e1deb4a34f385bfc4d6e5f647d370edffaacb4efb5059ec36796ad67568602e5

Analysis

user interaction
yes
max time kernel
900s
max time network
650s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SB24_PCDRV_LB_1_04_0090a.exe
Size 40.6MB
Sample260808-ajxryawbpc
SHA256 e1deb4a34f385bfc4d6e5f647d370edffaacb4efb5059ec36796ad67568602e5
MD5 dae258ce2f444d10fff7f3d192b935a6
SHA1 a032d5496e2d588ba9e1eea0e816ca5e9706a11c
SHA512 e1ad9ccf4603705bacfeccc1c9561fc4701f62f36fb83d4bb202dbba4e76ee5114b9915fa6fa714a0d4a25a95b62d21944d1c4dc346882d466bd3dcfaab43bd1
SSDEEP 786432:pQxO84w8AV22/wuGEP4H2QZmOdmwW3DE/ByzChY39qIQ:izAMbP4H2QGV4IL39qp
TLSH
T19B9733B3D19ECDCCFC8510B2E0E0A009E0396641AB185B7BF50CA6569A976737B75F8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4320	setup.exe
2108	setup.exe
8216	InstHelp.exe
812	InstHelp.exe

Loads dropped DLL 36 IoCs

pid	Process
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe
2108	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\IGDI.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp3A15.tmp\iGdi.dll	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKe69B4.tmp	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP6A26.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\objectps.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Setup.dll	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp3A15.tmp\temp.000	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\CMNS6fa8.rra	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\set39C5.tmp	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp39C4.tmp\temp.000	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isc6A05.tmp	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj6A46.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\CMNSUPT.CAB	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ius6A16.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj6A46.tmp	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\CTCA6f79.rra	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\CTCABEX.DLL	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ius6A16.tmp	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsProBE.tlb	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Dot69C4.tmp	setup.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\cto69D5.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isc6A05.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP6A26.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Install.log	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKe69B4.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\Dot69C4.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\cto69D5.tmp	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGEDIT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGEDIT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SB24_PCDRV_LB_1_04_0090a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4FF39B9-1A05-11D3-8896-00C04F72F303}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\TypeLib\Version = "1.0"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC5-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC5-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\ = "ISetupCABFiles"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA}\ = "ISetupUserInterface"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1169A235-14D9-4488-8B56-58ECE9C57002}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229A85A7-2F77-42A2-8CBD-01DD1C09BC88}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CD1F51-7199-46FA-9629-9C89D2F1AE22}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{084A0737-26B9-4433-8007-A9161333B5FC}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A0DBE3-B12E-4DC3-8C27-4197CA4DF76B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B15A454-9067-4878-B10E-B9DFFE03049D}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16344B6E-52E1-4BBC-AA79-E08B10B7BAB9}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8CB9A40-3665-4D33-B239-32CA4C7B8DEA}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FFDEFD7-3EC4-4E5A-9EFC-AD04E14A9934}\TypeLib\Version = "1.0"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8CB9A40-3665-4D33-B239-32CA4C7B8DEA}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2A3A842-FBA3-49D4-8806-7734716364A2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1B9357F-24B9-11D3-88B2-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE0B3F76-166A-4DA5-A97C-318595E3D15C}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E156322-57D4-448B-BAB4-35DC0C7ADF53}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F1ABEE7-FEDB-45AF-A01B-0B4DE6887573}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83755DD1-086B-11D3-8868-00C04F72F303}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F1ABEE7-FEDB-45AF-A01B-0B4DE6887573}\ = "IMsiServer2001"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94F4A332-A2AE-11D3-8378-00C04F59FBE9}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61892D50-28EF-11D3-A8FF-00105A088FAC}\ProxyStubClsid32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21D98482-146C-4EBF-AF1E-B04395110005}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FFDEFD7-3EC4-4E5A-9EFC-AD04E14A9934}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5469EE67-1493-402F-8E2C-99936C9E4983}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3CD7A86-04E4-4B47-88E8-3EE03A3DEE56}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4143914-2238-40F8-A74C-67C4B8ACB27A}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0D1DB92-DE05-4926-A5DC-01F3F9857587}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B15A454-9067-4878-B10E-B9DFFE03049D}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB9BF17-267D-11D3-88B6-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ECBE1E54-3649-4287-9888-D9FB133CAE0D}\ = "ISetupSharedFiles2"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00A0DBE3-B12E-4DC3-8C27-4197CA4DF76B}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17773851-7FF4-44C1-B084-1E1EDB2BFD4D}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83755DD1-086B-11D3-8868-00C04F72F303}\ = "ISetupObjectLifetime"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE0B3F76-166A-4DA5-A97C-318595E3D15C}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2065-CB55-11D2-8094-00104B1F9838}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\TypeLib	setup.exe

Runs .reg file with regedit 2 IoCs

pid	Process
1716	REGEDIT.exe
8728	REGEDIT.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4320	1860	SB24_PCDRV_LB_1_04_0090a.exe	89
PID 4320 wrote to memory of 2108	4320	setup.exe	90
PID 2108 wrote to memory of 8216	2108	setup.exe	91
PID 2108 wrote to memory of 812	2108	setup.exe	92
PID 2108 wrote to memory of 8728	2108	setup.exe	93
PID 2108 wrote to memory of 1716	2108	setup.exe	94

C:\Users\Admin\AppData\Local\Temp\SB24_PCDRV_LB_1_04_0090a.exe
"C:\Users\Admin\AppData\Local\Temp\SB24_PCDRV_LB_1_04_0090a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\temp\CRF000\setup.exe
  "C:\Windows\temp\CRF000\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\temp\CRF000\setup.exe
    -deleter
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\InstHelp.exe
      C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\InstHelp.exe /mce
      4⤵
      Executes dropped EXE
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\InstHelp.exe
      C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\InstHelp.exe /clear
      4⤵
      Executes dropped EXE
      PID:812
  - - C:\Windows\SysWOW64\REGEDIT.exe
      C:\Windows\REGEDIT /E "C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\BackUp0.reg" "HKEY_LOCAL_MACHINE\Software\Creative Tech\Installation"
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:8728
  - - C:\Windows\SysWOW64\REGEDIT.exe
      C:\Windows\REGEDIT /S "C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\BackUp0.reg"
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:1716

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6088

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:9280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DotNetInstaller.exe

