Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/07/2026, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
minitab22.5.1.0setup.x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
minitab22.5.1.0setup.x64.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target minitab22.5.1.0setup.x64.exe
- Size 306.6MB
- Sample260701-e3e4fsgs9w
- SHA256 09ca4b9404bf9a82c46c9263ec8320c527b05b3bf525995b97a13683d4e706b0
- MD5 6c46a375586ea2bb015d7059f9b44600
- SHA1 880a48ac6e246bf4b9521d760c226cf671720ead
- SHA512 cd54ca4f98818046549e24937271e227e91075496e382929f66e6767cb592b89ef599976fd9a6879d161eee464f0df0250e93ea64bd8cf7c17bc7c83671020df
- SSDEEP 6291456:xuklk8WpZhwffBl9+cA8sB9I0LOXl97XpNAfaSY96PijV76I64mm+8:xukopZ69s4plSy6ax76I6+v
- TLSH T184E83321359EC43BD6AA0171593C9AABA53C7E290FB150C7B3EC7A1B1A710C25337E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\E: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\O: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\P: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\M: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\N: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\J: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\U: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\K: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\Q: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\S: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\V: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\Z: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\R: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\T: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\Y: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\X: minitab22.5.1.0setup.x64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
pid Process 2100 vc_redist.x64.exe 2436 vc_redist.x64.exe - Loads dropped DLL 20 IoCs
pid Process 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 2436 vc_redist.x64.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language minitab22.5.1.0setup.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language minitab22.5.1.0setup.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe - Modifies system certificate store 2 TTPs 7 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd minitab22.5.1.0setup.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 minitab22.5.1.0setup.x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e minitab22.5.1.0setup.x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e minitab22.5.1.0setup.x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd minitab22.5.1.0setup.x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd minitab22.5.1.0setup.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E minitab22.5.1.0setup.x64.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe 5076 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2432 msiexec.exe Token: SeCreateTokenPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeAssignPrimaryTokenPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeLockMemoryPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeIncreaseQuotaPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeMachineAccountPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeTcbPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSecurityPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeTakeOwnershipPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeLoadDriverPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSystemProfilePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSystemtimePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeProfSingleProcessPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeIncBasePriorityPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreatePagefilePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreatePermanentPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeBackupPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeRestorePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeShutdownPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeDebugPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeAuditPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSystemEnvironmentPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeChangeNotifyPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeRemoteShutdownPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeUndockPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSyncAgentPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeEnableDelegationPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeManageVolumePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeImpersonatePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreateGlobalPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreateTokenPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeAssignPrimaryTokenPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeLockMemoryPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeIncreaseQuotaPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeMachineAccountPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeTcbPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSecurityPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeTakeOwnershipPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeLoadDriverPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSystemProfilePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSystemtimePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeProfSingleProcessPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeIncBasePriorityPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreatePagefilePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreatePermanentPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeBackupPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeRestorePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeShutdownPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeDebugPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeAuditPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSystemEnvironmentPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeChangeNotifyPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeRemoteShutdownPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeUndockPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeSyncAgentPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeEnableDelegationPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeManageVolumePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeImpersonatePrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreateGlobalPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeCreateTokenPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeAssignPrimaryTokenPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeLockMemoryPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeIncreaseQuotaPrivilege 1924 minitab22.5.1.0setup.x64.exe Token: SeMachineAccountPrivilege 1924 minitab22.5.1.0setup.x64.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1924 minitab22.5.1.0setup.x64.exe 1924 minitab22.5.1.0setup.x64.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 5076 2432 msiexec.exe 81 PID 5076 wrote to memory of 1660 5076 MsiExec.exe 82 PID 5076 wrote to memory of 2100 5076 MsiExec.exe 83 PID 2100 wrote to memory of 2436 2100 vc_redist.x64.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\minitab22.5.1.0setup.x64.exe"C:\Users\Admin\AppData\Local\Temp\minitab22.5.1.0setup.x64.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8695C2DDF99FE32393F1E82DA97E5B70 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\minitab22.5.1.0setup.x64.exe"C:\Users\Admin\AppData\Local\Temp\minitab22.5.1.0setup.x64.exe" /groupsextract:100; /out:"C:\ProgramData\Minitab\Minitab22.5.1.0\prerequisites" /callbackid:50763⤵
- System Location Discovery: System Language Discovery
PID:1660
-
-
C:\ProgramData\Minitab\Minitab22.5.1.0\prerequisites\Visual C++ Redistributable for Visual Studio 2022\vc_redist.x64.exe"C:\ProgramData\Minitab\Minitab22.5.1.0\prerequisites\Visual C++ Redistributable for Visual Studio 2022\vc_redist.x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\Temp\{F2D75183-4AF8-4971-86F1-307136762E46}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{F2D75183-4AF8-4971-86F1-307136762E46}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Minitab\Minitab22.5.1.0\prerequisites\Visual C++ Redistributable for Visual Studio 2022\vc_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=7284⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Minitab\Minitab22.5.1.0\installer\minitab22.5.1.0setup.x64.msi
- Size 8.5MB
- SHA256 4a432f54ad7e4fd3b72d87666512585a580abf0f61f79fbad9f33b144d03fb74
- MD5 c2a0908f5dd8cb5923dc96b63940ebff
- SHA1 9689d7fc3e30f40f7e29ab37a5317198b57d96c9
- SHA512 87de01a8040bca83d5c38e88bef245433752d5dd31b7e4fcadafa6c24afcf3d1d5369142ad1efe78c19fe71d6be69efafb3d9db8da0aa5422320cccb7a7e02c8
- SSDEEP 98304:OwlN+2FAHMXNmDYilFC2Y6b1Z8nMayXTS2fGQF/aW8h:OwlN+2uHuNwYilQ25boLymE/t8
- TLSH T197969E217586C036E19E02721A2D9BB7B27D6D254FB041CBBBEC7A1B19314C19637FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Minitab\Minitab22.5.1.0\prerequisites\Visual C++ Redistributable for Visual Studio 2022\vc_redist.x64.exe
- Size 24.4MB
- SHA256 d62841375b90782b1829483ac75695ccef680a8f13e7de569b992ef33c6cd14a
- MD5 de118d5e2ab7aaa7e1a08a0ecf84e8c9
- SHA1 c14a4b9a374d3ebd3f032a51b356dc8054d98e5a
- SHA512 e28e9c307ade513dfc54403610cc23ae17e6e91cc4b291355601ad086325e966b2341f19384b7d9a39c5b8bcfe0af722d0972c52eda82eafaedfe8d0a057db48
- SSDEEP 786432:c0fpx5hYBug515TxO5dmJGK0//uEDfhaje:ppx56Bu616sRQ75
- TLSH T17D473332A1588239E7F30433A575ED242E7EA22523168CF6C7CCDD4E6EB509257FB621
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1924\AI_header.jpg
- Size 1KB
- SHA256 79ba0532f7339d068b120169fbcde4eb8ab4af44d08da5036df6f7d0e023a317
- MD5 5e1f27d97d5a0736d110700ecf63e926
- SHA1 18f5d6bebd1dac1fa5fee0b5237dddd7cad69ffd
- SHA512 7b941412ec4b8e542a5a9beb65783d15cf56b4735d1c43d0fa8355d6eb3e2dbc9a0c3d725f11a9ffc41519ae8979b7e34c23b2319672bff952c9d601c92374a3
- TLSH T1BB41840727412F13DCE2D3787F1AD29563AEA7C4290337CA267201B8FB00ED41C0815C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1924\AI_watermark.jpg
- Size 9KB
- SHA256 22211987d48a101390e9bdf924dc602908c037b4b1a8861a88d56050b5ce0bf0
- MD5 f4617a285ed0fbaa960953443ac46404
- SHA1 576a6b03dca75b101600cfcb1d12e69301243c97
- SHA512 7a9534bf8da191e01f0084b461efb31b8758df378b8545e914b403eeb2746c8aa1c5808b3aa1498ad35ac1aa1729724f7e3613c1480366f095d13db3d603161f
- SSDEEP 192:nrSx01tbjV3BSMqIUr2e+dBeQjwoC8QBqMHgsIs:nuK1tbjxFwr9MIQjx5QBDHPR
- TLSH T1A7121932BF83C09CD49440FA61AADE7D18C72FBC6E82FE874CA14665A077051CF65A76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4C5D.tmp
- Size 290KB
- SHA256 f72fb1c46c68a8942143df813717879ce9d9e3367c0cd6a0e408dc074994f4bb
- MD5 b426c59d707d8d68d8a5ca78e858e225
- SHA1 91f08e920ee12304e54189fe2b53ab41eb52011c
- SHA512 f608043bf66ff490c78edafabc7128e7cb97244489e5f57980f0a553fb0d0013de2c1e1cebaad09ed65f8d2fce4db33b864a124e10617838be50f3f6c92cd236
- SSDEEP 3072:tV2Wnd+kuRa95njHk0LekMVkuzIA5hTSi/4I8zxZ+dNYqyu0OJuvOAg0FuDOoXOa:z99NXjM7Tv/4vzn+dNduWAO1Oi2VTq
- TLSH T19B540801F9979230D5A9567019B6BFB2C5BDBC0CDFB0CACF4F500E65A9212A27931B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4CA0.tmp
- Size 395KB
- SHA256 4c7aa0d4826bd94824f553116f3287d98c11d8fe2ca048da39b48c382ecc35ba
- MD5 e8d9c065b6ce55964b709a4944705d5b
- SHA1 465268cf89d4543bf01916012814470bd499d5f3
- SHA512 5a08aa446fde352e632941d5eddb0684c1d5f61e9e9630e17a80e9458aa885047e5d1d12851293b9b30b351f70580b1fd187de0337aabad51d227591f62b89b8
- SSDEEP 6144:nc2jxs/tK3EVGfGVI2F0ph0lhSMXlBXBW/HxXcaNzViP:HjKBVGV2F0ph0lhSMXlevpiP
- TLSH T1E684BF207695C032DA6F06746A7CCFABA53C6A910FB544CB63CC5E7B4E705C26232E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI897F.tmp
- Size 1005KB
- SHA256 7b3a4e3e3f58fa49164d49b14bc10c13a9d734846956c8a7a433c8bb6c82d983
- MD5 0606e1a2fe0d72593405cafeb945c740
- SHA1 641e8cfea8d2203d3127b49939b1ed5f1c97dc9e
- SHA512 696152be48a1256c5eda545b8759671117a7b55e49723b437b6ee258a3b568b9440f1592e4abf4eb1aa878e960cc721bdbc55f2a48d77bb1b3315b75cc15946a
- SSDEEP 24576:uADREF4f3fy4UpBxQnWh0lhSMXlI5G17n:uADREFClUDxuj45G17n
- TLSH T138257D203A89C436E56D05B3193D9B6BA13E797A0B7154CB93D8BE5A2DB00C2533DF93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9922.tmp
- Size 894KB
- SHA256 1a42e41b6c284aeb55d9ac8a28bc7fb50b98008d6a04464d73ebe8d200662ce0
- MD5 713c5d0c1b98583f3638212f91f9b99e
- SHA1 2845ae2516d94e05c8ae305b2f83a452a7e10117
- SHA512 1cdfd877a950733a12506002a885364842883adfc589c6fb6d06b894848e256b017308dd0939523a82497e7f1b33e6552f0bd5b469727f7fc0290a3eb3915d76
- SSDEEP 24576:gSGBHv6d7cW+Vcn8Ngh0lhSMXlhGybo4SaWq:HGKacn8nRGSo4SaWq
- TLSH T166157D70359EC076F26E01B0277DCFBBE11D69760BB544DBA3E8AD2A5AB04C21235E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{F2D75183-4AF8-4971-86F1-307136762E46}\.cr\vc_redist.x64.exe
- Size 670KB
- SHA256 3814f726440521e12762a4f1d83dfdcf4c62b2cf71873987d87ecd54330095b5
- MD5 db2fef85f5046e85ec2fc24089fe500a
- SHA1 ae1af50b3e95fc9f64ba3b101498654eaa7138c9
- SHA512 5b640b1a34940466305f5740734b21e0c38c8aad398e9e9b2bd2597db996f7493c23ba304b800df0c41abae9b38f7ca815a152c3ba3fb0876f66e22c4f7f9211
- SSDEEP 12288:93mgqnIZuYfCYqFet4CovkM7oi1nEPSrfDDIcbMZ3My:93WnIZuMCxezot7Nh0afDBMZ8y
- TLSH T137E49E32A5614033F7F10573B928A6303E7CE3282B51C8A9E7D4AD1D7EB4492A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{FC5FE2D8-F1C9-4733-BE02-70208D6E0647}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{FC5FE2D8-F1C9-4733-BE02-70208D6E0647}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH