78bb9755b35a94e59a72f299b6b63b5da472deb5c2b03ce016e5fe9f116a3554

Analysis

max time kernel
298s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FileConverter-2.2-x64-setup.msi
Size 57.7MB
Sample261002-ebptksscpc
SHA256 78bb9755b35a94e59a72f299b6b63b5da472deb5c2b03ce016e5fe9f116a3554
MD5 0083b7a95f43d50c572940278eadb116
SHA1 8dad2da3b0a1011fadc441f2db2a6cf83139509d
SHA512 5f155214fe19aec200b6f1e350c688c9c8f7231075ced936da035cea9462a520f2494c3f5f0c9112d7f9751f45f0cf054e0189b396b448e9eeb177656f11f167
SSDEEP 1572864:6hzhdNGWJB1RuSLTbYX0OEKJr/PjMQBghBfYxSrHMWfbiMKV4+:650uuSsEmr/PQ2AgSrPiL
TLSH
T125D712F071A5C42CD1D16670CB68E4B8CE353DC4250F8D1A1987FE18D93AAA8E8F5B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
4676	FileConverter.exe
3628	FileConverter.exe

Loads dropped DLL 9 IoCs

pid	Process
1596	MsiExec.exe
4676	FileConverter.exe
4676	FileConverter.exe
2600	regasm.exe
2600	regasm.exe
2600	regasm.exe
2600	regasm.exe
3628	FileConverter.exe
3628	FileConverter.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4796	msiexec.exe
7	4796	msiexec.exe
9	4796	msiexec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files\File Converter\Magick.NET-Q16-AnyCPU.dll	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.Abstractions.dll	msiexec.exe
File created	C:\Program Files\File Converter\WpfAnimatedGif.dll	msiexec.exe
File created	C:\Program Files\File Converter\ffmpeg.exe	msiexec.exe
File created	C:\Program Files\File Converter\Languages\en\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ru-RU\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Xaml.Behaviors.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ru\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\es-ES\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ar-EG\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ja-jp\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\sr-Latn\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\sv-SE\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\CommunityToolkit.Mvvm.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Memory.dll	msiexec.exe
File created	C:\Program Files\File Converter\gswin64c.exe	msiexec.exe
File created	C:\Program Files\File Converter\gsdll64.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\fr-FR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ko-KR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\pl-PL\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\FileConverterExtension.dll	msiexec.exe
File created	C:\Program Files\File Converter\README.md	msiexec.exe
File created	C:\Program Files\File Converter\Languages\he-IL\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ur\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\zh-CN\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Magick.NET.Core.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\de-DE\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\el-GR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\sr-Cyrl\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Markdown.Xaml.dll	msiexec.exe
File created	C:\Program Files\File Converter\Settings.default.xml	msiexec.exe
File created	C:\Program Files\File Converter\SharpShell.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\id-ID\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\pt-BR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\FileConverter.exe	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Bcl.AsyncInterfaces.dll	msiexec.exe
File created	C:\Program Files\File Converter\Ripper.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\cs-CZ\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\hu-HU\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\it-IT\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\FileConverter.exe.config	msiexec.exe
File created	C:\Program Files\File Converter\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\pt-PT\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\CHANGELOG.md	msiexec.exe
File created	C:\Program Files\File Converter\LICENSE.md	msiexec.exe
File created	C:\Program Files\File Converter\Magick.Native-Q16-x64.dll	msiexec.exe
File created	C:\Program Files\File Converter\yeti.mmedia.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\hi-IN\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\vi-VN\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\fa-IR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\tr-TR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\zh-TW\FileConverter.resources.dll	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{108B7211-CD2B-4F28-9959-4888825EFCDA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7313.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\SettingsIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\SettingsIcon.exe	msiexec.exe
File created	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe	msiexec.exe
File created	C:\Windows\Installer\e596dd5.msi	msiexec.exe
File created	C:\Windows\Installer\e596dd3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596dd3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4796	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000721441820b46a3f70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000721441820000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090072144182000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a72144182000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d72144182000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	regasm.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	regasm.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1127B801B2DC82F49995848828E5CFAD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\ProductName = "File Converter"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\ProductIcon = "C:\\Windows\\Installer\\{108B7211-CD2B-4F28-9959-4888825EFCDA}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\Class = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\RuntimeVersion = "v4.0.30319"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\PackageCode = "2BC42D770910B0046A5E0579AB3D1054"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\ = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\RuntimeVersion = "v4.0.30319"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\Assembly = "FileConverterExtension, Version=1.2.1.0, Culture=neutral, PublicKeyToken=15400b1c4b948c8a"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\ProgId	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Version = "33685504"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\Class = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\CodeBase = "file:///C:/Program Files/File Converter/FileConverterExtension.DLL"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}\0 = ".NET Category"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\FileConverterExtension\ = "{af9b72b5-f4e4-44b0-a3d9-b55b748efe90}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\PackageName = "FileConverter-2.2-x64-setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\ = "mscoree.dll"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\Implemented Categories	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1127B801B2DC82F49995848828E5CFAD\Application	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension\CLSID\ = "{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\Assembly = "FileConverterExtension, Version=1.2.1.0, Culture=neutral, PublicKeyToken=15400b1c4b948c8a"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\CodeBase = "file:///C:/Program Files/File Converter/FileConverterExtension.DLL"	regasm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B717AC3E798AA814BBFEC5E7537CE6B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B717AC3E798AA814BBFEC5E7537CE6B4\1127B801B2DC82F49995848828E5CFAD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension\ = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\ProgId\ = "FileConverterExtension.FileConverterExtension"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\FileConverterExtension	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension\CLSID	regasm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4676	FileConverter.exe
4676	FileConverter.exe
2600	regasm.exe
2600	regasm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4796	msiexec.exe
Token: SeSecurityPrivilege	4712	msiexec.exe
Token: SeCreateTokenPrivilege	4796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4796	msiexec.exe
Token: SeLockMemoryPrivilege	4796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4796	msiexec.exe
Token: SeMachineAccountPrivilege	4796	msiexec.exe
Token: SeTcbPrivilege	4796	msiexec.exe
Token: SeSecurityPrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeLoadDriverPrivilege	4796	msiexec.exe
Token: SeSystemProfilePrivilege	4796	msiexec.exe
Token: SeSystemtimePrivilege	4796	msiexec.exe
Token: SeProfSingleProcessPrivilege	4796	msiexec.exe
Token: SeIncBasePriorityPrivilege	4796	msiexec.exe
Token: SeCreatePagefilePrivilege	4796	msiexec.exe
Token: SeCreatePermanentPrivilege	4796	msiexec.exe
Token: SeBackupPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeShutdownPrivilege	4796	msiexec.exe
Token: SeDebugPrivilege	4796	msiexec.exe
Token: SeAuditPrivilege	4796	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4796	msiexec.exe
Token: SeChangeNotifyPrivilege	4796	msiexec.exe
Token: SeRemoteShutdownPrivilege	4796	msiexec.exe
Token: SeUndockPrivilege	4796	msiexec.exe
Token: SeSyncAgentPrivilege	4796	msiexec.exe
Token: SeEnableDelegationPrivilege	4796	msiexec.exe
Token: SeManageVolumePrivilege	4796	msiexec.exe
Token: SeImpersonatePrivilege	4796	msiexec.exe
Token: SeCreateGlobalPrivilege	4796	msiexec.exe
Token: SeCreateTokenPrivilege	4796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4796	msiexec.exe
Token: SeLockMemoryPrivilege	4796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4796	msiexec.exe
Token: SeMachineAccountPrivilege	4796	msiexec.exe
Token: SeTcbPrivilege	4796	msiexec.exe
Token: SeSecurityPrivilege	4796	msiexec.exe
Token: SeTakeOwnershipPrivilege	4796	msiexec.exe
Token: SeLoadDriverPrivilege	4796	msiexec.exe
Token: SeSystemProfilePrivilege	4796	msiexec.exe
Token: SeSystemtimePrivilege	4796	msiexec.exe
Token: SeProfSingleProcessPrivilege	4796	msiexec.exe
Token: SeIncBasePriorityPrivilege	4796	msiexec.exe
Token: SeCreatePagefilePrivilege	4796	msiexec.exe
Token: SeCreatePermanentPrivilege	4796	msiexec.exe
Token: SeBackupPrivilege	4796	msiexec.exe
Token: SeRestorePrivilege	4796	msiexec.exe
Token: SeShutdownPrivilege	4796	msiexec.exe
Token: SeDebugPrivilege	4796	msiexec.exe
Token: SeAuditPrivilege	4796	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4796	msiexec.exe
Token: SeChangeNotifyPrivilege	4796	msiexec.exe
Token: SeRemoteShutdownPrivilege	4796	msiexec.exe
Token: SeUndockPrivilege	4796	msiexec.exe
Token: SeSyncAgentPrivilege	4796	msiexec.exe
Token: SeEnableDelegationPrivilege	4796	msiexec.exe
Token: SeManageVolumePrivilege	4796	msiexec.exe
Token: SeImpersonatePrivilege	4796	msiexec.exe
Token: SeCreateGlobalPrivilege	4796	msiexec.exe
Token: SeCreateTokenPrivilege	4796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4796	msiexec.exe
Token: SeLockMemoryPrivilege	4796	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4796	msiexec.exe
4796	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1596	4712	msiexec.exe	98
PID 4712 wrote to memory of 1220	4712	msiexec.exe	105
PID 4712 wrote to memory of 4676	4712	msiexec.exe	107
PID 4676 wrote to memory of 2600	4676	FileConverter.exe	109
PID 4712 wrote to memory of 3628	4712	msiexec.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FileConverter-2.2-x64-setup.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F4626E85C5617870AED844E5D56C5CA3 C
  2⤵
  - Loads dropped DLL
  PID:1596
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1220
- C:\Program Files\File Converter\FileConverter.exe
  "C:\Program Files\File Converter\FileConverter.exe" --register-shell-extension "C:\Program Files\File Converter\FileConverterExtension.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe" /codebase "C:\Program Files\File Converter\FileConverterExtension.dll"
    3⤵
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2600
- C:\Program Files\File Converter\FileConverter.exe
  "C:\Program Files\File Converter\FileConverter.exe" --post-install-init
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596dd4.rbs

Path C:\Config.Msi\e596dd4.rbs
Size 19KB
SHA256 1eff25aba6fad29448b4eacb7d7be16744f4abf31a07ee15b10ea2acf20ae2e6
MD5 95aec7200de08d43e0537512a187a341
SHA1 a6596a2b7c98795d5e75fbfed0a485cae76904ff
SHA512 3e6a74eddd23c1124c63d263b5f99d2dfc878460be869980433b7d2951ef85900f686811ec2c6ea01cec952fdf92be687e54e800ca436fcdc34fc9ed80979ffb
SSDEEP 384:CxdQbySsQ5mCnHsGC/GbZfdqYOVa956cRut5tvvbh4v3piI6P2O9TL4FURpsRZXb:CxdQbySsQ5mCnHsGC/GbZfdqYOVa956a
TLSH
T1509202805A90DBD2F583357147133A74975ECC89A3E58B3E076AD12E9E43ED829F83E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Program Files\File Converter\CommunityToolkit.Mvvm.dll
Size 112KB
SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
MD5 634fa35f5855bea7fda4f5631ecb7aff
SHA1 982159403969b8d4a5ea31d99d18e3ba927c9ed8
SHA512 339d20de6ed61e7b86d43305198beba32a26d7e7721923219d475e0112f5429e01998404c4fdd10c0630813e55ad766ef3f2f8aa1df3c937c2b3a3f88bf22061
SSDEEP 3072:H+c+yfwDziGuqRGia5iKYR2l+EaXcw+MP:H+8wHiGuri8iI+c
TLSH
T104B37C0263E85E13E6FF0F7564A8504A8F32FA07B932E39A598C63F519837905D533B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileConverter.exe.config

Path C:\Program Files\File Converter\FileConverter.exe.config
Size 1KB
SHA256 2c71bdbefb2d86096b7e836d2952c8354e2e01ea193592d53bcc3da920d0d266
MD5 27e1608c7b1ed4ed7ae9cb5c674170cd
SHA1 658fce4b2e9df0c9b54475bc472ecaacdd2c6fb8
SHA512 8be8aca28ad02789b4d6b01566164d63e871ea62b6668dbb8d21c2ac082b64bae7aefa7076e728dcdbf6bba255e583003c78c16085ee6d04064c641b02379a14
TLSH
T168314D2191C8AFA58F7255F23E6B7428CB6D03B7288C41DD70EE6E5B8F25D9A5207073
MD5 SHA1 SHA512 TLSH

Submit Download

FileConverterExtension.dll

Path C:\Program Files\File Converter\FileConverterExtension.dll
Size 319KB
SHA256 0c9083d43c29e3ea7e07e2fecc864057d74300882144846645c69b090bf08ab5
MD5 d63f8423fd3b4d05d171b76a31031217
SHA1 54395ae14267823bc3b8ee69a7a66297c6de7812
SHA512 340dc98d65a68d4759183bb2c97af4074c572841ad39250dba0610cc71af1824f4dc3c9f217476ba18f355cb9dd421b3db1ecc14a967b9d22787d4d85bd5adc1
SSDEEP 3072:t+TpeV3QA69Qi9DSAlv4VbkKfq/xx/yy38Y:6XA69Qi9PghkKfq/xx/y88
TLSH
T174646EB0A545003CD6C63B31C7725AFC1EAE6DE8385CAD6A2947F9551E32E0E9DF210E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Program Files\File Converter\Microsoft.Bcl.AsyncInterfaces.dll
Size 27KB
SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
MD5 6b81ffcec37066c94500d0845f580e91
SHA1 795e193099214a767cb642c2b48022ef3e59e63d
SHA512 9213cd310664c429c4d1981b530639c33104b9d17ed8121304af6ec48ee6c3095f4d78365ad7d6141b2a18a0acfaabfa63211420248c0d891c6078dfb2608c45
SSDEEP 384:snuDmDZGXTmBxeg0ZrS2Yh0WXIdGl+IWY6FU2jWeT/WjjPDHRN77LDGTYAsR9zJn:suwIqBxEZ22LwJgFU23EvyMj9zGxji
TLSH
T125C26C55D36C4313CFAE2FB5E969C6822D74E38A3C33DA3E1248E6550C97788A63523D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 64KB
SHA256 04f478ab7d1393686d55f80a79fac55f577b360f4424f7ea691a9eb979564977
MD5 87707efaae9e0737deeacbdec1cbbe5b
SHA1 06feb5210bc59cdc6cd9a4b1f4b12eb56a06f7af
SHA512 c7b8821b1129620264ddbdfeee0a128008a3718ed7f91343964395b5cf0af0c38cab96287ebc14847e7ead858982271b15968810248eb84a29112073d7f7b9f7
SSDEEP 768:bjT1o8x0nc6kEZdTMru4YuqqIOhH0ypjawq5P1qt1QYeHDjtQZs49zC:vTP/WWafjOZ0ygwWPoXQv37wzC
TLSH
T1CA536C6C33FC8B62C7FF46B17AB055014B74FA472A12E71B3585E4AD1583BC860A0AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.dll
Size 99KB
SHA256 e4f80f6fa0a63cc895ad6acb4c7ab86f4da270e619d56f35d7379172da93aee3
MD5 fdf464a0e7e6748f7eb3d4b5bab8fb8f
SHA1 5068b076ae70d199bca93db798cd5dd1c008bc35
SHA512 fd90dafe9a9b28d9d4eeaf34241322bcbb4efa3cf487224e522f54ff54c272b4e957661e5f13d62b1fa79e8c0abbe3645e2a9bf602b98a5c76679ef2626f3bfa
SSDEEP 1536:ePbhGjEmBQa/gSIW/UY8GmvSmcu+lL4xjowrQFhsmp6nJcdRyLzS:ihoEmB/yMUXTcu+94xowrQcOzsO
TLSH
T121A37D7463FC4B66C9EF1AB5A47582000F7AB68B3003E71E5EC8A15D2A97FC157212B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Settings.default.xml

Path C:\Program Files\File Converter\Settings.default.xml
Size 95KB
SHA256 de9823cd862be7234513c4e0b76cc3d5fcb99ab2ab4f3c5d123c1be944dca8b7
MD5 4b06e20677df04a9c111175f399d88a6
SHA1 a2cabddfcafdcb25412e6cbc242b78652e09c27d
SHA512 e584bd4bcd2b351e027478cffdb114963448096080f725172d11485e94135820f26a2406fc80eb7ac0ce9401b1a232461033951f15d0baf7e940b893095ca53e
SSDEEP 384:2oiovoqofwosoXo5oBo9oionoho2X8XEQ6QeQygQxQDQhSocSp+So7SoUSo7oToT:4M1EnTsg6//xNf/7MDzQaMHRzZwu
TLSH
T111A3043136F5A92687790B79D9F58601DF6CC1AF0A4A0110B1AE2D2B4FB708F179BBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpShell.dll

Path C:\Program Files\File Converter\SharpShell.dll
Size 440KB
SHA256 63e0a221f9b84973195fb1514d06b26d7b5d539123ce010b7bbc3ee37ba0fca0
MD5 70125553edff4465dce49b2eeecb9bb0
SHA1 e6ae96cb114292ad9de448815e680ad9f467a235
SHA512 1a0d07f623bafd1e621af2d5e29d89f898c13a753d38fd9ffac9fbe2c8ca6ebfa605f517ef9496c958f4b2a9113336c7bbd3db3eec7f1379487734d4aee632d8
SSDEEP 6144:BFptzbaiLW0BQBQLwiqrn2XP9ZTxiUbLFITQ+mJe3aolB:r/bpLWwQ5iqDkwMITQma8
TLSH
T1F1A45B10B7F80F5FD56AC33495BA59018AB1F74D3625CB0B4681D18E2CF27438DAB7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Program Files\File Converter\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 1KB
SHA256 ba5575b889306c1396506b2df949b195c0c8debf811ee162529139f1f908c34e
MD5 2068c01498057b3e67672e669155a5a4
SHA1 f978ae21c5d11c5b903c8ed44ca82378e0688bd6
SHA512 ff266b889ae925ba52504dcbccefb199df5273ba5e3910b599ef0cc4c178d25dbf2153b1b03db62612030fa7ca09f9fcaa9f17e2c9f82c3566551b801bf0afb9
TLSH
T19831B527CE99A911AB065F359EF0E0381CBBEBEA048954872024C8C69D1177A7F26D4F
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
Size 2KB
SHA256 31de46dbb31d694e7c183e7edb4416aae1391fd512b07857ee817de36b5dc3b0
MD5 095719061d036c12ac5a44dca7972650
SHA1 b5b96771fe65413a90ef03775664c6eea0ce7435
SHA512 3ea95312afd3986cd157964f8a29af864d3743065930550ca163ad1c8209248e157834ea8822e200dcba8bc67b9358070d47d84d75906eaf505d6b1b605710b5
TLSH
T1734119468B213618B943EAB6CDC8C0316CB457D12540A6093B6C82CF0BA6B373F7601E
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 1KB
SHA256 d2de0d894af355675fc898026096f8db7284cbe4fb75f592846214b0f7033e68
MD5 c8c0ed471922395f5b13ac5100631c83
SHA1 455018c2016b0af2a02447cfca9c4a317835bdca
SHA512 c147da65cee20fa99db5571cad842c3153093148c23ba3595814dd79c94053b3a3fbf6dbbb1d47e032aab8b92dc464bfc90f1bc9cbf860dadd66e63050b599e8
TLSH
T16A31E7619E2268951E9249A12FE9E23E9A74B0C60D30000630BCD7D9DDD3BBB3F7640D
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 412B
SHA256 2436a3323a0ef93f22d35dc6507590165ddbd0397c11ca105a4550e6df7c44d1
MD5 8ebef694dd6f780fbf70bfe25753e138
SHA1 71894463550100486417abbabe1d7722e92eb799
SHA512 8253bf5121f1a2fbb1fd962c00f6efd07112a01ee7949f93247a8cecfafa11665b3ee0a2acbbd0ce59751cc607ea90d1912b9a8676bba0ed33b89ccb864b4b98
TLSH
T109E0681931FF1208F1758DFD03D922309E3CB1A331846AF2479012097395C04DCE37A9
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
Size 416B
SHA256 ac658fa5297c569634cae1fa56b3a6a8160c9e6681a21640ded51cc0abb2100e
MD5 016a7cd8c147de29319c92e4607688dd
SHA1 51873b351974f6a0bb21bec504fb63b842e6f16f
SHA512 0ff7dc3131312853c683368de518bacb4e27cce8db44ae1faf1d052c77a3dc80b281c8fc478b8bd361b7edbb762fc412e270921eeb291bbb12238984cca7cdb4
TLSH
T1DBE0C01436E9015DF337EA7887D6A67BCD1EF21754844BAB1B70100B4E02F004D33E24
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 412B
SHA256 26c3b70fc088cf6e88b47a896077a4ebc30df19c7fb71ec0050fd63737513b7b
MD5 0afe710b0e226d1c737b23bf2d108d52
SHA1 102621af320874e86303c458f5b306d90c395a87
SHA512 6fae313c0b427aa62b3756fd885738abdcd36f7df0829db7a2be98a831d0e5064844efa15aed6a0189190e99d10370eb30ccd1370417fda969fd9ce0cc038fcf
TLSH
T144E0682822BA40A8FB30E93A41C967F00A3FF637140C1BF00FA042057E109845C65C31
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.user.xml

Path C:\Users\Admin\AppData\Local\FileConverter\Settings.user.xml
Size 95KB
SHA256 d3381bc408ac8f5725b0193c365623f381e4b5727c3270ea2aaa289953353e5b
MD5 65d4c7fe2b7d71f28fe178fc289f4418
SHA1 edaf44f7f8307f98f0ede851c471d9a639f5e4ed
SHA512 88a479c60ebd63b7a1395b5aed1f9305ccdece0a032c27d969e5dc7619d6b3fb71d3539b2e8fb3e41c1536afcc2bfd05f80d54b7fd3e0d7186cc1ade3e14d354
SSDEEP 384:doiovoqofwosoXo5oBo9oionoho2X8XEQ6QeQygQxQDQhSocSp+So7SoUSo7oToo:vM1EnTsg6//xNf/7MDzQaMHRzZw9
TLSH
T1B2A3143136F5A92687790B79D9F58601DF6CC1AF0A4A0110B1AE2D2B4FB708F179BBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileConverter.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FileConverter.exe.log
Size 1KB
SHA256 a532b0c6027d95d3e7d387323b3e9a8c4af744e250c38883a75790b4e44d9f1d
MD5 8d761e7c697ef9777186fbdef6f3130e
SHA1 8d0021c505fe159b5677760f1a99cfe5c930b837
SHA512 5441ad4a10d3127b7e15fc25dc4a98d3c003ddf62c68f037fc61ebfcb8fa1759770c8e135be0b173ab1c5104a24699c0b4ba1cff8e2d5fcbc52493484e62b1ab
TLSH
T19731F07126B1B1D48E133F52296C258463FF0728FA545F5CB66C625EE9290179F232F3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1EAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1EAA.tmp
Size 175KB
SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
MD5 543072c649a87e1880784b7f0effaeeb
SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
TLSH
T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon.exe

Path C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe
Size 1.9MB
SHA256 162f16134c3ac80ff3322d2dce13d8fd4f0476108cb96415927ebea055abc241
MD5 0d263157cc322fb5ab9c3b65c114a258
SHA1 68cae707ef6a083a9e3a5329765f2fc64a2beb9e
SHA512 6b23ce6aa0014eb6669f36277ae24d18cb9d266c7339587aa3cbbfc9ac5566f5fbe43d2864bc6f6822d07c75952d99530d842d2a838eacbb32362fbb26057052
SSDEEP 24576:RRvSWJT69CO2csP29MmDkfs6pfmGEsxfOJZtEXrxKHcEQiBQPDmXM7P0j6m8:/SWJe98zcMJppvbxfsPqxK8EQsotPm
TLSH
T1ED959C70A2A4483CD5E63B78D37414FC8E2A2EC5795CDE5D2A83B8581932F0DADF065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 22df4c3ad274446c11026c203d9bb88269312ffe16d2d0c4e27a45053f23c1c5
MD5 e9682432d3837f0c95501f55423328b8
SHA1 98f726ba0787c88bc88dd363378ca99f3c26a7fe
SHA512 fd2605cd52a40e831215b634c0036e209353edf8406ab28650fd515768c4aa6215d1618a35e3c8cb7334946415540bc291c3bcdda52c7b07ae6b64c37de930fc
SSDEEP 24576:mu8m+1zddoO/vvTLb2KePmKObjEjyFay2MG9YlbVy067OdDnYvFDi8BB/:A
TLSH
T18747D52836F92100E7F7DE3CA8F06A2389797D5B9C159E8D05851F4E0921BB1E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ab7e6701-9b5f-4372-97a9-07342a0f0db0}_OnDiskSnapshotProp

Path \??\Volume{82411472-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ab7e6701-9b5f-4372-97a9-07342a0f0db0}_OnDiskSnapshotProp
Size 6KB
SHA256 26db1d9df048cd2404c8aee1eb7e82d5f1f909fa6377c683622d76a8480546bf
MD5 31420d67e8d39d783cda28f7a1858481
SHA1 aea7de38db291d84ec25921b755a468e9ff909ff
SHA512 cfcea4ff770c2d29ae95cfdf8d12eca0fbc493f34172deb27f759dfa15aed53567e1f2534b728e48bbdfcb184a7611a9f18696b6edfa499839c0c75843b415a8
SSDEEP 96:Fo/QAwmv4Cvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:2oARpb++ZVm
TLSH
T129D188085AF54311E2B3AB7228F14557A877B911EF33CB8E0298638E6670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2600-122-0x000002A373F80000-0x000002A373FCA000-memory.dmp

Download

memory/2600-117-0x000002A3721C0000-0x000002A3721D0000-memory.dmp

Download

memory/4676-101-0x0000028D8A470000-0x0000028D8A490000-memory.dmp

Download

memory/4676-116-0x0000028DA5E20000-0x0000028DA5E94000-memory.dmp

Download

memory/4676-114-0x0000028DA5DC0000-0x0000028DA5E14000-memory.dmp

Download

memory/4676-99-0x0000028D89E60000-0x0000028D8A040000-memory.dmp

Download

memory/4676-110-0x0000028D8A4B0000-0x0000028D8A4BA000-memory.dmp

Download

memory/4676-108-0x0000028D8A450000-0x0000028D8A45A000-memory.dmp

Download

memory/4676-104-0x0000028D8BDF0000-0x0000028D8BE04000-memory.dmp

Download

memory/4676-102-0x0000028D8A490000-0x0000028D8A4AA000-memory.dmp

Download

memory/4676-106-0x0000028D8BE30000-0x0000028D8BE4C000-memory.dmp

Download