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
Size 5KB
SHA256 4f9c15127e16eae3a7ddaed55817fb549ed31168f9861285c9349c468b260579
MD5 f89558047e71f655a4ddb99e893213ed
SHA1 68a0cd5af1aa62c46e965e8e5c85c33de4d4678a
SHA512 6ca5e7ba0db836f88685868d0788119fd441f47972907727f4eb711955f63cc74e3e818b93069a1c2baa5c49e387978acbe8ecfbbbc1723a7f40f4c0e41dac45
SSDEEP 48:67ndi0X7JBqVKk5YCfpZBAv8GPTUc4gQ+fzK/4hotiufsV5ZYNunoIwo8iwegMqu:4di0X7J0VJyopUwUQ+u/4FqsZYfNBsC
TLSH
T15AC17545E7E88336FDB78F3EBD7337824675BB108DA2976F05CE010A6C256608961B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctor.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
Size 68KB
SHA256 9620bdd78c1cad92a2118eab21e4dfa0ec8e9b59673adb84f917331b78402ad0
MD5 66cf4f30f925485e00191c16d00038c4
SHA1 80b576f6e5eebd5577cde81cbd6394136b9f08e6
SHA512 18072bdf7ab50132a08d620b5571c4c8ecb245124d91ebfda5cba1aac4fc41e020ae037cd7a49cfd119978b91c628428e85d2e7bf7ef362d319d9451e6c62cf3
SSDEEP 768:6mb6ReJQ+khADnEq+nZ15J8+DxhOHGyXClJS1NVCGJBVVgyw0oTH0w9nnbH67HIa:6q6ReJQlA5o0AhX7YnnwPJr67n
TLSH
T145633B1B23E3C5F1D7972332BB592B5E217E6E1531E1A3168F1349E32C3262BD662907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iGdi.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
Size 184KB
SHA256 63671696aa87c0862e6381bc759116cd377c5331ab50ae6d05ba7cd29cf02580
MD5 298c79ac2f609736788cc7cacdeeef32
SHA1 1cce1dcc23a941e650edfeaa7de59327fa452ba2
SHA512 29fc496780a4fdac6a8c4af6b737973019e3087b5d3d8fe8625d4ce1de88e437eea0254d8900934846c6519ce0bffbcddfe1aa01cf5736b47dba58f06071fe23
SSDEEP 3072:QYHma2vpbx5asru0aotKiaSk7uH0pT/sm8yoHKrHpZkmJbGcLB+XGLkh:QYHmJx5aslJaSkikH/DN7ggkh
TLSH
T198049E0478E0C13FC7AF0272B9AB6F75E7FCE5210FA5458B97580E4C5F75A868A22247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iKernel.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
Size 712KB
SHA256 cb29c9091d22a94e1aa72a6f2a83e01013e5148d8dcfba8c90d2cdbd6d9b6e48
MD5 1ea0c41b4f2f0e807700f9a72d99ac05
SHA1 65c693fd17be74d1c8dfeadd591f3c3408ae321c
SHA512 3f4e80bd8d3808fb76acef835c70cc00503acf38f13d3cec54bbf9cf87343a4c1d148a146fa432ca884eaf3c327e199c17432c91f6d6424fb3c17890255feda3
SSDEEP 12288:7iG5h/LslnIaEd+NFwwPlpFlkjjFV43j9qPA+6KaT+NBblHcIfzFptT:7iG5lwlIFUwwtpFlkjjFV43j9qVD++Nj
TLSH
T1CCF47E1335F8C125F28E0132EA2C9BB8A2F9DB654D3059473B488A5D6F75AC6C127F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iscript.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
Size 260KB
SHA256 a1c284e21ca49ef189e98e7847826556e64185c5542bd50c75ee30b25ea3d08a
MD5 84cfe010fd3403ad28835bb500a1a81b
SHA1 c57afea136a09266eae1af92bbd53d7c0b084ea0
SHA512 fce50dea91d5e34b6ede4a6dfa4978648062b0eb6fc167f12925002521674d513e978552b46ff3e693ae819bf695367d2fda70d5ee8e6fc7f44d205893e31ccb
SSDEEP 6144:TvOq2nKzn8ppgfI1ueM6Htmr3CTtJLON1:TvOq2KzCpgfI+nrUI
TLSH
T1AB447D1239B8C575C7DE0B31FA9A3F68A6FDE2248DF288430F594E1CDE37A45851252E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iuser.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
Size 188KB
SHA256 c25957200e1390b6a5facb4b1c52c55a8690bd3ca63dbb2f2cc770510e74448e
MD5 b54e00b79373514e838220436bd3f275
SHA1 9cea61a706a28439574d8f1aafe40cd040f5e156
SHA512 8efba669069d41c16e059cdf9bc74944e858b40e07f82a8160a3522e95ad770ab620bee78e0b10a184f31744931aeb790f4dcd4b895617875537ebd29b40a848
SSDEEP 3072:rR5V8qXjwUr2evAytiDQ6Vfo/x67VSKxE3hzHwJO4co5Ht/H157:95j8UrTtIuxmbxUrNYD/b
TLSH
T17214AE127AE0C47BD29B0132BF6B1F69B7FDD2448FF459878B100E9E9EB1946C422617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
Size 304KB
SHA256 ad010c642f2bb264c69c153dcde78daa0bbf4699155f22e16641bba82158e7b1
MD5 369ecaca6c59265f47d234da8faab871
SHA1 162bf1cb2d201766e4f0fa52dbeddd603eca9a21
SHA512 3430ccc7c78633c860c29778a0b854d5acf52b65283e88f18cad51796ece59cee1b2b040ffebd50a6ea52d2ce88836a06c136b92d7efc97e75ce8989d7571392
SSDEEP 6144:Ufc+V0TDWWyl1xqfFk/spCgW4DHV5FsK6YrX81jjOuuwML9j:lo0TDWW8Ig+yU5
TLSH
T1F664190366FA453AF2F72B30A97B1B655EBFBE615A38C04F4385194C1C71AA5CA34723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsP6A26.tmp

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP6A26.tmp
Size 101KB
SHA256 0858229878facde89776f9e4ec61e45cf14eca0bb6be9123234a9dedd0119c1a
MD5 fcd8f741b79248a1a25937cdc780ebc4
SHA1 f66ae868a445d4b802bfa369eff485f52b78782e
SHA512 c1854935c69b9c90ed8ffc8c8b9bdaf3dbbe5cafd835adf5732f19c1736b1b47e04842d3cf4cb0e813c39450c4c55f830145b196e8eb781465950b5c668aa3f0
SSDEEP 1536:ZEu4E2yFOSmAtonyhTwxv6F9ar1VqFtIqNG1lD+7NglO5/U:ZD4ERFTtEeQ6FfAzO5/U
TLSH
T1AFA35282FB82CAB3C40D0631581B63E61FB1E45A2E13B7573789536DAE733C1BB46664
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Objectps.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
Size 32KB
SHA256 b2278ce559b4d4cdce30c6b44f3664d1a6d1a5f0d9e1d99b87ba14bdcf31f4c5
MD5 f935e7f618e9fab282302c0951545417
SHA1 e04ea46a0445d78580839102164602a24e581464
SHA512 4f0f11b35415ad8879bd182de17dfdc43045133bc11107254cffb8478508ec21a5400c707d66186e042bfef865ddd628d5526b0d32e4e08d7ef8ceabf9d49218
SSDEEP 192:JnlX6cRWMxG4RMG180GoxMOSkA7sMC7znkDAa:B3B5Mcz6sMqgN
TLSH
T1E7E26412EAB659B1F68A40343C761577662D3C3148E9E073ABC2DD4E287D2F3856EB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdelet.ini

Path C:\Users\Admin\AppData\Local\Temp\_isdelet.ini
Size 945B
SHA256 2bddec4d4e681b5a5dbf6ccd88e339aecc065f4fae328fe086ad82b55703da51
MD5 5a091033f03b22473e2666e49a909c6b
SHA1 3f5f9961e2ad4433294c109cfced46cd08e95da9
SHA512 55e3baf29d902a2f2fdd9d89db702c595708a75162ff36cae07b2b68fbb0a45668f384fbdd264f12fd61c0ddec0d904a950983a0bc234c9279e989da4463f87b
TLSH
T16411E9866EC1D1E83310791727F1AE1B1F6AFA84B75211218B8EF6973DC5F0C64943E2
MD5 SHA1 SHA512 TLSH

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\isp3A14.tmp\_Setup.dll
Size 360KB
SHA256 ff6944c00f11ab10cc9bcbfe4f6f0cbab088b52448904282a695eea56787d82a
MD5 32fa757c64fb62f07f3205016656a0a7
SHA1 78c7d2f00878e2efa591a6e3ac80edab8242473b
SHA512 d87aef916ce072f16b6ca5978a424f2dc648d880241651019e6f21377834fdbba8dd424b002db373888840b358e13122c87e3db51a7bde6cdb1509fe74ac647a
SSDEEP 3072:C+zxGhVhyz5QpTOyGbs9nHoYgwQ/aQfn1SBLlwYK0yIrHb7SsFK6ZgRb4AtCHeoL:9khVh4yqiIY4uvfFZYCHe
TLSH
T19D74004366EA521CF5F36F71ADBF1DA1096A7D53A938C10D3201ED581CF0A64F9A3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.skn

Path C:\Users\Admin\AppData\Local\Temp\iss385C.tmp\setup.skn
Size 40KB
SHA256 066b519ddcadb23dd5d030f92984b66ac77f38d44d9a3c7582fe00281abddcb7
MD5 80a74317e5617c5f88bb0116fef7f442
SHA1 e82cd59d105f1126948b190f2363baad95881e1d
SHA512 d9e7368ff85a8336d3919f9c61fd581047c3158700f63dc590f8707df58988427a0af7cdea864c5940f60a55613b6363517ecc4a0f4c65a63b246cd58137d3d9
SSDEEP 768:qyAsNlhgmlJXfCbvrcjxTCz8c7rOqJA7g30Vwlr/6upIjpvuW57bujIjBuW5FJuO:qyAs9gmvPCjYdTrc3xJUgb56upI0W5+y
TLSH
T1C51372611BC36A0CF743AF63C7D41CC4A4BAA7F4171E339254E3AEB5A7834972B02952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin3b0b.rra

Path C:\Users\Admin\AppData\Local\Temp\skin3b0b.rra
Size 16KB
SHA256 d12f20294bfae4b572b71cbbb2f6d553b21982c90495fbf69833556b1790d949
MD5 ad4695c916e1610ced05e6c9a34f45d2
SHA1 e0053ffa31732e131b4a3d81204d93b953443785
SHA512 ff44b05c6bb53ae34431e6623a2c2e52d85984b33c7650269b35317822b860c9a38ba0a0f2154396b81811dabae9d2b3d32669ce87c7e87695e3633292a06eea
SSDEEP 192:gp4NNmjsN9zFwFeSAWak8VeumfgAYidzvv:gp4NNmYN0
TLSH
T13672C6D88B37370BC5A2E5B32D6AC481052F53785BBFB0E0A61F15580A9B178C9F6CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioDrv.ini

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\AudioDrv.ini
Size 1KB
SHA256 ad20d37524c4903a06a67bd03955a203632a511f67f92b10fec238e46d119325
MD5 9b6ae0504378e6a739a0644e66b1ca10
SHA1 9663e4120a3c7a63fd5fbc0e14dcf7d1d041301d
SHA512 9fabf2dd97ecc215357a8b2ec75bb66e1613b27f157c0a91f0982242a0c1b1edd5baafb0d3db9cc71443b3c143cadb3201774e6e221799f8acd0c6695bc6bd09
TLSH
T15831062CC733942CC6EF498E172F0E548F9251387131631AF9AD54DBE316289E108FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CT2MGM.SF2

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\CT2MGM.SF2
Size 2.1MB
SHA256 cfa4b5899f118208b2a98b5cc0dd35a81d94b5ac4b44e4652308c2d5aa0d646f
MD5 6f6a1081d2e4f081eb58b4e32f8b3393
SHA1 932f47de8825f19b8a4e08d0203cf2be9a425163
SHA512 46ddc17c2a63f18011d2affc6cb7b4db5b2d979959f22dd4178bd98c3601472cc3a713d0064409996060b858ff882e4bcbdcd7dad2587e1a40e2474ddb674911
SSDEEP 49152:L1euZ016maDk+f9QvcEywG5Nn6VHFC1x/t69/7j+V7:L1eY016cIQvDywsEHFC1zofG7
TLSH
T1E2A5D0A9B456CB37F82C9EB36CD78522FBA8B3443E52C80B64514385E4F7050AB99F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CT4MGM.SF2

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\CT4MGM.SF2
Size 4.0MB
SHA256 6c429ea4769c8dec705e6f766f6194fc14e3d8462368296b01a0768d669eb1c5
MD5 1652dfbefe914bdb8dc03afc0c76f619
SHA1 67f7d23dfadd2809169c81c6d9d21d7bea5c83ca
SHA512 ddd71982b9ddc9b6691de07116f3a44ccba12817f9de5ecdfcaec1e9057ad5ed420d005e0190fcf4e0fa01c0e07d6bdad876de97c131f09f007e1273d19c4e67
SSDEEP 98304:Rtq/ur1VFTUcJFWIhT5THML8oHZ8eYXv0w7D2mHQ6JZGei5:7qWr3FQcJF08oHZdYX3lw6J
TLSH
T104161223F1524B0AE434CA338CD21542CAE9FA4D3E42481F655BCF89F5E3560EAEA75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTHwAccl.exe

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\CTHwAccl.exe
Size 40KB
SHA256 30bf82abfe5436186bd400238270733a120f73b0e65690afbc061525221f026f
MD5 43b2940b19c923beabbbf92fd85a28ab
SHA1 9f18dbc776f2ca67df74a82a3ff24153a5364303
SHA512 73c6c7b57de9dc30851b692e074aae58985b2c99ab534b1405e04dbcdf57b1c7dbedb529f7d2be1e68983098e2329080d51c10741691641003283165d1f4fec2
SSDEEP 384:q04x1Z2vjjp2PpQCzNKjJB7F6td0yQZK4WrF6oZGx:Ov2bcpvWwK1ZK4oF6oG
TLSH
T155036C6379D70533D5D2827158B00B025A7FB7621E72C8DBDF845A5A3E31AE2AE36343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTRWE.DLL

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\CTRWE.DLL
Size 40KB
SHA256 d39c1f34abd98ac68b94f2c5678c7652192e953ae4f74115455b8bc7d1ebf6b0
MD5 040f00bea29d6ae631fd94b72b5d6cb4
SHA1 2ba92e2c843154094c6ecfd0dcc5a1e3b6b4ecc3
SHA512 7a2a4ed5b7a4f7860214a858ac36a41e55c4b1e20d725c010722384381fb134c7b69e6289f67fbb974911efda55c77c841820801f9e3733a67c623de04f5d5bb
SSDEEP 768:3+SNMk93ZlcbjRYdfiq7yGxurwIPqF9lkM:3pNME6yG4urwIj
TLSH
T1EE034B1273C1D1E3E1921230ADA59EA967EEFE104EE4D50BEF46375E3C317C5AE26142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTRWEU.EXE

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\CTRWEU.EXE
Size 48KB
SHA256 c377ea6c55ea65c4a39793ba8e16b9b9ff3d90f897c12f6c7734115f36d049b0
MD5 ad557eb6eeb5e820f82015d7978b3fb0
SHA1 937825c1efb063690d54f552f1febb4af6769279
SHA512 2f109b0ae443a7e12e4a6a861946d51376a148e501f20ad67f26c5e3f790593fe2285e4b4ea3707c9c3031bbe835cffedec7e5e86e3e7b4b762d299976b8edec
SSDEEP 768:gchZ8w9YXJYxkKJLCoUCLoAXG0dCrK0NJbposPAsu8:gchZ8wL5blXGvrRxosPK
TLSH
T118239F237D50C175FC56557066BF9B3AAF3B66D903349597CF44D8B63C22220AC3A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spk_2.reg

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Audio\Spk_2.reg
Size 129B
SHA256 216ba7d61303a1ad1dddf429265607abbde2349b68ce76d5b154fdb3e03e0736
MD5 0bb537f3b3a66023084fd53eed82a9cf
SHA1 256470fd75dd5d96ea2fa573a2a5b447fcd25d90
SHA512 9b35b49b1dc28aa105525faf947e2690ade468b72eda15a78d363cb6cbb057e53c8307cd8cc65d8314551a56d7cae84265225599644995f3cd55eedbc7d11bc2
TLSH
T106B09B74754382091E5982906550F0803465909D517F9CC275658507372FC5510DC7CF
MD5 SHA1 SHA512 TLSH

Submit Download

BackUp0.reg

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\BackUp0.reg
Size 202B
SHA256 f873f70ea66e7c3a79308ee7402f97fa219087e3eef867126be6364e9646f3ef
MD5 df6c1e330c32e2ac3038c119b7777248
SHA1 66ea16a3eff7041f2a88238d43f7940586b22330
SHA512 195ff8ad570921fdad8663375d5aa7fbe01e955d992054115eab643c3ebf7249c6da447e1126952f4f76957845877fc01f4f5b15955fd0893cd917fcd4a160b9
TLSH
T172D012531BE41009F6F32FC49EB5E5159F32BCE44834E4EC1284410E81F1500A4603BB
MD5 SHA1 SHA512 TLSH

Submit Download

CTDeInst.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\CTDeInst.dll
Size 56KB
SHA256 8d0f884d54d19f9b4a57700a2027ce5fb2363f44fa998b09930ad580f8ddf3c7
MD5 76893a9123cda779a800a05980f4939d
SHA1 d4ca5836c87970417f3b192dc00ba461f9bae630
SHA512 eba40c239a6acdd206e57f770680b76ffb162d008865ae03a846e225c2d192364fa73a3d19fdf7a6244378c23ff74235f3b480bca86b5e4daa49235aaa3dd8b2
SSDEEP 768:/1/0fBzawhxb35dZqkTX1OCXOCy/6uqwAHAV61MJSfoDLXu:NG/bXZqkTX1OCN1jwAgVoxoDLX
TLSH
T1AC43AE1238D240F3D289463914F65F2F1BBEB8260FE5D8978FB1565A3D325A0A12F347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CardScan.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\CardScan.dll
Size 80KB
SHA256 ca6b0a0c82c5c15f0ead1a2daaf8191f4f02ca3032f1a1c017bc05871e648980
MD5 4b3cee21f9da186836ed6605032b7790
SHA1 55875fa2afb203544a38564d3256ed56cfff9ee8
SHA512 f4f0baf88e03c228f3950a987d66d2b6e6266ec1fd7f71ff860235e9f26cee2fe42ec509b29fe72992d406d23bc789582b0622db18f87c964b8c1a5d9958b36e
SSDEEP 768:n0IBGuyvTuqnN8KwWBciGf3kA3sfwVzezQlK2ASC35msZTmlLyFsSir+VprbkKVK:RYh8sxW2/H3QsZTmlmiSLcKV3g+TOF
TLSH
T1CC838E12B5E140F7D38D893510A69B39977EBD510FF24893CF6ADA191D32AA3E13630B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Common.dll
Size 128KB
SHA256 013e947e5f0c653607d3bfb7a0df1ab68ae6a54b7edd943f816e34d1ca0d5312
MD5 7b66eca3d2efdf0500ca63b0a4f18ac1
SHA1 a6ce9529a3b2c85c9f13abf5974b176bb6d5c194
SHA512 390fe0a2abe8c57f93f5823af89c64660107e46a1b0e9231f80d6da8af2d99ac8e991360be7fd4fa7ddb9ab7ebdc56a9d8949d9b4d2f9e4b801e17ee1e44b462
SSDEEP 1536:updTMpUHMgqSjxkdYXonAF7jl1G1OxEaBEBXt3yONgyONtPPetFFYspS:up4g/C2XoEl1G0EaBEB93yONgyONep
TLSH
T151D34061B3E9CC21F0F29B3DE8F647936D66BC910434CA4E9325B35F4836A50ED26369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Creative_Installer.ico

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Creative_Installer.ico
Size 202KB
SHA256 41dfcb0920fc7cc0dcf9f675b6cc2ad351af8f496cf017329b48424d80ff2a58
MD5 0f577ff887eb12a06dac60a48931c78c
SHA1 8927bcc1e7813468f8c490984486fd26a121deef
SHA512 125ef16bbc5481f9644d7707f14cc8232ec7c42f3187f8242d0f6bd4ad8f33a6feb66d15885618ae5ace5153283737c5f891607e036b7a0c9f257c4c77d5b521
SSDEEP 6144:WTcDz4aPOCphzknMMItnCCCCCCCGTRQmoSsD:o+z4aPOCpyKnCCCCCCCGTRQmovD
TLSH
T1A91417116C9C4A9DD6E45478F96AE0F18363FE484AE5924728F8BEEB31FCCDB0211365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Error.ini

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Error.ini
Size 1KB
SHA256 a9af741a77ee16676c99063f0a3429b67f65aa09dbab9d9ac7d6802aa638c71e
MD5 9818bdb1cb7441f0a873fe2520b8bbe0
SHA1 241b7d1bca5905c89df05e9accbe28f8a70c5cea
SHA512 350a4fee0569499be2d93f899ad6335bfaf57ae3f9b76dcce75a0b7545df35808cf171cf2311abc75ad4b3f152fbc4bc51c085205fac122b3c9206fda52121b8
TLSH
T1BE21C8EEE7C431971CDDF1D80A2D9C3AD28E888C49D1190C539DA28C3DC7C863618FA0
MD5 SHA1 SHA512 TLSH

Submit Download

InstHelp.exe

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\InstHelp.exe
Size 50KB
SHA256 4932183c695afcbd5c755159d677946afdbf8d959299b54aed0d3b5e479be1f3
MD5 693d110d37331a42b5035e73c447e31d
SHA1 33fb7e2394470049c1d0a1aeea31d0e6a2e14ae7
SHA512 f6b3675827dea4a4ab45f0cb8b4bba0c31374f0a76340a3cc065453760e6dd840e9081f41adcd793ae621e84785b9b162b9c8fbf1ebf58ebc2403012a8198eef
SSDEEP 768:6x2L29tilMTa03KFAN4aUAu34+zVL+clQO83TLL3DBNiyVLjCz3:W2ybilMTp3cAN4aUfhz8e83bzTLg3
TLSH
T15A334AD772D180B6D0B792798DE20B82E27AB435137513CF576881662B73BD8AE3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfmodbs.vxd

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Pfmodbs.vxd
Size 6KB
SHA256 ae9049c14d040bcc8151f087e47c3adab959954826526106aee309c1c07cbd01
MD5 3ddf69a759f5a9e6ad9de94a5455ea56
SHA1 3f27b7dbb47034cce90cdb3660e435838d882841
SHA512 abaf548f1a6640b23601e294adf545f00919bc9d5a83b53215119cd2e6d46e0c2d632bc661d66f1924bba478f17fa1e2164ce18e5aac7b17666a7dceb3a6b5a3
SSDEEP 96:sSjN2ecXGeZtnpxTvWGTFAdaCcuGqGGGVklvbjq:sS4zZtpheaCcuGqGGGalvK
TLSH
T170E11A41F944CC4BC54F433021A3EA36AC98EDBCC38BC59782AE71262D909D4866E0AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RTFUtil.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\RTFUtil.dll
Size 28KB
SHA256 59b865998650d1c4f4fe625f1f014caae2a0d74a3f0afacdab5553b43026b889
MD5 6c94c1a0c37e47181872e542a70e4074
SHA1 9422a7f91c7a56551bf6b2b9aba929fc68df31b0
SHA512 8b5fb5bcf718b66d7e6a892768650dd16cb00e4684852c4b686ff4c93b06dc40e0e6d32a24e561e94453b164d94e0ea61e55b07370190bd4b082c6ba022a1d8c
SSDEEP 384:72wFRgpTuJ8WXjTH+kmlYPjWByrMtroIo9D18:pTgpTu5zTHHmxcIo958
TLSH
T148D27CB178D500BBC21A813268FB371B6A7E6D111AE508C26BF06ED62F35153B52FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegEdit.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\RegEdit.dll
Size 44KB
SHA256 fec56ee5e5e0ab643b3123f860bcdf657186ea32f0263363c1f03a5b4b13e74d
MD5 29c060fabbbae7b6977aebc338425b6f
SHA1 2b069c68d20c494bdf1672127aec3d2ca0c739e5
SHA512 3f711810865af5f44df0f323410c7ed0de2fbbb1da168078f0a2a78abdc74fad750cd9ec17a8029a373887b172a75b2e3a147c206f6f8c091be72593232f0e71
SSDEEP 768:1NJswmFH0TqWcVepueQTjShuYYMM20kuyNANJRUSjqoyvYu:1NJsPjiQTjShuJMMDkBiRUDoqYu
TLSH
T12D138C22348240F7E2D6967506E69F3A573EEE910BF288435F729C5A1D321B0E63B357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.bmp

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\Setup.bmp
Size 8KB
SHA256 1b26be070768c71e00254444ae966d480cf597e7265eede45072df0833cd65dc
MD5 897f2611f648113f778170942a425cc4
SHA1 d82d92d1d5d14c8a763ba4606a8ff1963bbda1ee
SHA512 b7f3cd1e87363c44b3338263b534cb2ca53c17f6dbb210e344e771e9646b3ab1989aff22f17f174e349029f13285c0b01832217ccdf66cee3d12133d3812fbe5
SSDEEP 192:ClK65O+thwWiJnxscSXfejiLyFTPgWGBjxYcWnIxR:m/OECscntjeYcN/
TLSH
T17512E83B8EB7872BF18B6B664574707A3F7D095FA70633806E8014047EFE784095B96A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebDrv.ini

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\WebDrv.ini
Size 1KB
SHA256 8109028bc6edf52d87d7f4dd7eb4bb63fd538df674edd7455d33b006b2545de2
MD5 29274260b8f3ae4ebd3ad0faa01de7cc
SHA1 27e61f4979d5f885d8788bbe8764c0ba7869dfec
SHA512 45784773770fa42b3b3c7715cfe075c4e258e9e8d5d81ea1e2e33842cfee2df0c171fa5901cf5089dbdaf87444025c3a9791e139324490f3f3bc0f205760041c
TLSH
T12D21FEFDA1466278A08B6B752F426CC0AD9A70DAC6D31504B1AD82C4D72FD0C926A3DF
MD5 SHA1 SHA512 TLSH

Submit Download

_ISUSER.DLL

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\_ISUSER.DLL
Size 172KB
SHA256 06cf694bf6b5ee8cb6af8d9e6b7da9dbf7e13ac66dd8659ac97f08d8c79b93d8
MD5 798f16673c833dbaed88a04caea00a8e
SHA1 6b497cf1371f6dd3e3b661c9b6d81fa373e734e4
SHA512 e8d522d7ad402616b463f1fd1e8a1cdd23004e9379ae1e0239abc62d1bd5f03cdf8e7efad5754bfb60165d26de37686557c44ccbe4c269b5506347ff6cbcad86
SSDEEP 1536:9bfw+wwlQbatRR07JSiJcvQhOgv/QenWz+fT5eqocGZCX:xIXatRRGwjYhOgtWib5ejFIX
TLSH
T101043062A3F84219F6F77FB4AEB952640E7ABC96AD78D25D1250405E0972F40CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_IsRes.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\_IsRes.dll
Size 356KB
SHA256 269f7f808409cbfce1a800221e28cf03f4743f5b3d98d5479ae4e8a6e3afb58b
MD5 acb826195230ba7c391b447c94910cce
SHA1 818affc0c770fab09a2f34fab3b2847623efd102
SHA512 7ada14e3829bac14d2fb5622109d7c594dcf9bf89e1fffb46308b58524779bd96e48d9cb341265738fbd9a7ad11c0bde972bd3b7f97ba31f896f4c9f9337c45a
SSDEEP 3072:nFnCQcfoskkkkknOpb9YfMX0E9QsJB9cWe7Ka2qJpSCQonNRf:n1GoskkkkknOpKluaRjNR
TLSH
T186740D03A6AA804EF1FE6A359CBF2E644AA53C17993082387954FD1D5CF1A50BC17F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isrt.dll

Path C:\Users\Admin\AppData\Local\Temp\{64B8F4C5-90ED-4F1F-8902-16EDF61D3CEB}\{EBF2EE61-718E-439F-929B-DC1288D6BB46}\isrt.dll
Size 392KB
SHA256 bea0a8f8454b94bd4cb2bf35a5363e538f816fdddd1d231358703d005faee17e
MD5 ea8a40913840238aed96eeb9dc19af1e
SHA1 8f94967525d852a5aaa1fb5ef8cdb20a98709877
SHA512 94973dca8cb25abd65c83ba2a680b3fab4ea7401f2d2b28f95369f678fd15f134d7d1dcbc812f285d30ab8003765928ccbd11d3924d2363f4a6f25d5b3df969a
SSDEEP 12288:svy9vtLXxLR11fcZlgUFPZYDMkS0GazZfOfyBISxT:sKvt7xNcPnvadGKBdxT
TLSH
T1EE848D01F6F5C53BC26B0134FB296FE9A3FC56251D619883DB944A5C2F73982D326A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Windows\Temp\CRF000\CTShared\LaunchEx\PIDInst\setup.exe
Size 114KB
SHA256 c500187ab0bafe03622c8fc4754915ed4cd36f643e691baf21c172c233660cc8
MD5 cafb55aa463c6df8802122838d50d2bb
SHA1 90054dfba153d69c426723121f2746d2aa18f912
SHA512 e0d064db008543bf0d62ef93e60529393e7e7f1ff121f6e0cb7274a0ec981a3edeeb25cfb0a6564558aa8f6ed2750af39714cea3fd0bf3a5059f165b7a6813cf
SSDEEP 3072:QAsBJ4EIukM38TrcAXJGnuMcwyBtJLt5Aa:zi4EIQ8ETucyVAa
TLSH
T1B2B33A1277E1807AF2F31731BD7526B14ABBBD311A38C60F5764264D1FB2AA5CA64323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ibt

Path C:\Windows\Temp\CRF000\CTShared\LaunchEx\PIDInst\setup.ibt
Size 366KB
SHA256 5357b88bf6e69d64ea3d4ed14c61c0e23159a503676b60d104e8584a9585ca0d
MD5 80087ad2e552ef6888543b4bb058f993
SHA1 6524362eebe7681cc9a944587f5e10de59498dfb
SHA512 0e7630961c591b2b9f304886b0ef23449778be5b9c39bfc4980bc9166693facecd4ea60bfe4be822d375906bae7aa065a310214b3b03766126c5136964be8941
SSDEEP 6144:S91gti2NiRZLw4/QC0VdmR4iQ2MnfdFow8jpzxePwUkJsqq7u/S5C32QSeRriSY4:SSc234IDVHZFFMzxuwd/SK2ELsxeu+
TLSH
T1698423D1FA7277BABA454EBA9431A7AED4375F10834A484B11A3CEC89703FD33544A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctzapxx.ini

Path C:\Windows\Temp\CRF000\Drivers\support\vista\amd64\ctzapxx.ini
Size 78B
SHA256 5c7b856e0c59b632d6a85a7544c7aa21d4d3ca191cab9c8f67b77f8a73509405
MD5 cc99bdcc7a4fa8a83523994fec232767
SHA1 08d8af8eb6d2083219e794c1613d891b88a6637c
SHA512 127b5ad09b60cd925429a6519ddede0ac02a643cfe93873373f0fefcf5d4a380cb5668ecd2deff5a94118f58dfdff51e4512c614d8be82068dee87dcfe76d9a6
TLSH
T1FAA0243051410CC171C7773DC0130431037F7C11000FC15F0004040407F174D314455F
MD5 SHA1 SHA512 TLSH

Submit Download

APOIM64.exe

Path C:\Windows\Temp\CRF000\Drivers\vista\Win2k_xp\AMD64\APOIM64.exe
Size 586KB
SHA256 ff3f50f99f3554b965a75d6b43860c25715a85ec59e023a0b7b017b0aadf5022
MD5 687910fe40b3bb1c07a74f21d23557ad
SHA1 3aa87ab8a04419049e117a08f59c8f09a88cbcee
SHA512 bd3078d38d2d043ceefc149ae7bcadf6c4d2f0dcc9c3174b2b18d83db7f5e4dae6cf47add1e614f1e7131c2e7508544c10fba84bcb079a8ca80f9f49e0312c98
SSDEEP 12288:qm0fZpqVpP0uoODHYStSaO4/Yt0jYize5uPwsdODjGrnZ:qIPbo//4/20MizOuPNOWrnZ
TLSH
T190D42312F6C74226E09A507085D30BA9E2BAFD70F8256693D3D87A0A1D32DD69B3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.txt

Path C:\Windows\Temp\CRF000\License\Br_Port\License.txt
Size 61KB
SHA256 971d8515403f10dab86123c08903fc2892beec2306fab7609cbeae973236f712
MD5 d1876495995225cad70d0de9cdff558b
SHA1 1627ac72982fc8b1ebaa3443888f7fef39bc9c6d
SHA512 488aef735b9d206a91d229ac7385790c639089e45a7f5de7a4515ed34c56df901fe2cb8067b8082eed9ad2eec4a3e4b015d18d002ec21e10daabd25c3bbecde1
SSDEEP 1536:mRNULDcUL3TATo0nv/961DO25nlm9ZZztLVzA88A:iNULDclBnvF61Cp9ZZx5zA88A
TLSH
T1AC53E93CB6C51333065313922617D4C6F20AD3E8E19ADAD669F9818D33E1F94C37BA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creaf_ms.cab

Path C:\Windows\Temp\CRF000\creaf_ms.cab
Size 40.5MB
SHA256 ca3c727a71fd08bfce35aa040c001d87320fb80e8bf9b1ae08180748d914289e
MD5 aa19a82e49a8617b5872d2d3e8d23581
SHA1 fcb8ceaf8e4b45372290f32a0ee9e6f824dacf9e
SHA512 cec01b468b841fa5b4d345bb3c600ea4de62db099f4124092502b7a23c0f005c833d00126694c1028053758d0f0f0b99bdbae34b261376ae0122018a40a2d05a
SSDEEP 786432:nQxO84w8AV22/wuGEP4H2QZmOdmwW3DE/ByzChY39qIQ:8zAMbP4H2QGV4IL39qp
TLSH
T1089733F3919ECECC7C4510A2E0E0A009E0396642AB185BBBF50CD656DA976737B75F8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CMNSUPT.CAB

Path C:\Windows\temp\CRF000\CMNSUPT.CAB
Size 1.1MB
SHA256 bd601630053310a961ca4a69954bedf11888b21decff38ce51a472b4b23980df
MD5 a7bd837e082428ca74949f43662d0d44
SHA1 b2cb7b5437cf51d3240f480a70c87d0b55c149ad
SHA512 343c390662dfaa6cb937d27093ecabb9991e68207352e6066085334b1d5be3798a38cea89c3dd8f40ee0af36bdb1e1e722e95d81b361b2b462c60a29e4841996
SSDEEP 24576:kXBxkZLdU51EW1765jYpfiyhAu95064f/Xny9x0zkfFWD8wXsRf:+7L1TWjYJ52BvHnCxUyFWD8asRf
TLSH
T19D3533B7E87583FAE81245BBF45AC33E4301110E1AA3CA152054F6597FD619FABAC2F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTCABEX.DLL

Path C:\Windows\temp\CRF000\CTCABEX.DLL
Size 280KB
SHA256 98f09feacdc59f4c9b3b8be70ecc199e75ef995029b64d1aad0803faf013a5d9
MD5 5a19e45818366b49cc93b5bc483265e8
SHA1 288ebe662a9f522a1e76fa2557e32eaddc494ea1
SHA512 4bbd146091ff41da1036af11cdde00b437e0f4d42d465028d9c4cf9711aac902be54e60da9b9989e44e9c67efe740ac5157c9faceaf97a71fbfac2c644e240a5
SSDEEP 6144:1Wy71bY6Jb6Cgid1xEWvNMcAO8guQ4W7BEgXUq7KWFQ:1v7LzxOO8gJtEgEqnQ
TLSH
T107548E01B992C479D8DF06755AEA2B3DAAFD6A942B46D4C3C3C41C6CCF339D2A53160E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Disk.id

Path C:\Windows\temp\CRF000\Disk.id
Size 73B
SHA256 ec2beabb2da8c25ae1f71d342d0e1b8d89fed4780b4d99922090090cc2e26987
MD5 afa8f823fb17e0a035ea3ddfcbb79e84
SHA1 e23b4f3fe37e738e779dca01f66fa31138a3dc53
SHA512 2769ea4f8ab1ad44f6cf28f2310192eae3f3722415702204603dd5da45efb2e3e902ca9740ccf543b62a93e7054aef21cac40a011fbcd8640e73f59569b7c616
TLSH
T1A9A02434F3C1D44C4C003445734300F317001054437D04F430354404131DF04343005C
MD5 SHA1 SHA512 TLSH

Submit Download

SUPPORT.CAB

Path C:\Windows\temp\CRF000\SUPPORT.CAB
Size 5.5MB
SHA256 c892bb749c43c6cf949cea8747f42323da91f38e8e1ce890c5e0410991160b53
MD5 00e23e011ce545a915218cfab9b69d75
SHA1 2776638802a95ec58b5d3d03a220702172c46bc2
SHA512 039dd778d68c83125d31a5c0b67e116b5b5d6c7e196f2630d29cd7d140064c31fb4c856fde2bcc577cad476754ebfb4ec0f660da4feecd5d50cf83248f1197d3
SSDEEP 98304:kVN7t/24xvQCPHWcSpEVHcIdmsEbThU3VA3KLSvvdFi6A:kDB/2uvQBpyrEG3VwgSv3A
TLSH
T1FC46339594D745C02EC580D631CE30D0B8CB3B046FCE752AD06E8A19E5B94FE2DB6FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data1.cab

Path C:\Windows\temp\CRF000\data1.cab
Size 1.1MB
SHA256 284baa56b7770f365c821fd80970b3ec5a23a3cd3fca92ad39d430747db52eea
MD5 58fe5c5e8ee33d8da5a61a719c22a405
SHA1 f13a95d5b03f8cb7a533b3a31369a7467e35084d
SHA512 b413725783e77efdfe691103932e73613835c1814fd692bc6119d2c4089795fb6feba5f16284af230805eae83d3b417379c414bd049a7c842c3c9000cfd79411
SSDEEP 24576:NhzMX9x1j71eVXqefiMeb1ete2Ie2DGeXqeqqWxYjAteryIndQeJt3pqnez4:aj7iij1jhzWxYjAepLh4
TLSH
T15045233701ADB9FB993E4DD8C24AD80D6952C7049334F6BED6CC8A27F0653B66503D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data1.hdr

