Overview
overview
7Static
static
7install_id...90.exe
windows10-2004-x64
7install_id...90.exe
windows11-ltsc_2024-x64
7ideaMaker.exe
windows10-2004-x64
1ideaMaker.exe
windows11-ltsc_2024-x64
1imageformats/qgif.dll
windows10-2004-x64
1imageformats/qgif.dll
windows11-ltsc_2024-x64
1imageforma...ns.dll
windows10-2004-x64
1imageforma...ns.dll
windows11-ltsc_2024-x64
1imageformats/qico.dll
windows10-2004-x64
1imageformats/qico.dll
windows11-ltsc_2024-x64
1imageforma...eg.dll
windows10-2004-x64
1imageforma...eg.dll
windows11-ltsc_2024-x64
1imageformats/qsvg.dll
windows10-2004-x64
1imageformats/qsvg.dll
windows11-ltsc_2024-x64
1imageformats/qtga.dll
windows10-2004-x64
1imageformats/qtga.dll
windows11-ltsc_2024-x64
1imageforma...ff.dll
windows10-2004-x64
1imageforma...ff.dll
windows11-ltsc_2024-x64
1imageforma...mp.dll
windows10-2004-x64
1imageforma...mp.dll
windows11-ltsc_2024-x64
1imageforma...bp.dll
windows10-2004-x64
1imageforma...bp.dll
windows11-ltsc_2024-x64
1jkqtplotterlib.dll
windows10-2004-x64
1jkqtplotterlib.dll
windows11-ltsc_2024-x64
1libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-ltsc_2024-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-ltsc_2024-x64
1libHalf-2_5.dll
windows10-2004-x64
1libHalf-2_5.dll
windows11-ltsc_2024-x64
1libTKBO.dll
windows10-2004-x64
1libTKBO.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 00:06
Behavioral task
behavioral1
Sample
install_ideaMaker_5.4.2.8790.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
install_ideaMaker_5.4.2.8790.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
ideaMaker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
ideaMaker.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
imageformats/qgif.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
imageformats/qgif.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
imageformats/qicns.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
imageformats/qicns.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
imageformats/qico.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
imageformats/qico.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
imageformats/qjpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
imageformats/qjpeg.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
imageformats/qsvg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
imageformats/qsvg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
imageformats/qtga.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
imageformats/qtga.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
imageformats/qtiff.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
imageformats/qtiff.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
imageformats/qwbmp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
imageformats/qwbmp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
imageformats/qwebp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
imageformats/qwebp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
jkqtplotterlib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
jkqtplotterlib.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
libEGL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
libGLESv2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
libHalf-2_5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
libHalf-2_5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
libTKBO.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
libTKBO.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target install_ideaMaker_5.4.2.8790.exe
- Size 116.8MB
- Sample260722-ad2hyagf35
- SHA256 38739612065da1abd9c46f4d97c472d2a4f677d379219bb160a762ffb9ac140c
- MD5 5a388e385c7be636c884e72e9933db81
- SHA1 221411f5181eb055bddd1a569b1d6a235c743769
- SHA512 a086c0a1a851e5b4c40de6fa3a9f474b1610be1bc89b4fa9df9b1b513ef785dc2eb38eca56dc1cc77f15a03380c4472bbe8838077416f79c4dce6eb62f344159
- SSDEEP 3145728:r/Oct26cXpQOOjQrwPAQT++PB3Ta3+itmQP:7OupcGObUoQbPodd
- TLSH T1CD48334ABDD8AE49EEAF0D7438FB1C36142B8E0B551F63E5B2D8532C732A08C1987D55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000b00000001c6ea-207.dat acprotect - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
resource yara_rule behavioral2/files/0x000b00000001c6ea-207.dat upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Raise3D\ideaMaker-App\platforms\qwebgl.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\Calibration-Extruder-Offset.idea install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\Qt5PrintSupport.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\d3dcompiler_47.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKFeat.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKOffset.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\IMPlugin3.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKG2d.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\icons\FIRM.ico install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libwinpthread-1.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKSTEP.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKVRML.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKXDESTEP.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libglib-2.0-0.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libgmp-10.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libngtcp2-16.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\IMCoreMesh.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libEGL.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKMesh.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libboost_iostreams-mt.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libcrypto-3-x64.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libcurl-4.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libharfbuzz-0.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libopenvdb.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKVCAF.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libssh2-1.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\quazip.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\imageformats\qwebp.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\resources\fonts\LICENSE-NotoSans.txt install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\V2_hot_end_installation_tool.STL install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\IMCoreProfileTool.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libGLESv2.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\vcomp90.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\icons\OBJ.ico install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\resources\fonts\LICENSE-NotoSansCJK.txt install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\20mm_Calibration_Box.stl install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\Qt5Svg.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKGeomBase.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\platformthemes\qxdgdesktopportal.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\resources\fonts\LICENSE-DroidSansFallback.txt install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\E2-Build-Plate-Handle.idea install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKBRep.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKBool.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKCDF.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKXmlXCAF.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\liblzma-5.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libnghttp3-9.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libssp-0.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\platforms\qdirect2d.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\IMCoreFileFormat.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\IMCoreSlice.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKBinXCAF.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libgmpxx-4.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\platforms\qminimal.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\platforms\qoffscreen.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\renderers\openglrenderer.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\icons\ideaproj.ico install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\N1 Single Extruder Cover.STL install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\Pro2-FanDuct-Left.stl install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\test_models\Webcam-support-N1.STL install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\Qt5Network.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libTKernel.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libharfbuzz-gobject-0.dll install_ideaMaker_5.4.2.8790.exe File created C:\Program Files\Raise3D\ideaMaker-App\libpng16-16.dll install_ideaMaker_5.4.2.8790.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{8220EEFE-38CD-377E-8595-13398D740ACE} msiexec.exe File opened for modification C:\Windows\Installer\MSIB874.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119347.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_1ece11b1.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\amd64_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_e2e562e3.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119396.0\9.0.30729.1.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119403.0 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF98FA2D52E42617D4.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119330.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\amd64_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_e2e562e3.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119368.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.manifest msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\EFEE0228DC83E77358593193D847A0EC\9.0.30729 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119352.0\9.0.21022.8.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90jpn.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119352.0\9.0.21022.8.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119391.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119347.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119352.0 msiexec.exe File created C:\Windows\SystemTemp\~DFB8873E848E9F98E8.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5ab41f.msi msiexec.exe File created C:\Windows\SystemTemp\~DF10C8923725C2E7E4.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119396.0\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119368.0\msvcr90.dll msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90deu.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90kor.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90rus.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119403.0\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119387.0\9.0.30729.1.policy msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\EFEE0228DC83E77358593193D847A0EC\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\EFEE0228DC83E77358593193D847A0EC\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90ita.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119375.0\mfc90u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119375.0\mfcm90u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119330.0 msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119330.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_021e6992.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119368.0\msvcp90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119403.0\9.0.30729.1.policy msiexec.exe File created C:\Windows\Installer\e5ab423.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119330.0\atl90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119368.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119347.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_1ece11b1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90esp.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119375.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119391.0\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119375.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_7264ef23.manifest msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\EFEE0228DC83E77358593193D847A0EC msiexec.exe File created C:\Windows\Installer\e5ab41f.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90chs.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90fra.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119375.0\mfcm90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119391.0\9.0.30729.1.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119375.0\mfc90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119347.0\vcomp90.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119387.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90esn.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119396.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90enu.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260722011119382.0 msiexec.exe File created C:\Windows\SystemTemp\~DF58B7DA2B033D03B2.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119382.0\mfc90cht.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119375.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_7264ef23.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260722011119387.0\9.0.30729.1.cat msiexec.exe - Executes dropped EXE 5 IoCs
pid Process 1612 vcredist_x64_sp1.exe 5396 install.exe 3380 VC_redist_2022.x64.exe 4636 VC_redist_2022.x64.exe 5116 VC_redist.x64.exe - Loads dropped DLL 6 IoCs
pid Process 3464 install_ideaMaker_5.4.2.8790.exe 3464 install_ideaMaker_5.4.2.8790.exe 3464 install_ideaMaker_5.4.2.8790.exe 3464 install_ideaMaker_5.4.2.8790.exe 5396 install.exe 4636 VC_redist_2022.x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install_ideaMaker_5.4.2.8790.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64_sp1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist_2022.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist_2022.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.OBJ.1\ = "Wavefront OBJ File" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\ProductName = "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\SourceList\LastUsedSource = "n;1;f:\\4a703434f9d5dab43e3f24\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.SLSCode.1\shell\open install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.OLTP.1\shell\open\command install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.STL.1\ = "Stereolithography File" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.DLPCode.1\shell\open\command\ = "\"C:\\Program Files\\Raise3D\\ideaMaker-App\\ideaMaker.exe\" \"%1\"" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker\shell\open\command install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.SLSCode.1\shell\open\command install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.DLPCode.1\DefaultIcon install_ideaMaker_5.4.2.8790.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 640053007b006e00510035006900210070003500360063003d0045003600580062006d0036006b00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e006200780051006100490053002d004000250036007000440077004e005a006700710078007800520000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.21022.8",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 640053007b006e00510035006900210070003500360063003d0045003600580062006d0036006b00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0046007600590040003f00320068006c002400340067002c005100500041006500340077007500500000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Project.1\shell\open install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.3MF.1\DefaultIcon install_ideaMaker_5.4.2.8790.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.21022.8",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 640053007b006e00510035006900210070003500360063003d0045003600580062006d0036006b00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0041004c00620021007a0058004d007a0062003600460056005b002c0078004700520039003d00310000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\EFEE0228DC83E77358593193D847A0EC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Project.1\shell\open\command install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Firmware.1\shell\open\command\ = "\"C:\\Program Files\\Raise3D\\ideaMaker-App\\ideaMaker.exe\" \"%1\"" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.STL.1\DefaultIcon install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.3MF.1\ = "3D Manufacturing File" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.3MF.1\shell\open\command install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.OLTP.1\shell\open\command\ = "\"C:\\Program Files\\Raise3D\\ideaMaker-App\\ideaMaker.exe\" \"%1\"" install_ideaMaker_5.4.2.8790.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.idea\ = "ideaMaker.Project.1" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Project.1 install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Project.1\ = "ideaMaker Project File" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Project.1\shell\open\command\ = "\"C:\\Program Files\\Raise3D\\ideaMaker-App\\ideaMaker.exe\" \"%1\"" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.DLPCode.1\DefaultIcon\ = "C:\\Program Files\\Raise3D\\ideaMaker-App\\icons\\dlpcode.ico,0" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.3MF.1\shell\open install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.oltp\ = "ideaMaker.Model.OLTP.1" install_ideaMaker_5.4.2.8790.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker\shell\ = "open" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.SLSCode.1\DefaultIcon\ = "C:\\Program Files\\Raise3D\\ideaMaker-App\\icons\\slscode.ico,0" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Print.1 install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.obj\ = "ideaMaker.Model.OBJ.1" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFEE0228DC83E77358593193D847A0EC msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.ProjectX.1\shell\ = "open" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.SLSCode.1\DefaultIcon install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.DLPCode.1\ = "ideaMaker DLPCode File" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.firm install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.OBJ.1\shell install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\ = "ideaMaker.Model.3MF.1" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.GCODE.1\shell\open\command\ = "\"C:\\Program Files\\Raise3D\\ideaMaker-App\\ideaMaker.exe\" \"%1\"" install_ideaMaker_5.4.2.8790.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 640053007b006e00510035006900210070003500360063003d0045003600580062006d0036006b00460054005f00560043005f005200650064006900730074005f004d00460043005f007800360034003e0021004300510050002c0068002a0035007300330026006c006b003f0054006000350064006f00440000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.3MF.1\shell\ = "open" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.GCODE.1\DefaultIcon\ = "C:\\Program Files\\Raise3D\\ideaMaker-App\\icons\\gcode.ico,0" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.idea install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.SLSCode.1\shell install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Firmware.1\shell\open\command install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.3MF.1\DefaultIcon\ = "C:\\Program Files\\Raise3D\\ideaMaker-App\\icons\\3mf.ico,0" install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.OLTP.1\DefaultIcon\ = "C:\\Program Files\\Raise3D\\ideaMaker-App\\icons\\oltp.ico,0" install_ideaMaker_5.4.2.8790.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.GCODE.1\shell\open\command install_ideaMaker_5.4.2.8790.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 640053007b006e00510035006900210070003500360063003d0045003600580062006d0036006b00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e0030004200400049003f00640071004b007b003700450047004d00380072003f00580064006100620000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\AuthorizedLUAApp = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Print.1\shell\open install_ideaMaker_5.4.2.8790.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ideaMaker.Model.OLTP.1\ = "OLT Printing File" install_ideaMaker_5.4.2.8790.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 640053007b006e00510035006900210070003500360063003d0045003600580062006d0036006b00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e00600050006c00570058006d0065003d006600340027006c004a00790027004500380065004d00480000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFEE0228DC83E77358593193D847A0EC\FT_VC_Redist_MFCLOC_x64 = "VC_Redist_12222_amd64_enu" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFEE0228DC83E77358593193D847A0EC\SourceList msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2060 msiexec.exe 2060 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5396 install.exe Token: SeIncreaseQuotaPrivilege 5396 install.exe Token: SeSecurityPrivilege 2060 msiexec.exe Token: SeCreateTokenPrivilege 5396 install.exe Token: SeAssignPrimaryTokenPrivilege 5396 install.exe Token: SeLockMemoryPrivilege 5396 install.exe Token: SeIncreaseQuotaPrivilege 5396 install.exe Token: SeMachineAccountPrivilege 5396 install.exe Token: SeTcbPrivilege 5396 install.exe Token: SeSecurityPrivilege 5396 install.exe Token: SeTakeOwnershipPrivilege 5396 install.exe Token: SeLoadDriverPrivilege 5396 install.exe Token: SeSystemProfilePrivilege 5396 install.exe Token: SeSystemtimePrivilege 5396 install.exe Token: SeProfSingleProcessPrivilege 5396 install.exe Token: SeIncBasePriorityPrivilege 5396 install.exe Token: SeCreatePagefilePrivilege 5396 install.exe Token: SeCreatePermanentPrivilege 5396 install.exe Token: SeBackupPrivilege 5396 install.exe Token: SeRestorePrivilege 5396 install.exe Token: SeShutdownPrivilege 5396 install.exe Token: SeDebugPrivilege 5396 install.exe Token: SeAuditPrivilege 5396 install.exe Token: SeSystemEnvironmentPrivilege 5396 install.exe Token: SeChangeNotifyPrivilege 5396 install.exe Token: SeRemoteShutdownPrivilege 5396 install.exe Token: SeUndockPrivilege 5396 install.exe Token: SeSyncAgentPrivilege 5396 install.exe Token: SeEnableDelegationPrivilege 5396 install.exe Token: SeManageVolumePrivilege 5396 install.exe Token: SeImpersonatePrivilege 5396 install.exe Token: SeCreateGlobalPrivilege 5396 install.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe Token: SeRestorePrivilege 2060 msiexec.exe Token: SeTakeOwnershipPrivilege 2060 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2060 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3464 wrote to memory of 1612 3464 install_ideaMaker_5.4.2.8790.exe 89 PID 1612 wrote to memory of 5396 1612 vcredist_x64_sp1.exe 91 PID 3464 wrote to memory of 3380 3464 install_ideaMaker_5.4.2.8790.exe 93 PID 3380 wrote to memory of 4636 3380 VC_redist_2022.x64.exe 94 PID 4636 wrote to memory of 5116 4636 VC_redist_2022.x64.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_ideaMaker_5.4.2.8790.exe"C:\Users\Admin\AppData\Local\Temp\install_ideaMaker_5.4.2.8790.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files\Raise3D\ideaMaker-App\dependency\vcredist_x64_sp1.exe"C:\Program Files\Raise3D\ideaMaker-App\dependency\vcredist_x64_sp1.exe" /q2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\f:\4a703434f9d5dab43e3f24\install.exef:\4a703434f9d5dab43e3f24\.\install.exe /q3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5396
-
-
-
C:\Program Files\Raise3D\ideaMaker-App\dependency\VC_redist_2022.x64.exe"C:\Program Files\Raise3D\ideaMaker-App\dependency\VC_redist_2022.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\Temp\{84A68186-9087-473E-9FC7-6484512DEB2F}\.cr\VC_redist_2022.x64.exe"C:\Windows\Temp\{84A68186-9087-473E-9FC7-6484512DEB2F}\.cr\VC_redist_2022.x64.exe" -burn.clean.room="C:\Program Files\Raise3D\ideaMaker-App\dependency\VC_redist_2022.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\Temp\{9F2F28EB-3E95-4009-941B-B59F542F5D4D}\.be\VC_redist.x64.exe"C:\Windows\Temp\{9F2F28EB-3E95-4009-941B-B59F542F5D4D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{969F4FA4-5D2E-46E1-B36A-23D53DE3AFFA} {692CE2E4-3651-46F7-9916-9181ED052513} 46364⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5116
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2060
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1968
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:2124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Raise3D\ideaMaker-App\dependency\VC_redist_2022.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Raise3D\ideaMaker-App\dependency\vcredist_x64_sp1.exe
- Size 4.7MB
- SHA256 55bf99ad3f063165c3ee1626787b5d4c2b65b5001fef79dd58c3490369ed282f
- MD5 40395c175553cb14d2050888efccdf00
- SHA1 13674c43652b941dafd2049989afce63cb7c517b
- SHA512 95f7596fbd76538ff2026b2232e0e7caf517ab4f60556e875e1538254a5c417cf8b82aaaebaabdf2eb33729b986b3ac6a870a62fdfc582f5218babafa4fceb14
- SSDEEP 98304:RfN8nttZrMa2xOy8MdEZZAFvdpf3yxy+K1hjknd8VxwyhSJQlWf:RanhAxOyMAFvdtyxzK1mO/Zkf
- TLSH T1DB363333D84E9BE7F81BF7F49531D18E3C315C0A5A83A69845E7CA4439A3BB8E91850D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Raise3D\ideaMaker-App\ideaMaker.exe
- Size 27.3MB
- SHA256 e3554b6acb70225b138cd90bb00e2549d25ea4877fac43edacc6f10f0e4467ec
- MD5 5197a40c46608f75a5566386a527ad05
- SHA1 181286dcc9e09b50efacd4a436d3e1541057177d
- SHA512 9ff5d669d11c4163060ab11be4ff958e0bf2d0da920604b43a7b5da6f8b6ab19b4f261e762ce88c4e221c5f3740a025eb03536cfd90c48a7e8de953890996ee0
- SSDEEP 196608:LV274cDtW9/kVd2qW9wsyJHcvkjZDGJor7AUywyr0LN9BuS68pvDeLN9ZUkBxXyt:LV2SaVgjyRcv1OrRy0RrDWLZ4YNbptvw
- TLSH T12B579E47F263409CC0A7C13853AB9633B674B89D4634BFAF6A609B763F60FA05719718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\VWLC0C1.tmp
- Size 392B
- SHA256 559b09d754a9a076a8d8292d9284d6161c735744cb1bb10e9ac23b02d314023a
- MD5 f1c8f9cbaa806945ee3c76772b50185b
- SHA1 37dbb805546cea8e2f71d334c7ed0d3d84549a96
- SHA512 2717cb309a735f5782f383cde73b23d451f3e8750da08e83a44dc83f15318b58f2fb72723ad8086d68b44deb3ae2ca089535bb5975370d9887c77e03728e5d47
- TLSH T106E0752E63E96428F8B39A9A96B741731B35BD746D7CD51C20E1235C41E1000B6A276B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI63C6.txt
- Size 1KB
- SHA256 03f8289bfaee166774ebe7ca154b2ac6707d97132e9c827e36d7e7cc1b2dc6a9
- MD5 8f9bdb286cd7f702c10b657a910d8478
- SHA1 74efd2a564a20800b41480e152c2dcd6f53a1dd0
- SHA512 cca511e8161cf44828c17665ccacf10a75caaaaebbc24383dfcb3a5e130ecceac3a48b30ae8c057f2d28d653bb87c200a1622fb5112bd44e08de7c06b9fb5c93
- TLSH T1DD31C7656AE50C0AF1B35717AEF3C4620A73BDD56874EB0C2348921D47AFD0869AC37E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiFBAE.tmp\AccessControl.dll
- Size 8KB
- SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
- MD5 9f1a88b953fd2a2c23b09703b253186c
- SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
- SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
- SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
- TLSH T1E3029D8643A40179E8730BFC4FAD4C1A1B2EFFB0CBB1569D2158356F6820B1488B6F31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiFBAE.tmp\LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiFBAE.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiFBAE.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 6ca43c758ee911544907752e074c478df0a79f583108891872d3443095f7da9e
- MD5 814fa76a7cef4d501f6979099a3afcd0
- SHA1 32d71fde416f5600d6d0fd019bb6bb7a47d78da8
- SHA512 9b7cc821ad874eda890c4c6c694ae4a804ddbe3aaace2454b9e94bd99317d13ee9890064997429c46744e277c4daf49a3dc03a2a6cc6f54d1c750d4904528343
- SSDEEP 768:Ej038j6TQJdoWKWo7m5wsPaOhOTyGfnGQNKn8F0p1I3d:Wj6T6ohd7sbGup1I3d
- TLSH T19FE30FE25C781AD284F7AB3AC1F1D6CCC92D48E9EE060C2968497B3D543B967F744368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsiFBAE.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{84A68186-9087-473E-9FC7-6484512DEB2F}\.cr\VC_redist_2022.x64.exe
- Size 670KB
- SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
- MD5 bc9c8a6a42e8d3ea18f8da78d5031820
- SHA1 07812a4b945364d04627363e46ab38de188281b3
- SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
- SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
- TLSH T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{9F2F28EB-3E95-4009-941B-B59F542F5D4D}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{9F2F28EB-3E95-4009-941B-B59F542F5D4D}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\VC_RED.cab
- Size 4.3MB
- SHA256 7018b7ee9088c6aed1dbff6447c2c8e0a1cc1e9247ae78ed365820d7482cc34a
- MD5 58468b495c025a4f8b8527c57f64fc5b
- SHA1 37159ba68ffcf6a8ec3aac3a842be44c0a442280
- SHA512 cce997840c0ad4e3e9d91e6ca086ca5263c9d6a83ace487ec4a2d6f034f2aa60c6bcf63c5c74cc8a83162f74ab80353ea6c958d6f8a1995c8a78faa6c514f3cd
- SSDEEP 98304:LdHC+Dp0ji/2YBAk0wu64EAAF40eYUAmz56ICadGSQyRgena:JHDOm2YY64EteYpmzTldsUna
- TLSH T1C1263323C45FFBD3A815F6BD8732E4097871AD0A2A85956818FBEF0539D3AB8941C60D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1028.txt
- Size 3KB
- SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
- MD5 f187c4924020065b61ec9ef8eb482415
- SHA1 280fc99fb90f10a41461a8ee33dbfba5f02d059d
- SHA512 1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743
- TLSH T15E81A6AC1DF32742F493ABB39D834821C7F1A6912BBA0A77458C87495A7045EB049BD7
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1031.txt
- Size 15KB
- SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
- MD5 3168ed3b48c1dc8d373c2abc036574cf
- SHA1 7ffbcfb6cd9b262a0e9a55853d76055693f60c60
- SHA512 9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197
- SSDEEP 192:unSQcLPGw05JEwLW4bt9xepjQOw9cqOANn2fxd:u2LPRwJEwK4xypjUGlA12fxd
- TLSH T13862C02167E5961CF6F37F542EB9E3689F72BDE2A87AD51E2340105E48B1B14CA20733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1033.txt
- Size 9KB
- SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
- MD5 162fc8231b1bd62f1d24024bb70140d5
- SHA1 7fa4601390f1a69b4824ee1334bee772c2941a24
- SHA512 a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda
- SSDEEP 192:6cJ4sOGsTRyAiLfoIPtjlDxsk4apSfqn7yb/:6cJTYyAwdPtjnszasfzb/
- TLSH T1D1229E15A7FD1208F6FB7F906EB9A1685E3A7CA6AD3EC65D1110105E09B6E40CE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1036.txt
- Size 11KB
- SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
- MD5 c360851dfdf51b6ddc9cfcc62c584898
- SHA1 f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6
- SHA512 a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d
- SSDEEP 192:lHcOi0SMq5Gl9EAbGu8xFk7XetMKgTqebK8T25C76j1o3M6ykT4Z9KhI/b:1cOiGF/BN3EWN09UAb
- TLSH T1C9425762A6FA5209F6F27F90BEBD91554F3BBD969D3AC11D1210118E48B1E44CEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1040.txt
- Size 13KB
- SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
- MD5 04b833156f39fcc4cee4ae7a0e7224a1
- SHA1 2ffa9577a21962532c26819f9f1e8cd71ab396bd
- SHA512 8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608
- SSDEEP 192:KYCk+hFhpk2i7mJZKVJTlVec3xo3xWScwMnuEz3ZGE88agajQq+Cv:5co6XG9lmhyukqSajsI
- TLSH T1F1528F51B7FD2208F2F77F90BE7AA6684E7BBE56A83AD11E1150109E4871E608D60733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1041.txt
- Size 5KB
- SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
- MD5 031fab3fb14a85334e7e49d62a5179fe
- SHA1 12370185ef938a791609602245372e3e70db31be
- SHA512 7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447
- SSDEEP 96:JV48yKn6zm4X4zyG61NDyroY1fnODSQJR4Jbcnnik49joxfhUWuNdTvp2U9:JZBn6lYSuxpO4MU7IS
- TLSH T15FC1116C1ABA09BE94F6809758C955F8F7B9F615A2DE0C89044CC88B05548ED730FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1042.txt
- Size 5KB
- SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
- MD5 6fcd6b5ef928a75655d6be51555288c7
- SHA1 eafdcc178343780b83f1280dad9d517aaedab9e4
- SHA512 635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905
- SSDEEP 96:A48gbatW+eU2giS0wyGjlH+5YO9M60AoV7nokPJ:MTi+ZREU
- TLSH T16AC152BB3AEDAA813251668017C6A7F7635F7202721F9C81CB90413421E87B48639BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.1049.txt
- Size 13KB
- SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
- MD5 bc3a8865b60ec692293679e3e400fd58
- SHA1 2b43b69e6158f307fb60c47a70a606cd7e295341
- SHA512 0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610
- SSDEEP 384:dSqMupEO2FQgf7vmbw6ZZSSOTewMtsKaK4NnszO2W:bkFszk
- TLSH T17852586FF8BC9515A460E2111F628AF710AB7750A328A5CAF2CF7DA8906D53533217CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.2052.txt
- Size 3KB
- SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
- MD5 ec4b365a67e7d7db46f095f1b3dcb046
- SHA1 d4506530b132ef4aad51fcbc0315dadc110c9b81
- SHA512 5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2
- TLSH T1D981096E5DFB1412F493795158A686D36BF315A3573B4DE3088C490C52374CE9830F9E
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\eula.3082.txt
- Size 12KB
- SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
- MD5 c2d1221cd1c783b5d58b150f2d51aebf
- SHA1 3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60
- SHA512 c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4
- SSDEEP 192:++hGO8i6aZyiqQm6W7TlR3LycUV2G+74G:+Vi3ZyDVF+mB
- TLSH T11C423650A6F96606F2F77F51AEB991688E3BBDA29C3EC51D0210119E0DB1E44DE34B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.exe
- Size 835KB
- SHA256 8d08136a1964c72b6b450b11d9bf2b3d3d289c26dfadfc9f021114eac2cea1ca
- MD5 87603ea025623b19954e460add532048
- SHA1 d27fc9abbeccb60906d22906ef9a73bd05da2b7a
- SHA512 f2af8c8eab805a39ccd3ccc3b8d1c3401c81f1b3d2dbe719aa39f6fcc28af955d778465aec8b699460e6897629f758b7986b5f7fb4705ba174911c3736c4f520
- SSDEEP 12288:dfEy/iRnznUDL4vr6yM29LQQ9j/Eh//FoXZ6tx95yW9Dmg:dfniBiL4ZM2GQ9j/E1eYX6Y
- TLSH T105051A18FAB94176E072DD7FD6A3C656E67234061B3496CB07128B6E0E3BAD58335332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.ini
- Size 844B
- SHA256 67a50ffbb8a1d500eaa4d9f0227d6a8595a2750154e6b31662fc4f51286e47fc
- MD5 5feaa6a36fea7dfdb88c18d69ba6d6a9
- SHA1 7afd91a7b046d68b6ee9fd367bcd7a4fec546216
- SHA512 6c8c0456f232a02a49d51b3f1a830a18b9078e621cd0dc3f4f76f79b83035e8affac67bce3af9a37fa9096a34a8499c59cf982b63a4b2400b9190d2db293e682
- TLSH T15B01EF63C629518928E6E8B740A00A8BBC559EC973412C54C0512CCC2FE789BD32EB7E
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1028.dll
- Size 73KB
- SHA256 aaa7f144e531ef07ca0202b2df444dee816fcecf6e735302c4bd4b46f4b6c832
- MD5 ba6c6053c2d9a4558a510c023adc76e0
- SHA1 174b33a9f5f517f0212b37a9d60a3efe3982ec3d
- SHA512 7dcf58660ee51652dd47fbaef89eff57dc16dd74ae1ee50b6b2ce66ea682d3916207b27d63c28a981b96a9b448dd27ee277524bf0a472298a5ba86a725d81209
- SSDEEP 1536:kxcS44cluhIaUAy4BCHgrA6O/waBlxB+8Cy/L:kxcS49lc9MArxO/waJB+8Cy/L
- TLSH T10F733C4467945075D0A60A39C8F29BA6FB72BC86173853CF52ACF46E1E737C4AD383A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1031.dll
- Size 93KB
- SHA256 4bf2dd62b481bdbba572a56febdeba1bbb3bb462c7d51dfe81d9418292af266b
- MD5 266c318b746b9a33b48d665fbb4fabee
- SHA1 950dea497a14763b5895be8566ed5fe79ce38df1
- SHA512 938af673fda054e42b7052f36df5cce3d15c68440a6a8e5f642d578dbcd5dfd6ecdf370fe649e1bb97fc8d2c7ccfb185bf4145d9e69066034345e9c2f07aed5b
- SSDEEP 1536:k6cS44cluhIaUAy4BCHgr7VO/6NabBfDNh5T8fdXWohToh+ohvodoEuQGKQG56KB:k6cS49lc9MArhO/6NabBfDNPT8fdXWo9
- TLSH T174933F5163E88629F1F21B34ADB557A16E72BCC6AB39D68F1350646D0CB2BC0DD34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1033.dll
- Size 88KB
- SHA256 95fe2c2979e331d725825b30422da1337266e7d4a029ed43e0312695f442db36
- MD5 644f7a3778dba970902f59ef1217e383
- SHA1 edcb1dbdfc484e33db714fed7ee3bbee1b0004f8
- SHA512 b4d2dff18265b33930608c5a7d532b2a6156bafeb410708c238c2f1f90990c5def3b8d1a2643e91c553cffd0f436719392c0bb6dc0189f4123905866a94a56e2
- SSDEEP 1536:ktcS44cluhIaUAy4BCHgr5MEO/CajF8Cy/qt:ktcS49lc9MAr6EO/CajF8Cy/u
- TLSH T112935E4267F84129F5F72B34ACB55A656E36BC96AF38D28F1250605E0EB2BC0DD30763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1036.dll
- Size 93KB
- SHA256 abf83d9975ec7d1af6f9c84341d000f856fd4b1e45a0a87934179b8f1e0fbdd6
- MD5 6251b4fbd4cc799a5b15646d63c0c1e6
- SHA1 0f8c21ab03252ec43de07806286ae9f22b13e31a
- SHA512 40b033da4c7004812b50203a12503b2ad853023590f8129e0a0c7ea8bb75da391c75ecf7e9ec34965e5ec140d977aeecee5a19ddfd71640aabcd0d9223f4838d
- SSDEEP 1536:kycS44cluhIaUAy4BCHgrIUO/3aUsJHA8Cy/p:kycS49lc9MAr/O/3aUsNA8Cy/p
- TLSH T1D8931A01A3E85161F6B32F35ACB946615E3ABC8A9F38D18E1250A49E0DB2FD4DD74733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1040.dll
- Size 92KB
- SHA256 521ed82128cb50b4c2d5c6a1b841781254eccfac5acb1946e8e5c2a4837bcb10
- MD5 489f3ffd277c2e243a304116eab8b856
- SHA1 b0bfebd0108a69c09b77196251f53a5fbaf6f2b8
- SHA512 bfcec27e4d924329dcb5fa054ac11efdc7d5ba0a976216af4e883e93aade7f71801b94c287a9d058ffc0b45180b5a49d1f1f4fc4e7820b8521a152397a896f40
- SSDEEP 1536:kdcS44cluhIaUAy4BCHgr0iO/2aWbXhqKKQ8Cy/eh:kdcS49lc9MAr1O/2a7Q8Cy/u
- TLSH T12A935F0167F85225F5F32B34BC799AA55E36BC869B38D28F0291606D1CB2AD4DD70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1041.dll
- Size 78KB
- SHA256 4e32f968065d2a2a05c19494be5c08a538685e71fc97a981a6af83475a544d8b
- MD5 2bd1bf3c36436cbd3e065eb995b30adb
- SHA1 3c9f844170cbe3c65991e38a89683c7ce097a935
- SHA512 a57983fda05725a828ef68b6883578a63c582654216c02ea4cda5cec75fcefdde42c47bb6e9e1858402228659a0a2a1bfde89cf18881a1e436a6cf51f6af97a2
- SSDEEP 1536:kRcS44cluhIaUAy4BCHgr9bO/dasPBK7YhJ8Cy/r:kRcS49lc9MAr1O/dasJJ8Cy/r
- TLSH T1A0732848B2A0457AE4A6023584B2BBA5BBB4FC8147B546CB069CF41F0D337C85F397B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1042.dll
- Size 77KB
- SHA256 e7dddcb80d05b9f2d03384e073d994560e9d6229b0c3735285da9679cf1e0ac7
- MD5 7f8f1d7116ae819f42690c360dfe1d9d
- SHA1 e5c6547f6515db03ab013b6996ff98fc17414d76
- SHA512 e90c253db2c1ad05752dbf40a11303ffa43d314288ce5b7074014d46f809645a6fb6994d619aea6f394d920e333984d41ef68311b8853be401a9e2b8e21e5875
- SSDEEP 1536:kccS44cluhIaUAy4BCHgr2RO/iaE5IelPpQpwIcw8Cy/r:kccS49lc9MArIO/ia4w8Cy/r
- TLSH T14E732B4662A49072D421473589F38BA3A736BCC15B2A12CFA360B46D1EF77D4DD343E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.1049.dll
- Size 90KB
- SHA256 ebec1897da072f34a42836580818bba38ebf7ddbb278e6e05ff67d9a7ebf4ceb
- MD5 c1226da5c1767b20bf32ed11788e504e
- SHA1 f463c2846e982680e8cc0fc3d971dad16d15a97b
- SHA512 38005222477b48dd106ee23dd8fb646eea70c805d125b565474700cef31165542af93b9817b444ac2ae6d85236ea40cc9430741862c339065af5c916053138b1
- SSDEEP 1536:kBcS44cluhIaUAy4BCHgrF8O/ca4zC8Cy/H3:kBcS49lc9MAr+O/ca4zC8Cy/H3
- TLSH T1FB93944FF6789160E455C2740A738AE32575BB40132952CB629FBC6964BA3F4BB383C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.2052.dll
- Size 73KB
- SHA256 a9713b48cf5fde9c84f97571d2fac4cada5ac66c23d371ea6c749ac4944df562
- MD5 a8b96ae4b972caf4bc8710a0adc3452a
- SHA1 9c21083b994c7205f2699adc3fe613b14a462977
- SHA512 08ad484770b4685c4879da255747d273286d01f0ef3f3a71713ffbdf42a55373ee8bc4b5a66cfe6cd556966c4300906ebf00749f750e2a268bd27ea19e23f092
- SSDEEP 1536:kscS44cluhIaUAy4BCHgr0qkd0psKM8Cy/TR:kscS49lc9MArRkd0p9M8Cy/TR
- TLSH T12A734A0563949475D19A063888F39BA2BB72FCC60B7947CF12ACB56E0E777C0AD38764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\install.res.3082.dll
- Size 93KB
- SHA256 bf06314e611391e7329bb58f1bc6813e78d9cc152e22b5d4328fad70a187e980
- MD5 e07e419773ea85395e4aaec8d1b617cd
- SHA1 02d186ab5e4fa4e2e24a5d98effad6eb6dbdb413
- SHA512 8ac621b0c278d94ae11c70a91c525a4150b9ba1d3a4247f6bace3aaf92d20f5c04bd3ec72ddd59b90a45285b5aaa359fcb1333daa8fbf8ba72bd74b7e00f2317
- SSDEEP 1536:kacS44cluhIaUAy4BCHgr2NO//a3p1yN0mnpzg8Cy/g:kacS49lc9MAr8O//aqN0mnJg8Cy/g
- TLSH T15E931D4067E85266F1F32F35A8765A659E3ABC829E38918F0350656E0DB1FC4DE34B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\vc_red.msi
- Size 236KB
- SHA256 3e7c86e3dfddc6d587cd0b1bae0e73dcaccfd865962b3985c39009ec8926ae5f
- MD5 77a421c01414d744315f7b5c1d9e3150
- SHA1 c7c5747135931800bad55d58bd523691364fcde0
- SHA512 312c4e882586b7e3f030e0f566ba0e96dc1bafbc882e3eb6774244b35365859ff815b78252fc4c6c063aeccc97a0594d00b74d97a7e5a9ed642d99f837f8230c
- SSDEEP 3072:SZhipq8Cy/EMSWpdIca0kawMYkGbxSRB5lZ+/z5J/mJI8Cy/i78XQlmNWVcqelSN:0gEIdIcZkQxGbxSnZ6Dtgi7O32sg
- TLSH T117347C41B255C033D8416372855B9F52BEB9BE860B6687DB22AEB28C0F737D0973634D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\4a703434f9d5dab43e3f24\vcredist.bmp
- Size 5KB
- SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
- MD5 06fba95313f26e300917c6cea4480890
- SHA1 31beee44776f114078fc403e405eaa5936c4bc3b
- SHA512 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
- SSDEEP 24:pS75l775l7aqV7j7Q55okTg2vrlgprDDcaWJQvS2PRSmob6SHSl4CiZ:pKV7j7AXgbjlLI
- TLSH T15EC1E74B200A6854D296603147AECDFB472BADC182E063F631F93E8A36FDC98351E719
- MD5 SHA1 SHA512 SSDEEP TLSH
