_hot.png
Size 180B
SHA256 bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e
MD5 1a883668b735248518bfc4eefd248113
SHA1 1112803a0558a1ad049d1cac6b8a9d626b582606
SHA512 d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04
TLSH
T123C0C0CD4F46413BCBC482620A860342F833050C1513329C546029310001020D040751
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5C55.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5C55.tmp
Size 904KB
SHA256 d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da
MD5 421643ee7bb89e6df092bc4b18a40ff8
SHA1 e801582a6dd358060a699c9c5cde31cd07ee49ab
SHA512 d59c4ec7690e535da84f94bef2be7f94d6bfd0b2908fa9a67d0897abe8a2825fd52354c495ea1a7f133f727c2ee356869cc80bacf5557864d535a72d8c396023
SSDEEP 24576:fuPYAGxUherZNh0lhSMXlrI5s2JK5kmwE:2P5Ferq7I5RJK5k1E
TLSH
T1FA156C71378AC527F76E12B02D3D8ABB502E79760B7104CB63D86E2A59784C36736E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5DD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5DD0.tmp
Size 1.1MB
SHA256 403869ed494bcbc3e535b492f2ebfad95748049e203ff7c31ac1afb38d8909ed
MD5 e612b2f3c68a7d5c34592c88778766b2
SHA1 e18329c9f763f923682408032b7b35a4e62fdf81
SHA512 753c8d4600595c0b83f1a5bca9da637d56d7778ffd74a90942ee243e6b998c113e372b35cde4aa90b4a11152176812e354a6c0761b169243ecf5d3a9c793b543
SSDEEP 24576:ZobYDKjR2XlJ+y+scZj/+H5Xza6JYXCxrwnFHP905AIASGdvxgh98E4qtNzR1Ca7:McB6jWH5XzatCJkH105fASGdvxgh98Et
TLSH
T1844509206C6CC57AFF2F9D7096965226E86D75D11BE209FF82E0D88562321C36333F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5DF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5DF0.tmp
Size 877KB
SHA256 107fd7ee1eaf17c27b4ed25990acace2cb51f8d39f4dfc8ef5a3df03d02e1d34
MD5 a67acb81551a030e01cda17fa4732580
SHA1 9f6b54919ee967fddf20e74714049b8c13640083
SHA512 30cc0870797220e23af40d5f50a9ce823c1120fba821ff15e057587c2a91c7247058e9a8479088047b9dc908c5176793e6f3ccd066da30bd80e1179649b2f346
SSDEEP 24576:y//vq14OUaH0yxgC91E1h0lhSMXldU5Fr2CB6b0Wk6:y/Y02gCQsG592CB6b0Wk6
TLSH
T1C7156B71358EC036F16D51B1762ECEBBE0ADAA760F7184DB67C0BD2A59308C21A35E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IQ Optimizer-v6.7.4.0.msi

Path C:\Users\Admin\AppData\Roaming\IQ Optimizer\IQ Optimizer 6.7.4.0\install\IQ Optimizer-v6.7.4.0.msi
Size 5.9MB
SHA256 ea668e9ba785e0b51a79c1020c5c33a2c3d72e6e4b2b936797560ae980f17b27
MD5 a2b170d002ec9c1847abbd170da4ed00
SHA1 3997dfefd9a18f5016c3b9bb3a6e66a235c0cbff
SHA512 261ffee6599a60ce4f0f00c659f470e6df1db9e4efeca348d3ad58faf8f9efe9392c61f9cb56bfe6dfec02a546088acbedfaddbf83188ff885be01bea9b41a6f
SSDEEP 49152:U+eOCMP5Ferq7I5RJK5k1scB6jWH5XzatCJkH105fASGdvxgh98E4qtNzR1CaTWV:UExFe7IC2H1HUFm402bYwy
TLSH
T16F567C21395DC036FA6F0970662EDA7AA56D7DE20BB104EB52D4FD5B3A304C22732E47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads