8be27d4835e411b0521cb9617a12738b9491301d7a39ae71dcd5fcde6a13bd4a

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HL7Tool.Setup.msi
Size 7.8MB
Sample260724-k8233abl7z
SHA256 8be27d4835e411b0521cb9617a12738b9491301d7a39ae71dcd5fcde6a13bd4a
MD5 0c644eb295c68836f9b49953f9e31158
SHA1 23991158a6441e234f5d744335656aee22c738bf
SHA512 c865eed4e2cdc8c9c0ae25462ebc6409b59977ecbbcf116d00c079a33547e1dd4468aeab4939f78cbabf8be35908278a09024f2e2b0df7ce641bc04e872b4829
SSDEEP 98304:3a8Q2iDXawfF7r7HJpdk10mf2X7tuvSQZtsLYXftPFYsCoxGXMc3Iv:q8vsawt/7y10mOX7tYts0xFYTowb
TLSH
T1A78612233F4EEC96E744AE72A2B14FA903506ED571D2887BE1123948E9F9CF064711DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
3952	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
4264	MsiExec.exe
4264	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Services.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedBoundary.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Danish\UIStrings.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedDataServices.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonServices.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Utilities.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\KinetDx.Dialogs.HL7Reconciliation.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\English\UIStrings.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\Xceed.Editors.v2.6.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.Utilities.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\French\UIStrings.xml	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Xceed.Grid.v4.2.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonForms.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.Common.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\StationManagerClientNet.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\French\UIStrings.xml	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Afrikaans\UIStrings.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedBoundary.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Resources.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\SecurityManagerWrapper.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\SysAdminServicesPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonForms.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\DataTransferClient.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationTool.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\UnManagedDataServices.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDxLinqToSQL.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Spanish\UIStrings.xml	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonForms.WpfInterop.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\siemens.healthineers.ui.fonts.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CommonDataTypes.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.DataContracts.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.CommonModel.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationToolConfig.xml	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedAuditLogging.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\ADTCacheAPI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CommonDataTypes.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonServices.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationTool.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\LogUtilities.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.XMLInterfaces.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\EncryptionUtil.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.DataContracts.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonFormsWpf.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.XMLInterfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedDataServices.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.CommonModel.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Swedish\UIStrings.xml	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\KinetDx.ManagedDBAC.DataContracts.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.Utilities.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDxAppNotifierConfig.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\SysAdminServicesPlugin.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Resources.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\PluginCommon.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\Xceed.Grid.v4.2.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\KinetDx.ManagedDBAC.DataContracts.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationToolConfig.xml	MsiExec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonForms.WpfInterop.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Swedish\UIStrings.xml	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.DataContracts.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\EncryptionUtil.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\base.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\sDxLinqToSQL.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.DataContracts.dll	msiexec.exe
File created	C:\Program Files (x86)\syngoDynamics\HL7Tool\LogUtilities.dll	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF4DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{A44110BC-68F4-4EFE-89BA-328CF8DDE2B8}\icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEDB38FB63B05EED4.TMP	msiexec.exe
File created	C:\Windows\Installer\e59e7e5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39A8E8DBD3319EC2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE8F.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e7e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDA3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBB8B43083F2536DD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e7e5.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A44110BC-68F4-4EFE-89BA-328CF8DDE2B8}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEEC2A881DE8E14FB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDB4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF4C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A44110BC-68F4-4EFE-89BA-328CF8DDE2B8}\icon.ico	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4288	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000508ea0cb0cbd3e300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801508ea0cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101508ea0cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3508ea0cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6508ea0cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CB01144A4F86EFE498AB23C88FDD2E8B\SetRegistryKeys = "\x06"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\ProductName = "syngo Dynamics HL7Tool (VA43B)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7876B7ED4C8F36D488CC5C28BE207422	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7876B7ED4C8F36D488CC5C28BE207422\CB01144A4F86EFE498AB23C88FDD2E8B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList\PackageName = "HL7Tool.Setup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\ProductIcon = "C:\\Windows\\Installer\\{A44110BC-68F4-4EFE-89BA-328CF8DDE2B8}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CB01144A4F86EFE498AB23C88FDD2E8B\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\Version = "671098446"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CB01144A4F86EFE498AB23C88FDD2E8B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\PackageCode = "BDECE0E767DD0E34688EDD8D123BA14E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CB01144A4F86EFE498AB23C88FDD2E8B\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5908	msiexec.exe
5908	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4288	msiexec.exe
Token: SeSecurityPrivilege	5908	msiexec.exe
Token: SeCreateTokenPrivilege	4288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4288	msiexec.exe
Token: SeLockMemoryPrivilege	4288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4288	msiexec.exe
Token: SeMachineAccountPrivilege	4288	msiexec.exe
Token: SeTcbPrivilege	4288	msiexec.exe
Token: SeSecurityPrivilege	4288	msiexec.exe
Token: SeTakeOwnershipPrivilege	4288	msiexec.exe
Token: SeLoadDriverPrivilege	4288	msiexec.exe
Token: SeSystemProfilePrivilege	4288	msiexec.exe
Token: SeSystemtimePrivilege	4288	msiexec.exe
Token: SeProfSingleProcessPrivilege	4288	msiexec.exe
Token: SeIncBasePriorityPrivilege	4288	msiexec.exe
Token: SeCreatePagefilePrivilege	4288	msiexec.exe
Token: SeCreatePermanentPrivilege	4288	msiexec.exe
Token: SeBackupPrivilege	4288	msiexec.exe
Token: SeRestorePrivilege	4288	msiexec.exe
Token: SeShutdownPrivilege	4288	msiexec.exe
Token: SeDebugPrivilege	4288	msiexec.exe
Token: SeAuditPrivilege	4288	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4288	msiexec.exe
Token: SeChangeNotifyPrivilege	4288	msiexec.exe
Token: SeRemoteShutdownPrivilege	4288	msiexec.exe
Token: SeUndockPrivilege	4288	msiexec.exe
Token: SeSyncAgentPrivilege	4288	msiexec.exe
Token: SeEnableDelegationPrivilege	4288	msiexec.exe
Token: SeManageVolumePrivilege	4288	msiexec.exe
Token: SeImpersonatePrivilege	4288	msiexec.exe
Token: SeCreateGlobalPrivilege	4288	msiexec.exe
Token: SeCreateTokenPrivilege	4288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4288	msiexec.exe
Token: SeLockMemoryPrivilege	4288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4288	msiexec.exe
Token: SeMachineAccountPrivilege	4288	msiexec.exe
Token: SeTcbPrivilege	4288	msiexec.exe
Token: SeSecurityPrivilege	4288	msiexec.exe
Token: SeTakeOwnershipPrivilege	4288	msiexec.exe
Token: SeLoadDriverPrivilege	4288	msiexec.exe
Token: SeSystemProfilePrivilege	4288	msiexec.exe
Token: SeSystemtimePrivilege	4288	msiexec.exe
Token: SeProfSingleProcessPrivilege	4288	msiexec.exe
Token: SeIncBasePriorityPrivilege	4288	msiexec.exe
Token: SeCreatePagefilePrivilege	4288	msiexec.exe
Token: SeCreatePermanentPrivilege	4288	msiexec.exe
Token: SeBackupPrivilege	4288	msiexec.exe
Token: SeRestorePrivilege	4288	msiexec.exe
Token: SeShutdownPrivilege	4288	msiexec.exe
Token: SeDebugPrivilege	4288	msiexec.exe
Token: SeAuditPrivilege	4288	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4288	msiexec.exe
Token: SeChangeNotifyPrivilege	4288	msiexec.exe
Token: SeRemoteShutdownPrivilege	4288	msiexec.exe
Token: SeUndockPrivilege	4288	msiexec.exe
Token: SeSyncAgentPrivilege	4288	msiexec.exe
Token: SeEnableDelegationPrivilege	4288	msiexec.exe
Token: SeManageVolumePrivilege	4288	msiexec.exe
Token: SeImpersonatePrivilege	4288	msiexec.exe
Token: SeCreateGlobalPrivilege	4288	msiexec.exe
Token: SeCreateTokenPrivilege	4288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4288	msiexec.exe
Token: SeLockMemoryPrivilege	4288	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4288	msiexec.exe
4288	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4288	msiexec.exe
5908	msiexec.exe
3952	MsiExec.exe
2132	MsiExec.exe
4264	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 3952	5908	msiexec.exe	90
PID 5908 wrote to memory of 4700	5908	msiexec.exe	96
PID 5908 wrote to memory of 2132	5908	msiexec.exe	98
PID 5908 wrote to memory of 4264	5908	msiexec.exe	99
PID 5908 wrote to memory of 2484	5908	msiexec.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\HL7Tool.Setup.msi
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E94617D8463BF064E61209275B7E377D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E191C5F8D533177EFE41D376B27DFD5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3692234AF6B4CA7819E510A45339BBCB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe" /c "del AuthenticationUtilities.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e7e6.rbs

Path C:\Config.Msi\e59e7e6.rbs
Size 14KB
SHA256 e32b469c79ff81cd2b637413abfe25aab981997eb53e274e1b99e9712481f428
MD5 ba7d7b7a4b2f7ec3bb9207a5504606f4
SHA1 a7e73bf512e82b70c60e773c7bdd86eb0d04e403
SHA512 b4442e25ff515e6d9713daa80fcbf96832882a1cc071b706fff2ea09a27de4ffdab6a6991e3dda943eb0d0ef79a27433449683276e93afb07439deaab50b3e25
SSDEEP 192:l5ThDDi4SRBKEB4EMmCAexNd7IRxNd706gOlg/oe/IhB6pDl:l5tDDbEB4EM1JyJzlg/Sha
TLSH
T150624201790182E3F9465E3377D3392D6741DD986740011BA6CD8E6E0FC7E9AB77A2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADTCacheAPI.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\ADTCacheAPI.dll
Size 263KB
SHA256 c3bc16b8aaa9654d17e007f7e24641b946d2f38733b538ad151d0b4a7a852c65
MD5 613b8955c5cf3ebbced150c7dc42231a
SHA1 9b79596d193b8371cfbc8e15bd58ea7f996b521e
SHA512 e922deb65fa1ddb3de1a9b376c2df2b1334312c26b233facf60f1df6f3a6880bd53aafdee9e8960cd6e54fa39aff5c324a946dabf77c90a3b28b5e4852e094fe
SSDEEP 3072:ScB5r5tAZiDYSmVTBM+BX299oU80uqVKHIlqbnL5TYfkJQd6iWXjDjjzKjDjjzo5:r5tAZiDYSmVTi97zVKfbnHB+OiTx6
TLSH
T1CF44961177FDAA08F2BB5A36EB74801446BB3E461A76D29C0CD239DE0B71B514B23763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADTConfiguration.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\ADTConfiguration.dll
Size 34KB
SHA256 f5c84759c4e5876f94711c6ecf6234fd1977a714cf909626d817482b6d8db212
MD5 75ffb1b45ad475a3dc65f36db25ca561
SHA1 4946a37bd7de9158f5814024aae2d3bfbecddd42
SHA512 3b72d0b82bd3ff86bc9bb2a9e8cd7f10b1a927adb72254160506918d7cd81616deb8279085e7b1c5f27c8f62dc8793888e5cdab890020ce1e458ea26d1e2c9bd
SSDEEP 384:pd6jLw/hd/9d1HcsfXdaedSGvpO5UpiAK5jZ3Y/lhsWuFRtVAvutMyLy8RbmL4nL:pAjLw/hz14kjv/LsT/KuCyL5ALmt
TLSH
T15DF20A2293F4451AF6FF2F74ACF588100BB2FE97ADB6D1AD1988504E1726B805F90736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AuthenticationUtilities.exe

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\AuthenticationUtilities.exe
Size 8KB
SHA256 b091ddce54fe7a3b5bcb596b4021958610055066a79de68111c99d64e29f0592
MD5 ecce2fb68800f1577a1420415b060ba0
SHA1 a9a9af8f234540e53465ac5087acbe1078e886bd
SHA512 ec0769087804783a15aa7bfd00dfe95f9cbf5f63a5a3346f2ace208e7652ec6dd614f89e5cc11d986062aba628a27499ba90bc38f4f8c7b79698c6c4489aa330
SSDEEP 96:llS9fU1sZNi1PbInSYS9PqL2LLawWUj+bSAtreZsFrf4Me//XzG03oozNt:2bTnX72LLoE+xmerAMedj
TLSH
T138F1B712E3E84727F6FA5B36AC7B55504B73F7054C26DB2D68C4650E2D32B448A63B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BaseNet.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\BaseNet.dll
Size 21KB
SHA256 f7941ccf450a8aea1d904c388caa3700e76c0e1956c49678f68aedb5b2c472dc
MD5 017f59df6e9ba412fa6859fcfae8143b
SHA1 64688e3a7e5a02b286d7818549d643c6cdac517f
SHA512 16d0f0b81cffd51307377ea10738c865a60b724f7bdcb5c925ce014110be2defd60bcdeb1f69d671a86cca25b7934f89c73b20d192011fa6bfb056e5ea0a89c9
SSDEEP 384:9qvBENgSzlI7UXso3IfkhsWuFRtVAvupCOMy8RbmL4nNyz7I:9L3Ay3IfMsT/KuQOM5ALi
TLSH
T10AA27E2BDBE44D02EEAF0F74F8D4561659B1F6829CD2C1DB248CC1092F913851FD67A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.CommonForms.WpfInterop.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonForms.WpfInterop.dll
Size 21KB
SHA256 7cd42d007c0561069c524ef601d3bbdf9f011bad7ca893241baf4aa4ede8f6b1
MD5 0c475cf6b2b304b38d19b0d668ea53ba
SHA1 8b25b89d87af12bb885eec34093d6e9e678640bd
SHA512 2bd7dac3e4ba689f4031246743ef13417da7ba84c541a539e6ecf90327b7f7dfa31f8116830f68498972ecd9c22d5e6cd577640018ee814afdb17f0737450a1f
SSDEEP 384:xjE01NQSqz4ofh+Nn33/HhsWuFRtVAvyk4Py8RbmL4nNyyV2St:tEw2dS/BsT/KyDP5ALst
TLSH
T1BEA27E26CBBC8D23ED9A4F7478D217175AB0F2825DD282D72884C1995F513921FD43FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.CommonForms.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonForms.dll
Size 435KB
SHA256 d5f3f60ac3b20010e5a891a6ffde71fa333f6e6164a6a992280e048e477d551a
MD5 302dddbb41c63657877dfbc3cb352f69
SHA1 deb433ba6e28dc9f1bb25142c97f3988de1983c2
SHA512 6d6a9caa47fe0f9f77312b26ac223a518322fc65dc0ab773430d308a7112c45acb5ba8c4d7ac8b76377d1ba7c1cc59835d9eb5027ffd54d90a9404786bc9d4bf
SSDEEP 12288:FHQcmjX7x45fi3VKeATA8nNO+lsRF8Vl3yxF:vWATA8nNO+lsRF8Vl3m
TLSH
T1EB9417103768CA17C67F46BAE5A400E183F5AE42E5EEFBDB9C8579ED38F2B544201253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.CommonFormsWpf.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonFormsWpf.dll
Size 165KB
SHA256 2c7cf1967d0b47734e40527c68e056cac2b686d83f65a82d0c6f6603480bbf7d
MD5 a89ebfd72b20acafd9a17f318a5b549f
SHA1 59d5edb7fab7e226346879cf063136c270be4df5
SHA512 c4ee2a1543dd1ff3ef4d52e2fcbf40b0c6d94de7903ddd01f38dfd611b629c10576d3e4f07e38b150a1c51f539881241645c7adde3869a20f8a51856182f98f9
SSDEEP 3072:4PvMYq6l9UFPhDiIY08Xej+rzIGu4lSmcQ5SdSSS77EaaSgTxd:SttlmDivFrzIGr1F5SdSSSHEaarTxd
TLSH
T1D6F3C094FB9C825DD39F4B35ACF51232AA713FCB9E52C64E60C8B20F597238146417AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.CommonServices.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonServices.dll
Size 239KB
SHA256 13b205d3ce95edd590e85f4d06191bcf8c790070795bdf7e761b2de616e63b49
MD5 49114b215b7837bb4a9d0c04a0ddf08c
SHA1 54d0d04553ee0efc43b9ca509725f0140c4bdf4a
SHA512 ba6ca53ec845999c5f91614ed48e17095b9176953b7a7e0568cab2da1b7203e82bf9016d69f644f3cc0aae1a6176da15a40109aeae91ef5c9326e93758501f20
SSDEEP 6144:duuXkOu553RALF9wu8MktUcNWvqP6NqTyRwHAlSjVTt8:dfkV55G/wu8MktUcNWvqP6NqTyRwHAlV
TLSH
T12834F88037F49A46D6FF17BB78390004873BF583ABB1D68A7A10A49E5563B545F333A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.CommonUtilities.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.CommonUtilities.dll
Size 387KB
SHA256 a01e097971444a4d95055b6ca9480dd6b1d18f440f38fab2f8f0b74ead6908ee
MD5 c9f8ec5ec02bbd9237ca01fe8b7d848e
SHA1 e831cc384ab8062d6738b5aca92770dafe74ba72
SHA512 7282e42a01f78b68a61e17d2f9897acaeaba64370bbbc3b1c28d824ebd45483c7c2c6afdf6edae58ca9c03d8eb5ae998768d127406a9e6300b6ecab37dc315d2
SSDEEP 6144:+BIZXGU9Sw8Za5UXVxKX0GLCuG3MIQr2aAy7drXlqLNkGTt8:+EcVuVjJ7lit8
TLSH
T1B684391853F881AFF1FF1E3BB43101695EB1E443AD6DEB6B25A4946E0EA33459C017A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.DataContracts.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.DataContracts.dll
Size 431KB
SHA256 eb0d61880873272e437241dd91520463a8f8493cb7be5216049323e03f25836c
MD5 dac41d59253dba4be252d0672c0231a6
SHA1 201fa737138c5ef83fbd8ffd3f1555fb747e33bd
SHA512 9d3f300304e1a2b494f0b765a2bd5811fe60525fbde2f077e044a683726d01521ee1a59fcff159dd434a77deed39cff08906d5fb88a225adea7982c928ac1d2c
SSDEEP 6144:jYQr3a7U9EERTKtdb1TIvtU1IiZfUTX7tKtxDxhWJF/zm2lTxyj:h3lVMtdhrIpX74nhOF/zmgxy
TLSH
T1B9940A316318CA6EDACE4531E08C06F756F0D31D397AEB97DB0AA9DA3D4378668071B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.Resources.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Resources.dll
Size 1.8MB
SHA256 4878ceb064dcc78dbc85e944d5bcef1e2d96b141295b32621162ed3e0f73f231
MD5 7ff93452fe8f3097b85450566a5645d0
SHA1 4574e2a662670b7681cfb9ea2e5c32bf2aac34d6
SHA512 3145e89633c65475a7b7dbe4b311e0e18da3562c7f3ac4f60741adfe246c35413332a20090a10876d8dd0c30d0633e6db149e30c271b019610b812eb09926630
SSDEEP 12288:bo+kbQDTSFdHDZxg9EhbgzbgPpmsU7ix7:bo+hTSFdHtTbmbgPpmssU
TLSH
T13D95211A20DC6B019A39233372238DD9DF99C2DB02A16458F79E17179F319B50DBB39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.Services.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Services.dll
Size 243KB
SHA256 bfe345843a0502967ae91f3faae6434403edcc146c5abb515328e4ea1bada7d1
MD5 330bd9c8a8fc0cec3320e6fb1729280d
SHA1 0964f66a7cc41784990ff6037764291bd95067de
SHA512 00340ef446ace5cc45a82cebd457adc982de5c891c54ae4cb4bbf48d80adf177d30e844f9f168a38b6bc9c46a5c8b77e19f52d74c90fa11dcac21856090b86d3
SSDEEP 1536:cDK+Dn9GqRyBm4WA+UMXE7Tzxl0zn48u2TTxmuq:cDK+sqj4WzUMXE7TsrZTTxmD
TLSH
T1F634D50C62985DA6D7EE0D74587701FE8E31BD42D51DD309687CF12D2AB2FC0362AAE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.Utilities.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.Utilities.dll
Size 51KB
SHA256 5a0077b568f2582f9bb08ea842f2dcec375d16d97ac3691bb8fb2d0852d5cfb0
MD5 b8de5753d83d6c369e107f47a49d7159
SHA1 4f76ca8123eb46da9301fef9b2ee3ff8ccceca77
SHA512 1fd32911d96dbfc05eae85c85fcc69fc9c48517b55bf3df7f3f9f9f6dc2fee14ab48c3898b4dddfd9bb666a5f53405083bea9a8f052ad909fa23c4b6791b758e
SSDEEP 768:HpwoocPTbwXhl+F4VHi/2LterwvLVNxgsT/KuQ715ALv53/:Hpwo3PnKhl+hqDvLJHTxQ7y/
TLSH
T12D337D165BDC4917DAFE4F74F8F0850042B6F6935872DB9E1D98808D1AA37904E60BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRC.XMLInterfaces.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CRC.XMLInterfaces.dll
Size 695KB
SHA256 72b2295b03484caf48b10fe445082d297d207da37c0cc76f72e1621d67deebed
MD5 985d8e5b6357ec2c8f9c39e59ed42adb
SHA1 2a4662bf284d83458b51440815633875144f8ea0
SHA512 4b03280911d13dafa7d3997b7d495537f0bd3a19a4cf60d4d3a5b33047eebd1998ba94234920b5cc66f3ff4f3d2aad75b89c1bb30b723b0fcbdf54ca924a9e1f
SSDEEP 12288:s8Gh+bu7tsBADzuEEz4+vFX8JJ6VvUCVsmJnmtSzeKPepfwu8fTdAFyCbQMgEZ7R:VGhGwtaAD6EEz4+vFX8JL+smJnmtSzex
TLSH
T1CCE4B628032C8296E67D6BB6B050156767F5C2133B07EB2ABD4499AF0F8F3075DF2196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonDataTypes.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\CommonDataTypes.dll
Size 21KB
SHA256 04a0d1217b13d130b55210e524a37927d6fa03c7449a1fffab324e8ab720ffe2
MD5 bfb779d916fcf76435a0816cb9e5c578
SHA1 ba0b48bf8223433b0576a5d5bb14bca08ce0ce64
SHA512 38df2a6f3674dd7376a3946d33afedd81bafb208365d7cf2597203c05d82658d029bd897a6145dd332f8f973907142c872620948d695f57a0a861a8474ac3115
SSDEEP 384:TJBa6fjbOC9AxJZjIbQLqL2FhsWuFRtVAvu7YYgy8RbmL4nNyfE:91JgP8bQo2rsT/Ku0Yg5AL6
TLSH
T13BA27D6B8EA85E3BCE9B4F74FCD1A9060AB0FB441DF2D6CA9048D00B1D513851AB975E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataServiceClientConfig.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\DataServiceClientConfig.xml
Size 7KB
SHA256 4fea9ba44fef78a6e018106639d2653bbf6cfb8b6d2e93dec67cf644b43cc6a9
MD5 2f3cce6d1acdd2111ae61b758aa4b878
SHA1 d33e1d7817fb4742f75e1441936de58db8d3526f
SHA512 7d6037e6a5a1cbb5ebc83f7050d4cbb43901441e9d5c6c2f4531fd19505751d922ba7ea400b1af6d4142f06187c30a521a3eba3f8fafef3434dadf5989849bb3
SSDEEP 96:B0I3+WTeqf84mdYBQjt+pMw2ueIZ3J5vK7vkPvqNNvqTzvihvMKRIUgQi9Q8RgUf:RIXtxw2bIdJ5QoCrCnSxSJIg1io1iiEI
TLSH
T173F1FEA9F8C15D9301B179E2ADA36A8DE55681B3054D30C4F6CECA072BF8DDE785720A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataTransferClient.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\DataTransferClient.dll
Size 92KB
SHA256 42f0e32196d4f7833c1b14c6bc0b741faa1b9d884e69dd18c7e0e52d19d32b1e
MD5 b5024d17c752ef4c1a527f93ed60eacd
SHA1 8ab820e10505e87c7c53690dfcc519b0f520d2af
SHA512 c2842153b580d4eecb2645a64ba086c53dff4bbdb08a4ee8f04ff15e4c5c5a9070e313ce1926d8fb9fcaa45b247ec02d75f19a7f07e6aa53fb8de441bc447e1a
SSDEEP 1536:UOeCvr49LFDGk8GXRDDa8faTteNa6V1EqFD23919O5Tt1/:UOrvEPDX8GN1Gt6RFD2MTtJ
TLSH
T1A2934C843BDD0B9AD3DF0975FEA1000E1375D31468D6E705A98854AB68E3F4C7E623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EncryptionUtil.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\EncryptionUtil.dll
Size 20KB
SHA256 bc5a1790506970e3e52ab8fbc860cf1824a1d663d160e6e422268f445a93a3b9
MD5 f5e61748b1a8c06dca2fc46bfd33db27
SHA1 7925360b47469a2d5655b9742aa3f4beaeacf5ab
SHA512 0bb2c6fe4785aea61cc411aa53a728e051133d51915fdb4690049b6eefdd08564ff3863a13bf0fab5646edb0305e780821f11222203e735a0c7460c3e20cc248
SSDEEP 384:ZkDuIl+at+uR5S82hsWuFRtVAvyhFn+y8RbmL4nNyMAzL2:+uk+S5SbsT/Kyf+5ALaWL2
TLSH
T13A928F6ACF984D03ED5B8FB8F8F4D9069EB0B6868DF3C6972840C0591E4239519D9B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HL7ReconciliationTool.exe

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationTool.exe
Size 1.2MB
SHA256 697008c9bcb592b695eea1fd7a3066876056b383cf01b4768861fc3de33ddbb6
MD5 fbb2dc370ffcf55b601a74be3373bf7c
SHA1 b27131c7d2cb8ed1ac494c9a10c826be6938ce68
SHA512 262ebe857a855c7af9a6f4f8eb86ee8073b19a84c9ae05946ef1bab95f415d608ab9e02ebfd9a77fb2c7c4732da49aeabae223066e97d58ad134571bcbc9b391
SSDEEP 768:KWpuoDzt05O/NdhWUv6/pMwLq3/VF2t/iLGH+t/iLGHSZqsT/Ky85ALG:KYPWO/N7WUv6sFa/Di/Dg5Tt+
TLSH
T14E552531E716AD03DB9F1AF3E74558A613E16C092864F1B88074725ACEB0E7E1D4B637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HL7ReconciliationTool.exe.config

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationTool.exe.config
Size 1KB
SHA256 03f0e7b50a753e40bd1f51eab5871b3da3a25ae8ee2cfe5d21afda39f43d9c19
MD5 5a924fd891c6808284e284b3d93737ae
SHA1 e16e018480f91d213703f7e43309157a4817815e
SHA512 209d2092b452f5b0dc830d82998945f636cede21708cf29e11a7dc2d1217ec1b7704caa924fcc1dfa3624b4bbdc36956603adb92f0839824797e6fb2a848237c
TLSH
T1E12138F450C15DD286F772D2DB13848ACB2350F2024E6488F1AE96171BB1C1AB397281
MD5 SHA1 SHA512 TLSH

Submit Download

HL7ReconciliationToolConfig.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\HL7ReconciliationToolConfig.xml
Size 11KB
SHA256 3f6a6fd9369b7e15b179a8fd762c5fab2cfb68973863acc4f9fc44051d29394e
MD5 3fff52fd6a269809dfe1a89734cde4b9
SHA1 130f8aeb695ae519efac1deda09e01360cd1cf10
SHA512 f728b064db489e1323cec1eaffe55d431759c50c8b5ddbe498315fe1029f002e578ee45d7525ecaeca7cc8987f9f1d92d22b48e5192c0d7f4d6886456b5395be
SSDEEP 96:u2b0yDRneMKLxdkDuXtcdYTAc+eD4VIB2Q8Dx7xGC7kZDlFmYNpV:fb0ARnyxdhyK+Sp2Dx70
TLSH
T1B632CC44189A3E2192C6F67CEEF3BC590DA085B549780AB4D5AFB73F008E644A60DEF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KinetDx.Dialogs.HL7Reconciliation.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\KinetDx.Dialogs.HL7Reconciliation.dll
Size 923KB
SHA256 27c584b23c9b3f585698f408128b742eaab83647f00cd33d53f1d0298f2a4fbf
MD5 f724653c289c5e0b4810244daac7dc37
SHA1 6b4115c5622e660e5587c37f99dce0ac2e440b7c
SHA512 10c989dd6322d63d5acb8fe170d4d46f237bc20bbc5455988055f51d2b7b3094cbd3279ab085fe3669c337daa476d6b43e483c8f3806e1ea625cec50dbca5eab
SSDEEP 6144:xRjf1rNJdlzIDsl47to18lQkAMPk4gopc5xz/wdG8lZrWXlXsLM9W9b4L3QDjBNE:xR/94hnuKAVSxYX3Q3z+b6YxH
TLSH
T14115C541F398BD4BC16E8BF7EB61040543F5DC12659EF74A2AA1B0EE1EB27016D122B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KinetDx.ManagedDBAC.DataContracts.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\KinetDx.ManagedDBAC.DataContracts.dll
Size 31KB
SHA256 fe7c3e68f6c87f330bc7e80674a7f4e8376bd2a262e8a0dbf6718f0d88fb32a9
MD5 989fac7690abb4f4ab44d0ade076ceea
SHA1 51e7912f2c39962a0b7acdc105b881eb1ebea72f
SHA512 e0bd5e9c43588c628bea94975eaca683063c9d3b5dffc7d993cae59478d3874b0bfe4856d05dbeb1831c043275c9cbf8e6cbca740afdf285873c2381087c222c
SSDEEP 768:lKNdxVzJZr7kDTWHc80sojsT/Kuj05ALzkf:QNdKATxji
TLSH
T1A3E26C25DF8C865BCB5F4BBDFCD057114779E0AAA983E36F75AC80081A877D1528428E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Afrikaans\UIStrings.xml
Size 1.8MB
SHA256 33cba625ec44525bfdfe1c731f8cc02c062fcddfab23f9161b47770186a106a6
MD5 da10ee00f25c0a3573a988b0c03f6cb1
SHA1 0556b19ba61fc363eeee1fa736e28c20c785b70d
SHA512 f234a341ddc5d3eebffc749412a7558242b290b0c7c2dbfc53c7bebfcc62e4f06aabef2b9f178ab66ae13c049c8aa3210d6c355a401d9de77783e743a2d97f37
SSDEEP 24576:1R0ZtCCjOlUSD3O7b54PcVOKSLH8iUN9Q8Z9m9NKlQBxLX:WCcW9Wa
TLSH
T17A95FC5E78C8BB1104350A20E6170D86EFD987EF8251A5ECF5AF125BAF34976863372C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Danish\UIStrings.xml
Size 1.6MB
SHA256 f37017df1e148d7be674977ca615b2528dd343301358f28a5d4c093840e96adc
MD5 9a1b1f702277941a8cff6314b45832a2
SHA1 e576db22b7d94364e16ebdd10c9c61f9b1c13512
SHA512 a34b94d2ec3b31d547e2f66799c483f4bf4360d5224b53d25c56c991fd51086754e3fbfcd7ecbcc58efb3568b77ee208a870b94e9694c12b3d52ebb062b16c7c
SSDEEP 6144:0Tjj9t7mz+ZVCsypcZafpn4ttXRS0a851Rl01sdEfoFla7yeqcoIRk4mSqzlmh1d:A9tKwCtcEfkysG2Y9z1OIeth546u
TLSH
T1E175DB6E74CC7E5258340A31A2071E82DFD947EF8216A4ECB6AF125B9F34D62463772C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\English\UIStrings.xml
Size 895KB
SHA256 d877ddd026c34025e2219bc8c1fb3b03ccb1fb1de14f14381074462c008e181f
MD5 8af3bb2abb7eefc01d8dd2ac3a67e52c
SHA1 079045ee8fce9fabf2a6739267ff9014777259b5
SHA512 9595a3d245c23a915ff532ffcd1977cf62ee5580458ffd1d137147830c7b27879f15651fd281871e1e238a5786061748de36103e5e8d9854405b358a29d5545e
SSDEEP 6144:E4WzONzcq9I222ProIf3mOTmQNQzk8XRumE8INfwPJt6Yd6HUjV:bNzcqDt3mOTmQYJhJ
TLSH
T1AB15DA2E74C87E5114341621A2031ED6EFD987EF8262A4EDB9AF1267AF34D72417372C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\French\UIStrings.xml
Size 1.6MB
SHA256 dbbc75fdea2f571931ee816a5c85dd088099244aa7af12f51022811915a05975
MD5 1b050413988d1361cb73440542012c61
SHA1 5ad154d56c32c774a9926254b1c159a2d3b2e14d
SHA512 75bd337e3abd128c8d69933aa3ad48c89d625ba0f479fe04f09b612508cd2a55eaee589ae14a303a451553f198aef23670f63e05c9ac6dd5bc306182c592d1d3
SSDEEP 12288:rZQzxPuwkHUogn6Ctv5J9CCaMGmLsCVV2ss3OUOVR6FYlGNcq33bV5oxXVArUeRe:mVLJYC91V1XVIUM14H
TLSH
T1C185EC6E74CC7E5258351631A2071E82DFD947EF8216A4ECB6AF125BAF34DA2413372C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\German\UIStrings.xml
Size 1.6MB
SHA256 72be2c4a6ce00622703d41e0017a152de0f77e6caabd2629c8275b1b881f097e
MD5 3196d84908a454fecce3fa2da2336f6c
SHA1 ff94f9a96cf70c831e6e293e5186d259f406cd93
SHA512 612dcce877076937d23c32526eba0245f4601ad2df7988fd2956cf58863ee5b1d3df1b512a983743caedba6574ba15ba73295f848b4bf152524f4f925fcbc05e
SSDEEP 12288:LAD4zkZvajVMvmzVWK6ILz755waXJChY9n4tw50S+:qZijivmZWK6Id5waXJChY93+
TLSH
T14B85EB2E74CCBE5258351A30A2061EC2EFD943EF825664ECB69F126B9F34D62453772C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Spanish\UIStrings.xml
Size 1.6MB
SHA256 a0aefcdfa61fda03263e735ef31207c8aa651a5caf4fc076b57b02857391d658
MD5 037a06b8630316946af34aa0e33fb197
SHA1 0140cd3b62587209fe30f9966b2d6c682cb4da41
SHA512 6ad41f311254a572774013f7a9618bcdcba786a01cd19d5e9ea962e2f4728d6c00ec13555458ef4b2e69c8fd02060e8bb7d9f1e326069bc11f23dcf2e2b1a7d0
SSDEEP 6144:2T9Iin4jvh2Y8X9CNqM1HQ+XRuKMgYcZ1JGYRrenjcouHgSIoeqModyGPUHlA0hL:5i4+9CNJ4FNlAzMA5/O08
TLSH
T11185FB2E74CC7F5258351620A2071E92EFD847EF8216A4ECB6AF125BAF34D62453772C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIStrings.xml

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Languages\Swedish\UIStrings.xml
Size 1.6MB
SHA256 2c7688a18a9f945f7c9c12d946b922a3422b74caea9b79b5d884fee04bcd8c1b
MD5 8557319818dea75ef9f5932a7a1c8a34
SHA1 e85f96a5a11342236d9a626dbec7adbbcf6b55af
SHA512 18b9a4fa593cbdf156990c71a394c81db5cc0916eae19a3d476ff37c6a40f3dd961007a52291aadf3e4b67d510a875695b6bdf73d988d15424f0120826c00776
SSDEEP 6144:Hg+7D+xTAEkl4Waq0s5YIu4EpXRvpX8I1v8YeI0BwPIW6eqcoHtvA11l2USZHplr:bDq8r4E0s5ge5XvZHH6oZ5WHG
TLSH
T11E75FD6E74CCBE5258340630A2071E82DFD947EF8256A4ECB6AF126B9F34D62453772C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogUtilities.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\LogUtilities.dll
Size 57KB
SHA256 f05605880da2accc6d3f8ab4f3a1e79265f6ea91faad9062d1e2600148c4f6a2
MD5 21f4238410256f5dac00f91dbfbd0353
SHA1 29dc2d996594672706872dbad6c3d719cf905254
SHA512 eca8f8f42d02e36a9ffba3aff0752824b7f69d5c374809fd01cae86c0867fe03ea06cc8e68c25bb588a21db7e754fa1499938b8f8a16e4e3796da055b4f5c804
SSDEEP 768:Db78rvAVtnOGfDeQhwqUswWWZ/MHgBBQAXAsT/KuWJi5ALa:ArvQt2dswWG/MHgBBQAXnTxX
TLSH
T1DA436D72771985F1EA0F627038958B6F823978910FF150C3E799A3AB0D352E35A72A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ManagedAuditLogging.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedAuditLogging.dll
Size 65KB
SHA256 0cf344efdbf9bf5c811f705ac05bc8a5d231b82e95be32d0b7c59251cfe69a3a
MD5 94c18abc029dc47e903eb2e99687fd5a
SHA1 1c38eb0b03fccb30ce3f38efd86d5a86e9005b57
SHA512 e7d6c40bc0860956ced498dfef97040c87bf6cc7fbe82f9d17291b91cd489040be9903b628fe3dd09434a4ebb9e38dccfe46311e83de4a047c2b8e81c6f4eb6a
SSDEEP 1536:XQa8F5nWwem5O1ZipRHXkPQy0UqhqbMruJCTxiLQ:Aa8F5Im5O1ZyxMIruJCTxis
TLSH
T1A5634B4277E509F6FAEF4FB52C36D1040931BC856CE2DFAE6120520F09667909AA5FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ManagedBoundary.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedBoundary.dll
Size 46KB
SHA256 35d9d0bc11511ad6a26ddcc8ec3ebee8007a3e6a486a97173a9b769e091096a6
MD5 a93b5185e9502c2223d9c0d4da3d3c8c
SHA1 c3352c31d572d8d6c0f1d8c5d1788b4f3feff33c
SHA512 7a0425c8c779d3dad843d65222ad347f7e46b385d9ab960d146d51568270f148381760d2b527c7b143028b46ba051c2abb7127d3992069d0715afd5741551ef6
SSDEEP 768:Cn+7aPVL2tLuboFbI9Y84P9ahSlyQKXKf5qa8sT/Ky805ALR:CnR92BuMFbIvq9ahhiLTt8h
TLSH
T1D0239D45EBA54CBBEDCF47B27CB1E0554A349E921EE0E51BB122C34C09573C0B662BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ManagedDataServices.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\ManagedDataServices.dll
Size 42KB
SHA256 4777d951ddc5edfa459b1487d1a39097a16fef6d01698a48e8100ca716b7e105
MD5 184d8fa3a3ac977edce5dab5c3e82918
SHA1 cb5a817cca3d8088e1ecf049cbe96c6ce866c3b7
SHA512 807df0726a1fb4f453b7171e5d32c13dc3691c7ca746961288b766d8bf1124a5aa44de9ce67e9644bc823b41ecb2d3afdc2e615ba91940ea062d1d93fab38d9c
SSDEEP 768:zy/hHkKesnU7ZFC3W8I062TlsT/Ky95ALaQ:G/axsU7ZFCG8jjGTtbQ
TLSH
T148135CAE8EEC4A23C6EF4ABCE4ACE0810BB0B7B64946D35F5985F097012DB511F5135B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PluginCommon.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\PluginCommon.dll
Size 63KB
SHA256 6268690f09e520b7f2985bef39a69bcafdc08429543761ecfdab0c133ad89608
MD5 2f5b2dd274b333ddaffd53fdca06f390
SHA1 efd07399dae2de85c3a865c7cfac492ee849eec6
SHA512 81c6a6230273743e398f88caaeb27c3e2d7267b626739ad25c0208fa50f8f900cc078407a594176d2513d4dd60271c925ead3d4b47f6fa3a0263cc841edcd073
SSDEEP 1536:JpZs44YXp9ARLGYhADXH4UFsIYI+L0TtA:G4K4H4UFsIYf0TtA
TLSH
T15753291233EC5627D3FE8FF5A8B4154517B2766A68B1D2CE6C80B0EE49D2F004B60B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Prism.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Prism.dll
Size 36KB
SHA256 8ec671be24a9fa40e21330af117c42091589aa0e802b56b6c5e46036e85993e7
MD5 156efabf80ea798db9f77dc4b70be013
SHA1 766c145b4c1e1e75f475137f72e9fcc1bb9075c3
SHA512 214c77cae46f92f3e3847238915632a3b990273ef61562c20b4c2845ccf5d97ac2c1589841745b44a21f413a4dfefd2cdf9ca29de3d8172163a7d41a98f47331
SSDEEP 768:8ZAs7GeEwV3EIeL6hh49c37mYOoVcKxgSRYMfSpve5:8Cs7R8mEjoOKxgwYMfUe5
TLSH
T128F24C15A7ED4721E8DE4B79796A100003B9F852A903E74B5FDC70EA28637C08D51B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityManagerWrapper.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\SecurityManagerWrapper.dll
Size 52KB
SHA256 9fee6636dd41361b485bb040dde35091f29a4ca7f248de1624c862c3c34a9ec5
MD5 2dcfeedf07920b91e36559380ed82aaf
SHA1 044db653ddc857dc4733457092a5f54095849718
SHA512 30bbeeff3a19f2b43aa7c9942ba274939fd60b84b3e9d06439672ebff165c8d2885491df41341375effaa8edd70c9832546360cb294c5fb704fa40f805e73fd0
SSDEEP 768:RgFCbgwfyAoDtjSm2qUykK1zIlyQUSpj4hXH3sT/KyKm5ALd:+il8Woh1zVSB6XcTtM
TLSH
T1CE337D067F664DB3D9DE42732C70E0490A32E8825DF1A75BA7B1C25D0A933C4A6A17D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensisInterface.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\SensisInterface.dll
Size 279KB
SHA256 49369d1d8e3d0163891f373fba60f8c658c344e0f75c226b59b40644a01a56ce
MD5 e5bfb4a32d38192a0d88692959a09c42
SHA1 8dd45789c8cebeef6d078461a2df9918e744e704
SHA512 c672aa0fffbacdfb0f1aaecdb42ae64e2bd952313d080076b6e3cc0483393daa7244aab86405fc54a5c77a9985c6033c8231043221a3ab9e1e8eb3811f9a8379
SSDEEP 3072:MLl+9bs89JTsP2qIElZuvpBtObbKUnICGQyb8Zb+D/1rIuskiL08M/5SZGqaKctR:AV2qIqYpbqKdohiZgN8GkTtl
TLSH
T11754E961BAFD4F26F4BE0D7865700008B671B48BE671D25ABD4E614E0BB1B12D6B3723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerUtilities.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\ServerUtilities.dll
Size 116KB
SHA256 91f533e329de1f9400d16ea0ef30178408fede574561ed693db9edb9c13754dc
MD5 081c558b1c3644c0a9eaf621eb6d4f20
SHA1 f89450c069d4096bd2bdda19b8c92b671536556d
SHA512 2648a946f254e9a8a8ee713ec618c33b37bf64cb40715a61ae467c5cfe8354b40974a8322a1a610d81a98b9fc905b53ac0abd7d065747fe9c71ab6fea48aab7b
SSDEEP 3072:mn2KMi7i/Q19lDRF+z4QQrGr+eHI7gLKcsaoSqfThLFTtM:u2KMi7i/Q19lDRF+z4QAGSeo7gLKczqu
TLSH
T1A7C30759879C965CE3EA0EF2FC6408169B70F2403847DE491706D6DE2973F832A276B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Siemens.sD.Server.Security.Contracts.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Siemens.sD.Server.Security.Contracts.dll
Size 16KB
SHA256 a302c21e4d41d1d1be26076cbcee79ace5406e25a22d0b41855b4b52a07436d1
MD5 228dfde59bf120dede5edd8c4bd00360
SHA1 7bddd50461f357af82fdfb864b42613ff3ce511a
SHA512 c8c8c743332576906b2f27a55ec86bb7d50dc7a7456ee145e1e4bcb033f2aaf9f4d545d2e8c163523a40f0bca53c09d470799a7cd2dc8db23bf8955796fa1a35
SSDEEP 384:Ff6ixOShsWuFRtVAvy4Whdey8RbmL4nNypb:FTOmsT/KyjXe5ALX
TLSH
T1EE726D678BE84E13FE974FB0B8E05A135DB0FB824CD6C3DB1155C10A2A513521EF9769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Siemens.sD.Server.Security.Manager.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\Siemens.sD.Server.Security.Manager.dll
Size 48KB
SHA256 14ccb69aeae50ce0113c94c8bbb1fc437409991b6d4b9eb6c0617a80c74341f1
MD5 6c9a36041a73022a37f88beb39123b02
SHA1 cedc8cade29b8eb9fa42112ece0af9980be4fe94
SHA512 a7b53b626a89eb47775ee317813aeda986d3481b64e5adc397bcba766cc7e68bd65b01c0aea178288097b7d9eb32b02a7bb7594ef79a0a582cfb8deeaa761f1c
SSDEEP 768:l/KLoyyX+d23R/bnDvh8PGX+AzJaqAh1XSPfVuIcQKsT/KuxTZ5ALpT:x5yyOaJDvX1fVrZTxx2T
TLSH
T1A0234C41FBE84916F7FF0FBA68F6010406B1BA9A5CA3C34D1AC6909D15323C19E617BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\base.dll
Size 2.3MB
SHA256 68514b8df56ab6ef64d32c2e3e0cd1492ceab45ec8af7e7f41eb4d868bd80880
MD5 41b995aaa590479fe3efde50defbf9f4
SHA1 b559576259b2869de9344acaef7a3a72165df52f
SHA512 52bf89eb7fd966c6a2bec49d3c4ac64e77a38e29541bc7fd2c2aa90cc88d5e52da67241944011ff6b26e253faf68dcd7f0e946378709e358fab0a88290ea8dad
SSDEEP 49152:XRkGIrxmzhXc1bfOSlzIXI2XS3Jce0TjZuq:jNcVNzKI2i5u
TLSH
T1DEB5E670351EC677CA2F56B25A1E57CF823E1D920FB258C3C25CAA4F34B91E01B7646A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDx.Common.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.Common.dll
Size 115KB
SHA256 b035c3e285bb71abc0719f4ade0c4e76c0ad00f7f59780e648605486182e0df9
MD5 2262cd2c4887a045abea3570d4b96189
SHA1 f72c4ebf3ff77c6ae056e11088f05fb7d2ef7e31
SHA512 adf36b9336055ebe0e40cd22ed0805a9d17471c42a3d240821972a06d6b4b71f19c334501f572eb40350b3b35282b7786b38f2057c39f67b33033902f650bbf9
SSDEEP 3072:MP5z10fW/AInJvv/v8aCpX/bOfBO5WsB+ohX6TxL1:MEWompCpX/bOpqUhTx5
TLSH
T1EEB34B8BA7E20601F5EF8B706FFB020F09377895A895876DC114510F496BB949A7AF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDx.CommonModel.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.CommonModel.dll
Size 37KB
SHA256 196a8260584af5a94840eb8c338de1e9258127a46f10b1d3575b3e38c220dbd2
MD5 a3da48a5e0605d0433709cb548721100
SHA1 fd31e4b88b0956ed62cbb51e3ffa3c3c0ae00161
SHA512 523b9c4f8be305eef4d96907bc2c6248d771fb336c9df6abc03fa2d176b723c2dbdd11349e46c5f8ae480c25e7f930aecda633fa74954a3d833534852be14740
SSDEEP 768:srIb6vXE/qIkOksROtsoGuvQ0U8n9u+pFTYhmykUEdKsT/Kuwm5ALtVTZ:qUqIW9u+pNIeZTxSVV
TLSH
T193036BA3CB98C26ECECE0EB8FCA441194BB6D7867493D3E68A10EC5E3D4F7414548766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDx.DataContracts.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.DataContracts.dll
Size 136KB
SHA256 35f88470e8a8e5638b58bc856b7e86ed268b2285fc070bf30be44a907158d702
MD5 c5c967bd5146c3c112d4cf7c4999aeef
SHA1 e39e395ac3bfe0cc9658918d5bfdef9bba42fa78
SHA512 246bd07ef2c02b5d6e384b19a941978479ffb86110b30b4a20deaf37432c65beabc259ea241d4329de447c95e90f81c39d9e79557ebe30e3166e69f200aeba3e
SSDEEP 3072:KlrDLLelq14a7AF+R5/DxojPytVK3hzWmA6GnRMTt1:0DLLeo71ajMSWVWTt1
TLSH
T19FD3E8211378C36ED9BD1973F424462D42A1E28EB565EAFB8B00B8CF3746BC67145BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDx.Utilities.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\sDx.Utilities.dll
Size 117KB
SHA256 125d70b8b2a9c49500c934712b9df898e56ee5b1caa0b21a12a6aabfe1a31bf4
MD5 36da45b6477c81c17ea61e34aba1e19a
SHA1 8e866e732aede1bbe37939665cfdf376c542a079
SHA512 80bfd9eb4b0bb341600f80822a3a8052ca8eab29801c7cd78fbe5f1b0315d1d36ac1ba45061636988cbcf4ff0ffa3a3a4ce9253ccbe1f800216334aad0ccfdc2
SSDEEP 3072:MKgl4+elAEpTB7NcfFALcRchd1qHld1WhAo5vwV/grchTtZIU:w4+eAEdBedAPUTtZIU
TLSH
T14CC31904B3E88B15F1FF5BB5ADF591054A35FC93E8A2C35D1482519F0A62B829DA0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDxAppNotifierConfig.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\sDxAppNotifierConfig.dll
Size 32KB
SHA256 a3f90970951c9ce2c82e32bee458b539f9205f37973084f017cb628904af2f3c
MD5 cedd889680430960c1e3e39513a98453
SHA1 f5b9c6fdb365ed7f2ccbe2c4197ee4717c364b72
SHA512 257691f7ef63a2d46094877d6b51c18fb0316558973db1604943de8d8a4f8eb9960075747f45fbeeb96a8475c078ef6b21c509d36c90db3c4a406901c72e47c9
SSDEEP 768:GxH+DY9Lu59+87iK0Xjd7Nq6sT/Ky65ALB:+eDOq54eiK0TNNqpTtf
TLSH
T1ECE28C510F4CDF27C9894B79F8D151635BF0C7936552EBEA4FA8E09A0D13B8B1E202B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDxLinqToSQL.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\sDxLinqToSQL.dll
Size 402KB
SHA256 ffe69447b1d274b61f4128bf919c58acbdd3e10950647349ef117750a6074939
MD5 ee940a25acaea925b9f25ff8d9812b74
SHA1 cefd84795968fe6ae4d3932a8cf4f9fc0b71d56b
SHA512 f4fc6e62bd959494f8d64c9968af6e935bc0a9c328b70ceb433f9c78bf198da5a8d452372536559ebc1e7044c9bfe300fec76347250d18a4b87f56529d6161e7
SSDEEP 6144:e8M4FR8UHRzX0H9Hn4Na7nB9C8V7IyaDJeC3Qi4oNVGT6r/TxR:7FuKgWa7nB9Ca7tT6rbxR
TLSH
T16994D6542788826AF1BD9ABBF050041A8B75A3873D3EF72837D2959C0C9BF518D252F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

siemens.healthineers.ui.fonts.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\siemens.healthineers.ui.fonts.dll
Size 718KB
SHA256 8617f2e3cb5dd4c90afe7e7216eb003e36ebe32f4b03dc277332694846cdc7aa
MD5 bc62c0303bf443d70ad185ceb238af70
SHA1 d43ece023944e36e8398f74d5e706c2ac0f9ff95
SHA512 141410324c8e94cabcb25019815ef02527aa0d861f253515693240623aae9013ddb0f5697283a46afe39d7a538a09b4b724fdcff2febe729f5253ca7d104dc6f
SSDEEP 12288:FTP5lGmxJB5cXYkGFlwK/ABXsIXRLBJ5qQX:FTrGmxualwK/ABcIFBJd
TLSH
T194F4AF43E76BBB0EEA195F358161E30757F1F9215E56C7CAD91C3AACC8871E48D0A2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

siemens.healthineers.ui.wpf.dll

Path C:\Program Files (x86)\syngoDynamics\HL7Tool\siemens.healthineers.ui.wpf.dll
Size 1.3MB
SHA256 468c34ce9973ffd35d6d2a378764a1c6c350c9a7a476fffad494cd108c8df6c1
MD5 8480ab5dc4318cdb162889b6790181b9
SHA1 de84f50d5ec0be868b13e9b8ddcdd8240649abc1
SHA512 81b92ad79b86bfcce53fb65dee48b13b99b4f40e677ea23933023f5f16be57cf548940e62489aa760b96f78c3f0d82339abbb1835f4c9abc23354dc70981109c
SSDEEP 24576:TkV1Y+0asfLzAN1OTmRip/gUTisE1susc5Fx78IxEOVR/4U9j63lRYURURREVRfP:Tkiz0W/gUJE1snQi3lRYURURREVRrr
TLSH
T1B7557D9873314A7CC96B0BF440A85C8C6E34A6B917D6DE4811CE1E5E7DC0B87095BBAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI53C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI53C3.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59e7e5.msi

Path C:\Windows\Installer\e59e7e5.msi
Size 7.8MB
SHA256 8be27d4835e411b0521cb9617a12738b9491301d7a39ae71dcd5fcde6a13bd4a
MD5 0c644eb295c68836f9b49953f9e31158
SHA1 23991158a6441e234f5d744335656aee22c738bf
SHA512 c865eed4e2cdc8c9c0ae25462ebc6409b59977ecbbcf116d00c079a33547e1dd4468aeab4939f78cbabf8be35908278a09024f2e2b0df7ce641bc04e872b4829
SSDEEP 98304:3a8Q2iDXawfF7r7HJpdk10mf2X7tuvSQZtsLYXftPFYsCoxGXMc3Iv:q8vsawt/7y10mOX7tYts0xFYTowb
TLSH
T1A78612233F4EEC96E744AE72A2B14FA903506ED571D2887BE1123948E9F9CF064711DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3952-4-0x0000000074D25000-0x0000000074D26000-memory.dmp

Download

memory/5908-26-0x0000011A02650000-0x0000011A02FF4000-memory.dmp

Download