00a7709e88502a7eed6a6f216eb408d7920b51586e944b302d6144742fc3a55b

Analysis

max time kernel
142s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.1.0.2286300022.msi
Size 9.6MB
Sample260722-eyft7aydlf
SHA256 00a7709e88502a7eed6a6f216eb408d7920b51586e944b302d6144742fc3a55b
MD5 74ff58273a26d716441a4692f69bd792
SHA1 e89693161a0025b0f4310b985fa3ca3bf22c6c70
SHA512 31c5d4d54902505c51a9cc7eecda28d703147bcd0b2c658ad4f80c9e0481bbabd1891ff1236fd28443d5cbe22478508d7101fb2e6511891f2699d8e5125729b8
SSDEEP 196608:D97fWQE+Od8HVtHrksQOlNTwqT7X/mBTHjWbgX3OHlC2giy:DVfZDH7LksJbwAToDL2Y
TLSH
T18DA633D6794A5BB1D48BD3756102A26D71183FC8B8A58C17B9F8BE0C3E7663640B338D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\7eOMQf = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
240	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5856	RA2yFY.exe

Loads dropped DLL 2 IoCs

pid	Process
1828	MsiExec.exe
5856	RA2yFY.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5668	icacls.exe
3688	icacls.exe
4276	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\7eOMQf\\RA2yFY.exe\""	RA2yFY.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	1828	MsiExec.exe
12	1828	MsiExec.exe
13	1828	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2156	cmd.exe
4852	cmd.exe
4816	cmd.exe
2132	cmd.exe
5160	cmd.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	RA2yFY.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\u7Pg4K\image.png	RA2yFY.exe
File opened for modification	C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe	RA2yFY.exe
File opened for modification	C:\Program Files (x86)\u7Pg4K\thumbs.db	RA2yFY.exe
File opened for modification	C:\Program Files (x86)\u7Pg4K	RA2yFY.exe
File created	C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe	RA2yFY.exe
File created	C:\Program Files (x86)\u7Pg4K\XPSPLOG.dll	RA2yFY.exe
File created	C:\Program Files (x86)\u7Pg4K\image.png	RA2yFY.exe
File created	C:\Program Files (x86)\u7Pg4K\thumbs.db	RA2yFY.exe
File opened for modification	C:\Program Files (x86)\u7Pg4K\XPSPLOG.dll	RA2yFY.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59fdaf.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCBA16445DC4FDAFF.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DEB810EB-854C-4347-31EA-54CE741E7ECA}	msiexec.exe
File created	C:\Windows\Installer\e59fdb1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAA6E3A17958C8B7D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59fdaf.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF02CD59F381DF235F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI458.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF826D018EA88C29FE.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4076	msiexec.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe
5568	cmd.exe
4280	cmd.exe
3336	cmd.exe
6068	cmd.exe
4616	cmd.exe
412	cmd.exe
4940	cmd.exe
3276	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0D998F6B083E84562400466342627EF\BE018BEDC458743413AE45EC47E1E7AC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE018BEDC458743413AE45EC47E1E7AC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE018BEDC458743413AE45EC47E1E7AC\UuueatYAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0D998F6B083E84562400466342627EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\PackageName = "setup.1.0.2286300022.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\ProductName = "Google Licensing Dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE018BEDC458743413AE45EC47E1E7AC\PackageCode = "9AAC035D126AC874980D663681C3D63E"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2496	schtasks.exe
1096	schtasks.exe
4112	schtasks.exe
3696	schtasks.exe
4708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1836	msiexec.exe
1836	msiexec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe
5856	RA2yFY.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4076	msiexec.exe
Token: SeSecurityPrivilege	1836	msiexec.exe
Token: SeCreateTokenPrivilege	4076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4076	msiexec.exe
Token: SeLockMemoryPrivilege	4076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4076	msiexec.exe
Token: SeMachineAccountPrivilege	4076	msiexec.exe
Token: SeTcbPrivilege	4076	msiexec.exe
Token: SeSecurityPrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeLoadDriverPrivilege	4076	msiexec.exe
Token: SeSystemProfilePrivilege	4076	msiexec.exe
Token: SeSystemtimePrivilege	4076	msiexec.exe
Token: SeProfSingleProcessPrivilege	4076	msiexec.exe
Token: SeIncBasePriorityPrivilege	4076	msiexec.exe
Token: SeCreatePagefilePrivilege	4076	msiexec.exe
Token: SeCreatePermanentPrivilege	4076	msiexec.exe
Token: SeBackupPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeShutdownPrivilege	4076	msiexec.exe
Token: SeDebugPrivilege	4076	msiexec.exe
Token: SeAuditPrivilege	4076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4076	msiexec.exe
Token: SeChangeNotifyPrivilege	4076	msiexec.exe
Token: SeRemoteShutdownPrivilege	4076	msiexec.exe
Token: SeUndockPrivilege	4076	msiexec.exe
Token: SeSyncAgentPrivilege	4076	msiexec.exe
Token: SeEnableDelegationPrivilege	4076	msiexec.exe
Token: SeManageVolumePrivilege	4076	msiexec.exe
Token: SeImpersonatePrivilege	4076	msiexec.exe
Token: SeCreateGlobalPrivilege	4076	msiexec.exe
Token: SeBackupPrivilege	432	vssvc.exe
Token: SeRestorePrivilege	432	vssvc.exe
Token: SeAuditPrivilege	432	vssvc.exe
Token: SeBackupPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeBackupPrivilege	5404	srtasks.exe
Token: SeRestorePrivilege	5404	srtasks.exe
Token: SeSecurityPrivilege	5404	srtasks.exe
Token: SeTakeOwnershipPrivilege	5404	srtasks.exe
Token: SeBackupPrivilege	5404	srtasks.exe
Token: SeRestorePrivilege	5404	srtasks.exe
Token: SeSecurityPrivilege	5404	srtasks.exe
Token: SeTakeOwnershipPrivilege	5404	srtasks.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4076	msiexec.exe
4076	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4076	msiexec.exe
1836	msiexec.exe
1828	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 5404	1836	msiexec.exe	94
PID 1836 wrote to memory of 1828	1836	msiexec.exe	96
PID 5856 wrote to memory of 240	5856	RA2yFY.exe	99
PID 5856 wrote to memory of 2156	5856	RA2yFY.exe	101
PID 2156 wrote to memory of 2496	2156	cmd.exe	104
PID 5856 wrote to memory of 4852	5856	RA2yFY.exe	106
PID 2156 wrote to memory of 5460	2156	cmd.exe	108
PID 2156 wrote to memory of 5032	2156	cmd.exe	112
PID 5856 wrote to memory of 4816	5856	RA2yFY.exe	114
PID 4816 wrote to memory of 4112	4816	cmd.exe	117
PID 4816 wrote to memory of 5464	4816	cmd.exe	118
PID 4816 wrote to memory of 1936	4816	cmd.exe	120
PID 5856 wrote to memory of 2132	5856	RA2yFY.exe	123
PID 2132 wrote to memory of 3696	2132	cmd.exe	125
PID 2132 wrote to memory of 1016	2132	cmd.exe	126
PID 2132 wrote to memory of 3936	2132	cmd.exe	128
PID 5856 wrote to memory of 5160	5856	RA2yFY.exe	129
PID 5160 wrote to memory of 4708	5160	cmd.exe	131
PID 5160 wrote to memory of 5480	5160	cmd.exe	132
PID 5160 wrote to memory of 2664	5160	cmd.exe	134
PID 5568 wrote to memory of 1828	5568	cmd.exe	138
PID 412 wrote to memory of 4104	412	cmd.exe	139
PID 4280 wrote to memory of 2928	4280	cmd.exe	140
PID 4940 wrote to memory of 5848	4940	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.1.0.2286300022.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 35DBE69EDCB22C8CD1E77974495F8466 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Users\Public\7eOMQf\RA2yFY.exe
"C:\Users\Public\7eOMQf\RA2yFY.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\7eOMQf\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\7eOMQf\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2664
- C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe
  "C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe"
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:6068
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\u7Pg4K" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3336
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\u7Pg4K" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3276
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\u7Pg4K" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4616
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\u7Pg4K" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\u7Pg4K" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:6124
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\u7Pg4K" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:4276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\7eOMQf" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\7eOMQf" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4104

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1136

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1828

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5848

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2928

C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe
"C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe"
1⤵
PID:5908

C:\Program Files (x86)\Fwoe0K9\E2kvg1QRw.exe
"C:\Program Files (x86)\Fwoe0K9\E2kvg1QRw.exe"
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59fdb0.rbs

Path C:\Config.Msi\e59fdb0.rbs
Size 7KB
SHA256 f6d365cc7d2404c94a860b7ab1a5d51eba8708c6859eb0913ba493bc58ee802a
MD5 5cb4da1e4b17638d865a48d225aedf6c
SHA1 613b2b9c333f5ea92d36826235669b27dc4bbd0b
SHA512 c49a4460792d317443fae9900f3941d0d8ccc2e1fd53c8fe01138690bd777e035ff41ec6942d2e189bd8b44860403d31345b6fde2b7ae05e3fc37c65f69d9183
SSDEEP 96:gbMfRHlCH3hUUg+1CsThqiUg+1C6jhtQ8VThqSHuT5B5W+/A9CKpljhTAMjjBZy:goCxzvIIkvIEKtxKpe
TLSH
T1AEF13102B70042E6FC965738CB4B1B5637EAC7D5C350635B06CE82602F4B78E6ED169B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Fwoe0K9\XPSPLOG.dll
Size 3.2MB
SHA256 601368742ce2ad1e3f87e015160ffe8f45c4f2bc8a4297f3baa8a48e6aaf5e79
MD5 500c4d85df6b00d754abbd978e1b8f2d
SHA1 15ed5e7218c0cbdab2b35b254044139cee7df1f0
SHA512 23f0f91ddaeaa2d63804de11947f5f58e1f0923bb5f25ff970ac30c8665e7dc5ad055a006cec647c621064ed53e6345632ef07aafcb5020f77e7f6b0ad8343a3
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1d:yCMWmcKfST5t+BceThTHfaCCUqmJb
TLSH
T1D8F5334ABBCB921EE55272B84F3DFC7E76B859C8430CEC84D4A5314B90A6B6D503DA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Fwoe0K9\XPSPLOG.dll
Size 2.6MB
SHA256 b9801f3eee2294260b5978dc02ab848187aabbdde531df8064b11b2f71a953a8
MD5 1b9d120e9e24ee98382ee636bb1af9cd
SHA1 0e0d7af7e22e4bce6d2ca36b492cca5dbef495bd
SHA512 6d11e67fdc8cf3cf85645956e19cadf975fad7f41b1be815cde682898d6265f9751e35ab0b2ec78d23557719d171274eb38eed8d9f24c5b14afe038e81ab581b
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOb:yCMWmcKfST5t+BceThTHfaZ
TLSH
T1C7C5339FFA5B561EEAA133792FADEC9DB2BC49C4822DE544D0D2704F0054B9E503E68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\u7Pg4K\XPSPLOG.dll
Size 4.6MB
SHA256 89f85e958e946a0a974e5c47c5006dc08377ea191de359486fe7dff60636301e
MD5 916c5834aef5f34e1050b929de305fc2
SHA1 53f390103a09b3bd20b71ad7580ed272b8f4a057
SHA512 da3faa0cabc1bc08028f402f24d7ffe0977ae492b975371e579d5dfcdb61181f744c4730e7af7c6a0895eb0ae0ff43b25d5d5ee05a361d81fc9613177b485cba
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyy:BMWKfU+BcUTHCCCfqCiUffny
TLSH
T137263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\u7Pg4K\image.png
Size 4.9MB
SHA256 9d466bb744d80bca35b25f91e989a47409953a23a27ff995bcff237a694a5233
MD5 3459cd7dd22e44082b88ba55d2b08bab
SHA1 580a43c174d9aee764ff67a67ec7375ae5760225
SHA512 aedc1072adf1f78c7bdff8dcf48dce4d29b86c5b0cd6e1d89eb4d85a0bea1bc7de7efa7f62c5d1020abf90a740ffe9c903eaa0079174441688ae280db342b54a
SSDEEP 98304:PJwqG8r+CvCzsqtSFk8B+uUB2LRKuXDnP1lv2JkNNFQCHae9s6cS1N:PJbrbit780VkLVDHFNqGae9s6c2
TLSH
T19036331F92C111F95B7FD3253BFA56FB14A372923191A80EB22B17E853D11929F2CE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\u7Pg4K\thumbs.db
Size 358KB
SHA256 e025f95ec0981508f13680c177df486ba7c545f45c3b88e244f79864e6470053
MD5 4630cf8691b32944471c8441dcfba841
SHA1 eb78ab146de8c323a3699e1cb4ae686a0fe41879
SHA512 05940d992365cb8c3447480de8bc0a2e0e1cd752a2fdeb52df242677a10d24061205a5260a9f7a1feaeac338496a029257f313a2d956618c7166445054ff8f3c
SSDEEP 6144:iiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:98u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1F674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u7Pg4K.exe

Path C:\Program Files (x86)\u7Pg4K\u7Pg4K.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RA2yFY.exe

Path C:\Users\Public\7eOMQf\RA2yFY.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\7eOMQf\UxEnhance64.dll
Size 3.1MB
SHA256 d6d7af60ea60c02d9cfe3ba1ef7fda5a6cd70e13718ddd6c9dd3ea09ad62ffe6
MD5 fefcbc762e4386014a4dd7c66b2970f5
SHA1 a2bb32bc79df11cc53dede63d6525b3f7a5ad589
SHA512 d371b2793799ed42df7ef4d86df0bfab4eed738938f7fde4399467039cc072447572b418420d01da5d5142d4091d5007942b534eb43b35a38854d71aa934a2de
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+E:P9m29xx3Tiqt06ox6+z2rNNrKoE
TLSH
T1AAE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\7eOMQf\adoresd.dat
Size 4.8MB
SHA256 f15d90c3a11e9ba776c7786bd09bf574d4a7c7ebdb93971a190ae80d9999959f
MD5 c7641889fc3d67331559003347c9dc33
SHA1 4daf0b087173e8b5ac4f5a96285b84be97f1a2cd
SHA512 8838d52f0167f6f0bf4ea279cfb52b977dd3257b93b9c32509eefea12b0805b785ee670090d427908f3ed15f7775d37e878e2e3bc845815a9d92e6c350931626
SSDEEP 98304:VuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:OQDPnORb7AdPEm7Y7ltlVgxs
TLSH
T138363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\7eOMQf\msadox.tb
Size 8KB
SHA256 d9e750fb15cec4c93d4daca35bdfb819af1a662900e7acab38254d1fd26cbe6d
MD5 a72b68656a4dfe24b1b3d0386d5fc5f7
SHA1 dfcadfa1df8220f736e331924026df71cda1a40b
SHA512 cc5730539f21e4cd4ab2888164b347c5135ad86a400d015d5f6a8cc0e03cbff8056ef443f1934935fe792bcd6dac9e7db2990d41573504c6f13e7427ef5a2f2b
SSDEEP 192:QqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:QsZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

MSI458.tmp

Path C:\Windows\Installer\MSI458.tmp
Size 9.5MB
SHA256 a5730a34ed4e04a0110c00f3f9f7a479e493b8340066819b2ede78e957b979c4
MD5 a3b8fdfffc1ab557ec1b1616178f80dc
SHA1 c28c4ab8e0ffc1e5c77d39809d2b679e02fc01bb
SHA512 f4f7cd911aa94e3ba03f3785122719501d5c30b26f42f624b60e2f0c94314bcae9b63a99c4f7aa5fd26c7e3c6e1f74c4b2fb7a71678290c2f4fecdf5865c5758
SSDEEP 196608:b97fWQE+Od8HVtHrksiOlNTwqT7X/mBTHjWbgX3xHlC2gib:bVfZDH7LkszbwAToDC2d
TLSH
T123A633D2754A9BB0D4DBD375A102716D711837C8BCA48C57B8F8AD0D3EBB63684B2389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59fdaf.msi

Path C:\Windows\Installer\e59fdaf.msi
Size 9.6MB
SHA256 00a7709e88502a7eed6a6f216eb408d7920b51586e944b302d6144742fc3a55b
MD5 74ff58273a26d716441a4692f69bd792
SHA1 e89693161a0025b0f4310b985fa3ca3bf22c6c70
SHA512 31c5d4d54902505c51a9cc7eecda28d703147bcd0b2c658ad4f80c9e0481bbabd1891ff1236fd28443d5cbe22478508d7101fb2e6511891f2699d8e5125729b8
SSDEEP 196608:D97fWQE+Od8HVtHrksQOlNTwqT7X/mBTHjWbgX3OHlC2giy:DVfZDH7LksJbwAToDL2Y
TLSH
T18DA633D6794A5BB1D48BD3756102A26D71183FC8B8A58C17B9F8BE0C3E7663640B338D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 9274ccd495d10bdd12c379d759cd39c09c1c0f72cd4b37cbd58a3344e6eabc7f
MD5 c4283a97fb0f5ffb07a5307a22f20f4a
SHA1 f80ffe9975168c12b48e1b131d1139b3e4507310
SHA512 1b5c11d7b66795c3bd9d9803b76c5586cb6b8b9b8eac3cd06c6d113ca8d04775349e1cb2c9c18db8adfc82ef238fc40703629fb9bd3f0fcb966844a0ab0b2b01
SSDEEP 24576:9Fo3DMP0doO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+0:sHg
TLSH
T15F57E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6181d940-d05f-4b7d-968a-0c8d6840e88f}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6181d940-d05f-4b7d-968a-0c8d6840e88f}_OnDiskSnapshotProp
Size 6KB
SHA256 69aef0feda7badb5e7cc04ae81ed12a2b5b71b2231cd226fa37f5f91cad55979
MD5 922331010865628dfc9b95d231bc8417
SHA1 e21c7430a4df82f0b3ee525120df4936725696e5
SHA512 ffff737e7bd2b02cd3ad1bf485b97b9f0d27287737e29d409906bf7ad18cd88e0813a2da5de6b25e9930238fef78bc65ae52b678871c771c88c0f440e18aed24
SSDEEP 96:FEPuQBOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:ePgb++uVmN
TLSH
T1F2D177185AF54711E2B3AB7128F18557A877B811EF33CB8E0298238E6631910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-97-0x000002377F420000-0x000002377F442000-memory.dmp

Download

memory/240-103-0x000002377F900000-0x000002377F90A000-memory.dmp

Download

memory/240-102-0x000002377F840000-0x000002377F8F2000-memory.dmp

Download

memory/240-101-0x000002377F760000-0x000002377F77E000-memory.dmp

Download

memory/1828-13-0x00007FF934C00000-0x00007FF935234000-memory.dmp

Download

memory/1828-16-0x00007FF9409B0000-0x00007FF9409C2000-memory.dmp

Download

memory/1828-12-0x00007FF957FF0000-0x00007FF957FF2000-memory.dmp

Download

memory/1828-38-0x00007FF9409B0000-0x00007FF9409C2000-memory.dmp

Download

memory/4152-189-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/4152-182-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/4152-236-0x00000000030E0000-0x00000000038C3000-memory.dmp

Download

memory/4152-217-0x00000000030E0000-0x00000000038C3000-memory.dmp

Download

memory/4152-219-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4152-213-0x00000000030E0000-0x00000000038C3000-memory.dmp

Download

memory/4152-201-0x0000000004D70000-0x0000000004D84000-memory.dmp

Download

memory/4152-194-0x00000000030E0000-0x00000000038C3000-memory.dmp

Download

memory/4152-191-0x00000000030E0000-0x00000000038C3000-memory.dmp

Download

memory/4152-187-0x00000000030E0000-0x00000000038C3000-memory.dmp

Download

memory/4152-183-0x0000000074F70000-0x00000000756BA000-memory.dmp

Download

memory/5856-83-0x0000021D21D20000-0x0000021D21DAA000-memory.dmp

Download

memory/5856-90-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-70-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-71-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-68-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-75-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-64-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-86-0x0000021D21D20000-0x0000021D21DAA000-memory.dmp

Download

memory/5856-63-0x00007FF958000000-0x00007FF958002000-memory.dmp

Download

memory/5856-84-0x0000021D21D20000-0x0000021D21DAA000-memory.dmp

Download

memory/5856-91-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-69-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-61-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-88-0x0000021D21340000-0x0000021D21BFE000-memory.dmp

Download

memory/5856-81-0x0000021D21C40000-0x0000021D21C8E000-memory.dmp

Download

memory/5856-56-0x00007FF934D20000-0x00007FF93523E000-memory.dmp

Download

memory/5856-55-0x00007FF957FF0000-0x00007FF957FF2000-memory.dmp

Download

memory/5856-85-0x0000021D21D20000-0x0000021D21DAA000-memory.dmp

Download

memory/5908-237-0x0000000074F70000-0x00000000756BA000-memory.dmp

Download

memory/5908-235-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/5908-242-0x00000000034F0000-0x0000000003CD3000-memory.dmp

Download