feee096c1d5d0d7bb7b36b18174818f7bac889be7668c550ff0e5ef9206ea9a5

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KeePassXC-2.7.12-Win64.msi
Size 34.2MB
Sample260816-e9wpsadk3y
SHA256 feee096c1d5d0d7bb7b36b18174818f7bac889be7668c550ff0e5ef9206ea9a5
MD5 f4ae20011ab36ecd2d436753a05c721f
SHA1 c0ce3eeeabc7fd548c3fdb3996b3e5fbfedbb534
SHA512 c528a4c96f2155ac7f3cd05593969933200973467eab0136c2dfc0dae9f57a5045574242bdb983164c6c15108c9be1a80bec1940c6e74189cc74990bf34bad23
SSDEEP 786432:XnBoo+9N77BSFJy3ccSMXp8nkc4u1R9uHJ6vulYYQT+SEPJY1stzgO:XBooM6Jy3ccFZIkc4JHJ4ulYYQqSEFtt
TLSH
T18177335675A5C062C07A0A34DC26AFF1623F7C2CDA2588472363BE1FF9769C1627B607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
360	KeePassXC.exe
5672	KeePassXC.exe

Loads dropped DLL 56 IoCs

pid	Process
2540	MsiExec.exe
5700	MsiExec.exe
5700	MsiExec.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
360	KeePassXC.exe
2540	MsiExec.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe
5672	KeePassXC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\KeePassXC = "\"C:\\Program Files\\KeePassXC\\KeePassXC.exe\""	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\KeePassXC\share\translations\qtbase_da.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\plugins\imageformats\qsvg.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_sl.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\keepassxc-cli.exe	msiexec.exe
File created	C:\Program Files\KeePassXC\Qt5Svg.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_lt.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_nb.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_sv.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_hu.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\freetype.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\KeePassXC.exe	msiexec.exe
File created	C:\Program Files\KeePassXC\plugins\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\Qt5Concurrent.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_zh_CN.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_de.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_fa.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_ja.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\jpeg62.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_pl.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_ro.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_ru.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_uk.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_zh_CN.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\botan-3.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\md4c.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_fr.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_ca.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\Qt5Gui.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_hu.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_vi.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\double-conversion.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\plugins\imageformats\qwebp.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_pt_BR.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_ar.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_cs.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_fr.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_ko.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_lv.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_nl.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\qrencode.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_el.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_fil.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_my.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_th.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_zh_TW.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\libpng16.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_de.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\plugins\imageformats\qico.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_it.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\minizip.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\icons\application\256x256\apps\keepassxc.png	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_be.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_en_US.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_pt_BR.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\plugins\iconengines\qsvgicon.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\qt.conf	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_cs.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_hr.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\qtbase_sk.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\ssl\certs\ca-bundle.crt	msiexec.exe
File created	C:\Program Files\KeePassXC\libwebp.dll	msiexec.exe
File created	C:\Program Files\KeePassXC\share\translations\keepassxc_uk.qm	msiexec.exe
File created	C:\Program Files\KeePassXC\keepassxc-proxy.exe	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59e853.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF863FE51DB2A65C42.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFECA87BAF4BAFC250.TMP	msiexec.exe
File created	C:\Windows\Installer\{638CBFF8-D709-4E43-8B2B-AB97A8E0F2ED}\ProductIcon.ico	msiexec.exe
File created	C:\Windows\Installer\e59e855.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0C43D07FB948D05D.TMP	msiexec.exe
File created	C:\Windows\Installer\e59e853.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79957BDB1393113D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF38.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF469.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF70A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{638CBFF8-D709-4E43-8B2B-AB97A8E0F2ED}	msiexec.exe
File opened for modification	C:\Windows\Installer\{638CBFF8-D709-4E43-8B2B-AB97A8E0F2ED}\ProductIcon.ico	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4544	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1676	taskkill.exe
416	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\Version = "34013196"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\ProductName = "KeePassXC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\PackageCode = "13CAA46F82C0C9241A04CB2B2E474A32"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\ProductIcon = "C:\\Windows\\Installer\\{638CBFF8-D709-4E43-8B2B-AB97A8E0F2ED}\\ProductIcon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx\shell\open\ = "Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kdbx\ = "KeePassXC.kdbx"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\KeePassXC.kdbx\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\27A58788EAE392F4983ECBB691ABA9B5\8FFBC836907D34E4B8B2BA798A0E2FDE	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx\shell\open\command\ = "\"C:\\Program Files\\KeePassXC\\KeePassXC.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.kdbx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx\ = "KeePass Password Database"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8FFBC836907D34E4B8B2BA798A0E2FDE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\KeePassXC.kdbx\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kdbx\Content Type = "application/x-keepass2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\KeePassXC.kdbx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeePassXC.kdbx\DefaultIcon\ = "\"C:\\Program Files\\KeePassXC\\KeePassXC.exe\",1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8FFBC836907D34E4B8B2BA798A0E2FDE\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\27A58788EAE392F4983ECBB691ABA9B5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\KeePassXC.kdbx\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8FFBC836907D34E4B8B2BA798A0E2FDE\SourceList\PackageName = "KeePassXC-2.7.12-Win64.msi"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
360	KeePassXC.exe
5672	KeePassXC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
572	msiexec.exe
572	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4544	msiexec.exe
Token: SeSecurityPrivilege	572	msiexec.exe
Token: SeCreateTokenPrivilege	4544	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4544	msiexec.exe
Token: SeLockMemoryPrivilege	4544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4544	msiexec.exe
Token: SeMachineAccountPrivilege	4544	msiexec.exe
Token: SeTcbPrivilege	4544	msiexec.exe
Token: SeSecurityPrivilege	4544	msiexec.exe
Token: SeTakeOwnershipPrivilege	4544	msiexec.exe
Token: SeLoadDriverPrivilege	4544	msiexec.exe
Token: SeSystemProfilePrivilege	4544	msiexec.exe
Token: SeSystemtimePrivilege	4544	msiexec.exe
Token: SeProfSingleProcessPrivilege	4544	msiexec.exe
Token: SeIncBasePriorityPrivilege	4544	msiexec.exe
Token: SeCreatePagefilePrivilege	4544	msiexec.exe
Token: SeCreatePermanentPrivilege	4544	msiexec.exe
Token: SeBackupPrivilege	4544	msiexec.exe
Token: SeRestorePrivilege	4544	msiexec.exe
Token: SeShutdownPrivilege	4544	msiexec.exe
Token: SeDebugPrivilege	4544	msiexec.exe
Token: SeAuditPrivilege	4544	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4544	msiexec.exe
Token: SeChangeNotifyPrivilege	4544	msiexec.exe
Token: SeRemoteShutdownPrivilege	4544	msiexec.exe
Token: SeUndockPrivilege	4544	msiexec.exe
Token: SeSyncAgentPrivilege	4544	msiexec.exe
Token: SeEnableDelegationPrivilege	4544	msiexec.exe
Token: SeManageVolumePrivilege	4544	msiexec.exe
Token: SeImpersonatePrivilege	4544	msiexec.exe
Token: SeCreateGlobalPrivilege	4544	msiexec.exe
Token: SeCreateTokenPrivilege	4544	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4544	msiexec.exe
Token: SeLockMemoryPrivilege	4544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4544	msiexec.exe
Token: SeMachineAccountPrivilege	4544	msiexec.exe
Token: SeTcbPrivilege	4544	msiexec.exe
Token: SeSecurityPrivilege	4544	msiexec.exe
Token: SeTakeOwnershipPrivilege	4544	msiexec.exe
Token: SeLoadDriverPrivilege	4544	msiexec.exe
Token: SeSystemProfilePrivilege	4544	msiexec.exe
Token: SeSystemtimePrivilege	4544	msiexec.exe
Token: SeProfSingleProcessPrivilege	4544	msiexec.exe
Token: SeIncBasePriorityPrivilege	4544	msiexec.exe
Token: SeCreatePagefilePrivilege	4544	msiexec.exe
Token: SeCreatePermanentPrivilege	4544	msiexec.exe
Token: SeBackupPrivilege	4544	msiexec.exe
Token: SeRestorePrivilege	4544	msiexec.exe
Token: SeShutdownPrivilege	4544	msiexec.exe
Token: SeDebugPrivilege	4544	msiexec.exe
Token: SeAuditPrivilege	4544	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4544	msiexec.exe
Token: SeChangeNotifyPrivilege	4544	msiexec.exe
Token: SeRemoteShutdownPrivilege	4544	msiexec.exe
Token: SeUndockPrivilege	4544	msiexec.exe
Token: SeSyncAgentPrivilege	4544	msiexec.exe
Token: SeEnableDelegationPrivilege	4544	msiexec.exe
Token: SeManageVolumePrivilege	4544	msiexec.exe
Token: SeImpersonatePrivilege	4544	msiexec.exe
Token: SeCreateGlobalPrivilege	4544	msiexec.exe
Token: SeCreateTokenPrivilege	4544	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4544	msiexec.exe
Token: SeLockMemoryPrivilege	4544	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4544	msiexec.exe
4544	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4544	msiexec.exe
572	msiexec.exe
2540	MsiExec.exe
5700	MsiExec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2540	572	msiexec.exe	90
PID 572 wrote to memory of 4768	572	msiexec.exe	96
PID 572 wrote to memory of 5700	572	msiexec.exe	98
PID 5700 wrote to memory of 1676	5700	MsiExec.exe	99
PID 5700 wrote to memory of 416	5700	MsiExec.exe	102
PID 2540 wrote to memory of 5672	2540	MsiExec.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\KeePassXC-2.7.12-Win64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F5A613E334E777B791B44EB30B2D616 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files\KeePassXC\KeePassXC.exe
    "C:\Program Files\KeePassXC\KeePassXC.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: AddClipboardFormatListener
    PID:5672
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 83488ADCB6F0E628A03D9578D5EBF96C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /IM KeePassXC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /IM keepassxc-proxy.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1032

C:\Program Files\KeePassXC\KeePassXC.exe
"C:\Program Files\KeePassXC\KeePassXC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e854.rbs

Path C:\Config.Msi\e59e854.rbs
Size 31KB
SHA256 43ab8ed0aaacfbd02584163440b301dbc7055315b6941fafabc8c7ae0dfdd66c
MD5 89260f76499010bdfe389f51b69e4e24
SHA1 7a56fe874388b4081612010f1a3f047997edd6a1
SHA512 32a4ec82ae0a3b82a9eee6eba28a394079e1f6ab62b3a6e479b507e6ce854ebd142b10634fc22fee529d7034c8f06f398d57188cf8a6b357241f62e933a9bea3
SSDEEP 768:k690klDR33JRgEvA1JCS5zfI6YsWpAcEkyiGn3QHUDdT/qRs62LrRfJJOy8M0djP:k20klDR33JRgEvA1JCS5zfI6lWpAcEkp
TLSH
T1B5E20190B984C2E6F04367E133C32F243B1EE554273E866F2A59D65FECD5AA05F6A0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KeePassXC.exe

Path C:\Program Files\KeePassXC\KeePassXC.exe
Size 5.4MB
SHA256 5bc3d50d4857f55bcff899006e66b8774258343c24e93bd83adbd6294447f7db
MD5 6299e98263327e873e8d99e18d03579c
SHA1 5ae598bc1aeadc8362fa51f9092d3ecf22af7a06
SHA512 5d2d55360cf7e2de3c449f0aebee5c83423562db3decc27a9775de8e731716ae5dc50ebc8b2c9cee8bea24039bce13d7ba81ba5855ceb32e57398a4522eed469
SSDEEP 49152:sp0FeOLB2HpdUMoHN5oWJEZrws5XdpaZaLa09j7h7VPxqEXIJuirlhRcUVS/n8aP:seSZHfLag7hBPxqsII8ia
TLSH
T1B9467C4BB2A483E1D125C075CA5649A2D176FE0187235ADB2426EE2E7F33ED11FFE601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Concurrent.dll

Path C:\Program Files\KeePassXC\Qt5Concurrent.dll
Size 45KB
SHA256 f38b65832afd56b221d4ea225df2f48b10b5a910eb03aa2581ea9a1c1dae93b4
MD5 82aad4120a1888eef6e07c7a6a82e4e4
SHA1 ee50d368b94019799680427731f6cf321cac6811
SHA512 6600db47b17d9b6657dc5d16321c2b287a8b19e9a5b95a58107338339bda67bf4c992f61b20985e612a80cf1ebb2ae5d609fccc59a4ebc1c556e91f4824d195b
SSDEEP 768:pfZzC5pjxqgYMrTjBDt6qUB2YfgLFCOwAmbL:pRzypjPYAjB6BzfgLFcV
TLSH
T16A23F85ADD26A027C74A8DB4C5430D0AEC73ACD79BD2B5CBA7500CD54C1ABD4BB3A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\KeePassXC\Qt5Core.dll
Size 5.0MB
SHA256 e986731757910cb03d10e912b56ef20d4d77c4162cef6055cb7dda9825dc038b
MD5 b598dd426b9a7d4e4e4101f044b9fe6f
SHA1 22a874f6f1276bd830cbf5e319cee0a46452deb3
SHA512 9071a7ec7c4f31f2777f30411f31ba6d4633b7cb61523eac17ab14c1b785ccb600d6e6e0aaac6b84fddbc38132661033615fc5d9adb88ae8f40e1a4933f65340
SSDEEP 98304:9xxcO8GhyIxigvJsv6tWKFdu9Csim2/xqf:72O8GxogvJsv6tWKFdu9CsG/xqf
TLSH
T110366D97B2B50251D0B7C139C6E7812BEA73B8028B229ACF125DA7591E737E15E3F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\KeePassXC\Qt5Gui.dll
Size 6.2MB
SHA256 e491000fd4452111c3d7918716cf28266161ddbc2c3b5bc5a222931ef7e9fee9
MD5 07b347ae3ada1013ed9228e19bb18b6b
SHA1 4e78e590f28ecdbf9f64d3d4ba2b6082d5aca3a0
SHA512 19427dba8a16785dfc45fd7ee7f5332d39aa662172116ee07a1e008586df725c4f997f6d5f64a89a3fa35885227403da5280e8faeb6870afc5cfaa5122a3dde6
SSDEEP 49152:bhn8V8DQRdWRn0bcaURV4kAfATmS/2dY0l3w8wxmgoJF2sUn39hSZ9V8cjMgk0Lj:bhnJdds6heLUseQbwjyt8Y3
TLSH
T1A5560786629A6252C977E17D874F052FE1F3B85283428BC748158B481F737EA1B7FE06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\KeePassXC\Qt5Network.dll
Size 1.3MB
SHA256 12819c2fec3495848d5fd81de2b04652817f562b0ea54bcb748ffb5949c8171c
MD5 068d78ac5954828c1547f1bcbcd419a7
SHA1 e6be721bc32c327fb943b6f61949f376c7bca250
SHA512 c236135425a47f8200da7dc4d207281d38f8c78932a614e359d5600de908286e7aa83ab4398e944ac8fb8559599312b93a45601bced02ca6e040e0079202896e
SSDEEP 12288:QH9prQhaPf34OEUZpAfgS/Nnv04pNu3ZEiV25n85XHPfaKV:QrrQhaHIOEU8zlv/pNW3V2585XvyKV
TLSH
T13E556B57B36143A5D1AAC179CB4B8607EA72700087265BDF6269CF692F737E2273E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\KeePassXC\Qt5Svg.dll
Size 323KB
SHA256 eed2275e8cd4cbcaf243f63d928f9cefdaff9bdec3a47615fe244d8c1d32e040
MD5 1ca2fe9908a40ab109e4d2f5f7e61acd
SHA1 44177579b6e09d158d9b40463c2d5d238ab23825
SHA512 7c6c9e6d5adf1cf762082be7f217b24d78ff64e03734c65007ec990eca7bb0c62c291e45313f21d24180288abd5133970f32e1ab2cd645ab056cd9dcfc2b36d3
SSDEEP 6144:pGX9+YYfaK2l68qbna1kOxLL0hq+SdrEr9wAVmEL5dvVuieV9:+efh2l67eUeV9
TLSH
T11E642947F3620D86D86BD27CCA8B8516D5B378101363E7DF022A8A1A7E237E17E7D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\KeePassXC\Qt5Widgets.dll
Size 5.3MB
SHA256 adb3fa6e7a334385337ebef6a17823e139e640ebc0c439dd0bbd615269a336a5
MD5 0d6f6b543d85b73eb73df768aa30d0e0
SHA1 e306b1cc39db2516e48b61e71f4dc91952d28322
SHA512 0d29f43c31e937d8948b1d6c85e93f53dbe99bcead76cdf14fd5f346a2861ac0e9efe5825327664d803e11142843c1688199467d515c497ed39e7272ab22037a
SSDEEP 49152:dCatac7/L8bJdkaK0ZmqHcaHxfpFhXhZkrFByKb0C/WmZczITfJfNnO4RnYyKfs7:lqGlzjZRn5gC76yJ3bqB6iZmCW//
TLSH
T190467B47B3A50195C16BD23CCB8B8613E6B270144B229BCF256ACE592F737E12E7E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

argon2.dll

Path C:\Program Files\KeePassXC\argon2.dll
Size 40KB
SHA256 802e0f5a1b5ca1bac6953f57e0694d2c03b96bcb854ad9ac17dfdbf28500fefe
MD5 54f95df860ce891b2d31b42f75a617b8
SHA1 ccd48bf93f3524e94e39db05682a39dbc1c73f11
SHA512 0a9b855235e58ebaa3d04baa358fba98a7b23f1b151d36000e3c6adcc7870349873722a7b0166da98c823d8022e41b6091d0c43536b8c523b6d849601d152fdd
SSDEEP 768:1Dkh9Uk5AbcPR/nenC9430Zi53t5c1JasgLFCOI5nBAmbLN:1U9TVP5nenu43Mct5EdgLFcjV1
TLSH
T1AD138E93BF2405F4D573D6B8C2C7972AEA713275579129CB036002591E26BE26B3E38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botan-3.dll

Path C:\Program Files\KeePassXC\botan-3.dll
Size 6.1MB
SHA256 42a16d5ffc139f96c68056cdc08af081ea0cfc98f0c4d4a6f1675d8e39d2f55d
MD5 0e13311e1afb1c78f8c6731514d208bc
SHA1 7e94bf75520bb8daf8423c1155bb5332cdc496e6
SHA512 7fce8b2715621af7490f02b3ea3ec72142575031208d82027342a11e050ea98df686c795f9518f0ae043bc8d35eb1f09b3366c553ecd07d99061d0045eb29e86
SSDEEP 49152:BMb50F7kNZhgf9YuKUSH/RNmVIGjUcObuwF1qCqhN8c2iam4gKwUuT3ChY91xnBk:nCsqsB4fEKEcf+GlOGuBFV4HTk/ct
TLSH
T13A567C1366AE01E8C0B6D0BCCA9B9943FB75B8554331ABDB02D10B561F17BF45A3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brotlicommon.dll

Path C:\Program Files\KeePassXC\brotlicommon.dll
Size 144KB
SHA256 8dfb5ea54cad133f95da7e00941982426af6c34c56d8c26d66dc0838da1e32cb
MD5 f5beb5c11a5a19e2adc50e63ac423701
SHA1 02942066a8ef60417140385ce24057c518998053
SHA512 603cc18059b7168a3e1ddcd03b07e9f04e3869143a5a8751674fc195f14ed46277a33c63ed232afb44500206933ecdc8b1b13f47795f007096f34e8d9e7f69fb
SSDEEP 3072:p4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBN/8FeVs:p4AhdNorGvHdbi09GJn/ieVs
TLSH
T107E38CA2B7051336C65B227AE4996BB9F33182B493630551B4A9026D60C3DE4873F7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brotlidec.dll

Path C:\Program Files\KeePassXC\brotlidec.dll
Size 59KB
SHA256 27f6c1ad03dab08c0433d15a49f4381029cc1cf001046b5b33fd7ff104b76fd6
MD5 171674e210cea9d2ea483916701e2518
SHA1 2afc50938f5fe0ccc7d2b2a28c86e18d5ca70935
SHA512 a9d98b5accc8adef645461865d5e66fdfc9cf2d0a4a49fc20afb4b51d38b0fc87023160a752ab4becfcf9f01742a14b240cdb24d64a581c54745fc531932ca62
SSDEEP 768:p8UwDM0oE4j4vwyu/x6oOWIH880mL/RkeaU/azQxARbYs3h8HauegLFCOdAmbLQZ:p8UwA1ewyu/xiHfL/v0aqgLFBVG
TLSH
T1FB538E427AA52A44DD43C13893DBD76BEBB7785A9300A3E7F2D0E6213E077E22375149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.dll

Path C:\Program Files\KeePassXC\bz2.dll
Size 84KB
SHA256 25eeecbe72dd08fc3f719d4c47ffc143200dcba9d4fe3aeba98c5ee2e9800b57
MD5 178b7549b225de18bbad71ca59889c72
SHA1 cf54ec163844d84f9094d45bee96e9e4729b3405
SHA512 f4604eef5685056b365ff97801632129284fdb4d4934419f38f5a8100b5f12ccc2ec1ebfa7e3a14f66fbb245a2feaaf5f67f4151ca716088b54fb5bf618fcb0c
SSDEEP 1536:JtYPj/yb4mgmij1vgqFUtDHE77/GPKf4ez/qlLmvQp8pr65gLF1VO:v4t0ZkZ4eWRmomA8F1VO
TLSH
T118835C817762BBEEDA07857982720762EB34B93C0F5196BF2264C7362B51FE55C7030A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

double-conversion.dll

Path C:\Program Files\KeePassXC\double-conversion.dll
Size 80KB
SHA256 10c04ebbc7aca3d8546ad27233102237422b32958423d9c6e88e4af5730d350e
MD5 cadc42561313a8c6f78ea4593cff7db1
SHA1 d2507d2f6b6942c3b9ae4391988f82a05f8007fa
SHA512 ace00e3f64ce2d49297cb93091e66270f2a8d06fcf657953c57eb7552822644745ed1dedb4266cc0cb1bce15c8065808cae4171f41c6ad7d6151a28ad9d97591
SSDEEP 1536:Xsgq5FW5SPah6iw7nUuIJhPFhxdsJtmTkS+onCqHgLFvV:2FW8i8iw7nnIJhthXeonCqH8FvV
TLSH
T12A838D0E765630A6D003C6388949852DFF7376328362EFDF0A614609AD137E759BAF23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Program Files\KeePassXC\freetype.dll
Size 682KB
SHA256 f4d2cd003a49f8e94eb3f93a78161035ff941e02c30fd32299e19b4714206a00
MD5 6f27dff9879e5360d46c30a6f25e7d10
SHA1 0c1d12ca288f8dcbe224cda9b9385ebd2a487575
SHA512 1df80abdd13cb6f2f5fa7ea9192393c9a40242de8e0317c45cd2b0536a6f7ace57a42bf077543458b059237c18d692454c73dbdc67495ebd12bf772e900ae993
SSDEEP 12288:FWxVmCDHznPuyxu+vNiecqxgJKsjgUs7X31afEWm1n2eHxuVw:FWS6qyxpNbLxgJKEJs7NZ1nPRuVw
TLSH
T1CBE48D82F3A011A8C667C27C8657872BE776B4051310ABDB56A05B6BBF13FE16B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