Path C:\Windows\temp\CRF000\data1.hdr
Size 17KB
SHA256 cae343878d0d55fd3b7d7bc6b338b34c28c92e6c0836bfca3822dca502917384
MD5 102e033e26e2b3601c53cdffb9d22809
SHA1 d957875074ae4c5c30ba85675e6438e29624551a
SHA512 7c4dbcf66b5ab12692dda512a266b15035e12fe39d827878640d605c0464f3ef07fc5f8d8f4834381ed68808bca3168df8f7a3b5249f8f3d3c54d880f5dfe82f
SSDEEP 192:XzQGB2ISV+ppXcub5hqQ0v9bRDafdPtftftftftftftftftftftzPd+q9j7C/8kt:EGBvSV+pl/b5gMQq9j7ty9
TLSH
T1DF823D25DF21B4B5DCC857722B57078A2F51DD8702A8D3BB505C63A5FDAE200EDEA2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine32.cab

Path C:\Windows\temp\CRF000\engine32.cab
Size 448KB
SHA256 fe5dc5947f277b459cb55877439e74e9bb2fb891cb42b72abc42322a51e8423d
MD5 de89c44f15d1bfbcca26778af838f720
SHA1 5765184ccb2a2eed633d62abf50507235bb920b0
SHA512 8aa8d3c94ec73d89af71461f4188c308f1f7d88af4a37736ac7b8ab1691933a067fe6e11ca58c19e984002faeb3fafb2c3ec28edac198b59b2b0934580de95fd
SSDEEP 12288:s+uPUhdysAvxbSmN9S7ktPkpc4OuOY56/g7P8Rp75v:4Qq87ktMu4OuOY5grv
TLSH
T1F6A423F956B82C8548DE033525E2E034D62911AB37F43D65B0A5F8FB60C2BB27E6931D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

layout.bin

Path C:\Windows\temp\CRF000\layout.bin
Size 492B
SHA256 a27f440e0297f874eb0228d157d7db883022b7020d83f25b774b074f29fda102
MD5 4e990a2c01afbab7fe01a78db72d7b03
SHA1 906dc817045750d77513151f355223a3c12f2449
SHA512 acbb3fff993bb389627c077328a6ad0c3b4fcb6827599599ec5d9791960819e4d8ccc02cfc0db4c5b9c812ff344cef10d35955a1409cf49720c01d511334e6af
TLSH
T197F0123E0F235832C4125D74543FC47D4ED265D214E2C6DE322171591D6FD08FC501AB
MD5 SHA1 SHA512 TLSH

Submit Download

setup.ibt

Path C:\Windows\temp\CRF000\setup.ibt
Size 425KB
SHA256 8af43e8f489b166177d6820783f55d32911baed67378e5542ee0a3e3c51ec4bc
MD5 0fcd29b249c145bab33f24c8341dd0a3
SHA1 375d97a6c23974da0f73db806533bc3205676ec0
SHA512 57c5c61be9c2105dcc6da9830b527cb0acd83f04faab418df603874a3b682cd33148b3092ad8eb0b9ca91aa011278a5576aac62aa4074ebb4759928892091e55
SSDEEP 12288:SSc234IDVHZFFMzz//eZQKqF/SK2ELsxeu+:Pc23tDV5jZ4tq+
TLSH
T195942392FFB1EBB67F8455BAB43093FADC1B4E58824604471617CE9DD603FD22841AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.ini

Path C:\Windows\temp\CRF000\setup.ini
Size 680B
SHA256 20b604d078640e8a728163236ad9d8262fb2e1bc47b140449900b63bd692c50f
MD5 51e17457b25f32e51825ca4e05d3dc64
SHA1 9bb980e92ee7d4ec166bfba8d199ded8daca8e26
SHA512 298ff4fb6f61a2ce61789983a821e03353f3c1be81d297cc626c49ce637226d8685df0133ecb6ec3d95ff393be9ca4d00ef249881ba11af34ab612d1ba123164
TLSH
T15E0102F7D34DA42A34098A5DB63E196467D125A842CAC684C2C4462F5E9FB48FF942B2
MD5 SHA1 SHA512 TLSH

Submit Download

setup.inx

Path C:\Windows\temp\CRF000\setup.inx
Size 361KB
SHA256 137cc60a43194fc833f30a5eb4db159a099bcda7955edc2b9945f9efc296c28c
MD5 5d9c2cb565a88ba968cc0d8b9f8b3202
SHA1 3867c7adc75cb9ee4fab088f9f1fe25a15114dec
SHA512 96243b0d5310727e53dd1cc047f9091adfdb6d3a3a3bd082cb1fd44ae307aa70078488205588c6af84c7965f18217b3f7186c1f1dac79e467750541c2964a8de
SSDEEP 6144:jUSMz7N5vcQ+5ocsR/yPIApR06feIBXxC7a3:jUSQN5vcQPv/eIApq6fea8a3
TLSH
T13374CF9C4EA60FCA772C8AEAF437089036C5EC4DE1B45A97A3E2C590CF794F940DD199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2108-321-0x00000000058F0000-0x000000000593D000-memory.dmp

Download

memory/2108-383-0x0000000005B10000-0x0000000005B6A000-memory.dmp

Download

memory/2108-7876-0x00000000060E0000-0x00000000061A9000-memory.dmp

Download

memory/2108-7938-0x0000000007140000-0x00000000071A4000-memory.dmp

Download

memory/2108-377-0x0000000005960000-0x0000000005990000-memory.dmp

Download

memory/2108-7922-0x00000000061D0000-0x00000000061E1000-memory.dmp

Download

memory/2108-8153-0x0000000005D40000-0x0000000005D62000-memory.dmp

Download

memory/2108-7929-0x0000000006870000-0x00000000068B2000-memory.dmp

Download

memory/2108-8192-0x0000000005D10000-0x0000000005D1D000-memory.dmp

Download

memory/2108-8237-0x0000000005D10000-0x0000000005D25000-memory.dmp

Download

memory/2108-7999-0x0000000005CD0000-0x0000000005CFE000-memory.dmp

Download

memory/2108-7981-0x0000000005C70000-0x0000000005CCB000-memory.dmp

Download

memory/2108-7946-0x0000000007390000-0x00000000073C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads