Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup_Power_BI_Helperv12.3.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup_Power_BI_Helperv12.3.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target Setup_Power_BI_Helperv12.3.msi
- Size 5.3MB
- Sample260727-w6bc4scf54
- SHA256 9cbc9c06e2399568712e7f2139508ee1ea22933ff468c33aa41de6513cc6149f
- MD5 5c1fb0e92511d099c661f122cbf9f657
- SHA1 7cd7229fc974ffb797c5a48f3009c3e15e12e79f
- SHA512 4d24ac80054e2548828ba5e06bc775bf55438860c3d5f15eed1f26425c7a395ed2fa37eedce8e978912289242789f513b97dbb7be5fa99748fac53dd3dbc93eb
- SSDEEP 98304:s8YicXMTpplsR9tG+R+HNModB2aZF3MaoBivM1KeisbLz:CiMMT2HtVQHNRBnF3LoYvaKpsH
- TLSH T10F46DE1D61918EB2CCAD07300D65F3B4DEB56F32F9904A17D2D23E1B3A79283662DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 11 IoCs
pid Process 4980 MsiExec.exe 4980 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe 2800 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4668 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Threading.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Net.Http.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Net.WebSockets.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Linq.Queryable.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.IsolatedStorage.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Collections.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.ComponentModel.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Threading.ThreadPool.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Dax.Model.Extractor.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Security.Cryptography.Encoding.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Diagnostics.Tracing.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Data_Layer.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.Compression.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Runtime.Handles.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Threading.Timer.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Microsoft.AnalysisServices.Tabular.Json.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.AppContext.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.FileSystem.Primitives.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.ServiceModel.Http.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Microsoft.AnalysisServices.Core.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.FileSystem.DriveInfo.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Net.NameResolution.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.FileSystem.Watcher.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Linq.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Net.Http.WebRequest.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Microsoft.Rest.ClientRuntime.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Text.Encoding.Extensions.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Reflection.Emit.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Globalization.Extensions.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Runtime.InteropServices.RuntimeInformation.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Globalization.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Threading.Tasks.Parallel.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Diagnostics.TextWriterTraceListener.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Power BI Helper Updater.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Collections.NonGeneric.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Runtime.Numerics.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Drawing.Primitives.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Runtime.Extensions.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Xml.XDocument.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Runtime.Serialization.Json.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Runtime.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Diagnostics.Tools.dll msiexec.exe File opened for modification C:\Program Files (x86)\RADACAD\Power BI Helper\System.Text.RegularExpressions.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Security.Claims.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\netstandard.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.ServiceModel.Duplex.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Reflection.Primitives.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\Microsoft.PowerBI.Api.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Xml.XmlDocument.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Security.Cryptography.Csp.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Linq.Parallel.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Reflection.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.ComponentModel.Primitives.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Security.Cryptography.X509Certificates.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Resources.Reader.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.ServiceModel.Primitives.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Net.NetworkInformation.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Xml.XPath.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.IO.Compression.FileSystem.dll msiexec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Security.Cryptography.Primitives.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Power BI Desktop\External Tools\PowerBIHelper.pbitool.json MsiExec.exe File created C:\Program Files (x86)\RADACAD\Power BI Helper\System.Diagnostics.StackTrace.dll msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF2225FE51F30926F0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF293955CEC7BB882E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4412DABC044F75E5.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIDE22.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE027.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7843840DAB10C19C.TMP msiexec.exe File created C:\Windows\Installer\e59d6af.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{66E9406D-0485-4BC9-91D1-5840EF90063E} msiexec.exe File opened for modification C:\Windows\Installer\MSIE9EC.tmp msiexec.exe File created C:\Windows\Installer\e59d6b3.msi msiexec.exe File opened for modification C:\Windows\Installer\e59d6af.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDBC0.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4668 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 6108 msiexec.exe 6108 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4668 msiexec.exe Token: SeIncreaseQuotaPrivilege 4668 msiexec.exe Token: SeSecurityPrivilege 6108 msiexec.exe Token: SeCreateTokenPrivilege 4668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4668 msiexec.exe Token: SeLockMemoryPrivilege 4668 msiexec.exe Token: SeIncreaseQuotaPrivilege 4668 msiexec.exe Token: SeMachineAccountPrivilege 4668 msiexec.exe Token: SeTcbPrivilege 4668 msiexec.exe Token: SeSecurityPrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeLoadDriverPrivilege 4668 msiexec.exe Token: SeSystemProfilePrivilege 4668 msiexec.exe Token: SeSystemtimePrivilege 4668 msiexec.exe Token: SeProfSingleProcessPrivilege 4668 msiexec.exe Token: SeIncBasePriorityPrivilege 4668 msiexec.exe Token: SeCreatePagefilePrivilege 4668 msiexec.exe Token: SeCreatePermanentPrivilege 4668 msiexec.exe Token: SeBackupPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeShutdownPrivilege 4668 msiexec.exe Token: SeDebugPrivilege 4668 msiexec.exe Token: SeAuditPrivilege 4668 msiexec.exe Token: SeSystemEnvironmentPrivilege 4668 msiexec.exe Token: SeChangeNotifyPrivilege 4668 msiexec.exe Token: SeRemoteShutdownPrivilege 4668 msiexec.exe Token: SeUndockPrivilege 4668 msiexec.exe Token: SeSyncAgentPrivilege 4668 msiexec.exe Token: SeEnableDelegationPrivilege 4668 msiexec.exe Token: SeManageVolumePrivilege 4668 msiexec.exe Token: SeImpersonatePrivilege 4668 msiexec.exe Token: SeCreateGlobalPrivilege 4668 msiexec.exe Token: SeCreateTokenPrivilege 4668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4668 msiexec.exe Token: SeLockMemoryPrivilege 4668 msiexec.exe Token: SeIncreaseQuotaPrivilege 4668 msiexec.exe Token: SeMachineAccountPrivilege 4668 msiexec.exe Token: SeTcbPrivilege 4668 msiexec.exe Token: SeSecurityPrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeLoadDriverPrivilege 4668 msiexec.exe Token: SeSystemProfilePrivilege 4668 msiexec.exe Token: SeSystemtimePrivilege 4668 msiexec.exe Token: SeProfSingleProcessPrivilege 4668 msiexec.exe Token: SeIncBasePriorityPrivilege 4668 msiexec.exe Token: SeCreatePagefilePrivilege 4668 msiexec.exe Token: SeCreatePermanentPrivilege 4668 msiexec.exe Token: SeBackupPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeShutdownPrivilege 4668 msiexec.exe Token: SeDebugPrivilege 4668 msiexec.exe Token: SeAuditPrivilege 4668 msiexec.exe Token: SeSystemEnvironmentPrivilege 4668 msiexec.exe Token: SeChangeNotifyPrivilege 4668 msiexec.exe Token: SeRemoteShutdownPrivilege 4668 msiexec.exe Token: SeUndockPrivilege 4668 msiexec.exe Token: SeSyncAgentPrivilege 4668 msiexec.exe Token: SeEnableDelegationPrivilege 4668 msiexec.exe Token: SeManageVolumePrivilege 4668 msiexec.exe Token: SeImpersonatePrivilege 4668 msiexec.exe Token: SeCreateGlobalPrivilege 4668 msiexec.exe Token: SeCreateTokenPrivilege 4668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4668 msiexec.exe Token: SeLockMemoryPrivilege 4668 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4668 msiexec.exe 4668 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4668 msiexec.exe 6108 msiexec.exe 4980 MsiExec.exe 2800 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 6108 wrote to memory of 4980 6108 msiexec.exe 90 PID 6108 wrote to memory of 2428 6108 msiexec.exe 96 PID 6108 wrote to memory of 2800 6108 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Power_BI_Helperv12.3.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4668
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8DC5FE65F96E729D11D1BCEDA437ABC6 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4980
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2428
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7A2B24AC5EFD1C3ACA982EE5CD303182⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59d6b0.rbs
- Size 84KB
- SHA256 e637ec427e24a16a795c9107d0fd8f2de93523b47d70a89926a9d92a308fb2b9
- MD5 c2efe9a6511aa0df1a0b0a17333696dc
- SHA1 a9cd93311ae449f5a0f166f8686deef71174b3a8
- SHA512 19777d08909245226500ebf6183bb707cf64ba9f02f16b1648c295d4db83feaecdd8f00cf1c62a7ab115925689d62e1ad426f64a0e83f6969bf334d5a9eb6ca4
- SSDEEP 768:OA8lWUTi/esT4G8+hrEaRwPRsk4+WtW9SDcJVwoSVrpyG0t1WgkfYTPPfXqIA8qN:78wt/rA66O0ZiulXYuml
- TLSH T19F8374337612D6D5E54526B26781EA863335C782E6C4273E72EAC54F8EC2E28376C1D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\RADACAD\Power BI Helper\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
- Size 1.0MB
- SHA256 1a697140605ce4f33bd7f31f9f1535be309d8c614db2a59ca3164e9c6ff1b3ed
- MD5 1243c9a157968653afa32077c6b39793
- SHA1 6363258ac098041179d939aa3df89326187c6707
- SHA512 e0f558008d50f02fa9e5dba79bad5a437e9c924611471fd43ae07f99deec1463ed4e6b7c36e4e07fe4e2502578a0bbaad357897c3df4b87909f3bba7c9421af0
- SSDEEP 12288:NtFnHPNKScTJHPjUa/M6gOAbBVpIrGdnop+eTiwfVBJjeRpC80ctPW:7D05Pq6g/FV0bp+e+OVBJjCc
- TLSH T169353A1277E8CF26E1AF3778A4705A1887B1F847AA7FEB4F2604959E1C577808D503A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\RADACAD\Power BI Helper\Microsoft.PowerBI.Api.dll
- Size 906KB
- SHA256 6a8fcfbe5a2d03a8ff0df704f5b5b81885643c6a55402f3e096c9d6bd7aee0fc
- MD5 7debd526499abebd4f6739a059597bb1
- SHA1 c61542afd68e1d1cc46d125ed03c80d714b5f094
- SHA512 a43cbbee13c3d6ca51b236983b1b5776201b8ddc1640c496ce4b6b0efa6d9164b1e5518c70a430004e9d9d90a064dbb9b9f43a517b12b3c856c1e83785445c1a
- SSDEEP 12288:uwBP85bTpEfR3Z43tnmf+h/Pwnlxkh2nhAzfBgcRRDw4en7I/:NDSmGh/Pwnlxkh2nhAzfBgcRRMJE/
- TLSH T1BE15288663B59A35D25F5678E2412555C3E3E303D5A2FB4E9F8CF8E41886308B8DF293
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\RADACAD\Power BI Helper\Power BI Helper Application.exe
- Size 1.7MB
- SHA256 2aead4e584b8d1c1fd0eb0fe8434f3b60c3af62cb36765d532282b9d963a61bd
- MD5 af3c1fe4abe2d44d3ed4e5423456451a
- SHA1 95fa1dd37e8eb88ae674d3053ba1ed922e2c23cc
- SHA512 843c6a14c2c0bcbf2739984e4f49f1b197e4db8430f2138f4af7ed44a87ee044e9949be632bd17b4349040ab111a69b3829da7a361793af775cb4c044bd97d5e
- SSDEEP 24576:TVNxHRlDNrJTSfXrNdrUx9XR000j9u3r:ZNxxlDNr0PrPruX10jI3r
- TLSH T14085501C22A4AD55DCBB57B05D60F3B0CEB26F33F518816A84C23DCB3265783A96D792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\RADACAD\Power BI Helper\System.Collections.dll
- Size 20KB
- SHA256 af67ff9881668e32d1557185c3996eccfd060ccb64faa6d0182f2c48d3e9535e
- MD5 85873e463222c96d59766be8a03ed43d
- SHA1 61e3a576f356e8ed0cc29c968d54a64a87d6d721
- SHA512 1404ed0dbd4edf1099935050b05517b171e0ae712a3dc0193bb9e38331b7bb65b6f5cbebe84a350b6b47eeb9701b6824891d25e4aa3ba1396de591a3929d694c
- SSDEEP 384:mSyokipgwCW8jeWmam0GftpBjEjeFpaQHRN7YlJnX7:fPuHFVi6KFpL8X7
- TLSH T17F924BD2CBBC8543ECD66EB067E5EA833C3CEBD70D205525149AF5991C833C1AB24A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\RADACAD\Power BI Helper\System.Text.RegularExpressions.dll
- Size 20KB
- SHA256 1f826d4a5a9b21a14053bf1664dd5ae0ced693c4686cd5f687245ae55250a15d
- MD5 c4704dc4545706bdce3eb0cca6fa9721
- SHA1 123c2c72ef88ada8573ed9013716b7c5bf83dd6c
- SHA512 260ebb6a2f13158613b6e01ca1b02cef62534984b3fff89da1e1b813d83511dc46adc5a2b09dfdf85d2746d2a73962ef1ae7367db48d602cbc14e9de4c436340
- SSDEEP 384:QKDsWizW9Qim0GftpBjEzhGW53aQHRN790FlkArsCzJ:QKDcefVize3LCt
- TLSH T17D923A91CBBC5243EDD29D7066E4D9937D3DE7C35C20862B1099F2991C833D5EB24A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CFGDDF2.tmp
- Size 150B
- SHA256 f5ba88b4a9928b710c9dbf757f0c4dee5bc6b6a56985d5bfeba8620c8ae65b6c
- MD5 84f2f872035a2b2007494208ac3b98c4
- SHA1 385b4bf0d62025d669935f690b9b64345de41273
- SHA512 d1f141da4761d82feb78563ddbaef0c7b422cc4d80db23a9895b71ec525ffdb907351d9ecfd263ee1004dcf919ef66e287a254117e24eab6da2ae539779db2e6
- TLSH T1A3C02B19402C7D37EC130F5391138D52FFF003616034000CE01FF727021001D5316306
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI35EB.tmp
- Size 298KB
- SHA256 9f3b0f3af4bfa061736935bab1d50ed2581358ddc9a9c0db22564aced1a1807c
- MD5 9945f10135a4c7214fa5605c21e5de9b
- SHA1 3826fb627c67efd574a30448ea7f1e560b949c87
- SHA512 f385e078ceeb54fe86f66f2db056baba9556817bbf9a110bcd9e170462351af0dd4462429412410c7c3b2b76ea808d7bce4ea1f756a18819aa1762edb3745cc5
- SSDEEP 6144:juAO5lvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+npAMysZ3:aDlvgiHAcTmS80g9vTMx4yAyA5b0urHu
- TLSH T1AA548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{66E9406D-0485-4BC9-91D1-5840EF90063E}\_71ACB5740094E0E06CE4EC.exe
- Size 223KB
- SHA256 02ed76b27caa2c5533b2dc88f053299787788636ee5267657f70d0b78a0fae0c
- MD5 ebd0702378af22a2c43dc7c323d4e40d
- SHA1 bd3b95baf2b0bea38cdd18f0c1bdad7aa5ea3f07
- SHA512 68992d90bf5adf86f680de7361d0be35de24190aa745922622b00428ad6cb2aa5c6a039e12958d32976d32700b8abc897e644095436531e717b8d524a2cd30aa
- SSDEEP 768:phRRjjXHa/1En9p19qujiMNGoA7Ayz9oTi5lbQR8Hieh7F:phRlHa9En319ViM4oOAqCiPQR87
- TLSH T11D24D52C65619EA6CC9C87704D61F3B4EEF14F76FA450A13D2D73E4B3A2A5872A2C701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE9EC.tmp
- Size 114KB
- SHA256 4f10c0bd8d22e8215b02f092279abf7bb148cb1497207ec2ebab32662009b2ac
- MD5 fe01d395c4b85df8c426fc9620120ba8
- SHA1 23348d42947a64efa5209b30e9b8a6264f4a990a
- SHA512 d255211adb5fbf5cda875ad138abb064a7deedbed28f4e862df4fea962f84437c92a53dd18ed6d2098d0d9415d4a5ca80e39e9bc91b4382b01714d23f29615ea
- SSDEEP 1536:dS8CWyksWMcdM4Bpjr+UsgtFmVrrXL1MgbIurgnOMolQbm8DhIGo0Uqc3:dS8SgMA+jVrrb1MMBnMolULDhImc3
- TLSH T15DB39E51BA908472D5FF2D3C1578DA621E3E79701FE09DAB175452B90EB43C0AB38E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59d6af.msi
- Size 5.3MB
- SHA256 9cbc9c06e2399568712e7f2139508ee1ea22933ff468c33aa41de6513cc6149f
- MD5 5c1fb0e92511d099c661f122cbf9f657
- SHA1 7cd7229fc974ffb797c5a48f3009c3e15e12e79f
- SHA512 4d24ac80054e2548828ba5e06bc775bf55438860c3d5f15eed1f26425c7a395ed2fa37eedce8e978912289242789f513b97dbb7be5fa99748fac53dd3dbc93eb
- SSDEEP 98304:s8YicXMTpplsR9tG+R+HNModB2aZF3MaoBivM1KeisbLz:CiMMT2HtVQHNRBnF3LoYvaKpsH
- TLSH T10F46DE1D61918EB2CCAD07300D65F3B4DEB56F32F9904A17D2D23E1B3A79283662DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 a35b8e51a11f64187a9bbaf48840041c37b4636dc68289e0654b1a94d23b8f62
- MD5 04fba3f656460f89527978ef10d0843d
- SHA1 1f2666600de8d8cde773ed2b76b39de01104e713
- SHA512 46c1eb3ea56012af2e2e0eb116a705fdfe4197ed9e82568290b595580e3246c81cc20e358713f88dfad49d1a71a4188b05e255bf8f3e0f9eb5d6d316803a704e
- SSDEEP 24576:aFo3DMPLdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:QH4
- TLSH T1A857B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c9d8e8a2-646e-45b9-a91e-2bef98486c92}_OnDiskSnapshotProp
- Size 6KB
- SHA256 53eea584fcb19fb7073d29dccdf81356ccb94d61871cc835a8461e11550d7b1e
- MD5 4e00744da596f58a1bc0b1b13af250b3
- SHA1 e44301920b887fe5ef2d7083719e4e85245a264b
- SHA512 f7a1477eb43f46e928a883a3892758f8e3262593a36f6221469d596b465bca803de881ef0bb2246359c10094c3e21e5870b684a3528a1cdb2d93220d9ebb93a0
- SSDEEP 96:F1PW5mXdlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:L20dl/b++uVm
- TLSH T133D1890C5AE54311E2F3AB3229F18557A837B911EF33CB8E0198238E6671911F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH