d24af7dbf4684671f4c848660f09c5a107d622549dd2ac6dbc60115fa7ee699f

Analysis

user interaction
yes
max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDA Pro 7.5 SP3.msi
Size 360.1MB
Sample260822-k7ew5sshkc
SHA256 d24af7dbf4684671f4c848660f09c5a107d622549dd2ac6dbc60115fa7ee699f
MD5 c8df2f169dedd5a4ba9804a475ee7755
SHA1 107250c48f1c8a0805987c1a4c97cccf7458b1d5
SHA512 d0b1b5767c250e3162f7574e400f8c504fd8d62713ab1490e9076ad07f689a8dbc8c9e02eda441fb0ab44666ffe85a2d04b6b95a0dae4e4f1a99324c97dd3584
SSDEEP 6291456:w6cnX9GIaqoPzeqAFtwRXa0dTuxgiWYj6H//KKOKb+92vE2X1MswwmADh/SNF+qi:L2EI2reqAgRK0dKkYj6H3KKOKa9HCMkd
TLSH
T18B093332F44E5F31D283783A40759939009E3E5183868DB6D328BF69766BEC35BB5782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3520	ida64.exe
3524	ida.exe

Loads dropped DLL 64 IoCs

pid	Process
1600	MsiExec.exe
1600	MsiExec.exe
1600	MsiExec.exe
1600	MsiExec.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3520	ida64.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe
3524	ida.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2108	WScript.exe
1268	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\ida_moves.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\PyQt5\uic\Compiler\indenter.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\ida_64\_ida_fpro.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\qt.conf	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\vc64_14.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\til\pc\ntapi_ws03.til	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\procs\ppc.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\ida_64\_ida_enum.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\PyQt5\uic\port_v3\as_string.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\mv16rwin.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\til\arm\iphoneos64_sdk13.til	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\pic33.cfg	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\ids\os2.zip	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\ida_32\_ida_dbg.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\__pycache__\ida_typeinf.cpython-38.pyc	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\arm\pe.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\til\pc\mssdk_win10.til	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\Turkish.clt	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\plugins\hexrays_sdk\plugins\vds5\hexrays_sample5.cpp	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\plugins\hexrays_sdk\plugins\vds6\hexrays_sample6.cpp	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\ida_fpro.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\ida_entry.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\examples\core\trigger_actions_programmatically.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\arc.cfg	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\plugins\bochs\api64_kernel32.idc	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\procs\f2mc.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\ida_32\_ida_graph.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\PyQt5\Qt.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\PyQt5\uic\port_v3\as_string.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\PyQt5\uic\uiparser.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\PyQt5\uic\Loader\__init__.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\Central_Europe.clt	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\idc\tpdll.idc	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\loaders\dos.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\__pycache__\ida_problems.cpython-38.pyc	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\bc31cls.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\ms64wdk.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\vireobc.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\themes\dark\icons\expand.png	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\plugins\hexarm.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\procs\tms32028.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\arm-with-neon.xml	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\highrto.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\ndprtd.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\til\objc64.til	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\m68k-core.xml	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\ida_32\_ida_ida.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\PyQt5\python_3.8\sip.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\examples\core\custom_data_types_and_formats.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\examples\core\list_segment_functions_using_idautils.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\examples\hexrays\vds_create_hint.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\mips-cpu.xml	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\ida_32\_ida_ua.pyd	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\examples\hexrays\vds6.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\gdb_arch.cfg	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\cfg\Japanese.clt	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\plugins\dalvik_user.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\ida_diskio.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\bds8vcl.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\sig\pc\vc32_14.sig	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\procs\arc.dll	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\2\PyQt5\uic\exceptions.py	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\python\3\__pycache__\ida_kernwin.cpython-38.pyc	msiexec.exe
File created	C:\Program Files\IDA Pro 7.5 SP3\til\xnu_4903_x86.til	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58f972.msi	msiexec.exe
File created	C:\Windows\Installer\e58f96e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3336F851-F0A2-42F8-AE8C-3251F324C5CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f96e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\865780D1D2004544E983463E62E696E3\158F63332A0F8F24EAC823153F425CDC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\ProductName = "IDA Pro 7.5 SP3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\158F63332A0F8F24EAC823153F425CDC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\158F63332A0F8F24EAC823153F425CDC\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\Version = "117768212"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\865780D1D2004544E983463E62E696E3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\PackageName = "IDA Pro 7.5 SP3.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\158F63332A0F8F24EAC823153F425CDC\PackageCode = "0AEAA38C7D47D6240AF8757C8E20F2C2"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3520	ida64.exe
3524	ida.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2268	msiexec.exe
2268	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3520	ida64.exe
3524	ida.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1224	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1224	msiexec.exe
Token: SeSecurityPrivilege	2268	msiexec.exe
Token: SeCreateTokenPrivilege	1224	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1224	msiexec.exe
Token: SeLockMemoryPrivilege	1224	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1224	msiexec.exe
Token: SeMachineAccountPrivilege	1224	msiexec.exe
Token: SeTcbPrivilege	1224	msiexec.exe
Token: SeSecurityPrivilege	1224	msiexec.exe
Token: SeTakeOwnershipPrivilege	1224	msiexec.exe
Token: SeLoadDriverPrivilege	1224	msiexec.exe
Token: SeSystemProfilePrivilege	1224	msiexec.exe
Token: SeSystemtimePrivilege	1224	msiexec.exe
Token: SeProfSingleProcessPrivilege	1224	msiexec.exe
Token: SeIncBasePriorityPrivilege	1224	msiexec.exe
Token: SeCreatePagefilePrivilege	1224	msiexec.exe
Token: SeCreatePermanentPrivilege	1224	msiexec.exe
Token: SeBackupPrivilege	1224	msiexec.exe
Token: SeRestorePrivilege	1224	msiexec.exe
Token: SeShutdownPrivilege	1224	msiexec.exe
Token: SeDebugPrivilege	1224	msiexec.exe
Token: SeAuditPrivilege	1224	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1224	msiexec.exe
Token: SeChangeNotifyPrivilege	1224	msiexec.exe
Token: SeRemoteShutdownPrivilege	1224	msiexec.exe
Token: SeUndockPrivilege	1224	msiexec.exe
Token: SeSyncAgentPrivilege	1224	msiexec.exe
Token: SeEnableDelegationPrivilege	1224	msiexec.exe
Token: SeManageVolumePrivilege	1224	msiexec.exe
Token: SeImpersonatePrivilege	1224	msiexec.exe
Token: SeCreateGlobalPrivilege	1224	msiexec.exe
Token: SeBackupPrivilege	4896	vssvc.exe
Token: SeRestorePrivilege	4896	vssvc.exe
Token: SeAuditPrivilege	4896	vssvc.exe
Token: SeBackupPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeBackupPrivilege	4728	srtasks.exe
Token: SeRestorePrivilege	4728	srtasks.exe
Token: SeSecurityPrivilege	4728	srtasks.exe
Token: SeTakeOwnershipPrivilege	4728	srtasks.exe
Token: SeBackupPrivilege	4728	srtasks.exe
Token: SeRestorePrivilege	4728	srtasks.exe
Token: SeSecurityPrivilege	4728	srtasks.exe
Token: SeTakeOwnershipPrivilege	4728	srtasks.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1224	msiexec.exe
3520	ida64.exe
3524	ida.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4728	2268	msiexec.exe	94
PID 2268 wrote to memory of 1600	2268	msiexec.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.5 SP3.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CB90C364B3E8D6EA6EE6D0899CDEF352
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\TraceMerge.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:2108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\TraceMerge.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1268

C:\Program Files\IDA Pro 7.5 SP3\ida64.exe
"C:\Program Files\IDA Pro 7.5 SP3\ida64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3520

C:\Program Files\IDA Pro 7.5 SP3\ida.exe
"C:\Program Files\IDA Pro 7.5 SP3\ida.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f971.rbs

Path C:\Config.Msi\e58f971.rbs
Size 138KB
SHA256 9fa5a4e57c06af8dd2976f489fa9a72148170968f8176392baa99daf84bdbbb1
MD5 76a37496111119c0441dd9ba39c7fdf5
SHA1 a75a492397fd09a554132402a50ddb7e0a312b08
SHA512 0f6c29c05f8cc505af4ddf94dc95075203fb8ba2c49e20941910984ab7319c7f0ce5ef1d5410b7a88cde333ea58f26e160ba9e7002106a25f649703510ed0711
SSDEEP 1536:nPyRdO43f3/oMkEPWK4XUFlaIT4ylZGevjDkWb0Vu9M+jATILds8NTi0hUOj6IHu:97/WLHtudf
TLSH
T19BD360A18907C2E07105FDD553D0698993188D94EB4811BB37ACC31BAB96BD2E3FE1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\IDA Pro 7.5 SP3\Qt5Core.dll
Size 5.3MB
SHA256 f4bb94194c6cc946f4cc2f9f331a0e4dc08a6180f95250bc404f993c0f082762
MD5 770c19c0938faaec8a471291af3b8258
SHA1 18426b403007556702ee1dba703b88dacdf6442a
SHA512 f0705a4ed45f7dd0a96e1b16a557927d16128d4c3f1bc0e0fe099a4c6fda030276d2c067b7a682cb8a1973ac3267980566898f635ca113335034c666821886c1
SSDEEP 98304:WLlGhzXVWaJ3/BwTJsv6tWKFdu9CzpNbQGms:4lGdXVWa95wTJsv6tWKFdu9CzjbQGm
TLSH
T16B468C67B7A20161E4B7C238C5978212F2B3B8155B234BDF1659532A5E337F2293F392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\IDA Pro 7.5 SP3\Qt5Gui.dll
Size 6.0MB
SHA256 233116a16585ecff6a7e8f500efa52a6e1277601898ffce1d100f828eb29b745
MD5 e3ddcbf6454378030fb21616c301418f
SHA1 34c9ef4fcaef11ce2f44d8f1de626e1deccb7617
SHA512 414db90adb094320b3f92180b1c68d0f43b5cf98efc2278199f0fe8687e870cc49516ffb931c6faa30384e3b46279df78b8247ac5839a649724d993489925674
SSDEEP 49152:OXHCE7DogXjNY/cpK4QCiCsgDGY8+s7f8pnthKT3aqpF4fX/aNedePwiVn3tBSgT:OLC/YR3pn63awomIkZ/
TLSH
T11456188662596251C977E1BD874F052EE0F3B85AC3534AC34D159B680F237EA0B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5PrintSupport.dll

Path C:\Program Files\IDA Pro 7.5 SP3\Qt5PrintSupport.dll
Size 316KB
SHA256 8f228458a99aca0f6aa5aa2f366bee096193e2d52baa4cbe88bcd17cce2518e1
MD5 9202512581c2ecdcbc68101bd609cdb1
SHA1 1a94dd729f345e2d98c555287afda49f7a4ad377
SHA512 9fbc4a61bfbb60dd7de68a1c3181e7eefe34d8381ea7ca3699321aa8e990355b9ebd72c1ebd9e49e397a01108c20ff1566b95ce696aedca23b190f3c72db5de9
SSDEEP 6144:p8Bn8I6h0EvjB3klbMexD8lAPISiVblrHhunjEwL0LWlxiwCnSpl/hN:pY8IM0E4MexD8lAPISiVblrHhunjEwLn
TLSH
T147640883F2570E83C99AD278CA8B4511E273745907A387DF49199925BE233E2BCBD7D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\IDA Pro 7.5 SP3\Qt5Widgets.dll
Size 5.3MB
SHA256 282475dd2c8148638000ecde4132f6eb29d4e6e56eb1c0f2e3897dba60195541
MD5 ce299d5dca46de56813e8e5c269c961f
SHA1 96d7b66b1251802108c998b67c6273e26f870c26
SHA512 4b53eb780c57c256753fb42be173ffa7eea14c65cebc0263da333e2f22cc40ffe7a2617e7cfe32321112535de99178341f6f9756429fa51d79d0839fc47a5120
SSDEEP 98304:YCT9XZB/or+X612celeTrnHHWT/lQ4yfUE7:lT9XZB/oyX62celeTrnHHWT/o7
TLSH
T13B466B47B3910281C16BD278CE8A8517E67370184B634BDF1A9ACF691F736E21E7E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idagui.cfg

Path C:\Program Files\IDA Pro 7.5 SP3\cfg\idagui.cfg
Size 66KB
SHA256 88de5ebaea940f43d608c135d6cc50f6abd0ab9465feea92d012133401a5e292
MD5 57265fcf34e0323df1cfd554bbdef518
SHA1 66822b445182c1e887672b9391a4192cf8dc4206
SHA512 2155abe5e56fd6bea0b071c177934507bcb858972ba448ad02ace05dc13f7c6d1f58563172049c18536dc1c3272920213a23f079e2b03c1b43939db803e22992
SSDEEP 768:JVWAAFHDNv2dqv3Uidb6lb+JYThr3MAldlVT/CDOl8myieKz:PW5FH0MvEip6V+JYThrvXPbCCamy2z
TLSH
T166636133D8C69F364477A2315F0B6662F05A476F1152A45B34BE87CC0F3A63652BB38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clp64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\clp64.dll
Size 1.0MB
SHA256 f5ff0cc9a31fdd5037ebd4becf6e56e244c9cf2098ce21ae9bc695d98072307c
MD5 4cf33f5396e8d3c92ecedced7d476c60
SHA1 96d72eab40c347d9fd68917c281bce23d53f4c6c
SHA512 bcf1da90f01e71ebe62ad92c66c3073b8b1f1c703701b6e8292b078e544b30c4053f9616f767fa2583dc82b16cd1425c788d8d942d98bae6fccb220a59295563
SSDEEP 24576:V7Vt9qfawrN27U1izzZaRbfp81L/Wm/nd6Wrr+U/FQT:hBqfSU14Zadq1L/cWrrTFQ
TLSH
T182356B46E6A505ECC067907543B9B157F6B1301A0364ADF70B929B292F2BE90BD37B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ida.exe

Path C:\Program Files\IDA Pro 7.5 SP3\ida.exe
Size 4.0MB
SHA256 8292af86d0639d67282b9277fb6876b131ea7366b6605ad08be56aaef4fb2abd
MD5 2297a3f7cdbdfd5cb1e78b63ba6873e2
SHA1 f0b497b43e473a5d75ca12490823cd84443fa151
SHA512 c53312beb362ed106f6e3507b106885476047b129e4f4bc09aed68803332700ad8c99d7b9c6842f5dd6f862618502dff06756374069155efbf42e6552da491e4
SSDEEP 49152:pCXcWyZWoH/Ce+6zJNDKTkoFqA83FJ7cQIyTQE8E+nQqfHLgbhadzh0YorYrF9pq:8QxbzFIVrJgKCKmD
TLSH
T193169C7A776580E5C026C139C5AB8642F7B270165F229FDB25588F6D1F33AE12E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ida.hlp

Path C:\Program Files\IDA Pro 7.5 SP3\ida.hlp
Size 889KB
SHA256 2b1817bd177e8ffe079f45da640359fd806e12ff5f03682829894a1935199c07
MD5 97e53567b7672bdd0a3141ba32536f3e
SHA1 a7bbd8b8a469e5efc2c7a3f6a14f60084daf0c86
SHA512 3f498445bfb6e7446fa92f7f9a734277b4b6ed05c4d77decdef6439f57f17f3f71a7eb7c6b3272295f9b23a5893626a7fa509572fbd998452fc3d81e8210d6ac
SSDEEP 12288:W5VapD9pWaMhGkppVTpH6MnY4+jiJBV3RglLf/GoeT:W5VPpV24+eJBV3VoeT
TLSH
T18D1508063AF06372C5E241B1BA4E22D2D734C36B7324919134DDB158AF0EB69D6FB9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ida.key

Path C:\Program Files\IDA Pro 7.5 SP3\ida.key
Size 1KB
SHA256 2a7f5cbf25324c9364c7075aa8abfe628d7ef84dc080db5d4d11ecafcd1e2579
MD5 47977b40831c63ada8e115eea2fff934
SHA1 869f350d0525207401a6cad6927171314d39e041
SHA512 33951f948b85fdd0911c5b3b3db5878c2eade7f2685f84b2f2c01bf0c362cbc26a9212ffceb7cf832cb56f7a19346c41b5ebe0d77da55258de241bb982c4f43e
TLSH
T11421F0301DBFD49146A8D9E32D15CA42CF60D8BF5926104430BE6099EFA9F052F8C5BA
MD5 SHA1 SHA512 TLSH

Submit Download

ida64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\ida64.dll
Size 3.4MB
SHA256 725ff1681cab0ae488e42e42dfd947d1db2168d5b05dccb80f4722adee6be917
MD5 b262c1d99b8ce7f6ddc84b6195b6b21e
SHA1 5af49434a03eb75b3249dc5619f22c187335dbac
SHA512 a01b6a431504834975da8f40e76cb3de1fc5ef962f7a74e9d26faf2d2ab887581572c6906cc56e96edf230d182c154b31fe2db6ad2bf01f6ff7bc57027103f38
SSDEEP 49152:85jPj0cgNMV3w2011PEfSMPrCdxhP78EBdVKdWZj5Ea3OzlxtvBrS+xEaN2FcOuT:8lTXsTFDBnHBGbJB3PNIK
TLSH
T142F57C1AA77582ACC06BC038C99686A3F7F1B4454F35AB6B25E5876F2F33A31563D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ida64.exe

Path C:\Program Files\IDA Pro 7.5 SP3\ida64.exe
Size 4.0MB
SHA256 1d505c8aa64a559be8514a042cb5b14711d3ddc6cc841e327d79f3d7faa7d9e5
MD5 49c792b5be71d206e1ee75c06829ca0c
SHA1 8cbea26408f807694e59c7d013f38867ff613f44
SHA512 193caea24d97de2837ab827df29adf77f0f2558c34479a229284ea02a950390c93977b58d258c52397c6930e1e762f0fe7515f2eec36cf4c0ca774158942ff52
SSDEEP 49152:QNcDmkbP38wRtKovjO+7yIJxPv5swm2SEGiDaSw01fm39H5JrL60RDoW1e3rZpSG:QNDmEnVrE9O9HbSeaCKum
TLSH
T1FC168D7AA76480E5C026C138C59B8742F7B270165F229FDB15698F6D1F33AE11E3E7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idc.idc

Path C:\Program Files\IDA Pro 7.5 SP3\idc\idc.idc
Size 299KB
SHA256 3dd40aa945bfa6658411600e3b99151a4c7c82a951c0a2cd36394edd2d2c1c06
MD5 bf9ad247fe56790e8b2dab03a55eeed0
SHA1 cef52d9ccdabd68629f0512fadf841e3969cca6c
SHA512 8b735cbd688751fa8a905bfa9ffa957ca498739913096cb908251830dd536e2611678dd28520b9504044743c01206dd531ec37da85387473a5297e844fb720bf
SSDEEP 6144:kG7F0Mn+wOKrgOC9h//GotCX4Hk53VFfmblN5hlxeSZf0QTl+P7bwWPDtciOd:kGxkWCGSVvd
TLSH
T1EC64A2082DC263739965F121021E2143E624EAA3D36E67DC34BE8B48AB1592CD5FF5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\IDA Pro 7.5 SP3\platforms\qwindows.dll
Size 1.1MB
SHA256 ad1829b51a7be67ab0c4a040ee8ac0024d67e1f0e0b0b5dd819a6166a89235fa
MD5 19b2d175eb0427773beb2f3cf02ed1cc
SHA1 62e1d07e26b89b379a777deb42434fdf023a6594
SHA512 3bb4beb9b220999a06cf27ccb2efd0d94b0df014e14ee8ea9ec8ce699d50cd4745faf115d55687fd53f2add2db224038874530d692a1a6dab45300d9ef9a96f3
SSDEEP 24576:aiYXQE7QZQMVcvDI9bvtQs4mPwqzUPzdNNZ6a0wIe:aV/QbVa2ztim9QrdNh
TLSH
T17F457D43A36902A5D1AFC13CC75B870BE772705913229BCB15A18E692F33BD32A3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armlinux_stub64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\armlinux_stub64.dll
Size 150KB
SHA256 2bfa5fe3cf64af0e51e08e63362d8d41fe91cd7045385988b3a9210cb799bb28
MD5 44e798847565e8b677c76a27b376fbed
SHA1 f787d209b58aae77899a1340d986395cca71b4bd
SHA512 9c7c64878045e99dc04931781b0ca414d692d54215d2124298cf4813a0e283d08c423951ff6d7aaccafc655fff74cecdd016b7ee3509c6d0f0312b07798c62b3
SSDEEP 3072:+QQUpJbSa9+sry3K6Fzsgdw87YKZtwlcVO:gg+bk877twlcVO
TLSH
T18CE3186E7B6440A5C127C23CC591AA42FBF5B4561F321BDB43A1823D1F73AF86E39690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdescr64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\bdescr64.dll
Size 22KB
SHA256 5cb0f36a0e25335c779d0055098260f2e354a386981813cfe704791a87c42e85
MD5 315e30d73ba54f8a4adea1df690ba7bf
SHA1 1da607873344fdf428bb0aa9340b1e82b4bf6acf
SHA512 58123b2b747806c3914fd26a024b9f291543385b339589194246a1bec8ee59ca37120b145eb87edabd6150308ef7d4e1ac26dae29a5e595b26f83780e1ec1d00
SSDEEP 384:hIh1QrMv/6H9wi0p5G4AtHTwIeS9uvZf0gxRVlreQLMgSCHbdQDMoq:hIhasu9wjWHTwp5rfreQIiQD
TLSH
T1D1A218ABFF20906EE4D6C13A89A5811ED9B873510B6193CF769C036D1FA73D4A6393C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bochs_user64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\bochs_user64.dll
Size 346KB
SHA256 37d346ce3f14f4d254e1bb74ddcfcd8a685976b15a63a92dd5e51f3982c63123
MD5 5bce0bc7c330b4aed4ee55be40615b6a
SHA1 b111c104e04b593e0885556f950e92c33d4f6f22
SHA512 0eae06341aafbb80523f2090495d1448276dcd69523a307cae1b198d19c1aef507648c76da06960f2ec7c8e20c59bf32ace9b1309d59234ad2e496a3a316b6d5
SSDEEP 6144:8AS6GlbNjWQXA25LijTcsZsfZufS+5Z+WwNA7o:89XbxAcLQgsZMboZ+PW
TLSH
T12E743B5ABF7494A5C137C07C8666D246F6F1709D0B39ABDB46A4422D3F23AF42A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

callee64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\callee64.dll
Size 13KB
SHA256 b41e54a25153cc6494c43e65c9c30cee29a5a76ef85a787c1a45f9a7027cacc9
MD5 bfa6a9ce69f6f40f27be12eb2501d32e
SHA1 23f804dc434420d17449edc0f3b5993b527b1e60
SHA512 081f3a47174b734341beb68f658d0a48417a14b47d32f0530d36177a96600cfb237d0a3f3dd90578e7771623f2af18ebe785b9760f2fa115827814879ec396bf
SSDEEP 96:rMcTkZgIY3S6f5N4PNGt3umTSwbaUfOZpCRcO7YbzYJJ90uEWV/mvofVGEQT+N+R:rMcYmSQPPTHmX79vc0uRV/o+AHugfm
TLSH
T17E521A4F77900AF7E0265135C4630729F6B6B3745BE29B4F0B2062570FF36917A3AA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comhelper64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\comhelper64.dll
Size 27KB
SHA256 611c604a863c3c947bd8660aa458eef4e9e02145d8ed223398e803ec0dce0081
MD5 36fb887faa1990617350b6e73d0773f2
SHA1 dc584b60e021485537ce8893a5c266b920e42d68
SHA512 14ed4c46ead909a4d8255afd7694610ccc03dab78110ca3b147392c0e99f93cd6520a381c85cdebc4ac842ecb62c8a7d6326545791d5e626ba170d367adcab6b
SSDEEP 384:lSOuWInNYuxllgArhPj/aa3kxwzTUL5KbwOjZZVRMjhcxCff7PXb1+nHEdCYl:ABNtTe6wUm+sHjb1xCY
TLSH
T106C23A4AF79800E9E15B8078C4A7132AF7B974515B7097CF6790065E0F73BE07639B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dalvik_user64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\dalvik_user64.dll
Size 369KB
SHA256 3cbf0455e676fe93aa534970e6f5768b89b0a4e6c09e4bce09258ddd11859c6d
MD5 9db74b45bfa48b55709035d7718d77a1
SHA1 1256dfbd4c815c95a59632189200afd8af7a4d2f
SHA512 e45426d28b8beadbdbea9b8f00dc8ef65fda4e7df46fe811a0d89ca05d3884311c14cae54181673d170f5bd9f75444115b68dcf2bb656c9fee8a118424a12cec
SSDEEP 6144:h8spCT6VpD0jopKdYhT9WuOU6hqyy4LjPG:hNpND0MKdYVHyS
TLSH
T169844A6AEB649CA5C02BC03985A9C287F3F170591F75EBDB16B5022E2F339F45939720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbg64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\dbg64.dll
Size 61KB
SHA256 06705c77efa22aa4d648be9f1f201f0e9ca09b387f985aad50cf67d5f9f21f72
MD5 e62a21831cdb02982a576f7794f0320b
SHA1 cb6c4d0acccf4fa5a2b6335ebbb9502ca8808531
SHA512 c05653e0c9075e463e2b0906970842bd41c734b6b340be4dd1e68c41eb7f0f754ab67d5df11b9f40e6c624d722a33d1842183606fa30499c59f0274c4766f6eb
SSDEEP 768:4rsFwhe7EeXjQw7vHyOuKtXrJqxESvvyJkQh8yKHJEJkeHG/12h/qTqCAVNTIBL:Yis4fyYXroTvyK7Q7d5NE
TLSH
T1F0535C49B7A494B8D16BC038DA53462FF7F930B15B628ADF47544B2A2F239F06B35E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dscu64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\dscu64.dll
Size 76KB
SHA256 64a8d8c5d08aa31b1cb8e979c22589bab033129629b5f066b6070f75437f554f
MD5 c399d9a5fc271528fe5510e59391732e
SHA1 69eb41fe0d924adb2f566e359f7f065093479dc5
SHA512 91276e9c526430caf987de72f5f41ff40fcd6499d54d34a54a3acc539d5d35467bf3e8f63dec7fb40c7748b744d80e989642d97fe120416cddd039739b45bb91
SSDEEP 1536:fz0QGg6GLAd04ruuS4AU1+gJbP9epzqt90xyRv/DxX:fzJYXCj4AUEA9epzN0/Dx
TLSH
T16B734B6E7BF550A8D162D0B9C4698207E7B571592B222BCF03A1832D1FA3EE44D3E7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwarf64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\dwarf64.dll
Size 511KB
SHA256 fd7e4bc4c3f8382c4802f1a787f58f42f18ee448011e25290acc1cca62e083ea
MD5 3b17777ec9aab4914d9308de9553cbfb
SHA1 33a9d25b49dd165f4733765dd81a5dcd5a6089f4
SHA512 b633bc470a33c85b388c71afc25d6126b83e6a5be9e574eff0423057c330ff736f12924fc52687ddf0d43808f76524c5d92f9f51760ed9fc18dc16d9f1442bc4
SSDEEP 12288:oJcZERYNABMmv/b14eQih9DtLhhzuq/rLc:oJcZERWAB9TuivtLhhzu
TLSH
T131B46D29EBA852A5C127C13C86B6C743F7F170494B29ABDB56A5922D1F33EF0163D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eh_parse64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\eh_parse64.dll
Size 112KB
SHA256 acfdbd5fe7bf7a230bb50e758772cca111e39d64e7d4622be4f662b5a77ef826
MD5 e2b9bc1154c428458b0933c2ba6a8dcc
SHA1 f3641497474642af08c04512d401f5a38353edda
SHA512 cc7196d13f8affaeec1fbb63e4dba61c57af1471a72e854c6bea1260b64394d86adaa699875049ce3c8d9fdf4e0b623757db9a1059fd73b7fbb372f584b7ef0a
SSDEEP 3072:vjljkc7AWgks/JwzpiahXMsd96o+ErCVDQ:vjljkc7Pgkka9Msd9hoD
TLSH
T1BDB33A6A376890EEC12BC17D89428183E7F670111F215BDF3790835D1FB3AE16E396A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdb_user64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\gdb_user64.dll
Size 344KB
SHA256 71aea5f15b02ff566cd8f4c131d5af1548e227db6116c85a74188763f5ece288
MD5 095fb07c3dda19e9db7a29fa49f2c0fe
SHA1 980545580a799ae82f2243f1c4842eab578afaea
SHA512 63683e0445ba65a338c8d0415f095242124ed0f189069ff94f606ae6a599ff6d76a837b53ff57292268640a9b5902e9a42e227b1aec4d58e3617ced2b6a0f7a2
SSDEEP 6144:kzW6chgtnKD23sdboEReYz8ktR+I1f9m3/1f/E+VLuhVVf/:07nKDMIddQPI1f9mvz
TLSH
T186743B6ABB7088A5C267C1798A59C687F2F170990F35AADB06A4532E3F33DF4553D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hexarm64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\hexarm64.dll
Size 3.1MB
SHA256 b76cd8b7dbb64d90a99b925c34ffe3996bb91e48f9bbf8233b81b4854675d851
MD5 9576dd46e09437819ba23ce1e60e448d
SHA1 c8a1d131dd4451e48081a786a134ab054bc211b8
SHA512 0195b460a82c70320323d1f86aff1fb06d4a910d1eed77f297f486fdadf2af8d6c90ef3e87335896e449cf7697e03feac7d38ac8df486cd171f27d55d2ab6891
SSDEEP 49152:XlG59qB5XYelLS0Ux8hzFrOUEWVlXaXLvGqYYyAAXuL0FgXyjn/Oh1AHekTG:kO5eQhzFLtaXL9wfgi72h1AHdTG
TLSH
T199E54A2A677481ACC057C078CAA5C6A3F7F1744A5E3D9A9B34E583AF6F33A71152D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hexppc64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\hexppc64.dll
Size 3.0MB
SHA256 3aad1ffc3cefe4c318e56d70da49ffd15037bbe30fd335e76c55bfc666437a90
MD5 72fa7578090319e0bcdd260adadbb283
SHA1 4e4a68e2a7b3c533fb283c638c4a35347345a57b
SHA512 77c260299041b3f1cd21bcb5ffa8a4f25be814676ca92bee9e7afee601efe06e71e1da4bc54ea111eb3d400792fa9ed8cb059caa9ec9f1a180a85d43ffdd22bf
SSDEEP 49152:8/Wmhhw/RwhmSCodcaNoo+PusMYfSOZY3ZWlKq2ZDpRhX+D+Ip:r5wprL4oOZm0KqcpuCIp
TLSH
T1C1E55C2A677581ECC017C078C9A9C393F7F1B4465E395B6B36E587AF2F33A61492D220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hexx64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\hexx64.dll
Size 3.1MB
SHA256 cd69dc3a6807189a3e063bea5d4ddbb7f4e539c33bd028e1d583fbcda604b7e1
MD5 c2e49a750feffc904fd3b091b215ea65
SHA1 e632e76f6d8df32269ac3b6bafcf6a8d08823115
SHA512 4278841e60ab020d011132dcd9651936c7898cb223edb50ea9e0b1824f870787bd38d0496d41e6b2221c676bd0cad2be0202e8cbfbce28b0dd19947142ff8b6a
SSDEEP 49152:ezXznsIHTjq3GPdqDTGhdkNig56EKtDdaA89MEqsH+fS1ivJDg3S8C0eoM:M7H7qBxKth8J1ivSXeJ
TLSH
T1ADE56C3E677481ACC053C078C9A5C2A3E7F570568E3A9B6B34E5976F2F33A61162D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idapython3_64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\idapython3_64.dll
Size 112KB
SHA256 e4f13c4d24c84d99dfaa422f38d02f974166e29cf037d070e5fbd4edc68e7b35
MD5 6962a5502ff886e9bd3e34802518f1ed
SHA1 58fa228daf7f63b759f36f5f2b43f1034a00d5db
SHA512 0b09221fef188744ef93d3e1c7683b88f3077780e69c435f0fc28495c429a9315fdc51166492a3f3daf8707beaf66a22a39f5bad87573e5ed8826a845c3b75e5
SSDEEP 3072:/Q7DaanCmbJAdFtv1TjpK8gcAyl8RSo0RdJkm4m:/Q7mHmbJEp1PJklm
TLSH
T157B3080E37648856D232D17F88694242E7F9B1895F320BEF1352835E1F22BE66D7D6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ios_user64.dll

Path C:\Program Files\IDA Pro 7.5 SP3\plugins\ios_user64.dll
Size 413KB
SHA256 d1a45cc241039c3464f04853df60646e62dd3d8cb06be6991b68b22559a4bb79
MD5 ef71aece6534e6eb707f7fdb25ab218b
SHA1 cbed19ef5ea7414e415dc0a51fe8fa315e5950cf
SHA512 f45c5e251563f2d8ad8a6f6109de80acc12c32528a5072fe889b977883242c39ce4627fc1197df4c09185fcc063418e517d0c209b2099cbb6c1a2eb067129411
SSDEEP 6144:0cd7GIQohAXlxFakHV140I0loXPj/Yt1ENh4xIPEqkV97ByUL:lSlxFj14H0mQI70fL
TLSH
T167944A6AEB7484A9C137C03D85A6D643F2F570990F39AADB12A4C67E2F33DE4553D220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Program Files\IDA Pro 7.5 SP3\python\3\PyQt5\uic\Compiler\__init__.py
Size 548B
SHA256 4fb2f6155bfb5efd7b9f5df6f80e11fb3d7997657fc2c8282c0189a3177dfe3c
MD5 8e40717de96792f3f07cc9233be4743c
SHA1 6de35101b0ce8fdb91729d54668006f694cffd25
SHA512 f0072d85733febcd67d10bac289f1f90d1b929fe1aaf1e90a09b5dd1836b47f183dc8e9f671ab599c74625b984c8336ef32be44914c0c532d240c7486b951bb1
TLSH
T1ECF0ABA8190286FA430004AB22CBEBD5A31E1F5AAF3BE992780D80881608A5884F0888
MD5 SHA1 SHA512 TLSH

Submit Download

qt.conf

Path C:\Program Files\IDA Pro 7.5 SP3\qt.conf
Size 207B
SHA256 2518738eb7865283890de96021a55438468625d23e6b11fd09ae21d90265a83d
MD5 afe6c730b47e00e3ff5f65b0756363f3
SHA1 bcfbc80905b6e9f597de0cc1d987d9200c446c80
SHA512 ba82e4ddae268572b36cc1745fa39e0b468754ae2a8670f9f2ae91cecc4ccfffe7ee07b3db783a5f6a14c0e4fb744a5e89f748025872f2be7faea22d459d4407
TLSH
T18BD0222227BA4C0B99B6B13213438E70D3DD07AF2AFBE058626C1704ECD271952B2A20
MD5 SHA1 SHA512 TLSH

Submit Download

theme.css

Path C:\Program Files\IDA Pro 7.5 SP3\themes\_base\theme.css
Size 6KB
SHA256 bafad2c7e0e569e2a0dc278f346a61274cb7c95c010a3c8d5381dcae6cac0c96
MD5 19386b9e51dda226887c2149c84c9814
SHA1 370d5ca188f31ad01cd389483e47b6b59370383e
SHA512 c7bbd21fa4875aa247d9f1326f784da251aaf107f2a1a7128773587ec78e6ae599ed66259e3ecf8286fb8136375cf8eabeb6b0976e87622a33d5771e886ab27d
SSDEEP 96:Z3aXtBckH/SgF05c8Q08j18xKuyN4j5EquJXJaKXAKFgrMRKCADCWV08sVACKLQ4:Z3aXtBckH/vv0Q1abOW08sVACKv
TLSH
T111D15351FFE39C6A61CF806E23A27468DFD99A43E274C95CFB4D23854F0C920A1996C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

theme.css

Path C:\Program Files\IDA Pro 7.5 SP3\themes\default\theme.css
Size 5KB
SHA256 393c43e96d84514121e8c6098afce5a0f1d07e22165dcbf4e1207839f44fd63a
MD5 edb15b0a58256a6c8cf5763154aff06e
SHA1 10d87040a16e31bb420e761e512778af2d378fdc
SHA512 98a7c25e8027a74e5fa41f8f48487f42f3a9476d53838dc425197e9c0638a968e052e63fbac5098c3ca9776fcfd209e9aa06c15d320c8f4e51591f31e00b4b51
SSDEEP 96:5c6cmUJicKa5S1xVR0oSC7MCzMSF0HhTwJSzqEOMVBf0yywCFFFNswfdrgwBdCC3:5pcmUJila5S1xVR0oSoMQMe0HhTwJMqz
TLSH
T131C1EB55FFE2DC2B05C7CE3833923010DAC9EA5BB6B020A1FBAE57544B48B25B0595CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID06.tmp

Path C:\Windows\Installer\MSID06.tmp
Size 381KB
SHA256 44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9
MD5 d90ab57e6c584f90fbbea74b566216e3
SHA1 4616e59aed33848f5870e5e1fe865f932721a162
SHA512 5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695
SSDEEP 6144:JyVt6fHYx+8GOL2bS9Li0k9TY1fuMuwLspJaDsAkvAO5cSrQVKlbCS4T73:6tkeYbS9L/RuMuwLocopMlVSCS4T7
TLSH
T1F8846C2072DAC436D5BE4AB43A3CD99E44297EA59BF2C4EB13C81D1E09739C24635F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 29915c7fdf6850b5ae6cc87cf7220ad091bd904755a92ea8f72076530bc8ad55
MD5 239e8faad5196695e89413f96b384582
SHA1 444adecd49af925c8cfe560ae6072d57fb4762a8
SHA512 4d00f76aa808142630600170a07dea1d93858a5f6801ebf2dc41318b6acf99e143c31f303d60f01f24434314743c918b928da46a7d098a744b88c6f8c826f3c2
SSDEEP 24576:Ou8m+1zjdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:6
TLSH
T1DD47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ddd2f9ef-bd64-4d02-a3b2-dcfcfa8d5458}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ddd2f9ef-bd64-4d02-a3b2-dcfcfa8d5458}_OnDiskSnapshotProp
Size 6KB
SHA256 e4419b8ece70c874044b903342b3d97ae3ec3d80e0fe6b89dc23bf7e3ad3260e
MD5 4c0bed359fd80d3fabd85447621be44d
SHA1 757262fadef9e30d93cb6117561fd2823c12a4a6
SHA512 37e8351ee8cd9beb523e82b2d43d83574251bba587530339e31aad0da04ba2e1764c681ca9221066db4dbab6935aaa7ea144367090493bb7e2ecd7895a0c5115
SSDEEP 96:FgrJqGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:WIGPGnb++ZVm
TLSH
T161D199085AE54711E2F3AB3129F14557A877B911EF33CB8E0298638E6670A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3520-1404-0x00007FF689A40000-0x00007FF689E56000-memory.dmp

Download

memory/3520-1405-0x00000000521D0000-0x000000005272A000-memory.dmp

Download

memory/3520-1403-0x00000000521D0000-0x000000005272A000-memory.dmp

Download

memory/3520-1406-0x00007FF689A40000-0x00007FF689E56000-memory.dmp

Download

memory/3524-1451-0x00000000521D0000-0x000000005272A000-memory.dmp

Download

memory/3524-1453-0x00007FF6151C0000-0x00007FF6155D7000-memory.dmp

Download

memory/3524-1450-0x00007FF6151C0000-0x00007FF6155D7000-memory.dmp

Download

memory/3524-1452-0x00000000521D0000-0x000000005272A000-memory.dmp

Download