Overview
overview
7Static
static
3OMARPERM/O...er.exe
windows10-2004-x64
1OMARPERM/O...er.exe
windows11-ltsc_2024-x64
1OMARPERM/�...1).exe
windows10-2004-x64
7OMARPERM/�...1).exe
windows11-ltsc_2024-x64
7install_all.bat
windows10-2004-x64
7install_all.bat
windows11-ltsc_2024-x64
7vcredist2005_x64.exe
windows10-2004-x64
7vcredist2005_x64.exe
windows11-ltsc_2024-x64
7vcredist2005_x86.exe
windows10-2004-x64
7vcredist2005_x86.exe
windows11-ltsc_2024-x64
7vcredist2008_x64.exe
windows10-2004-x64
7vcredist2008_x64.exe
windows11-ltsc_2024-x64
7vcredist2008_x86.exe
windows10-2004-x64
vcredist2008_x86.exe
windows11-ltsc_2024-x64
vcredist2010_x64.exe
windows10-2004-x64
7vcredist2010_x64.exe
windows11-ltsc_2024-x64
7vcredist2010_x86.exe
windows10-2004-x64
7vcredist2010_x86.exe
windows11-ltsc_2024-x64
7vcredist2012_x64.exe
windows10-2004-x64
4vcredist2012_x64.exe
windows11-ltsc_2024-x64
4vcredist2012_x86.exe
windows10-2004-x64
4vcredist2012_x86.exe
windows11-ltsc_2024-x64
4vcredist2013_x64.exe
windows10-2004-x64
4vcredist2013_x64.exe
windows11-ltsc_2024-x64
4vcredist2013_x86.exe
windows10-2004-x64
4vcredist2013_x86.exe
windows11-ltsc_2024-x64
4vcredist_v14.x64.exe
windows10-2004-x64
4vcredist_v14.x64.exe
windows11-ltsc_2024-x64
4vcredist_v14.x86.exe
windows10-2004-x64
4vcredist_v14.x86.exe
windows11-ltsc_2024-x64
4OMARPERM/�...1).exe
windows10-2004-x64
6OMARPERM/�...1).exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 20:03
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OMARPERM/OmarTweaker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OMARPERM/OmarTweaker.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
OMARPERM/متطلبات وتعريفات/7z2602-x64 (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
OMARPERM/متطلبات وتعريفات/7z2602-x64 (1).exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
install_all.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral6
Sample
install_all.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral7
Sample
vcredist2005_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral8
Sample
vcredist2005_x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcredist2005_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcredist2005_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral11
Sample
vcredist2008_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
vcredist2008_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
vcredist2008_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral14
Sample
vcredist2008_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
vcredist2010_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral16
Sample
vcredist2010_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
vcredist2010_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
vcredist2010_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
vcredist2012_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
vcredist2012_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
vcredist2012_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
vcredist2012_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
vcredist2013_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
vcredist2013_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
vcredist2013_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
vcredist2013_x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
vcredist_v14.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
vcredist_v14.x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
vcredist_v14.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
vcredist_v14.x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
OMARPERM/متطلبات وتعريفات/dxwebsetup (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
OMARPERM/متطلبات وتعريفات/dxwebsetup (1).exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target vcredist2010_x86.exe
- Size 8.6MB
- Sample260805-ystcwavepc
- SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
- MD5 1801436936e64598bab5b87b37dc7f87
- SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
- SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c
- SSDEEP 196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC
- TLSH T1789633D714300ADFFC07BB70F7568555D8E9496233A8D7EA4AC60CC89AEEAE4C0B6750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5392 Setup.exe - Loads dropped DLL 5 IoCs
pid Process 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName Setup.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2010_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe 5392 Setup.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5392 Setup.exe Token: SeBackupPrivilege 5392 Setup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5552 wrote to memory of 5392 5552 vcredist2010_x86.exe 88 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
\??\f:\e78f6775b11d3441c026de5326df8df0\Setup.exef:\e78f6775b11d3441c026de5326df8df0\Setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5392
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Setup_20260805_210545752.html
- Size 18KB
- SHA256 2cf091443e4ea9f35fa20c0cffec93072dd6353ac1628168b9bf4f6c3a93eb6f
- MD5 54c216cc9bf0fca3422ff3540e22075e
- SHA1 6aceb7eb318fa7cc1ca7536211a9cd4bf3ca593c
- SHA512 9b7c3210fa49d15bce6ec94c18c7c920e52bbc635d1be2a4aebf569fad4e7c774732d22c21e0669096cd46441cedfbbb76cb91afb0fdd54500f181c142a6f7a7
- SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHj1hv:fdsOT01KcBUFJFEWUxFzvHZJ
- TLSH T12782675327E84244A1B6BF49AEB600754B79BD45AC3CCE7D12A0591E49E3E04F872FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\e78f6775b11d3441c026de5326df8df0\Setup.exe
- Size 76KB
- SHA256 531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7
- MD5 2af2c1a78542975b12282aca4300d515
- SHA1 3216c853ed82e41dfbeb6ca48855fdcd41478507
- SHA512 4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb
- SSDEEP 1536:GgNItbBL5NWiiESvRexWZnqxMQP8ZOs0Jr6FrHU0:GgNAB9NWTZvwc/gBAFo0
- TLSH T14C738E027294C435D859163408ABDEB25E7E7D829BB048CB339877EF5F713C26A3835A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1028\LocalizedData.xml
- Size 29KB
- SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
- MD5 7fc06a77d9aafca9fb19fafa0f919100
- SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
- SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
- SSDEEP 384:4Y6C7xfsxMEYgPNRAsy50keJzH7o3oDPnv:MxLJz7
- TLSH T110D2A112AEEB3114F0BAAE19BD3314944EF779905C35C01E10992E4E9BB7FC28965F93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1031\LocalizedData.xml
- Size 40KB
- SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
- MD5 b83c3803712e61811c438f6e98790369
- SHA1 61a0bc59388786ced045acd82621bee8578cae5a
- SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
- SSDEEP 384:4nF+jpoHnZi8oO0GOJ2+8q6OUjEYJL/ZiITrKv:V03XjZJL/YIy
- TLSH T122139B11AFEA2214F1F6BF59BD7611944EB37E91AC35C40D01992D8E8AB3F81C921F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1033\LocalizedData.xml
- Size 38KB
- SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
- MD5 d642e322d1e8b739510ca540f8e779f9
- SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
- SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
- SSDEEP 192:4kVKhG9aX0SDpI53/asO0KMv+VXxwVcPIv5COQu4SLbpmQVX5FB0zJOkue6Jjfz3:4MKhJkeZsdlNl9SJOkR6NXaxu
- TLSH T196036602AEFE2154F1BBBE19BD7210954EB7BD915C39C11D00992D8E8AB3F81CD61B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1033\SetupResources.dll
- Size 16KB
- SHA256 74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4
- MD5 0b4e76baf52d580f657f91972196cd91
- SHA1 e6ac8f80ab8ade18ac7e834ac6d0536bb483988c
- SHA512 ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87
