bumblebee | 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpzx8m0tzj.msi
Size 9.3MB
Sample260602-cedvdacw7j
SHA256 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24
MD5 bd99a02d8afdc468d315d47870202198
SHA1 67d6e46cf006d34d7606c03f48052fcd7af58d86
SHA512 e8b1aee097276a6a77f76daa99676a62843e310277027a08d538f6504b6babf498f1a5776e233783f9322fe2028bec10e2b789ef3ef2cecdf82752fa2239d9e4
SSDEEP 196608:YKhpGIqbo0qpUd5DxbN9QZc1GmbL8bdeIlntj/8/Vy5XgLF9fmR2Q:Y+RGdt0ckmcb8IltzvxgTm
TLSH
T17EA6336E3BB8A70BC73E75B499931280804EACD352C8F846F25DF7A833787606E55356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rvt1 discovery bumblebee loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

rvt1

Attributes

dga
7g342zvzn3uqq.life

xsenlg0qhhi1b.life

g0yw5p28hbx0s.life

52szf55f8gmk8.life

rkrjtpvvmeals.life

17ek6ne63tvp1.life

iwzkgwcv5ebat.life

9n9tal4hw00ip.life

6rzcyj1sswqm2.life

b51lj50er7i5c.life

7gup8m7nsh4bl.life

pxu2liz19adny.life

pdyckgp144x0w.life

hsxe8ye2venfd.life

oh6qtkwfuus46.life

xigticnxbhrv8.life

euod9uk8f3l81.life

i6r4k2jo8giob.life

9qnk0nmyswkvz.life

3tkemqy8wipsj.life

yo2blls44tlmy.life

aftxgkj92l0in.life

awov62djki4y0.life

duhhgvdrjx5m8.life

zucscj1mnafjq.life

u0dvovexg8a9r.life

94y5pkgk1etpy.life

jced3p0f46gyy.life

h3t6oau35fj9w.life

ch7bk8l5jzsdy.life

iy4sgebvy7irq.life

pg3k818fzjx8x.life

q2afcbxeqvlvp.life

yrdzyc58ivnz2.life

5rysu08g3k6gc.life

cbo4qfnw25cvh.life

q77e1ox1itdb4.life

s7m284fqxpzmw.life

p55dbejqk240n.life

lbrizkb47cwrc.life

hl81xtzjv36jf.life

3rv3hcanv2go8.life

mw3bn6jeeodm5.life

4j20prz1zjnfj.life

o10m4i9qkdlym.life

62mqkuu1q1o15.life

i8670z8zhfp8t.life

ww9uswruc5bfm.life

c11t50tj3160n.life

mlxjgjbdkpww3.life

zel0o851i608p.life

n5xvvdz9y896o.life

5zf7kj41fuqr9.life

dhfl9u35aao7j.life

8svblqs899cjr.life

b05tsf8p68rbe.life

hik8gmiewwu0r.life

y3vmprmb726we.life

dtramz0feg4dw.life

yx1zja0dj8qju.life

r23sxlqhzx8vg.life

i32jgcz842stw.life

e7rn9f4gseyzp.life

ol3sj2hi7bb2c.life

9kb3iv3ou95tt.life

wf8gacjbp9imr.life

39werlh4rv5s8.life

ptr5rfuuq7juc.life

eh8gll5bhpt91.life

dg0ffst21bgvr.life

i0unymq8nqf8e.life

m0b88ot97bjsb.life

c66pqivko6n8o.life

agp9y0wg814pa.life

i449op4jt9r92.life

ll5q20efbibpr.life

23hixodoyv0dd.life

c2euwefme48jz.life

r17o8laaolhog.life

fcung4iggr5p3.life

di1cn3vl5228i.life

pqoq7q5lty905.life

zn4fgfonyn1qn.life

0gh9do46p1l2y.life

cjglyj70nhu28.life

9vueh00h1bdwv.life

44n306fqocyhv.life

ox6pb5okf6aoh.life

37hrryyz275k8.life

8cx1dqbdb6ch8.life

jjpz3ywa12xe7.life

kw6ahe9ib2rxc.life

6gl5viz85n1mt.life

iikz0tznluj1j.life

13zljo99byc7n.life

zf20ias6u41qg.life

qv3f3zwf9brmd.life

dzydy8wal311h.life

qd0gy4oktstgt.life

o64zkgme71j8y.life
dga_seed
-7827392873490824478
domain_length
13
num_dga_domains
300
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Badlisted process makes network request 21 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2140	msiexec.exe
6	2140	msiexec.exe
31	2140	msiexec.exe
36	2140	msiexec.exe
94	3892	rundll32.exe
95	3892	rundll32.exe
96	3892	rundll32.exe
100	3892	rundll32.exe
101	3892	rundll32.exe
102	3892	rundll32.exe
104	3892	rundll32.exe
105	3892	rundll32.exe
106	3892	rundll32.exe
107	3892	rundll32.exe
111	3892	rundll32.exe
112	3892	rundll32.exe
118	3892	rundll32.exe
120	3892	rundll32.exe
122	3892	rundll32.exe
127	3892	rundll32.exe
129	3892	rundll32.exe

Loads dropped DLL 5 IoCs

pid	Process
3892	rundll32.exe
2996	MsiExec.exe
2996	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dell\RVTools\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVTools.exe	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\ClosedXML.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\Microsoft.ApplicationInsights.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\log4net.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsSendMail.exe	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsFindBadVM.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\STSService.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsMergeExcelFiles.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVTools.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\log4net.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsBatchMultipleVCs.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\DocumentFormat.OpenXml.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\rvtools32x32.ico	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\Vim25Service.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsPasswordEncryption.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\FastMember.Signed.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsMergeExcelFiles.exe	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\FastMember.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsSendMail.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsCreateLocalUser.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVTools.pdf	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\VMware.Binding.WsTrust.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\ExcelNumberFormat.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58bde1.msi	msiexec.exe
File created	C:\Windows\Installer\e58bddc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942756}	msiexec.exe
File opened for modification	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_853F67D554F05449430E7E.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_4B94857914A0BD97A1B4FE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bddc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bddf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI140C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI145B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14E9.tmp	msiexec.exe
File created	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_4B94857914A0BD97A1B4FE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEE6.tmp	msiexec.exe
File created	C:\Windows\Installer\e58bdde.msi	msiexec.exe
File created	C:\Windows\Installer\e58bddf.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{803A037A-6E5F-4088-B880-1AD90D542187}	msiexec.exe
File created	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_853F67D554F05449430E7E.exe	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2140	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 8c0d0000d8239c7033f2dc01	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Dell	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 741d710015f390b02c38006d6f2f4c15744252634c02e81f97bc875ea9527b3d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Dell\RVTools	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Dell\RVTools\ProductImprovementOptIn = "1"	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Net.Http.dll\System.Net.Http,Version="4.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3A" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e004900440029002d006a003f005b0059003900280059004d0028004300360041006a0032003100380000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|FastMember.dll\FastMember,Version="1.5.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e004f003000340024005a006500390029004500250075006f004e00670074007d00640026004e00520000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A730A308F5E688048B08A19DD0451278	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|STSService.dll\STSService,Version="6.5.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0070007e006100730074006c006e00390043002700290028007d006b003d00380062004c0067002e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVToolsMergeExcelFiles.exe\RVToolsMergeExcelFiles,Version="4.7.1.4",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0072003900290066006d0044007a00790031003400730055005a00260028006f007a0077005900710000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\ProductIcon = "C:\\Windows\\Installer\\{803A037A-6E5F-4088-B880-1AD90D542187}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Microsoft.ApplicationInsights.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.IO.FileSystem.Primitives.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Diagnostics.DiagnosticSource.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Diagnostics.DiagnosticSource.dll\System.Diagnostics.DiagnosticSource,Version="5.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13F = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00610065004d0030002d0025005600720043006300480040004300410042003300730056006500360000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVToolsMergeExcelFiles.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ApplicationInstallationFolder_11\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|DocumentFormat.OpenXml.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Runtime.CompilerServices.Unsafe.dll\System.Runtime.CompilerServices.Unsafe,Version="5.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e003600600025007400610033004800520025002a003100630027005e0044006400570068007500590000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|FastMember.Signed.dll\FastMember.Signed,Version="1.5.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="9E8F22703BEF9A29" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00560055006b004d0027005b00380057007700350044002d0074006a002b007a007d0061003300610000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\PackageCode = "BC0FEFB58D74A934FB554FFE92FC3004"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\SourceList\PackageName = "RVTools4.7.1.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\ProductName = "RVTools"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Microsoft.ApplicationInsights.dll\Microsoft.ApplicationInsights,Version="2.22.0.997",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="31BF3856AD364E35 = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e005f00290058004700480067006400400078006d003500760051005e0067004b0039005a006e00370000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|VMware.Binding.WsTrust.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|log4net.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVTools.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Memory.dll\System.Memory,Version="4.0.1.1",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0062002100270050005a002c0058006e0066007a00270021005b006b0056007200470071004800320000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Net.Http.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVTools.exe\RVTools,Version="4.7.1.4",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00430075005b00500040007a0057003f00450032004400680064004c0072004c005500290024007a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D776E87A51EAD0E4C89AC389B4778FD0\A730A308F5E688048B08A19DD0451278	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|ClosedXML.dll\ClosedXML,Version="0.95.4.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0034006b004800650026003f00510070006a0055002c00350029006200290034005a0055002a00310000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|VMware.Binding.WsTrust.dll\VMware.Binding.WsTrust,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e005f0058004300300040004f0033002c004e00540056007b007d00470043002a0042005a003d00530000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D776E87A51EAD0E4C89AC389B4778FD0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Vim25Service.dll\Vim25Service,Version="0.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0053007400480068004300600050002b0024007a0067007e00520076004e005e004c0024004a00690000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Memory.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\PackageName = "tmpzx8m0tzj.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497265	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497265\AppLicense	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Numerics.Vectors.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Numerics.Vectors.dll\System.Numerics.Vectors,Version="4.1.4.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3A" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e002b007a0076005f00490025002a006c002b003f0078004400740033002a002d0036006a002c00460000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|DocumentFormat.OpenXml.dll\DocumentFormat.OpenXml,Version="2.12.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="8FB06CB64D019A17" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e004e0073005600260056006f004b006e00530064003d004e00690064005000760024002a007800400000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Newtonsoft.Json.dll\Newtonsoft.Json,Version="13.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="30AD4FE6B2A6AEED" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00760026004b003d00780048007e00530062002b0032007d006600680066007e0076005d007200430000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|ExcelNumberFormat.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Buffers.dll\System.Buffers,Version="4.0.3.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0032003f006a007a0060002b003f00760067005a0055004600540049006e007b004d00310055002d0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.IO.FileSystem.Primitives.dll\System.IO.FileSystem.Primitives,Version="4.0.3.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3 = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e007b005d0038006800240024004000640027007500470074004200310065006d00500025002c002d0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|FastMember.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|STSService.dll	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3468	msiexec.exe
3468	msiexec.exe
3468	msiexec.exe
3468	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2140	msiexec.exe
Token: SeSecurityPrivilege	3468	msiexec.exe
Token: SeCreateTokenPrivilege	2140	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2140	msiexec.exe
Token: SeLockMemoryPrivilege	2140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2140	msiexec.exe
Token: SeMachineAccountPrivilege	2140	msiexec.exe
Token: SeTcbPrivilege	2140	msiexec.exe
Token: SeSecurityPrivilege	2140	msiexec.exe
Token: SeTakeOwnershipPrivilege	2140	msiexec.exe
Token: SeLoadDriverPrivilege	2140	msiexec.exe
Token: SeSystemProfilePrivilege	2140	msiexec.exe
Token: SeSystemtimePrivilege	2140	msiexec.exe
Token: SeProfSingleProcessPrivilege	2140	msiexec.exe
Token: SeIncBasePriorityPrivilege	2140	msiexec.exe
Token: SeCreatePagefilePrivilege	2140	msiexec.exe
Token: SeCreatePermanentPrivilege	2140	msiexec.exe
Token: SeBackupPrivilege	2140	msiexec.exe
Token: SeRestorePrivilege	2140	msiexec.exe
Token: SeShutdownPrivilege	2140	msiexec.exe
Token: SeDebugPrivilege	2140	msiexec.exe
Token: SeAuditPrivilege	2140	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2140	msiexec.exe
Token: SeChangeNotifyPrivilege	2140	msiexec.exe
Token: SeRemoteShutdownPrivilege	2140	msiexec.exe
Token: SeUndockPrivilege	2140	msiexec.exe
Token: SeSyncAgentPrivilege	2140	msiexec.exe
Token: SeEnableDelegationPrivilege	2140	msiexec.exe
Token: SeManageVolumePrivilege	2140	msiexec.exe
Token: SeImpersonatePrivilege	2140	msiexec.exe
Token: SeCreateGlobalPrivilege	2140	msiexec.exe
Token: SeBackupPrivilege	888	vssvc.exe
Token: SeRestorePrivilege	888	vssvc.exe
Token: SeAuditPrivilege	888	vssvc.exe
Token: SeBackupPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2140	msiexec.exe
4048	msiexec.exe
2140	msiexec.exe
4048	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1804	3468	msiexec.exe	105
PID 3468 wrote to memory of 4048	3468	msiexec.exe	107
PID 3468 wrote to memory of 3892	3468	msiexec.exe	108
PID 3468 wrote to memory of 2996	3468	msiexec.exe	109
PID 3468 wrote to memory of 2936	3468	msiexec.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpzx8m0tzj.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2140

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1804
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools4.7.1.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:4048
- C:\Windows\system32\rundll32.exe
  "rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools.dll",DllRegisterServer
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  PID:3892
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8BCC866C12CB520C468460D6ACEB9197 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F1579E959556374445D601212E0FBB98 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bddd.rbs

Path C:\Config.Msi\e58bddd.rbs
Size 7KB
SHA256 bfa755f96bb985b4d08909ccf403d1238464225c4276d8abf204e999b2ac1798
MD5 f23cffe4da386fdfea7d0da71d637d83
SHA1 45063ca6e61a905c5ecc4303a14d02e03f5efc99
SHA512 59f72ac8482a3142c17f8b9e431cbfac6c191143c84b77bab0d319f1985fe3fbaabc8a6f609a5271c3ca7480ebec2325a3348b2ad4461275f30705b252b70d87
SSDEEP 96:ImP8D3JjJEUARz8ZeCSZaUbXBTCsTlBUbXBTCW4UBuxTlF6Bo55ZhZW2XozFCMpT:dkFlE8ZeDtNOIgNOxvVFZ3MpT
TLSH
T119F14281B31091D2EC92573ACB4B275637A7D3DDC390230B19CD92686F567895FE22CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bde0.rbs

Path C:\Config.Msi\e58bde0.rbs
Size 19KB
SHA256 9b4cd5e8c6bac93c4f2b4a7c8c078f44f743f0659658c47e9689cc4eebcb6fad
MD5 efff4bf27dcd9c968c2604754335cb50
SHA1 0e596e622d45177d9a0ae0c5d0de0f983917a5ab
SHA512 e7ae33384dc0fddd0f6491903c7dcb1938a35846daad3894ecc0036c4bc16ecb6a0896ba3f7ef428aed6c7d6116e3d77e0520b245309393658321f71533b1fbf
SSDEEP 384:srIPQeCwyLjN05mPrwSPrwy1kcyusmDtpdArf3ezjpVupT7i:sMFwne5mP0SP0UFBQi
TLSH
T13D92B505B409D6C2FE11637173817E1637B18E48E6A4226D46C9D92D8FC8E4D2BBB3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A
Size 1KB
SHA256 d58f74d4e8e99394dfca60ee58ee41911581e7ec470e5a92234dc3854f7f6b39
MD5 a0ad638d6f3e95830fd5dc6149edc665
SHA1 cbe971d9ba7fe4f397f9cf2138dd75bb947bb4f1
SHA512 2178425f6f30e5421126ef60c67ee04055c1e95473e3bfe2cb56543968d48f8f202a34722578e8e0ac761511f3704ea06fc27ad6fbc2653ab227f69431939b2b
TLSH
T17031FA951E1E19966ACECF2C8CCA9614BC29A4D06A6C64311137D769A5803D3AF7501E
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 b35260221236e2997429a3d05d79273d0e1944bd47e9e065b9e0b3d88c2b0ddd
MD5 a74993266a1bc95bb82f4a1417f3d34a
SHA1 933edfe02e1aff2a934902f8b1ee215324e062d2
SHA512 a25fc9b33736bf77fa2701ec6f3d18c090fab6c0977c72c4c5ee23d1c4a85cfa448a71b8b4e2016b629045e965c29b0fa28dcdab2cc635823962fb8486d79b28
TLSH
T1A1311A274F2E6921CF228D8415C6F9322970E9D22CEA246A7218EA0B2884BB34F1554B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A
Size 540B
SHA256 6a8a8bb89bff1953806919a93141d6f14350bba58d22f05a5ed5f81b9326cc58
MD5 9d4c823879f0bfb04a03847fe90ba811
SHA1 c17a3478a056541965c9ae91b2bf2c2bc9e9dfd3
SHA512 9d2d569a6b11686ad59a28edb8c9edb2d837c628c14db5a9f2fb5d8e43361d296d55f5bf54a800f953fd7de84042fef44e86e5e05ecd81970a6ceaa38b4015f3
TLSH
T11BF0973054FA002FF076CE380BC0E6E94C69FA1234325B6A087C87197C20E055C93A3A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 42078b1e3e429299b5573e5fbc651cf080d6aafd397c5b72f116435c4806785e
MD5 b5a8677ff7dfe945a360133a435a579e
SHA1 d271619d9465997a41bcae53b7f0b0dab9d5ddbd
SHA512 03e1470575c4fdd6ac0137c50788fe3038e2f2b44cdca96415dc56f89f8d9176d0887cf527c77b5f77181ac3073e7e473c3fbcc027127e4bf4365f58bdfe6710
TLSH
T1B6F0DC0C08F5822EF0B6C97A0DF868129529F9031824962E02A04B0E3D20F00AD2692D
MD5 SHA1 SHA512 TLSH

Submit Download

RVTools.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools.dll
Size 2.1MB
SHA256 fb51b8123a5f6f9e886af8f9455f7992ba58bebe905c4fd74cd8568eee60eef2
MD5 9aa24fb8c7dabb6c5120b9d7adcc1dfb
SHA1 ffc419abc8a93c671ecf0ffa87b483c0b8cbfe7b
SHA512 14dbbcf36a8050df64cf1c77942451d46b2e5b799c1f7c5ac19e968cd749bf4136b478d2a3bde05bf0593ee85e6b2bb10c97f46adccbf5a04a0da1a3c20b38d9
SSDEEP 49152:xQW1vx+wfJHk5x0YBQj4a40X0cOk+YJ6ARcGydWw0eizwLJMO:mAvnHix0YBQj4a40XHncGydWwriA
TLSH
T1B3A501D8C48911CFF3A80B3C26395B96FEC4A44DFCD8AD8DCA564BCE0AF956812557C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RVTools4.7.1.msi

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools4.7.1.msi
Size 8.0MB
SHA256 0506126bcbc4641d41c138e88d9ea9f10fb65f1eeab3bff90ad25330108b324c
MD5 10610e3e81158e7f2a0c48e2b2f26d99
SHA1 8bc692cb4478b317bbc74ee60771b1f723d85649
SHA512 922b549abab60cae3a61941841c5da97297f84d9e76003364f19eaef2aae173ee91859e14cb2a0ad31ea153aee76228f432ebab4cbcbd473bd6b9e92a78a2abc
SSDEEP 196608:/E8GMQtdn/62RNOIGIcTvuOjkbV44GB1Shbo7OhnqM9ASZCHI:/EWWR62RNOdIcTLjkbV4HBEhgOZqM6Y
TLSH
T1AD86239C25078332D3B623F16877F2885C27FC2035A198967399F97D077AA90B375E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC01F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC01F.tmp
Size 285KB
SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
MD5 b77a2a2768b9cc78a71bbffb9812b978
SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
TLSH
T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bddc.msi

Path C:\Windows\Installer\e58bddc.msi
Size 9.3MB
SHA256 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24
MD5 bd99a02d8afdc468d315d47870202198
SHA1 67d6e46cf006d34d7606c03f48052fcd7af58d86
SHA512 e8b1aee097276a6a77f76daa99676a62843e310277027a08d538f6504b6babf498f1a5776e233783f9322fe2028bec10e2b789ef3ef2cecdf82752fa2239d9e4
SSDEEP 196608:YKhpGIqbo0qpUd5DxbN9QZc1GmbL8bdeIlntj/8/Vy5XgLF9fmR2Q:Y+RGdt0ckmcb8IltzvxgTm
TLSH
T17EA6336E3BB8A70BC73E75B499931280804EACD352C8F846F25DF7A833787606E55356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 cd28f8da260cc27fe430edd880bb01276c9a0e2b5d711bc30bc4f16e94891d57
MD5 2d75b7b963dcb2990d899dc6e367ea76
SHA1 dccfe84df12858841b598ae003ab5df0d026bb01
SHA512 3f359d993164169836b7c0e34083748ad918e901b7fa82fb8b10684a2d5faa5aa558b2462be9e59a8571fe1d36b922c3e0d3dfe668ae5b919e0b9ca23fa87ce3
SSDEEP 24576:Du8m+1zzdoO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:r
TLSH
T1A547D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{77123db3-1209-477b-baf8-7925b11abd5e}_OnDiskSnapshotProp

Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{77123db3-1209-477b-baf8-7925b11abd5e}_OnDiskSnapshotProp
Size 6KB
SHA256 04c6ec2bb255bb80042f4334ab38253f40f5990f941eeeaf8ed1895e46635d2a
MD5 02084fe9e9a10dae4a1ad7eda3992080
SHA1 5a9fa17c4e08918e5e6fe4c90f31ced6fc06337c
SHA512 5503f534a15c0a2b256577937b9b5a339699fbaac48665b9b220e43a4661a7c22d4cdbc9e23e0d2144af7a3f1c7b9b60512a84d3d88a992725871f90640cdc62
SSDEEP 96:FaIhM+lSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ZGb++ZVm
TLSH
T16ED189085AF54711E2B3AB7128F14557A877B911EF33CB8E0198238E2670A14F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3892-36-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-110-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-111-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-113-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-114-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-115-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-118-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download

memory/3892-119-0x00007FFD89690000-0x00007FFD898B2000-memory.dmp

Download