harfbuzz.dll

Path C:\Program Files\KeePassXC\harfbuzz.dll
Size 1.1MB
SHA256 6bda54b45cf58785eb36359bf604c7e9cc0f4eadf088cb5f4f5636c690108b96
MD5 f8c0b84d8864b70051ff734319cfe429
SHA1 c589a3ae0f1755494fba0a3097492c53b7c8c585
SHA512 387d4b0e1f1e8ab8369a9a35534ba1a2794bc64fdd4f31133171fd90661c358606a08618de2a78d006625cbec2c4684d95d250e8a0d607535b2db14c6b47f599
SSDEEP 12288:32D2h42CNaVzf99S8iXWGtuut8SkWwtb2dc4ah+3MX1cl4Ux7uLmNMjoItVk:3Th42CgJf95cuB32qGM9auiNMhtVk
TLSH
T15345AE45F15754E5E83F9074C6E1C10BEBAAB1021305AEFFAAE09649FB23AF1197E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files\KeePassXC\libcrypto-3-x64.dll
Size 5.1MB
SHA256 d0c3b8dfc94808bc6963e68a5c2e0da92542b0717d67d9a26f9fed022a790d1e
MD5 6889e3e5b3bd9d1d5910410bb511041f
SHA1 89fa3817746b9d62708da835cb0ad1e83d220acb
SHA512 8062c36ff7157386cb228a2e281d57530952cfdf8c075eb4075c232728a158c146a75d07208df6c9adf0e3fce135e4e4ea5d179db230028624790c92af79cec7
SSDEEP 98304:MKOeEV4ryktZgEy0QCekk9d+F1CPwDvt3uFlxCiL43:MKOFV4rbZgEy0QCe1Xo1CPwDvt3uFlxs
TLSH
T1CD368D69B6BC004AE87A81BDC2836227EB71B92557B057DF5A284AF50F23FD0177E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16.dll

Path C:\Program Files\KeePassXC\libpng16.dll
Size 201KB
SHA256 4ca5b37e1c59d06b2f8d6a4269c1d8a6cc02424cf9a225b5baf6d82ac8c6adf4
MD5 fbeaa76dc09d073f953b1097f7812d99
SHA1 45f8a5811585a31cd13987a6a83a9dd8c892d522
SHA512 59024a159b247f0931c07b858b4dc375d62661672f78e650f6322e5e245317108ed90a9e75be4d6d4e71d6b223a1392a68cb9d82861a8405eb49eea37c56370c
SSDEEP 3072:yN2JfE/uH6AmKj/bKUqL6MpLF9KSvjIT8FMV:ySfE/uaAmBV6McSvjITiMV
TLSH
T15E148DC7B26400A9EDD3D03C8646A117D2B1756813609BEF1BD08BBD6F23BE8793A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files\KeePassXC\libssl-3-x64.dll
Size 859KB
SHA256 3e1dc05063b65da0f9d40e54bb2f1a323e7e8129fae13dfc8e7d57544d9160d5
MD5 4aadd7545faa7c75129483a1dd660e6a
SHA1 ac3d953fee76381d7ffb884066a6a6d3110ee5ee
SHA512 eaa5321de8f5d71663b65f9befc2bcbbfc8a8fbb61411ddd11cdd7f7090cf91aa68fdcf236b1df040f8e314ea0fc2fcd4e21391975830a75852828a4f99a8ece
SSDEEP 12288:cMGoqxqBNmspvJzeVt3nEZAazPx1DoUbrf9mT2NOUAm5OTmVN:cMwcgsBJWtYAazPx1Db02NOUAsOTmVN
TLSH
T1A3154C65BBB811ACE862D17C86D34613D6B6F4163370EBDB1B248A392F637E1263D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md4c.dll

Path C:\Program Files\KeePassXC\md4c.dll
Size 70KB
SHA256 4d73e934c606a745b8021d0bfc7dd9b31f5df23bac758b4ad556ffe8d9af7030
MD5 16e5cfa18a9ae8ca7a013b2ff15d9761
SHA1 8941b228419dfda4baa98e991e65941d2f64fa9d
SHA512 6714f8a7bdcb4fe9d911f19317ab72ebd976c6396b4636a10c77e5fde73ca9263b90dd5a707262a483e2bd76cf2a0d2d4c4dcc6ee61454c90bef234be4f3b20f
SSDEEP 1536:iyC9Qzy3yTRb4V9DwUck8+UpGueNoEaXOvubyMrtgLFYYVHE:ceOiTinHU7iZv/Mrt8FBVk
TLSH
T1C2638D12F6E92CD5CA4A8778C4894B13E671F25B07008DFF0B50972DAE337E16A3D926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minizip.dll

Path C:\Program Files\KeePassXC\minizip.dll
Size 55KB
SHA256 776bcbe479d85f0b7bf71332893ff4cbb30ecdde2cb22d864045b098a4a1d622
MD5 096f680b75bd5d2dc9ef2aeb831b18f8
SHA1 eb52606f48e3c5f69d5d9395fe3c1194e7cb47a2
SHA512 581f885092cfee8b9f9f3a8252938fb89b804276123af5242a96bb887724fb2732ad4134ed526e2e320eb3bafcc86940596ea044ffac8ee2c534fe0c6e6b8329
SSDEEP 1536:u9QavE9FRJjnd+/w0CBGv1vG5vulgLF9xVr:QEbRJDmtv1aGl8F9xVr
TLSH
T170437D87BFA040A0DA93C9B4C1855A6FD672B018231567CF57D2CA5A6F33BF32B39119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcre2-16.dll

Path C:\Program Files\KeePassXC\pcre2-16.dll
Size 564KB
SHA256 7e0b45d5a886f1c199dcaa536623465c7b9b5385c4b403a7ffb2c1d77e49ea1c
MD5 a9517829bdbde58959f6fbbe38cd74e7
SHA1 80d5b5af5a17473c51a8b27b16422269911ee491
SHA512 99a54a8e11375ae41c085f8ba65c36e2eb3da3b5433d257cc7cfcfd0bfefa7ea9ad89146f435897bf9c92e21b8d54e066057d9800dae27f43d693fa1866f2878
SSDEEP 12288:mhzagw7ObSitixK6Uv4AHwpul1pvWVh6GDw8rCYv/Vv:mhzaJOWfx8Qr4l1grC8/Vv
TLSH
T186C41847B8F30498CD76C130D6A33176EA7D39E922747D9B16A0C736BBA35601B7A24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll
Size 805KB
SHA256 6a6b24c26760aeb579f7f04acd30a2be801029bb837944762f1eeaf917d94ead
MD5 e72a70217b80bac45e0fe7fc286e7241
SHA1 f41bb2894b14af64919696e77aed30078d2d4e7c
SHA512 701875d277ba96a663adb155c04cf9a8d125817d36732e78127e315952cdb2068c6184ef248f7b4f3d816c0310f39bdb3e88881ef306d69eaaef6db0b6d27c04
SSDEEP 12288:QtuBdjPr4t5T/t+rduKWRIzrQSp80wTFzEVR:vPPr4XT/t+rQDRIzr1pUEVR
TLSH
T12F056D5BB3A80281D03BC13E864BCA13F6B2741813938ACB5165CE597F337D269BEB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll
Size 148KB
SHA256 c74ebd53cc80dd144621c2ac8dbc097ec7cb172a80c568da71f32c7f60a0d125
MD5 6ea610058c4c0887ef778064e915014c
SHA1 84df6114da368dd622721b69f53130b69fe902d9
SHA512 f0985348e4a3b73bc250c4d7c6ac481ed650ae687a2cd6b759c94d3b885b8f8b4e49e04f70bc38389f5185ecee9f2700f22816bc78fc39aa5d1406e0bbde20d4
SSDEEP 3072:315RYTGCzS5mUOp/6VD6zN4K4vgglbhGQaOi2Wz+8FZVq:31vYyYW5Oh6Yz8gglbhGQaOi2W6iZVq
TLSH
T1E4E35B0373A612CAC423D2B8C25F0613F7737055431697AF09A7C9B56F532E2BE79A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qrencode.dll

Path C:\Program Files\KeePassXC\qrencode.dll
Size 55KB
SHA256 7b56611ca051176b4e28a155bfad853fdf6799e88a7a8b30f1f80d82a3d9a78c
MD5 294651c8905e60a2fea08b28ac3e5a91
SHA1 355efd10e5cfd19f398a6863a2d93f0618782e1e
SHA512 8c3ac843797d1d2c800bfebb92e2f08a32f6481ca26331ee4e6bbfe958f06fbf9fa0102819c201ec9f3538560cb0a0262b2611e6ae76b2d4d5dbd3ceb24f690d
SSDEEP 768:NF+hYTZhuSpmx/swVfs/5QUp21jlHXWgacvFMiOf5VlODteTqsmAEWgLFCO/0mAg:n+KTSJ1e/tGj9ZMjseTJEWgLFz9V
TLSH
T141438E867B6C0199F9174A39C2C70A4AD371B5251B025BCF1790AB692F73FD36A3930D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Program Files\KeePassXC\qt.conf
Size 44B
SHA256 e1107b7db2ba81ed230cd4fd356f530a3aacbf3721310dd945fcbac1888fcc25
MD5 3c78d544476bc37984bd9141c682119f
SHA1 7edceb105ad6092f35861c77295aa551c61bfdc2
SHA512 af2f24a1a36326dffc9b6b484993f246e519fec1ff87ee707b1485fe4fa569fce511f0e9f3deebbc18d2aa8c97b3db063a5e068f709b299b3d7920292ad47b34
MD5 SHA1 SHA512

Submit Download

zlib1.dll

Path C:\Program Files\KeePassXC\zlib1.dll
Size 96KB
SHA256 29af14a2f529b6c938dca11114feea4373ea61539f59bfa888f381c8436ca917
MD5 7840ce62c8e9555d8386736b3479a598
SHA1 95ee3c9ccc10840dabf7afc5c3a945c1bba91966
SHA512 a3abdd04b67c9173e3e750af42f92656b660fefc644dd5574964f0969eb6bcd66a28c827a5eaa3b717b888654958b5a136a5eb93df2859161b7c319df9d051df
SSDEEP 3072:So5La9Xa8+EgJrdhIi1SZl3ug6z78F+V:r5epa8+l9Hr1SZluRi+V
TLSH
T186A39F95BE7422A2DAB341B4E8D3479DD731B01407641BDF9348A7691F23AE02F352EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI87A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI87A5.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEF38.tmp

Path C:\Windows\Installer\MSIEF38.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59e853.msi

Path C:\Windows\Installer\e59e853.msi
Size 34.2MB
SHA256 feee096c1d5d0d7bb7b36b18174818f7bac889be7668c550ff0e5ef9206ea9a5
MD5 f4ae20011ab36ecd2d436753a05c721f
SHA1 c0ce3eeeabc7fd548c3fdb3996b3e5fbfedbb534
SHA512 c528a4c96f2155ac7f3cd05593969933200973467eab0136c2dfc0dae9f57a5045574242bdb983164c6c15108c9be1a80bec1940c6e74189cc74990bf34bad23
SSDEEP 786432:XnBoo+9N77BSFJy3ccSMXp8nkc4u1R9uHJ6vulYYQT+SEPJY1stzgO:XBooM6Jy3ccFZIkc4JHJ4ulYYQqSEFtt
TLSH
T18177335675A5C062C07A0A34DC26AFF1623F7C2CDA2588472363BE1FF9769C1627B607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b132c4425d2930182c8a5a1468af2f9f4e3bf12c74804c4431978ecfeef1af82
MD5 7e0b6506e38dd0d7b938340ad9234a9b
SHA1 41c1c671309dc0ffc797b297d84f6ad54985cd34
SHA512 d568343f3577dc36d9f3cf5ba924f86c6aa6b0300b4109e87763b4b6f62277a10203f7ae4cc5f48b68ffff2a3e9786b4d544dbd16f55210b852dbad9dc6329a2
SSDEEP 24576:cFo3DMPgdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+0:xHg
TLSH
T11157E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{63d2f375-c497-423d-af94-1ccff964ea44}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{63d2f375-c497-423d-af94-1ccff964ea44}_OnDiskSnapshotProp
Size 6KB
SHA256 f17ee33c44bbc98674b16df3ec74b9a558a37e29bb2cdba860c19e1da03ac98e
MD5 2390fdbc35f30f83ff165ec7a4d73feb
SHA1 ba6a1fca1ff2eccd1bd23703f8b3ae37d005b02a
SHA512 03bccddb0c234ba2ab993bfbff103d47dc8c5beaf70a1755d570a9b51ced404dc78a78b1538dfd635d8320b5a6e3760c820f3918e601ffb29da040946dcb7fd2
SSDEEP 96:FT8Q1hOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:5v0b++uVmN
TLSH
T19CD188184AF54711E2B3AB7128F18557A877B911FF33CB8E0298238E6631A10F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-206-0x00007FFA4DCA0000-0x00007FFA4E1E9000-memory.dmp

Download

memory/360-218-0x00007FF7A3AF0000-0x00007FF7A4061000-memory.dmp

Download

memory/5672-232-0x00007FFA4F010000-0x00007FFA4F559000-memory.dmp

Download

memory/5672-233-0x00007FF7A3AF0000-0x00007FF7A4061000-memory.dmp

Download