- SSDEEP 192:/BykqnUfwTW7JQWp/eWfjp8M+9HS8bC/TJs7kFkUQKPnEtm3EFxJhjeyveCXaq:jNo7Wp/eWk9ygC/TfFkULb6Fjpvkq
- TLSH T1FA72308163FC8505F6F73F70AEB586A25E3ABD825838C71E2591A19D08A1F80DD74B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1036\LocalizedData.xml
- Size 40KB
- SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
- MD5 e382abc19294f779d2833287242e7bc6
- SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
- SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
- SSDEEP 192:4GrYAOJoFbZZ0eQiFaD4EbJeiI5hJUPu2oBknXoFDYnZCoroUnAJJFHq20/kFR/0:4GZUoRZc5ryx2fHIJR0kbG52gjfVv
- TLSH T193137711ABEA2214F2FABF05BD7610944EBB7D919C35C01D01992D8E8EB3F85C971B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1040\LocalizedData.xml
- Size 39KB
- SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
- MD5 0af948fe4142e34092f9dd47a4b8c275
- SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
- SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
- SSDEEP 384:4hZo3+Ma9e1JzNZNs4fneAEJ0o5H/PuRv:NaudsJ1u
- TLSH T1D6035811AFFA2214F1F7BE09BD3615984EB77E919C35C01D01992D8E8AB3F818961F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1041\LocalizedData.xml
- Size 33KB
- SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
- MD5 7fcfbc308b0c42dcbd8365ba62bada05
- SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
- SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
- SSDEEP 192:4OTOo45ZyAYcou3LDnmUjMFsrHZmxqJOXhNCGYHre3iR7v:4OTOoMhYcRaOXJ6koIv
- TLSH T12BF2D101AEEB3114F0FAAE55BD7310944EF7B9909C35C01D00996D4E9AB7FC58A26FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1042\LocalizedData.xml
- Size 32KB
- SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
- MD5 71dfd70ae141f1d5c1366cb661b354b2
- SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
- SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
- SSDEEP 192:4cdsW0fwUrh+UgYUDQhGAtPN/2JWCTJSIQvPaLWL2C4oH/Drv:4cdszvrBgYUDQhF5N7IJSIQvkQfLH/Pv
- TLSH T1D6E2A212AEEB3154B0BAAE15BD7314944EF779909C36C01E10992D8E9BB7FC1C921F93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\1049\LocalizedData.xml
- Size 39KB
- SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
- MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
- SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
- SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
- SSDEEP 384:4q0oG/2VrQa0inweNLvSli+CJA3aJW5cGUT3CT+v:DVFJl
- TLSH T19F03D40BFEFA7114B0B6EA55AE3304D109B77A501E35C08D109F2D5D9AA7FB19A21F83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\2052\LocalizedData.xml
- Size 30KB
- SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
- MD5 52b1dc12ce4153aa759fb3bbe04d01fc
- SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
- SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
- SSDEEP 192:4Qn7cJwYTzOnyquEWTOAXUewfMcqQJywXk83GJPupIoxnb/2v:4Qn7cJxTC/uEWTfXUewiQJyoknJY9b+v
- TLSH T1ABE29C12AEEB3114F1BAAE15BD7314944EB779905C35C01E10992E8E9BB7FC28971F83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\3082\LocalizedData.xml
- Size 39KB
- SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
- MD5 5397a12d466d55d566b4209e0e4f92d3
- SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
- SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
- SSDEEP 384:4fgA4Ukd+uYW1HCD1GO/tja2QDu7Jr++dP8z3AzOrv:tUZW1iDDdWCJi8Pg32Y
- TLSH T106032811AEEA2214F1F7BF09BD7614944EB7BD919C39C00D01592E8E8AB3F85C961F63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\DHTMLHeader.html
- Size 15KB
- SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
- MD5 cd131d41791a543cc6f6ed1ea5bd257c
- SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
- SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
- SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
- TLSH T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\ParameterInfo.xml
- Size 21KB
- SHA256 4eae293ca91b31aaa206e5a1c655714f0fe84e39f9331cb759d2236cdb915523
- MD5 13f8768c289476fdd103ff689d73cd2d
- SHA1 ddebcecc02c6b1b996423d62d0def8760f031f58
- SHA512 c72998f30ebff8f4a757248639cf0351d03f5502be475b4cb8f02b09ad800dbbe2f9a82c7d9bde6d7bd748e0ee6e61b86e369192773fe726421a564e793a0139
- SSDEEP 384:R3vG8G6KGXaNR1ydfaWZy1EwtKRliehOxnCGYCrKFl:R3OfQqNR1ydfaWZy1EwtKRliehOxndY7
- TLSH T16EA2918317FE5055B2F34A4CAEB224674E137D525E38C86D00EC694DCBE3D929862BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\SetupEngine.dll
- Size 789KB
- SHA256 a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952
- MD5 63e7901d4fa7ac7766076720272060d0
- SHA1 72dec0e4e12255d98ccd49937923c7b5590bbfac
- SHA512 de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0
- SSDEEP 24576:hS62AlYAxM20z7TzuO5cEewDODLzNu/6K8lxvSU1CcweD:hS62AlYA8TEpNuV8LvSU1Ccwe
- TLSH T1D4054B2267F98135E2FF1372753A676957BAF9A14B30CACF12815B5E0E356D08C38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\SetupUi.dll
- Size 288KB
- SHA256 29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713
- MD5 0d214ced87bf0b55883359160a68dacb
- SHA1 a60526505d56d447c6bbde03da980db67062c4c6
- SHA512 d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5
- SSDEEP 3072:IDPVUK59JnkphBxIc7e+Fe2rNiw8EktfyTm0HqRi/M+sy1lQWc+pm5hxv5yDoBni:SaygowjTMi/uVwd3KP
- TLSH T1EB54293237E4C574D4EF1374B55EA26842AAF1E21BF0C0CB2B451BAE8A337D15D34A96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\SetupUi.xsd
- Size 29KB
- SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
- MD5 2fadd9e618eff8175f2a6e8b95c0cacc
- SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
- SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
- SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
- TLSH T1B6D227C631D1CA0007374831AD223B0DFEE5A57382D83D61B5DCA637BB76AC62967279
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\Strings.xml
- Size 13KB
- SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
- MD5 332adf643747297b9bfa9527eaefe084
- SHA1 670f933d778eca39938a515a39106551185205e9
- SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0
- SSDEEP 384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
- TLSH T12B52934376FB2018B1B23ACA6FFBC1B4CF6675D00976462F0159204B87D7C1B6AA2776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\UiInfo.xml
- Size 35KB
- SHA256 66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b
- MD5 4f90fcef3836f5fc49426ad9938a1c60
- SHA1 89eba3b81982d5d5c457ffa7a7096284a10de64a
- SHA512 4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160
- SSDEEP 768:S4UR0d5v1SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v1QYQLIN/6Fmhvk71sO0Nep3q
- TLSH T1EFF216535BEB0118E2F6AA4D69B304705F5B7A45093AD13C04EC354DEFE7E628CA07AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate1.ico
- Size 894B
- SHA256 37026c4ea2182d7908b3cf0cef8a6f72bddca5f1cfbc702f35b569ad689cf0af
- MD5 26a00597735c5f504cf8b3e7e9a7a4c1
- SHA1 d913cb26128d5ca1e1ac3dab782de363c9b89934
- SHA512 08cefc5a2b625f261668f70cc9e1536dc4878d332792c751884526e49e7fee1ecfa6fccfddf7be80910393421cc088c0fd0b0c27c7a7eff2ae03719e06022fdf
- TLSH T15811C0F9B9714BB5D68589B18820C7B731D07DCE1CE9AB6B7530CC5F0C9D45C0DA1821
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate2.ico
- Size 894B
- SHA256 db89d8a45c369303c04988322b2774d2c7888da5250b4dab2846deef58a7de22
- MD5 8419caa81f2377e09b7f2f6218e505ae
- SHA1 2cf5ad8c8da4f1a38aab433673f4dddc7ae380e9
- SHA512 74e504d2c3a8e82925110b7cfb45fde8a4e6df53a188e47cf22d664cbb805eba749d2db23456fc43a86e57c810bc3d9166e7c72468fbd736da6a776f8ca015d1
- TLSH T18911C07632C09A7AC0CCBF700018FFDA81DC72C08A5CAF7776601F0B1A258E002694A0
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate3.ico
- Size 894B
- SHA256 02a7fe932029c6fa24d1c7cc06d08a27e84f43a0cbc47b7c43cac59424b3d1f6
- MD5 924fd539523541d42dad43290e6c0db5
- SHA1 19a161531a2c9dbc443b0f41b97cbde7375b8983
- SHA512 86a4c5d981370efa20183cc4a52c221467692e91539ac38c8def1cc200140f6f3d9412b6e62faf08ca6668df401d8b842c61b1f3c2a4c4570f3b2cec79c9ee8b
- TLSH T1C21126B33D7093B8F0EBA5308089DFD360DA77DC1948ABBBBC514D99056B08D8EB1891
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate4.ico
- Size 894B
- SHA256 8d82ff7970c9a67da8134686560fe3a6c986a160ced9d1cc1392f2ba75c698ab
- MD5 bb55b5086a9da3097fb216c065d15709
- SHA1 1206c708bd08231961f17da3d604a8956addccfe
- SHA512 de9226064680da6696976a4a320e08c41f73d127fbb81bf142048996df6206ddb1c2fe347c483cc8e0e50a00dab33db9261d03f1cd7ca757f5ca7bb84865fca9
- TLSH T15E11C065B7C0D5A4D455F9304003F38C00C930C0505E1FF63438CE67467C85504B64A5
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate5.ico
- Size 894B
- SHA256 7237051d9af5db972a1fecf0b35cd8e9021471740782b0dbf60d3801dc9f5f75
- MD5 3b4861f93b465d724c60670b64fccfcf
- SHA1 c672d63c62e00e24fbb40da96a0cc45b7c5ef7f0
- SHA512 2e798b0c9e80f639571525f39c2f50838d5244eeda29b18a1fae6c15d939d5c8cd29f6785d234b54bda843a645d1a95c7339707991a81946b51f7e8d5ed40d2c
- TLSH T15211684279B0C7A2D0BEF93281C6C31201D239C8085517EA38A1982B887D0C84CA557C
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate6.ico
- Size 894B
- SHA256 19abcedf93d790e19fb3379cb3b46371d3cbff48fe7e63f4fdcc2ac23a9943e4
- MD5 70006bf18a39d258012875aefb92a3d1
- SHA1 b47788f3f8c5c305982eb1d0e91c675ee02c7beb
- SHA512 97fdbdd6efadbfb08161d8546299952470228a042bd2090cd49896bc31ccb7c73dab8f9de50cdaf6459f7f5c14206af7b90016deeb1220943d61c7324541fe2c
- TLSH T12D11C0D4361CB4F4DD69E6309541C7BA88D8B8C6ECC797EB34A0DC4A083E0244492060
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate7.ico
- Size 894B
- SHA256 4f46a9896de23a92d2b5f963bcfb3237c3e85da05b8f7660641b3d1d5afaae6f
- MD5 fb4dfebe83f554faf1a5cec033a804d9
- SHA1 6c9e509a5d1d1b8d495bbc8f57387e1e7e193333
- SHA512 3caeb21177685b9054b64dec997371c4193458ff8607bce67e4fbe72c4af0e6808d344dd0d59d3d0f5ce00e4c2b8a4ffca0f7d9352b0014b9259d76d7f03d404
- TLSH T1C51168AA3A54F6A8E999EA714000CB824189BAC489A81F77B062ED0F192A80044E1820
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\Rotate8.ico
- Size 894B
- SHA256 5fb03593071a99c7b3803fe8424520b8b548b031d02f2a86e8f5412ac519723c
- MD5 d1c53003264dce4effaf462c807e2d96
- SHA1 92562ad5876a5d0cb35e2d6736b635cb5f5a91d9
- SHA512 c34f8c05a50dc0de644d1f9d97696cdb0a1961c7c7e412eb3df2fd57bbd34199cf802962ca6a4b5445a317d9c7875e86e8e62f6c1df8cc3415afc0bd26e285bd
- TLSH T13A1168B4733A5590C489BD3DC001E7D280C1BFC2ACAC9AA3B020AC17162E1682465860
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\SysReqMet.ico
- Size 1KB
- SHA256 8bfc77c6d0f27f3d0625a884e0714698acc0094a92adcb6de46990735ae8f14d
- MD5 661cbd315e9b23ba1ca19edab978f478
- SHA1 605685c25d486c89f872296583e1dc2f20465a2b
- SHA512 802cc019f07fd3b78fcefdc8404b3beb5d17bfc31bded90d42325a138762cc9f9ebfd1b170ec4bbcccf9b99773bd6c8916f2c799c54b22ff6d5edd9f388a67c6
- TLSH T17D215205B3CB5F92CF764239181E3214221CED301216CE17F6C8F80E4C3A82641B7DC8
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\SysReqNotMet.ico
- Size 1KB
- SHA256 3c9c71950857ddb82baab83ed70c496dee8f20f3bc3216583dc1ddda68aefc73
- MD5 ee2c05cc9d14c29f586d40eb90c610a9
- SHA1 e571d82e81bd61b8fe4c9ecd08869a07918ac00b
- SHA512 0f38fe9c97f2518186d5147d2c4a786b352fceca234410a94cc9d120974fc4be873e39956e10374da6e8e546aea5689e7fa0beed025687547c430e6ceffabffb
- TLSH T17221BB676B6AA751C07E47380007D14A7E40DC5E60F5DE83965434B34D132931C7C7C5
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\print.ico
- Size 1KB
- SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
- MD5 7e55ddc6d611176e697d01c90a1212cf
- SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
- SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
- TLSH T1CF21CC8173E10968D9898771135997616F8AFE00C1100B9330E3BA0BBC3E3B79453246
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\save.ico
- Size 1KB
- SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
- MD5 7d62e82d960a938c98da02b1d5201bd5
- SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
- SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
- TLSH T1F521EF7A71902420D0AA08794693C56516C5FEAAC824089672D93AFF6DF9C523023786
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\graphics\setup.ico
- Size 35KB
- SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
- MD5 3d25d679e0ff0b8c94273dcd8b07049d
- SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
- SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
- SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
- TLSH T1BCF28D89B250D9E4C89C11318C67CEF61F947D1AED840A4733EABF5F2FB23923125894
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\header.bmp
- Size 7KB
- SHA256 133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a
- MD5 3ad1a8c3b96993bcdf45244be2c00eef
- SHA1 308f98e199f74a43d325115a8e7072d5f2c6202d
- SHA512 133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658
- SSDEEP 48:9L9GXidTgX2bqxIS0SRosEYYgJSIf4pKTg7pDdEAeObh8EWu:R/Y2bq10Q/EY1sK8M4bb
- TLSH T11CE192A4890ECAD6C4D1CFA0DE7624FE65F61D20CC31964B6489F3BE7B777C44006899
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\msp_kb2565063.msp
- Size 3.8MB
- SHA256 7c969fcda6ef09d2eb7bbbc8d81795eb60c9c69ed835fd16538369ad0a6e0f10
- MD5 9843dc93ea948cddc1f480e53bb80c2f
- SHA1 d6ec9db8b8802ec85dd0b793565401b67ad8e5e0
- SHA512 79008cfdd8ae1ea27675588e7ba8123d08ce14047e5f167b3b5f6fbcdadeb45515bd72e18e59abf632ecbfbb42243fbcbebe4cbe0ed6ba195d0b2ca6d88676f9
- SSDEEP 98304:lEpd3qZ0G3garI8w8xhB2TU01SHMMV6ZArX:KaZtC8vBy10M4
- TLSH T1F216335BE3CBDF2AE4DA9A705B8D02031E2D4A01BA07448672CD7D98373397BD74525E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\sqmapi.dll
- Size 141KB
- SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
- MD5 3f0363b40376047eff6a9b97d633b750
- SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
- SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
- SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
- TLSH T1BAE34C18F7B695F2C56322300E0E72BAEB7DD92C3E99BE872380F6567430580D729756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\vc_red.cab
- Size 4.0MB
- SHA256 71c0acc75eecdf39051819dc7c26503583f6be6c43ab2c320853de15bece9978
- MD5 c580a38f1a1a7d838076a1b897c37011
- SHA1 c689488077d1c21820797707078af826ea676b70
- SHA512 ea3a62bd312f1ddeebe5e3c7911eb3a73bc3ee184abb7e9b55bc962214f50bbf05d2499caf151d0bd00735e2021fbea9584bf3e868a1d4502b75ec3b62c7ff56
- SSDEEP 98304:buCaO1KF/Zn4LkYytTHmuzfgnKZ9zWs2wU2Td:buCf1KF/94Lk9TPzf9Os2wU25
- TLSH T1CE1633F4083381A1D412BD7DFE2B8B2568F984B941899EEC75FC08545AD7F7282F3560
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\vc_red.msi
- Size 160KB
- SHA256 9ecf3980b29c6aa20067f9f45c64b45ad310a3d83606cd9667895ad35f106e66
- MD5 3ff9acea77afc124be8454269bb7143f
- SHA1 8dd6ecab8576245cd6c8617c24e019325a3b2bdc
- SHA512 8d51f692747cfdd59fc839918a34d2b6cbbb510c90dea83ba936b3f5f39ee4cbd48f6bb7e35ed9e0945bf724d682812532191d91c8f3c2adb6ff80a8df89ff7a
- SSDEEP 3072:0oTMYRradauoCcJg95gTdmmYdwYNRTK0+E4mN2E2275V495u:7RWd1odm4mmYdwT1
- TLSH T100F36D027951C237EC82A33115AEA76A2F3CBC654B6541C73199B2DC5FB27C0973A3E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\e78f6775b11d3441c026de5326df8df0\watermark.bmp
- Size 301KB
- SHA256 2e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2
- MD5 1a5caafacfc8c7766e404d019249cf67
- SHA1 35d4878db63059a0f25899f4be00b41f430389bf
- SHA512 202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46
- SSDEEP 3072:yUDLmozgtuVYKKKvwUbKh5+/uWLspp2e1jSaMsb1bIZU0g0WQbO//QGVYBtGKQgc:yUDLmozvygKjzbIGgBZBkUfDfc
- TLSH T1176410513177E012F43B25023715E51CBDF4D48AEBB58BE36C311E5A27B73A22AE6839
- MD5 SHA1 SHA512 SSDEEP TLSH
