Analysis
- user interaction
yes - max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
ee4p_pm (1).msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee4p_pm (1).msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target ee4p_pm (1).msi
- Size 124.5MB
- Sample260722-stchvstygx
- SHA256 2446b07ee36fcc553c911d3bf3e5f0cb9d11bbe9e35e9d5b4f342b8244254509
- MD5 57b7f168d837fb940c79a70278d8d5f1
- SHA1 d405071ba48c68eeb39f11b87bf20fd9844d22f4
- SHA512 17de89038be26d35867b164aa6365d96b35fd0d72d028a08ba6204f3448979e97d85a5e309cfb572264db96a7e6342c97893139163a8bef0d1842db10f05d80f
- SSDEEP 3145728:YqHvLmf6MbmIAN5sUgViYIOKpW2DUxAMlSrWAD0VI+0oFu:YqHjdMbHAz3YIOX2ft02aF
- TLSH T12F583362788E8C32E75F02716525FA6A8C693DB10B6200E772FBF5697A357C2433DE41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
pid Process 1748 MSIC04.tmp 4156 MSI1149.tmp - Loads dropped DLL 23 IoCs
pid Process 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 4852 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 1524 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 1524 MsiExec.exe 1524 MsiExec.exe 5656 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 4792 msiexec.exe 7 4792 msiexec.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraLayout.v18.2.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\EPPlus.System.Drawing.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Svg.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Buffers.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Formats.Asn1.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETaggregator.pdb msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.ValueTuple.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.Broker.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Diagnostics.DiagnosticSource.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Formats.Asn1.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeFontInstaller.exe msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\EPPlus.Interfaces.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Memory.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.NativeInterop.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Program.xml msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeConnect.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNET.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\PdfSharp.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ru\ee4pNET.resources.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraGrid.v18.2.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-arm64\native\WebView2Loader.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-x86\native\msalruntime_x86.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Diagnostics.DiagnosticSource.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETteamsync.exe msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-x64\native\WebView2Loader.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.IO.RecyclableMemoryStream.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.Broker.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraBars.v18.2.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\AlphaFS.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\de\ee4pNETteamsync.resources.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Web.WebView2.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.RichEdit.v18.2.Core.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraRichEdit.v18.2.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\pt\ee4pNET.resources.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETteamsync.pdb msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-x64\native\msalruntime.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.Printing.v18.2.Core.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ExCSS.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETloader64.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.XtraWizard.v18.2.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Web.WebView2.WinForms.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\eeConnect.pdb msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.IdentityModel.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\timestamp MsiExec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\it\ee4pNET.resources.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\PdfSharp.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Microsoft.Identity.Client.NativeInterop.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ExCSS.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Buffers.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Memory.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.Numerics.Vectors.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\System.ComponentModel.Annotations.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\fr\ee4pNET.resources.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETupdater.exe msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNET.pdb msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\zh-Hans\ee4pNET.resources.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\NamedPipeWrapper.txt msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\DevExpress.Utils.v18.2.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\AlphaFS.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\runtimes\win-arm64\native\msalruntime_arm64.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNETloader32.dll msiexec.exe File created C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\ee4pNET.dll.config msiexec.exe - Drops file in Windows directory 34 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC76E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICF27.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC04.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1129.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIFFF.tmp msiexec.exe File created C:\Windows\Installer\e59bdba.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF90.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59bdb8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF2BAC900AB4D7CD94.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\AiFilesRemoveNoImpers_FC9F3505_BF4A_4F65_92AD_6B78D0D7B9EF.bak MsiExec.exe File opened for modification C:\Windows\Installer\MSIDA92.tmp msiexec.exe File opened for modification C:\Windows\SystemTemp\EfficientElementsCleaner_log_260722-162631.txt MSI1149.tmp File created C:\Windows\SystemTemp\~DFEA21958D433AB405.TMP msiexec.exe File created C:\Windows\Installer\e59bdb8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC899.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSICEC8.tmp msiexec.exe File created C:\Windows\Installer\{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}\ee4p_1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIF12.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1149.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID92A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC6E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC79E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC926.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC9C4.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFAA9B1BA125CB881D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICE0B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFA4DF5CC00B3C06DA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICA51.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF} msiexec.exe File opened for modification C:\Windows\Installer\{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}\ee4p_1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIFB0.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIC04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventcreate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI1149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies data under HKEY_USERS 23 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6392210f-0000-0000-0000-d08302000000} MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6392210f-0000-0000-0000-d08302000000}\NukeOnDelete = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6392210f-0000-0000-0000-d08302000000}\MaxCapacity = "94852" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MSIC04.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSIC04.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MSIC04.tmp Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MSIC04.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MSIC04.tmp - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32\ = "C:\\Program Files (x86)\\Efficient Elements\\Efficient Elements for presentations\\Program\\ee4pNETloader32.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\customization = "ee4pNET" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\ee4pNET.CheckTaskPane\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ee4pNET.TaskPane\ = "ee4pNET.TaskPane" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Efficient Elements|Efficient Elements for presentations|Program|ee4pNET.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\RuntimeVersion = "v4.0.30319" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\Class = "ee4pNET.Modules.DesignChecker.CheckTaskPane" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\ProductIcon = "C:\\Windows\\Installer\\{FC9F3505-BF4A-4F65-92AD-6B78D0D7B9EF}\\ee4p_1.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2D5C193D06DF7A4DB11543E49FFD889 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Efficient Elements/Efficient Elements for presentations/Program/ee4pNET.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\RuntimeVersion = "v4.0.30319" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\ProgId msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\PackageName = "ee4p_pm (1).msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\Assembly = "ee4pNET, Version=4.5.2600.1, Culture=neutral, PublicKeyToken=null" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\ProgId msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ee4pNET.TaskPane\CLSID\ = "{EE000001-3942-40F3-84CC-9F79304AF198}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|Efficient Elements|Efficient Elements for presentations|Program|ee4pNET.dll\ee4pNET,Version="4.5.26.0",Culture="neutral",ProcessorArchitecture="MSIL" = 54007000450034007a00380041002700540041004c004d00690064004e007b002800270027007600700072006f006700720061006d003e006f0074005800480070003d0053003400210041006e005a0068002c0030006f0063005f0073005a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\RuntimeVersion = "v4.0.30319" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\program = "ee4pNET" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\Class = "ee4pNET.TaskPane" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ee4pNET.AddIn\ = "Connect Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\ = "ee4pNET.AddIn" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ = "mscoree.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\Assembly = "ee4pNET, Version=4.5.2600.1, Culture=neutral, PublicKeyToken=null" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\ee4pNET.AddIn\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\ProgId\ = "ee4pNET.CheckTaskPane" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\ProductName = "Efficient Elements for presentations - Standard Edition" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\ee4pNET.TaskPane\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32\ = "mscoree.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\InprocServer32\ = "C:\\Program Files (x86)\\Efficient Elements\\Efficient Elements for presentations\\Program\\ee4pNETloader64.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5053F9CFA4FB56F429DAB6870D7D9BFE\registry = "ee4pNET" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000001-3942-40F3-84CC-9F79304AF198}\InprocServer32\CodeBase = "file:///C:/Program Files (x86)/Efficient Elements/Efficient Elements for presentations/Program/ee4pNET.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\ee4pNET.CheckTaskPane msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE000006-3B34-41A2-8EF5-A4FF4E95EBF5}\ = "ee4pNET.CheckTaskPane" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5053F9CFA4FB56F429DAB6870D7D9BFE\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE000000-3421-4932-A0FE-FB95AF9B08AA}\ProgID\ = "ee4pNET.AddIn" msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4852 MsiExec.exe 4852 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 5656 MsiExec.exe 2256 msiexec.exe 2256 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4792 msiexec.exe Token: SeIncreaseQuotaPrivilege 4792 msiexec.exe Token: SeSecurityPrivilege 2256 msiexec.exe Token: SeCreateTokenPrivilege 4792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4792 msiexec.exe Token: SeLockMemoryPrivilege 4792 msiexec.exe Token: SeIncreaseQuotaPrivilege 4792 msiexec.exe Token: SeMachineAccountPrivilege 4792 msiexec.exe Token: SeTcbPrivilege 4792 msiexec.exe Token: SeSecurityPrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeLoadDriverPrivilege 4792 msiexec.exe Token: SeSystemProfilePrivilege 4792 msiexec.exe Token: SeSystemtimePrivilege 4792 msiexec.exe Token: SeProfSingleProcessPrivilege 4792 msiexec.exe Token: SeIncBasePriorityPrivilege 4792 msiexec.exe Token: SeCreatePagefilePrivilege 4792 msiexec.exe Token: SeCreatePermanentPrivilege 4792 msiexec.exe Token: SeBackupPrivilege 4792 msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeShutdownPrivilege 4792 msiexec.exe Token: SeDebugPrivilege 4792 msiexec.exe Token: SeAuditPrivilege 4792 msiexec.exe Token: SeSystemEnvironmentPrivilege 4792 msiexec.exe Token: SeChangeNotifyPrivilege 4792 msiexec.exe Token: SeRemoteShutdownPrivilege 4792 msiexec.exe Token: SeUndockPrivilege 4792 msiexec.exe Token: SeSyncAgentPrivilege 4792 msiexec.exe Token: SeEnableDelegationPrivilege 4792 msiexec.exe Token: SeManageVolumePrivilege 4792 msiexec.exe Token: SeImpersonatePrivilege 4792 msiexec.exe Token: SeCreateGlobalPrivilege 4792 msiexec.exe Token: SeCreateTokenPrivilege 4792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4792 msiexec.exe Token: SeLockMemoryPrivilege 4792 msiexec.exe Token: SeIncreaseQuotaPrivilege 4792 msiexec.exe Token: SeMachineAccountPrivilege 4792 msiexec.exe Token: SeTcbPrivilege 4792 msiexec.exe Token: SeSecurityPrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeLoadDriverPrivilege 4792 msiexec.exe Token: SeSystemProfilePrivilege 4792 msiexec.exe Token: SeSystemtimePrivilege 4792 msiexec.exe Token: SeProfSingleProcessPrivilege 4792 msiexec.exe Token: SeIncBasePriorityPrivilege 4792 msiexec.exe Token: SeCreatePagefilePrivilege 4792 msiexec.exe Token: SeCreatePermanentPrivilege 4792 msiexec.exe Token: SeBackupPrivilege 4792 msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeShutdownPrivilege 4792 msiexec.exe Token: SeDebugPrivilege 4792 msiexec.exe Token: SeAuditPrivilege 4792 msiexec.exe Token: SeSystemEnvironmentPrivilege 4792 msiexec.exe Token: SeChangeNotifyPrivilege 4792 msiexec.exe Token: SeRemoteShutdownPrivilege 4792 msiexec.exe Token: SeUndockPrivilege 4792 msiexec.exe Token: SeSyncAgentPrivilege 4792 msiexec.exe Token: SeEnableDelegationPrivilege 4792 msiexec.exe Token: SeManageVolumePrivilege 4792 msiexec.exe Token: SeImpersonatePrivilege 4792 msiexec.exe Token: SeCreateGlobalPrivilege 4792 msiexec.exe Token: SeCreateTokenPrivilege 4792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4792 msiexec.exe Token: SeLockMemoryPrivilege 4792 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4792 msiexec.exe 4792 msiexec.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4792 msiexec.exe 2256 msiexec.exe 4852 MsiExec.exe 5656 MsiExec.exe 1524 MsiExec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2256 wrote to memory of 4852 2256 msiexec.exe 90 PID 2256 wrote to memory of 5656 2256 msiexec.exe 92 PID 2256 wrote to memory of 1524 2256 msiexec.exe 93 PID 2256 wrote to memory of 1748 2256 msiexec.exe 94 PID 1748 wrote to memory of 1268 1748 MSIC04.tmp 95 PID 2256 wrote to memory of 4156 2256 msiexec.exe 97
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\ee4p_pm (1).msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4792
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 04DD41327EA1A5035787EB76DC2E8577 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4852
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69E390E5D6D0BEB9F1B977CFBBE47D362⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5656
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7061DB835A402045A125668F3301773 E Global\MSI00002⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
C:\Windows\Installer\MSIC04.tmp"C:\Windows\Installer\MSIC04.tmp" eventcreate /ID 1 /L APPLICATION /T INFORMATION /SO "Efficient Elements for presentations" /D "Event Source Created"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\eventcreate.exe"C:\Windows\System32\eventcreate.exe" /ID 1 /L APPLICATION /T INFORMATION /SO "Efficient Elements for presentations" /D "Event Source Created"3⤵
- System Location Discovery: System Language Discovery
PID:1268
-
-
-
C:\Windows\Installer\MSI1149.tmp"C:\Windows\Installer\MSI1149.tmp" /s /u2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4156
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59bdb9.rbs
- Size 4.9MB
- SHA256 e9183e1ba9cfe3be587086fe74e2ad1d699977a93587021c48a7982a1aac2705
- MD5 7f26e45bcb2645f18630c0f75bc4713d
- SHA1 845c9005b401ba920d2eb110e469c417ef6e1d46
- SHA512 c838f5020bc9a02b0523d72ff61bced45d524042776e4a206b2352044eb5bffc3862b2a7ce70d2f76840bc7480fe257df792a87c143bad162b7abd8fae0f6d5d
- SSDEEP 49152:A/C9vUR05lS/NVCf/C9vUR05lS/NVCv/C9vUR05lS/NVCD/C9vUR05lS/NVC1/CF:FU1U9UnUPUF0
- TLSH T1D8367BB035898061F79E0174A66D8BBFB05EED7A1F2408CB63D97A6D5931EC0273DE06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59bdbb.rbs
- Size 491B
- SHA256 4916098d94014792088b4b38df85787b1d3c6cfde020fa79ad23339e082afb2e
- MD5 b11f71112a586dee813025768a512a98
- SHA1 fa0715370b598e03808d285e076d6382f776bc44
- SHA512 23a7fd879b13960cf55e0098f0fd091054ec6ee8dc9b8713997be85cc862a60b1b691b3853b49d6472bfaedb47c815a940504c8991601d1d705aa81366d24b12
- TLSH T1C0F05C9BABC812D1D583813ADA45598320BBD439691457626C07436C7E927D66EFC409
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Efficient Elements\Efficient Elements for presentations\Program\Program.xml
- Size 655B
- SHA256 a9953460fc7770e149d514f2610e30c6b3ac3843815815d2c3380ad3c200ea97
- MD5 af0caca67105b6654463500e86b0e814
- SHA1 f29dcb329591f9751f672f9f297d4ce3035437c4
- SHA512 4041840acd09ce078e35d1aed8bef1f2e09b029cf0598be53e323cbcdb70de238ba14486f44d9e1a281455248dd9bad4294171d108a4ca75bb4decd8f03f00ed
- TLSH T12DF08170A8D4CEE84F219F37ED00A946405FD1B8A3A8ADAC75ED35178563D8401B7194
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\Indents.xml
- Size 6KB
- SHA256 cf66f9a28a141f22c209ab2bb061d9c925b2aa9137649440ef00f4f4168033c3
- MD5 1c8c07040d0d932bb848c27598dd16de
- SHA1 16589dd11f6bc6787f269f4f8a3a144b9f235b55
- SHA512 557e420ae3f523247eb1922f58fde70b7745a290207447d56b62b598724778a779f4dd1691746ed0d6a5e01fa46b20eabd951b56f8e4fb56fefe441d7d851ab1
- SSDEEP 48:uiX9T7qgpGKgX40XTiZQTxvo6U/AqQ147m1VUm9ONhV6hLV5Gi0ITlcw8+IzSb+1:uia3aIxw33Q0mwm92hV6hDiQuV/
- TLSH T1D4D16B1DA3D04A7687F2A61436F414E1FF51D0E38B0617F4F99C63626B628A24ED7172
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\MasterWizard.xml
- Size 2KB
- SHA256 4ec4e86e682d85d796d755d37df8c5caa87d129889fee3ba6602b8d2dabcdbc9
- MD5 5eafe9eecdd466b87d77fc0bc3981ece
- SHA1 198734903a2bd08192e4fae9557c5c6d2cb575a6
- SHA512 460e5ed5b8a2adc1846942b032e756a7d85b4e870256c3e2c7f42c908a8f1194b5961e420c1131992e2a38925382889d1bb4b9f056de8fe6118c69915503d905
- TLSH T18E41F93608D88C739B67173CB59AF4DDC9F1816B8A4D608135DC9627ED5A0E048E38DB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\ProjectPlan.xml
- Size 12KB
- SHA256 dcb7005a688ef32e0c07c0309b616905bb3a0717886815d5b5eafe8ccbb4f347
- MD5 f7b5f12c6ae3beedc24d2be081788923
- SHA1 88abb4fd829c9e6cc15a2c3cf5e28fca68e79797
- SHA512 da023bffd9a90fd7385aaaa3f7da6e48e69a877fb09e6f784016071a9ae29fb16e76cd9389b4d54ec14f74e1104ac8ef229465fe9b6277c22045eff89582b5bf
- SSDEEP 192:owlztlW6x84ENnRcIN1b1mKUmC3E/rNafTMzevxVW1ow31x16LC8cT:owlbQu0ebW3jILu
- TLSH T10342AE2898C09C758739852E72B24846EF1E66D7070924A0710FAA377FF78F61E175FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow\SmartElements.xml
- Size 11KB
- SHA256 c5374651d78989de09cc5e1a860c5d1584e1717f03fcc2be288ae5f467374730
- MD5 1788187bba2149a03117e14a2eb1425d
- SHA1 52909ccfeac1e2c4dd3153f5899087dd49cd9742
- SHA512 e0e2bb368c18ed1fc4b28d7307867b6ae67545831690fe867afa33d0e41ada0e4cb2f8f4e2964bc6d98d0aa83fbb3633449473e3a8e9c94e47240a96940d8188
- SSDEEP 192:xJGD5f4c9qkjo4uqq59/5UYhkshwp56qr:xJ2F4c9qkM4DqD/CY+syprr
- TLSH T116325914B4D49D3253BF883E7A93649DEF4671E3011A2105718EB5230F3BEB66EA3876
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Efficient Elements\Efficient Elements for presentations\Customization\Style_Shadow_AR\ColorPalette.xml
- Size 1KB
- SHA256 39f853a71b371278df160a743e229a990b15f877e3fa07634e8a00e73611ab0a
- MD5 907c628a4d22eb4a7e2c96f302e9a04f
- SHA1 d2665ac43e1c4c76d13bc6376b54f7cd20a3aeea
- SHA512 f43462c131edd750d9d0807fbcb362c75ebb4314148b784df4ab26b895e42965bf3302c8f11c8807ce08bd4b7c71e1ba555f122b72d77579a0065b2dbf40586e
- TLSH T1EE319E04E4C9AD634273957D480EB8DCAE62B5F3841E338978CDFA52AFB78534953812
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI91C6.tmp
- Size 738KB
- SHA256 8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8
- MD5 36cd2870d577ff917ba93c9f50f86374
- SHA1 e51baf257f5a3c3cd7b68690e36945fa3284e710
- SHA512 426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda
- SSDEEP 12288:z0WEPSjIw3my6hFWRZGdTph0lhSMXleaGv5PCcuvk:zxkuf3T6hFWXKh0lhSMXlxG5q7vk
- TLSH T15DF46D2139C9C02AD56D01B12AFDDA6B912EBD7A4B7144CBA3D8AD7B19F14C29334F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9574.tmp
- Size 199KB
- SHA256 8fdea6b9bf9b87857fc5d5b3d84ce0fb03d4e23daf694db1e08ecba6c35170b2
- MD5 22eafd3e76796f0e0725a2ddd91582a6
- SHA1 fffe28a43631dc83870dfcb6e10890d8fcc4d1d3
- SHA512 51ed363f9aeaaf8bc416279c13ce136c404fcc0e7e219ec2e1375c35fce63f0352513e981e2613c53d3f3a3649f4cfd1e0ca839fea8b5c5c747a992fb4f5e8c8
- SSDEEP 3072:oA6eQkUAL3H/v67er6KTdBnms+u80fLWcYx59OHLy3L3Ag0Fuja+8Nt8T6iz:og1UAbK7/K3nHbTWjfbAOA8T6iz
- TLSH T185147C4075D1C176E6BE16380839DBA65A7DB9100E70CEAB73D54EBE4F302C0DA35A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9799.tmp
- Size 1.1MB
- SHA256 34fe948e2b005a424f4e8aff9d9ef847d5623b99196fe5f5e9bff4983770d95a
- MD5 7e4ef4bc701a5f46a1fee1a9fdc403f1
- SHA1 ab00fc0985d7cae8ccfdae1cd4e687192f079d47
- SHA512 7f8013d024142377aad49fc2c5c30376a4b9dd6c732dbbe3d88d2377965ca9e544d7065c7ee5aa1bd9d29b51f19255335c7ac3f85b5079b1cad710dc74bb8748
- SSDEEP 24576:Aruj7NEzYyR9j+9lwCItiGS5oWjIPibwd/TyZ5HCbhpP9gY0dB0lAwvI/oD:A6f4dCItiGS5oW8XlT45HqhpP9gY0dB4
- TLSH T179451A11BD7D8572FB2F1E704A169627E86D55D11BF248FBA2E0D8862235AC31333F86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1149.tmp
- Size 158KB
- SHA256 8de5310615294af0baf6b662b53146be0d39f0ec574b9cfc175ab03f9c5e40de
- MD5 6b1902479894417317a8bef1bf3eb719
- SHA1 d70903bc37139dd083e52ca8588cedf920270942
- SHA512 569d43e244273b234ca5f3718bea69be44f322bbd36a1d6916706097777653d8d994b9b93f750494422da339d5d78f758273fa0086939a869544cfb777dbb7da
- SSDEEP 1536:vI+CNu9irZ9C0ZMsX8ZBmyMXzWEL2P4LxAF4oid:mMOfMsXqoda4LxAc
- TLSH T1A6F371569BC50CBCF36E0A398AF0F17108EBBC76180799AA01373052B67ABD5536DF19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC04.tmp
- Size 419KB
- SHA256 2498aca74afe7cd4cae778e635042f84246137a18d43f1b11a27aaae6b4edb4f
- MD5 6d3ec55de344d1c6b9bf1cfd673531b3
- SHA1 86ad4ffd15209b381ba8a46a9a3982e9a8037cde
- SHA512 687c519890d25d8680ff824d2679544145219b00a88e0277f5d157b4a29281675e1c82fa163b662475118fd4bd954b07e53fe78c641d2df07ef41b1044b4b979
- SSDEEP 12288:h9x/jGiu4WkT19YwPhHk2D+F8p7cA53BoUviH:h9pjGiHWK9YwPhH9D+iz5xxvQ
- TLSH T187949D217AD5C033D9A211714FA9EAB6677DB9300F6309CBB3D49E2E2A706C15732B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICEC8.tmp
- Size 868KB
- SHA256 f7a548861c26fd64cdd96f03f1e77db9cbe5de139bad5c897444752615c34182
- MD5 e498c8ebbdc8e3930f401e26cc4051ea
- SHA1 493863d1245182cd5ffdc1507a645352442090ec
- SHA512 21fcf147ff3750f935f2b49a3b7c8016a48fe163dd2ac19d1ccd1af222db412b10ecc2e5c357e0a175051db2022d0557ded6566f5d5ec95973c3612360730c0b
- SSDEEP 24576:l1J2ReC9EpmCehUvyXh0lhSMXlE5lS/NVCh:l/C9vUR05lS/NVCh
- TLSH T162156C71354EC036F6AE0170262D8BBBA52D7A760FB108CBA3D4ADAA59704C17735F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\EfficientElementsCleaner_log_260722-162631.txt
- Size 2KB
- SHA256 14538b6c7c0311d10c5471941bdac1830171bf05ed35b41b5814c73bd1b4ddc7
- MD5 2ece212678a028706a8572575bc86254
- SHA1 57eef884ba495880fa36e5857182696a895745fe
- SHA512 e53f845e8dcce9a8b1aaf6d2d230f7b91436f7ac0908301699c93516be1dd51b8b95d4db602d1348f714395b18b2e05a864ce475ca9d4cdc40406a5c31f05226
- TLSH T192517D74E6B29007A4BA23930750184EE797B17DD5EC34F571E11359078662BC7FA389
- MD5 SHA1 SHA512 TLSH