78bb9755b35a94e59a72f299b6b63b5da472deb5c2b03ce016e5fe9f116a3554

Analysis

max time kernel
298s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/10/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FileConverter-2.2-x64-setup.msi
Size 57.7MB
Sample261002-ebptksscpc
SHA256 78bb9755b35a94e59a72f299b6b63b5da472deb5c2b03ce016e5fe9f116a3554
MD5 0083b7a95f43d50c572940278eadb116
SHA1 8dad2da3b0a1011fadc441f2db2a6cf83139509d
SHA512 5f155214fe19aec200b6f1e350c688c9c8f7231075ced936da035cea9462a520f2494c3f5f0c9112d7f9751f45f0cf054e0189b396b448e9eeb177656f11f167
SSDEEP 1572864:6hzhdNGWJB1RuSLTbYX0OEKJr/PjMQBghBfYxSrHMWfbiMKV4+:650uuSsEmr/PQ2AgSrPiL
TLSH
T125D712F071A5C42CD1D16670CB68E4B8CE353DC4250F8D1A1987FE18D93AAA8E8F5B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
2240	FileConverter.exe
2252	FileConverter.exe

Loads dropped DLL 9 IoCs

pid	Process
4276	MsiExec.exe
2240	FileConverter.exe
2240	FileConverter.exe
1256	regasm.exe
1256	regasm.exe
1256	regasm.exe
1256	regasm.exe
2252	FileConverter.exe
2252	FileConverter.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3708	msiexec.exe
3	3708	msiexec.exe
4	3708	msiexec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files\File Converter\Microsoft.Xaml.Behaviors.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\sr-Cyrl\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\sv-SE\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\CHANGELOG.md	msiexec.exe
File created	C:\Program Files\File Converter\gsdll64.dll	msiexec.exe
File created	C:\Program Files\File Converter\Magick.Native-Q16-x64.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\zh-CN\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\el-GR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\fr-FR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\hu-HU\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\CommunityToolkit.Mvvm.dll	msiexec.exe
File created	C:\Program Files\File Converter\README.md	msiexec.exe
File created	C:\Program Files\File Converter\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\File Converter\gswin64c.exe	msiexec.exe
File created	C:\Program Files\File Converter\Languages\es-ES\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\vi-VN\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\WpfAnimatedGif.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ar-EG\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\en\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\he-IL\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\pt-BR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\pt-PT\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\FileConverterExtension.dll	msiexec.exe
File created	C:\Program Files\File Converter\Magick.NET-Q16-AnyCPU.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\File Converter\yeti.mmedia.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ja-jp\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\FileConverter.exe.config	msiexec.exe
File created	C:\Program Files\File Converter\Settings.default.xml	msiexec.exe
File created	C:\Program Files\File Converter\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\File Converter\ffmpeg.exe	msiexec.exe
File created	C:\Program Files\File Converter\Languages\de-DE\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\zh-TW\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\FileConverter.exe	msiexec.exe
File created	C:\Program Files\File Converter\Languages\fa-IR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\SharpShell.dll	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Bcl.AsyncInterfaces.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ur\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\cs-CZ\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\id-ID\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\hi-IN\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\pl-PL\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Magick.NET.Core.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\it-IT\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\sr-Latn\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\LICENSE.md	msiexec.exe
File created	C:\Program Files\File Converter\Ripper.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ru-RU\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\tr-TR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Markdown.Xaml.dll	msiexec.exe
File created	C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.Abstractions.dll	msiexec.exe
File created	C:\Program Files\File Converter\System.Memory.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ko-KR\FileConverter.resources.dll	msiexec.exe
File created	C:\Program Files\File Converter\Languages\ru\FileConverter.resources.dll	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF2C4C00D0E25E44D0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\SettingsIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFD56DEE8145ABC99.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\SettingsIcon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDB79FACABA1FED65.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC938442B26ADC04F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{108B7211-CD2B-4F28-9959-4888825EFCDA}	msiexec.exe
File created	C:\Windows\Installer\e5947bd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5947bd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BE4.tmp	msiexec.exe
File created	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe	msiexec.exe
File created	C:\Windows\Installer\e5947bf.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3708	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000655f0e1918fbd5600000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000655f0e190000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900655f0e19000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a655f0e19000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d655f0e19000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	regasm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	regasm.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\CodeBase = "file:///C:/Program Files/File Converter/FileConverterExtension.DLL"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\Class = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}\0 = ".NET Category"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\PackageCode = "2BC42D770910B0046A5E0579AB3D1054"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Version = "33685504"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\ProductIcon = "C:\\Windows\\Installer\\{108B7211-CD2B-4F28-9959-4888825EFCDA}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension\ = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\ = "mscoree.dll"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1127B801B2DC82F49995848828E5CFAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B717AC3E798AA814BBFEC5E7537CE6B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\ProgId	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\FileConverterExtension\ = "{af9b72b5-f4e4-44b0-a3d9-b55b748efe90}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B717AC3E798AA814BBFEC5E7537CE6B4\1127B801B2DC82F49995848828E5CFAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\ = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\ProgId\ = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\Assembly = "FileConverterExtension, Version=1.2.1.0, Culture=neutral, PublicKeyToken=15400b1c4b948c8a"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1127B801B2DC82F49995848828E5CFAD\Application	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\FileConverterExtension	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension\CLSID	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileConverterExtension.FileConverterExtension\CLSID\ = "{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\RuntimeVersion = "v4.0.30319"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\RuntimeVersion = "v4.0.30319"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\Implemented Categories	regasm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\Class = "FileConverterExtension.FileConverterExtension"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\Assembly = "FileConverterExtension, Version=1.2.1.0, Culture=neutral, PublicKeyToken=15400b1c4b948c8a"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF9B72B5-F4E4-44B0-A3D9-B55B748EFE90}\InprocServer32\1.2.1.0\CodeBase = "file:///C:/Program Files/File Converter/FileConverterExtension.DLL"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\ProductName = "File Converter"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\PackageName = "FileConverter-2.2-x64-setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1127B801B2DC82F49995848828E5CFAD\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	FileConverter.exe
1256	regasm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3708	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3708	msiexec.exe
Token: SeSecurityPrivilege	4908	msiexec.exe
Token: SeCreateTokenPrivilege	3708	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3708	msiexec.exe
Token: SeLockMemoryPrivilege	3708	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3708	msiexec.exe
Token: SeMachineAccountPrivilege	3708	msiexec.exe
Token: SeTcbPrivilege	3708	msiexec.exe
Token: SeSecurityPrivilege	3708	msiexec.exe
Token: SeTakeOwnershipPrivilege	3708	msiexec.exe
Token: SeLoadDriverPrivilege	3708	msiexec.exe
Token: SeSystemProfilePrivilege	3708	msiexec.exe
Token: SeSystemtimePrivilege	3708	msiexec.exe
Token: SeProfSingleProcessPrivilege	3708	msiexec.exe
Token: SeIncBasePriorityPrivilege	3708	msiexec.exe
Token: SeCreatePagefilePrivilege	3708	msiexec.exe
Token: SeCreatePermanentPrivilege	3708	msiexec.exe
Token: SeBackupPrivilege	3708	msiexec.exe
Token: SeRestorePrivilege	3708	msiexec.exe
Token: SeShutdownPrivilege	3708	msiexec.exe
Token: SeDebugPrivilege	3708	msiexec.exe
Token: SeAuditPrivilege	3708	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3708	msiexec.exe
Token: SeChangeNotifyPrivilege	3708	msiexec.exe
Token: SeRemoteShutdownPrivilege	3708	msiexec.exe
Token: SeUndockPrivilege	3708	msiexec.exe
Token: SeSyncAgentPrivilege	3708	msiexec.exe
Token: SeEnableDelegationPrivilege	3708	msiexec.exe
Token: SeManageVolumePrivilege	3708	msiexec.exe
Token: SeImpersonatePrivilege	3708	msiexec.exe
Token: SeCreateGlobalPrivilege	3708	msiexec.exe
Token: SeCreateTokenPrivilege	3708	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3708	msiexec.exe
Token: SeLockMemoryPrivilege	3708	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3708	msiexec.exe
Token: SeMachineAccountPrivilege	3708	msiexec.exe
Token: SeTcbPrivilege	3708	msiexec.exe
Token: SeSecurityPrivilege	3708	msiexec.exe
Token: SeTakeOwnershipPrivilege	3708	msiexec.exe
Token: SeLoadDriverPrivilege	3708	msiexec.exe
Token: SeSystemProfilePrivilege	3708	msiexec.exe
Token: SeSystemtimePrivilege	3708	msiexec.exe
Token: SeProfSingleProcessPrivilege	3708	msiexec.exe
Token: SeIncBasePriorityPrivilege	3708	msiexec.exe
Token: SeCreatePagefilePrivilege	3708	msiexec.exe
Token: SeCreatePermanentPrivilege	3708	msiexec.exe
Token: SeBackupPrivilege	3708	msiexec.exe
Token: SeRestorePrivilege	3708	msiexec.exe
Token: SeShutdownPrivilege	3708	msiexec.exe
Token: SeDebugPrivilege	3708	msiexec.exe
Token: SeAuditPrivilege	3708	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3708	msiexec.exe
Token: SeChangeNotifyPrivilege	3708	msiexec.exe
Token: SeRemoteShutdownPrivilege	3708	msiexec.exe
Token: SeUndockPrivilege	3708	msiexec.exe
Token: SeSyncAgentPrivilege	3708	msiexec.exe
Token: SeEnableDelegationPrivilege	3708	msiexec.exe
Token: SeManageVolumePrivilege	3708	msiexec.exe
Token: SeImpersonatePrivilege	3708	msiexec.exe
Token: SeCreateGlobalPrivilege	3708	msiexec.exe
Token: SeCreateTokenPrivilege	3708	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3708	msiexec.exe
Token: SeLockMemoryPrivilege	3708	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3708	msiexec.exe
3708	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4276	4908	msiexec.exe	81
PID 4908 wrote to memory of 3860	4908	msiexec.exe	85
PID 4908 wrote to memory of 2240	4908	msiexec.exe	87
PID 2240 wrote to memory of 1256	2240	FileConverter.exe	88
PID 4908 wrote to memory of 2252	4908	msiexec.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FileConverter-2.2-x64-setup.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3708

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B80506E69F414AF2388CF8C440C31551 C
  2⤵
  - Loads dropped DLL
  PID:4276
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3860
- C:\Program Files\File Converter\FileConverter.exe
  "C:\Program Files\File Converter\FileConverter.exe" --register-shell-extension "C:\Program Files\File Converter\FileConverterExtension.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\regasm.exe" /codebase "C:\Program Files\File Converter\FileConverterExtension.dll"
    3⤵
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1256
- C:\Program Files\File Converter\FileConverter.exe
  "C:\Program Files\File Converter\FileConverter.exe" --post-install-init
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5947be.rbs

Path C:\Config.Msi\e5947be.rbs
Size 19KB
SHA256 5bb53caddf79eac3e3fad6a506ad27a31a8085bbe05f4c2c4a957f95224e7b5d
MD5 586cfc85722ec794d013d25c73dd17ee
SHA1 4b48ef580d66ded6c8aa0773fa5379c416332289
SHA512 c3e3ba1a920f85091a6fae68008d1015f8618e57f9d107d8464786b894d92367d06ebe69b7021780b4988b688599eb5dfb63db6bd3fd0bf3661c7db2941ec0ba
SSDEEP 384:kkdQbySsQ5mCnHsGC/GbZfdqYOVa956cRut5tvvbh4v3piI6P2O9TL4FURpsRZXl:kkdQbySsQ5mCnHsGC/GbZfdqYOVa956U
TLSH
T1199212805A90DBD2F583357147133A74975ECC8963E58B3E076AD12E9E43ED429F83E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Program Files\File Converter\CommunityToolkit.Mvvm.dll
Size 112KB
SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
MD5 634fa35f5855bea7fda4f5631ecb7aff
SHA1 982159403969b8d4a5ea31d99d18e3ba927c9ed8
SHA512 339d20de6ed61e7b86d43305198beba32a26d7e7721923219d475e0112f5429e01998404c4fdd10c0630813e55ad766ef3f2f8aa1df3c937c2b3a3f88bf22061
SSDEEP 3072:H+c+yfwDziGuqRGia5iKYR2l+EaXcw+MP:H+8wHiGuri8iI+c
TLSH
T104B37C0263E85E13E6FF0F7564A8504A8F32FA07B932E39A598C63F519837905D533B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileConverter.exe.config

Path C:\Program Files\File Converter\FileConverter.exe.config
Size 1KB
SHA256 2c71bdbefb2d86096b7e836d2952c8354e2e01ea193592d53bcc3da920d0d266
MD5 27e1608c7b1ed4ed7ae9cb5c674170cd
SHA1 658fce4b2e9df0c9b54475bc472ecaacdd2c6fb8
SHA512 8be8aca28ad02789b4d6b01566164d63e871ea62b6668dbb8d21c2ac082b64bae7aefa7076e728dcdbf6bba255e583003c78c16085ee6d04064c641b02379a14
TLSH
T168314D2191C8AFA58F7255F23E6B7428CB6D03B7288C41DD70EE6E5B8F25D9A5207073
MD5 SHA1 SHA512 TLSH

Submit Download

FileConverterExtension.dll

Path C:\Program Files\File Converter\FileConverterExtension.dll
Size 319KB
SHA256 0c9083d43c29e3ea7e07e2fecc864057d74300882144846645c69b090bf08ab5
MD5 d63f8423fd3b4d05d171b76a31031217
SHA1 54395ae14267823bc3b8ee69a7a66297c6de7812
SHA512 340dc98d65a68d4759183bb2c97af4074c572841ad39250dba0610cc71af1824f4dc3c9f217476ba18f355cb9dd421b3db1ecc14a967b9d22787d4d85bd5adc1
SSDEEP 3072:t+TpeV3QA69Qi9DSAlv4VbkKfq/xx/yy38Y:6XA69Qi9PghkKfq/xx/y88
TLSH
T174646EB0A545003CD6C63B31C7725AFC1EAE6DE8385CAD6A2947F9551E32E0E9DF210E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Program Files\File Converter\Microsoft.Bcl.AsyncInterfaces.dll
Size 27KB
SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
MD5 6b81ffcec37066c94500d0845f580e91
SHA1 795e193099214a767cb642c2b48022ef3e59e63d
SHA512 9213cd310664c429c4d1981b530639c33104b9d17ed8121304af6ec48ee6c3095f4d78365ad7d6141b2a18a0acfaabfa63211420248c0d891c6078dfb2608c45
SSDEEP 384:snuDmDZGXTmBxeg0ZrS2Yh0WXIdGl+IWY6FU2jWeT/WjjPDHRN77LDGTYAsR9zJn:suwIqBxEZ22LwJgFU23EvyMj9zGxji
TLSH
T125C26C55D36C4313CFAE2FB5E969C6822D74E38A3C33DA3E1248E6550C97788A63523D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 64KB
SHA256 04f478ab7d1393686d55f80a79fac55f577b360f4424f7ea691a9eb979564977
MD5 87707efaae9e0737deeacbdec1cbbe5b
SHA1 06feb5210bc59cdc6cd9a4b1f4b12eb56a06f7af
SHA512 c7b8821b1129620264ddbdfeee0a128008a3718ed7f91343964395b5cf0af0c38cab96287ebc14847e7ead858982271b15968810248eb84a29112073d7f7b9f7
SSDEEP 768:bjT1o8x0nc6kEZdTMru4YuqqIOhH0ypjawq5P1qt1QYeHDjtQZs49zC:vTP/WWafjOZ0ygwWPoXQv37wzC
TLSH
T1CA536C6C33FC8B62C7FF46B17AB055014B74FA472A12E71B3585E4AD1583BC860A0AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Program Files\File Converter\Microsoft.Extensions.DependencyInjection.dll
Size 99KB
SHA256 e4f80f6fa0a63cc895ad6acb4c7ab86f4da270e619d56f35d7379172da93aee3
MD5 fdf464a0e7e6748f7eb3d4b5bab8fb8f
SHA1 5068b076ae70d199bca93db798cd5dd1c008bc35
SHA512 fd90dafe9a9b28d9d4eeaf34241322bcbb4efa3cf487224e522f54ff54c272b4e957661e5f13d62b1fa79e8c0abbe3645e2a9bf602b98a5c76679ef2626f3bfa
SSDEEP 1536:ePbhGjEmBQa/gSIW/UY8GmvSmcu+lL4xjowrQFhsmp6nJcdRyLzS:ihoEmB/yMUXTcu+94xowrQcOzsO
TLSH
T121A37D7463FC4B66C9EF1AB5A47582000F7AB68B3003E71E5EC8A15D2A97FC157212B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Settings.default.xml

Path C:\Program Files\File Converter\Settings.default.xml
Size 95KB
SHA256 de9823cd862be7234513c4e0b76cc3d5fcb99ab2ab4f3c5d123c1be944dca8b7
MD5 4b06e20677df04a9c111175f399d88a6
SHA1 a2cabddfcafdcb25412e6cbc242b78652e09c27d
SHA512 e584bd4bcd2b351e027478cffdb114963448096080f725172d11485e94135820f26a2406fc80eb7ac0ce9401b1a232461033951f15d0baf7e940b893095ca53e
SSDEEP 384:2oiovoqofwosoXo5oBo9oionoho2X8XEQ6QeQygQxQDQhSocSp+So7SoUSo7oToT:4M1EnTsg6//xNf/7MDzQaMHRzZwu
TLSH
T111A3043136F5A92687790B79D9F58601DF6CC1AF0A4A0110B1AE2D2B4FB708F179BBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpShell.dll

Path C:\Program Files\File Converter\SharpShell.dll
Size 440KB
SHA256 63e0a221f9b84973195fb1514d06b26d7b5d539123ce010b7bbc3ee37ba0fca0
MD5 70125553edff4465dce49b2eeecb9bb0
SHA1 e6ae96cb114292ad9de448815e680ad9f467a235
SHA512 1a0d07f623bafd1e621af2d5e29d89f898c13a753d38fd9ffac9fbe2c8ca6ebfa605f517ef9496c958f4b2a9113336c7bbd3db3eec7f1379487734d4aee632d8
SSDEEP 6144:BFptzbaiLW0BQBQLwiqrn2XP9ZTxiUbLFITQ+mJe3aolB:r/bpLWwQ5iqDkwMITQma8
TLSH
T1F1A45B10B7F80F5FD56AC33495BA59018AB1F74D3625CB0B4681D18E2CF27438DAB7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Program Files\File Converter\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 1KB
SHA256 ba5575b889306c1396506b2df949b195c0c8debf811ee162529139f1f908c34e
MD5 2068c01498057b3e67672e669155a5a4
SHA1 f978ae21c5d11c5b903c8ed44ca82378e0688bd6
SHA512 ff266b889ae925ba52504dcbccefb199df5273ba5e3910b599ef0cc4c178d25dbf2153b1b03db62612030fa7ca09f9fcaa9f17e2c9f82c3566551b801bf0afb9
TLSH
T19831B527CE99A911AB065F359EF0E0381CBBEBEA048954872024C8C69D1177A7F26D4F
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
Size 2KB
SHA256 31de46dbb31d694e7c183e7edb4416aae1391fd512b07857ee817de36b5dc3b0
MD5 095719061d036c12ac5a44dca7972650
SHA1 b5b96771fe65413a90ef03775664c6eea0ce7435
SHA512 3ea95312afd3986cd157964f8a29af864d3743065930550ca163ad1c8209248e157834ea8822e200dcba8bc67b9358070d47d84d75906eaf505d6b1b605710b5
TLSH
T1734119468B213618B943EAB6CDC8C0316CB457D12540A6093B6C82CF0BA6B373F7601E
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 1KB
SHA256 d2de0d894af355675fc898026096f8db7284cbe4fb75f592846214b0f7033e68
MD5 c8c0ed471922395f5b13ac5100631c83
SHA1 455018c2016b0af2a02447cfca9c4a317835bdca
SHA512 c147da65cee20fa99db5571cad842c3153093148c23ba3595814dd79c94053b3a3fbf6dbbb1d47e032aab8b92dc464bfc90f1bc9cbf860dadd66e63050b599e8
TLSH
T16A31E7619E2268951E9249A12FE9E23E9A74B0C60D30000630BCD7D9DDD3BBB3F7640D
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 412B
SHA256 acee3292144a1ada6961537c95983adf3f1cb6d44d6767a4b3bad76e987da659
MD5 aef2775bfdce88af066ce1f7eec56303
SHA1 87d3b0e9855d78ac3facf8db6e2c6ee6639cea4b
SHA512 dba7f85118c33e5af01eb76a14f92280dfb446f230bd3187dc5f02e15313af616d7245de9bd124d9c891bdfb14e45873e2a9bdb4f9dfc9a873f9b696104bcd78
TLSH
T1ECE0680831EF0208F1758DFE03D962309E3CB16331846AF387A012097395C04DCE3769
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_54FE2DB854A61608CCAE6FB40014B35D
Size 416B
SHA256 c64c9bf73b0615cf60e1ab77e270b97430af5b6f43fa6d6efcca074eb58b9513
MD5 8e7b221b7e90a5b0dd8595761b13b1ba
SHA1 16a4b1eb07bb27fa1d8e994e40ec6dcd1f2b0aee
SHA512 8b116da11bf5ca730eadc76848369c083aeb469c02fae25025cd658076320aa5b2e10c668673fe2e1e78a69390e0837536fffcc1aed92adadf884b589d23d7af
TLSH
T1B3E0680435D9015DF233AA7887DAA66BCD2EF21754844BBA1B60100B4A02F004D33E24
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 412B
SHA256 a0e764058ee4c82b4c34d0aecc82facd2836b4cdcd90469afbba37f6c717a77f
MD5 e670a4515d2c841204180d943f2a7381
SHA1 f235141e649fef040217bcb6fbf719534031b1bc
SHA512 26b310b99aa64e7917b7d7520302ea9c408c82527642645953fb86fb3b1f276ce1d62f163002b3d13d86f98343aa75e25357b04be94426dd0377f41a65d159c2
TLSH
T154E0682822BA40A8FB30E93A41C967F00A2BF637040D1BE00EA042097E109849C65C30
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.user.xml

Path C:\Users\Admin\AppData\Local\FileConverter\Settings.user.xml
Size 95KB
SHA256 d3381bc408ac8f5725b0193c365623f381e4b5727c3270ea2aaa289953353e5b
MD5 65d4c7fe2b7d71f28fe178fc289f4418
SHA1 edaf44f7f8307f98f0ede851c471d9a639f5e4ed
SHA512 88a479c60ebd63b7a1395b5aed1f9305ccdece0a032c27d969e5dc7619d6b3fb71d3539b2e8fb3e41c1536afcc2bfd05f80d54b7fd3e0d7186cc1ade3e14d354
SSDEEP 384:doiovoqofwosoXo5oBo9oionoho2X8XEQ6QeQygQxQDQhSocSp+So7SoUSo7oToo:vM1EnTsg6//xNf/7MDzQaMHRzZw9
TLSH
T1B2A3143136F5A92687790B79D9F58601DF6CC1AF0A4A0110B1AE2D2B4FB708F179BBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileConverter.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FileConverter.exe.log
Size 1KB
SHA256 32057fc909fe5d91e3385994b05f8e635504de7dbd0aaa0fdba5e46f70172060
MD5 2a46230b81d99cb674e68c36e8c3c96c
SHA1 fab3ccacbb230d0d213bd68691f3b81d41d1eb20
SHA512 f597ec0ae64c10d5ea19e922eca9019beb427830c3c51b5cb48040bed7e4d965854054c597044874ecd0e84e35f33a9ec424a9a76555953ff964b8f7842382bc
TLSH
T10A31D071267171D48E233F53196D268563FF4328BA445E5CB569620EE92E01BAF232F3
MD5 SHA1 SHA512 TLSH

Submit Download

MSIFC4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIFC4D.tmp
Size 175KB
SHA256 9d6745913a51d4c6749a4119f87da410cb226c45a72d6dbc3231efe5b928f491
MD5 543072c649a87e1880784b7f0effaeeb
SHA1 c0f986dbb344aab2efe92bffbc8e683f11558f80
SHA512 b7a16edd32a517245ba3c70d83175009486e840f9a0820b8d787b3e39b8594687617f67c50db253bce213786609975bb969325150b99ccdcb4e4b858e539ef2d
SSDEEP 3072:nColDBwKxdtOToLEzKqflmw9N+rDoluP2:nl+Kx/XL4KIT5
TLSH
T188046C5673B400BAE8B78235C4934A16EB76B8511720DBDF07A4433A9F2F3D1A93E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon.exe

Path C:\Windows\Installer\{108B7211-CD2B-4F28-9959-4888825EFCDA}\Icon.exe
Size 1.9MB
SHA256 162f16134c3ac80ff3322d2dce13d8fd4f0476108cb96415927ebea055abc241
MD5 0d263157cc322fb5ab9c3b65c114a258
SHA1 68cae707ef6a083a9e3a5329765f2fc64a2beb9e
SHA512 6b23ce6aa0014eb6669f36277ae24d18cb9d266c7339587aa3cbbfc9ac5566f5fbe43d2864bc6f6822d07c75952d99530d842d2a838eacbb32362fbb26057052
SSDEEP 24576:RRvSWJT69CO2csP29MmDkfs6pfmGEsxfOJZtEXrxKHcEQiBQPDmXM7P0j6m8:/SWJe98zcMJppvbxfsPqxK8EQsotPm
TLSH
T1ED959C70A2A4483CD5E63B78D37414FC8E2A2EC5795CDE5D2A83B8581932F0DADF065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 bc1b49211d3f7f4ca4c3e006d9aa0984aa8822c0d2b93d013e855835d70f7bbb
MD5 e97aa94439bee059e5e3bf31c6518d4c
SHA1 44cbf57340266ea9ceba181f38dc0445f7d92c5d
SHA512 e187fcb2f70cbbd78a218413d53fc8949ceaccfe47cfc24ccde24d7ccdb1f234084c655555e04171a9db42318bde73a2a747812f328c81c0c250cbba00cf19ab
SSDEEP 24576:Y2gmSp1/doO/vvTLAGLuRkXKfaJQQIvhWGIdH50byAKo0nfu4A6cLWhcR:G
TLSH
T10647D52436F92210E7F79F3DA8F06A2389397D579C15DE8D05421B8E0961FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1be6a305-a3d0-4f14-bcea-6476374a36a7}_OnDiskSnapshotProp

Path \??\Volume{190e5f65-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1be6a305-a3d0-4f14-bcea-6476374a36a7}_OnDiskSnapshotProp
Size 6KB
SHA256 cb4562208c5a17f0e4a1ace790af8bb185d6b7dd99ddb2c9730ae01ef1e9315c
MD5 fe80d72dfef88ae830a52cf03da4682c
SHA1 6467bab93a717172eacb24d6dd41c47fbc3b8142
SHA512 65f14c63f8ca261c99cebc5310d4c91e407e14fbdb65009f67b8a208359342b8ed956135aff5487cd082e74e735411c85a35522b365134ac003f88c33bcf15cb
SSDEEP 96:Ffr2wk8vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:hr2kb++ZVm
TLSH
T199D188085AE54711E2B3AB7229F14557A877B811EF33CB8E0198638E2670910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-117-0x00000222505A0000-0x00000222505B0000-memory.dmp

Download

memory/1256-122-0x0000022250A60000-0x0000022250AAA000-memory.dmp

Download

memory/2240-106-0x000002B0B7500000-0x000002B0B751C000-memory.dmp

Download

memory/2240-108-0x000002B0B7280000-0x000002B0B728A000-memory.dmp

Download

memory/2240-114-0x000002B0B75A0000-0x000002B0B75F4000-memory.dmp

Download

memory/2240-110-0x000002B0B72D0000-0x000002B0B72DA000-memory.dmp

Download

memory/2240-116-0x000002B0B7680000-0x000002B0B76F4000-memory.dmp

Download

memory/2240-104-0x000002B0B74E0000-0x000002B0B74F4000-memory.dmp

Download

memory/2240-102-0x000002B0B72B0000-0x000002B0B72CA000-memory.dmp

Download

memory/2240-101-0x000002B0B7290000-0x000002B0B72B0000-memory.dmp

Download

memory/2240-99-0x000002B09B5F0000-0x000002B09B7D0000-memory.dmp

Download