Overview
overview
7Static
static
3OMARPERM/O...er.exe
windows10-2004-x64
1OMARPERM/O...er.exe
windows11-ltsc_2024-x64
1OMARPERM/�...1).exe
windows10-2004-x64
7OMARPERM/�...1).exe
windows11-ltsc_2024-x64
7install_all.bat
windows10-2004-x64
7install_all.bat
windows11-ltsc_2024-x64
7vcredist2005_x64.exe
windows10-2004-x64
7vcredist2005_x64.exe
windows11-ltsc_2024-x64
7vcredist2005_x86.exe
windows10-2004-x64
7vcredist2005_x86.exe
windows11-ltsc_2024-x64
7vcredist2008_x64.exe
windows10-2004-x64
7vcredist2008_x64.exe
windows11-ltsc_2024-x64
7vcredist2008_x86.exe
windows10-2004-x64
vcredist2008_x86.exe
windows11-ltsc_2024-x64
vcredist2010_x64.exe
windows10-2004-x64
7vcredist2010_x64.exe
windows11-ltsc_2024-x64
7vcredist2010_x86.exe
windows10-2004-x64
7vcredist2010_x86.exe
windows11-ltsc_2024-x64
7vcredist2012_x64.exe
windows10-2004-x64
4vcredist2012_x64.exe
windows11-ltsc_2024-x64
4vcredist2012_x86.exe
windows10-2004-x64
4vcredist2012_x86.exe
windows11-ltsc_2024-x64
4vcredist2013_x64.exe
windows10-2004-x64
4vcredist2013_x64.exe
windows11-ltsc_2024-x64
4vcredist2013_x86.exe
windows10-2004-x64
4vcredist2013_x86.exe
windows11-ltsc_2024-x64
4vcredist_v14.x64.exe
windows10-2004-x64
4vcredist_v14.x64.exe
windows11-ltsc_2024-x64
4vcredist_v14.x86.exe
windows10-2004-x64
4vcredist_v14.x86.exe
windows11-ltsc_2024-x64
4OMARPERM/�...1).exe
windows10-2004-x64
6OMARPERM/�...1).exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
18s - max time network
23s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 20:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OMARPERM/OmarTweaker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OMARPERM/OmarTweaker.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
OMARPERM/متطلبات وتعريفات/7z2602-x64 (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
OMARPERM/متطلبات وتعريفات/7z2602-x64 (1).exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
install_all.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral6
Sample
install_all.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral7
Sample
vcredist2005_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral8
Sample
vcredist2005_x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcredist2005_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcredist2005_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral11
Sample
vcredist2008_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
vcredist2008_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
vcredist2008_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral14
Sample
vcredist2008_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
vcredist2010_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
vcredist2010_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
vcredist2010_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
vcredist2010_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
vcredist2012_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
vcredist2012_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
vcredist2012_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
vcredist2012_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
vcredist2013_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
vcredist2013_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
vcredist2013_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
vcredist2013_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
vcredist_v14.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
vcredist_v14.x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
vcredist_v14.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
vcredist_v14.x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
OMARPERM/متطلبات وتعريفات/dxwebsetup (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
OMARPERM/متطلبات وتعريفات/dxwebsetup (1).exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target vcredist2008_x86.exe
- Size 4.3MB
- Sample260805-ystcwavepc
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- TLSH T1982633EE1E32462AD70B42B2E4352783D578F0A68C7B8DD79D93553EE1E3266FA10046
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4484 install.exe - Loads dropped DLL 1 IoCs
pid Process 4484 install.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll msiexec.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\ msiexec.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI71A.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification \??\c:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2008_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "206" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3444 msiexec.exe 3444 msiexec.exe - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 4484 install.exe Token: SeIncreaseQuotaPrivilege 4484 install.exe Token: SeSecurityPrivilege 3444 msiexec.exe Token: SeCreateTokenPrivilege 4484 install.exe Token: SeAssignPrimaryTokenPrivilege 4484 install.exe Token: SeLockMemoryPrivilege 4484 install.exe Token: SeIncreaseQuotaPrivilege 4484 install.exe Token: SeMachineAccountPrivilege 4484 install.exe Token: SeTcbPrivilege 4484 install.exe Token: SeSecurityPrivilege 4484 install.exe Token: SeTakeOwnershipPrivilege 4484 install.exe Token: SeLoadDriverPrivilege 4484 install.exe Token: SeSystemProfilePrivilege 4484 install.exe Token: SeSystemtimePrivilege 4484 install.exe Token: SeProfSingleProcessPrivilege 4484 install.exe Token: SeIncBasePriorityPrivilege 4484 install.exe Token: SeCreatePagefilePrivilege 4484 install.exe Token: SeCreatePermanentPrivilege 4484 install.exe Token: SeBackupPrivilege 4484 install.exe Token: SeRestorePrivilege 4484 install.exe Token: SeShutdownPrivilege 4484 install.exe Token: SeDebugPrivilege 4484 install.exe Token: SeAuditPrivilege 4484 install.exe Token: SeSystemEnvironmentPrivilege 4484 install.exe Token: SeChangeNotifyPrivilege 4484 install.exe Token: SeRemoteShutdownPrivilege 4484 install.exe Token: SeUndockPrivilege 4484 install.exe Token: SeSyncAgentPrivilege 4484 install.exe Token: SeEnableDelegationPrivilege 4484 install.exe Token: SeManageVolumePrivilege 4484 install.exe Token: SeImpersonatePrivilege 4484 install.exe Token: SeCreateGlobalPrivilege 4484 install.exe Token: SeRestorePrivilege 3444 msiexec.exe Token: SeTakeOwnershipPrivilege 3444 msiexec.exe Token: SeShutdownPrivilege 4484 install.exe Token: SeRestorePrivilege 3444 msiexec.exe Token: SeTakeOwnershipPrivilege 3444 msiexec.exe Token: SeRestorePrivilege 3444 msiexec.exe Token: SeTakeOwnershipPrivilege 3444 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4396 LogonUI.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4484 3540 vcredist2008_x86.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist2008_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist2008_x86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\4a212ed6ac6bdf207c97e5\install.exec:\4a212ed6ac6bdf207c97e5\.\install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa391e855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\4a212ed6ac6bdf207c97e5\install.exe
- Size 547KB
- SHA256 b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
- MD5 4138c31964fbcb3b7418e086933324c3
- SHA1 97cc6f58fb064ab6c4a2f02fb665fef77d30532f
- SHA512 40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557
- SSDEEP 12288:hkjNFCqa3Gypbl+3/Rfut4oTxZavud30BuK:huO+3/FulZavC30YK
- TLSH T1A1C46D307EF48035D4F351B496AD622551B9FC700B3984CBB38453AEAAB0BD1AB35B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\4a212ed6ac6bdf207c97e5\install.res.1033.dll
- Size 85KB
- SHA256 a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067
- MD5 ff6003014eefc9c30abe20e3e1f5fbe8
- SHA1 4a5bd05f94545f01efc10232385b8fecad300678
- SHA512 3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2
- SSDEEP 768:hN/14PhLnHqCHyDRO6ApsnzwPu1+IiPMRpfrO/CaqpuK6tmbb6FjpvB/p:F4PhLsOazwPIRpfrO/Cajg6F5B/p
- TLSH T18D83510177F88525F5F73B74ACB956701E7ABC91AE38C28E2280219E4DB2AC0DD74763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3B9D.txt
- Size 1KB
- SHA256 cd589979f1a4cad4fd3ddf69aaac9a7ad5ebe6462e84768b1c179d3f540adcac
- MD5 0e2335616865f3bf2afd9981c51f78ed
- SHA1 5bb5fb6231983553f018149d23ac8e9136910159
- SHA512 50b9a4fc03148303667ada0c5de74b56dc9439a00f4a11dbe10849dc8bfe467e64d707d3bbcd2386207b9eb3c60ec8fd369bdd5ef81f671faffd0f80d4c13a2f
- TLSH T1A931D8652BD60C05F1F36647EDF3C0725E33BDE16838CB4D2389826906ABD056D687BA
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\VC_RED.cab
- Size 3.7MB
- SHA256 461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d
- MD5 0ee84ab717bc400c5e96c8d9d329fbb0
- SHA1 be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a
- SHA512 4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2
- SSDEEP 98304:YBSL15/KHNl+HwawYti+jRMDbPmebgYSL2RniKQZipvsk9vuLV:YYytlK7/IQMDbmG6+iDipm
- TLSH T1BB0633D87EB18B55C3992EB19430AAC7ED6CB1DA0D728C727D62593DF2831A7F22404D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1028.txt
- Size 3KB
- SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
- MD5 f187c4924020065b61ec9ef8eb482415
- SHA1 280fc99fb90f10a41461a8ee33dbfba5f02d059d
- SHA512 1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743
- TLSH T15E81A6AC1DF32742F493ABB39D834821C7F1A6912BBA0A77458C87495A7045EB049BD7
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1031.txt
- Size 15KB
- SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
- MD5 3168ed3b48c1dc8d373c2abc036574cf
- SHA1 7ffbcfb6cd9b262a0e9a55853d76055693f60c60
- SHA512 9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197
- SSDEEP 192:unSQcLPGw05JEwLW4bt9xepjQOw9cqOANn2fxd:u2LPRwJEwK4xypjUGlA12fxd
- TLSH T13862C02167E5961CF6F37F542EB9E3689F72BDE2A87AD51E2340105E48B1B14CA20733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1033.txt
- Size 9KB
- SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
- MD5 162fc8231b1bd62f1d24024bb70140d5
- SHA1 7fa4601390f1a69b4824ee1334bee772c2941a24
- SHA512 a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda
- SSDEEP 192:6cJ4sOGsTRyAiLfoIPtjlDxsk4apSfqn7yb/:6cJTYyAwdPtjnszasfzb/
- TLSH T1D1229E15A7FD1208F6FB7F906EB9A1685E3A7CA6AD3EC65D1110105E09B6E40CE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1036.txt
- Size 11KB
- SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
- MD5 c360851dfdf51b6ddc9cfcc62c584898
- SHA1 f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6
- SHA512 a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d
- SSDEEP 192:lHcOi0SMq5Gl9EAbGu8xFk7XetMKgTqebK8T25C76j1o3M6ykT4Z9KhI/b:1cOiGF/BN3EWN09UAb
- TLSH T1C9425762A6FA5209F6F27F90BEBD91554F3BBD969D3AC11D1210118E48B1E44CEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1040.txt
- Size 13KB
- SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
- MD5 04b833156f39fcc4cee4ae7a0e7224a1
- SHA1 2ffa9577a21962532c26819f9f1e8cd71ab396bd
- SHA512 8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608
- SSDEEP 192:KYCk+hFhpk2i7mJZKVJTlVec3xo3xWScwMnuEz3ZGE88agajQq+Cv:5co6XG9lmhyukqSajsI
- TLSH T1F1528F51B7FD2208F2F77F90BE7AA6684E7BBE56A83AD11E1150109E4871E608D60733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1041.txt
- Size 5KB
- SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
- MD5 031fab3fb14a85334e7e49d62a5179fe
- SHA1 12370185ef938a791609602245372e3e70db31be
- SHA512 7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447
- SSDEEP 96:JV48yKn6zm4X4zyG61NDyroY1fnODSQJR4Jbcnnik49joxfhUWuNdTvp2U9:JZBn6lYSuxpO4MU7IS
- TLSH T15FC1116C1ABA09BE94F6809758C955F8F7B9F615A2DE0C89044CC88B05548ED730FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1042.txt
- Size 5KB
- SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
- MD5 6fcd6b5ef928a75655d6be51555288c7
- SHA1 eafdcc178343780b83f1280dad9d517aaedab9e4
- SHA512 635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905
- SSDEEP 96:A48gbatW+eU2giS0wyGjlH+5YO9M60AoV7nokPJ:MTi+ZREU
- TLSH T16AC152BB3AEDAA813251668017C6A7F7635F7202721F9C81CB90413421E87B48639BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.1049.txt
- Size 13KB
- SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
- MD5 bc3a8865b60ec692293679e3e400fd58
- SHA1 2b43b69e6158f307fb60c47a70a606cd7e295341
- SHA512 0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610
- SSDEEP 384:dSqMupEO2FQgf7vmbw6ZZSSOTewMtsKaK4NnszO2W:bkFszk
- TLSH T17852586FF8BC9515A460E2111F628AF710AB7750A328A5CAF2CF7DA8906D53533217CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.2052.txt
- Size 3KB
- SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
- MD5 ec4b365a67e7d7db46f095f1b3dcb046
- SHA1 d4506530b132ef4aad51fcbc0315dadc110c9b81
- SHA512 5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2
- TLSH T1D981096E5DFB1412F493795158A686D36BF315A3573B4DE3088C490C52374CE9830F9E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\eula.3082.txt
- Size 12KB
- SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
- MD5 c2d1221cd1c783b5d58b150f2d51aebf
- SHA1 3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60
- SHA512 c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4
- SSDEEP 192:++hGO8i6aZyiqQm6W7TlR3LycUV2G+74G:+Vi3ZyDVF+mB
- TLSH T11C423650A6F96606F2F77F51AEB991688E3BBDA29C3EC51D0210119E0DB1E44DE34B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.ini
- Size 841B
- SHA256 c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
- MD5 f8f6c0e030cb622f065fe47d61da91d7
- SHA1 cf6fa99747de8f35c6aea52df234c9c57583baa3
- SHA512 b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde
- TLSH T18201EF63C629518928E6E8B740A00A8ABC519EC973412C54C0512C8C2FEB89BD35AB7E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1028.dll
- Size 71KB
- SHA256 1074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e
- MD5 8c2c1df03574e935277addc6e151bdbe
- SHA1 33f7eae718d6704ea99d7c7803207dbe0d1ea3a0
- SHA512 735c438da7fd3e4e0e4738ac11c87a73ce3cacbaa24b21994ec76868e70fc485469337eb6e067e20bb92210995ffb3c385677fcc986c4c34f24bfde6b91ba0c8
- SSDEEP 768:cU/14PhLnHqCHyDRO6ApsnzwPu1+IiPMRwqO/wa2Lc3aE1Nk+IVJb6FjpvKy:j4PhLsOazwPIRwqO/waBlxIr6F5V
- TLSH T1A0636B007591C432D492167884BAD3B1BBBEADC12B2542C37BDC75AE6DB27D0BD38399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1031.dll
- Size 90KB
- SHA256 2c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa
- MD5 6f22a8ecc5a917c61f1478ef4ad53949
- SHA1 180c370698091e53f203d23eb6c839467deebfb9
- SHA512 8513f09da143983d436368c6067a62f1829d5d66776a168026f7562f8337d8e1bc8df2ff9ab421f4cc7d75757a0e9b8a75f3761c9e8aba7d0785d2fcb1b00a93
- SSDEEP 1536:y4PhLsOazwPIRrhO/6NabBfDNh5T8fdXWohToh+ohvodoEuQGKQG56KjtrE4HErj:yEhLsFRNO/6NabBfDNPT8fdXWohToh+E
- TLSH T193933D1163E58629F5F22B34ADB993A06E76BCD1AE35D18E239021AD1CB1BC0DD34773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1036.dll
- Size 91KB
- SHA256 cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6
- MD5 4d431f94a7d0945f4a7f13b7988632aa
- SHA1 61461b14b57382eebb3bf4621b7dadb0cb2475b3
- SHA512 e4197801c20dfce7dc14d5d74aa572de18954dceaaca77a75bf989427c6ff7d5889085e5c325376a993ad290ee43ab25e0f6bea074fed3d5158e0fd4c785aeca
- SSDEEP 768:r53/14PhLnHqCHyDRO6ApsnzwPu1+IiPMR4XYO/3aXLNRg41isJafbAgw8RxKb6L:994PhLsOazwPIR4oO/3aUsJSs6F5z
- TLSH T148932C11A3E88521F6F33F34ACB992611E7A7C8AAE35C15E2680659E1CB1F90DD74733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1040.dll
- Size 89KB
- SHA256 709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8
- MD5 ef1ccfe8572cdaaefb1940efbbff6d80
- SHA1 b1d587c8fdb3ca82c320d08379ca7bd781253e3f
- SHA512 98538c82d56b6e0e9f0ca7cf47a6ce57e0acd18b2a64b90304a95a3c7270920efb835731272200afa16e45dfd461df94f95da04f39c2436915dc6969a4a0ebce
- SSDEEP 1536:+4PhLsOazwPIRE+O/2aWbXhqK7+6F5UFj:+EhLsFRBO/2aiDF54
- TLSH T1B9934E1167F98625F5F33B34AC7996A41E3ABD91AE38D14F138120AD58B2AD0DC70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1041.dll
- Size 76KB
- SHA256 f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332
- MD5 6bfb58958d58bf38e9242b2056392b8c
- SHA1 f4c4653e061eb903ddae29f0d6a798db6ab5bdf4
- SHA512 672727552812c7d7b775896096d556851d6990b2d9c24c0e2c728f6c720b47c156d2ec2ce7ef23126fd222178969aff848f06568f695d154d6f7836ecf222d88
- SSDEEP 1536:m4PhLsOazwPIRNyO/dasPBK7Y166F5rcc:mEhLsFRcO/das9vF5Ic
- TLSH T1DB730804B5608936E4A2017844BAF3E02BBCFD9057A545C36ACCB59F58727D46F393BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1042.dll
- Size 74KB
- SHA256 16fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767
- MD5 ba91e387d54b94689644ebd23ff264ba
- SHA1 267b0af1774b6440cac00fad6524f277fde09457
- SHA512 79e818ffc57880a9881d771c0ea607d64a2cbdad29b28a270138d4d03edb8b026e7536e89396968c8454c56c740d198e67a75cac3e2447ca120b7cffefa4c0bd
- SSDEEP 1536:Q4PhLsOazwPIRGhO/iaE5IelPpQpwItI6FrHUp:QEhLsFRIO/iaRlFop
- TLSH T10A7328427564C532D851123899FA93B2673EADC06B175183FB8075AE5EF23E0EE343DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.1049.dll
- Size 87KB
- SHA256 3de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e
- MD5 9aac6ce2ad6c7aee5481e46ddb0ad0dd
- SHA1 dabd5e299a4595b1341f47313ac26c663d79a7c4
- SHA512 97e00a50d3e8c8954854cc44f36049d63d8f1860e547a511feccf4214ff0560079b5512053aea4c2a40769d58738934d69c1a45186092ff11af1b907395dd126
- SSDEEP 768:4V/14PhLnHqCHyDRO6ApsnzwPu1+IiPMRVBO/ckYiE7t0gd7tWdz+tb6Fjpve:q4PhLsOazwPIRVBO/ck4Ss6F5e
- TLSH T10B93B50FF538C521E455D2740A768AE225B9BB50231941C7A6CF7DA9A4B53F0BB383CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.2052.dll
- Size 70KB
- SHA256 f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4
- MD5 208f1260b7145b19434a8c95ff7c0474
- SHA1 6a0a74affdc8f988873841b7073f428056a8aa5d
- SHA512 2e9cf1ed7944a6246a2f3febee99d0a36759191664e83aee3c14424b64785a134fe9c50e9e5deaaab1095ae298a2f49aac2037f64a127d250af973a077a7e03a
- SSDEEP 768:Ge/14PhLnHqCHyDRO6ApsnzwPu1+IiPMRkiFkd0p4B7QcmSkjuoAb6FjXHUa:X4PhLsOazwPIRkakd0ps7/6FrHUa
- TLSH T16A635B0175A1CC32C586153885BAD7B12BBEBDC11B2586C37BDC76AE1DB22D0BD38399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\install.res.3082.dll
- Size 90KB
- SHA256 8de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f
- MD5 dbbe392a7536c76ec60a21e211eb3210
- SHA1 e1cead8b1e0fd41e9ed79f4921c5e40c2d739dda
- SHA512 f725bc786076947874cc58b9591445064b3f133c75865bb1d661e95f29f1a9556447ee3f385a38f9438561e35e6cfa8208dbc938d3304c415cc25ed85c29f15d
- SSDEEP 1536:c4PhLsOazwPIRmBO//a3p1yN0mnpqC6FrHUU:cEhLsFRoO//aqN0mn0HFoU
- TLSH T1D4932E0067F89666F5F33B38A87956605E7ABC919E39D14E535022AE0DB1FC0DE34B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\vc_red.msi
- Size 222KB
- SHA256 34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
- MD5 7e641e6a0b456271745c20c3bb8a18f9
- SHA1 ae6cedcb81dc443611a310140ae4671789dbbf3a
- SHA512 f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903
- SSDEEP 3072:vZhXppF5fyi9JXgvJVJS5pNF531iBkNmGK0+E4mN2EJojF5:p1/QvzJOXvU+0
- TLSH T1F1245C05F512C033DC803379115FDBA26ABCBEA64B52899722ED729C9DB17D0D37A18E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\4a212ed6ac6bdf207c97e5\vcredist.bmp
- Size 5KB
- SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
- MD5 06fba95313f26e300917c6cea4480890
- SHA1 31beee44776f114078fc403e405eaa5936c4bc3b
- SHA512 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
- SSDEEP 24:pS75l775l7aqV7j7Q55okTg2vrlgprDDcaWJQvS2PRSmob6SHSl4CiZ:pKV7j7AXgbjlLI
- TLSH T15EC1E74B200A6854D296603147AECDFB472BADC182E063F631F93E8A36FDC98351E719
- MD5 SHA1 SHA512 SSDEEP TLSH
