acf4ac18dea358efc825cf5c5528672f5c85421b55705e05d5340634b5627bcb

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AI_yemot_0.1.0_x64_en-US.msi
Size 4.2MB
Sample261110-ktf72seb82
SHA256 acf4ac18dea358efc825cf5c5528672f5c85421b55705e05d5340634b5627bcb
MD5 e8d98f7f423df53403ef9f5fd5ab809b
SHA1 9355959ec4efb822979a4da3a09af7239e9f219c
SHA512 3ca7b155eb8421ad9922cdcb9f4182a34c0431720925b4d4e7bdd8e14b7b86c95a4ae47a1606a4155aa3757bec3d8562659c19c01c1eda31b71191fa47a87f9f
SSDEEP 98304:KaLiuL9EP5AbM0+/Fu0VaP9s1X+FS2gy5ceUviuoZgQ5zOQm:jZ9UdH/Fu0Va6MQKnqVGzS
TLSH
T1402633AB3EC18427C84C0DBB5072CB71AB2D6C584A14380B775A735EEFF52E09DA56D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1128	desktop.exe

Loads dropped DLL 1 IoCs

pid	Process
4344	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	desktop.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\AI_yemot\Uninstall AI_yemot.lnk	msiexec.exe
File created	C:\Program Files\AI_yemot\desktop.exe	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a5e7d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5e7d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE6E5879E65C8B578.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3142F7A367B9E5B4.TMP	msiexec.exe
File created	C:\Windows\Installer\{4D99B6A5-A290-48C8-AF16-1807D158144A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79AAD1EC8646351E.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4D99B6A5-A290-48C8-AF16-1807D158144A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{4D99B6A5-A290-48C8-AF16-1807D158144A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a5e7f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46870C50A03AC3BA.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3344	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	desktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	desktop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\11F53E3045C5D3A5185E87AE423B7A8E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A6B99D4092A8C84FA6181701D8541A4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A6B99D4092A8C84FA6181701D8541A4\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\11F53E3045C5D3A5185E87AE423B7A8E\5A6B99D4092A8C84FA6181701D8541A4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A6B99D4092A8C84FA6181701D8541A4\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A6B99D4092A8C84FA6181701D8541A4\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\ProductName = "AI_yemot"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\PackageCode = "2754C2E68C8E25243ADBA7577DBA682C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\ProductIcon = "C:\\Windows\\Installer\\{4D99B6A5-A290-48C8-AF16-1807D158144A}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList\PackageName = "AI_yemot_0.1.0_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A6B99D4092A8C84FA6181701D8541A4\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\Version = "65536"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A6B99D4092A8C84FA6181701D8541A4\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	msiexec.exe
4704	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
916	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3344	msiexec.exe
Token: SeSecurityPrivilege	4704	msiexec.exe
Token: SeCreateTokenPrivilege	3344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3344	msiexec.exe
Token: SeLockMemoryPrivilege	3344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3344	msiexec.exe
Token: SeMachineAccountPrivilege	3344	msiexec.exe
Token: SeTcbPrivilege	3344	msiexec.exe
Token: SeSecurityPrivilege	3344	msiexec.exe
Token: SeTakeOwnershipPrivilege	3344	msiexec.exe
Token: SeLoadDriverPrivilege	3344	msiexec.exe
Token: SeSystemProfilePrivilege	3344	msiexec.exe
Token: SeSystemtimePrivilege	3344	msiexec.exe
Token: SeProfSingleProcessPrivilege	3344	msiexec.exe
Token: SeIncBasePriorityPrivilege	3344	msiexec.exe
Token: SeCreatePagefilePrivilege	3344	msiexec.exe
Token: SeCreatePermanentPrivilege	3344	msiexec.exe
Token: SeBackupPrivilege	3344	msiexec.exe
Token: SeRestorePrivilege	3344	msiexec.exe
Token: SeShutdownPrivilege	3344	msiexec.exe
Token: SeDebugPrivilege	3344	msiexec.exe
Token: SeAuditPrivilege	3344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3344	msiexec.exe
Token: SeChangeNotifyPrivilege	3344	msiexec.exe
Token: SeRemoteShutdownPrivilege	3344	msiexec.exe
Token: SeUndockPrivilege	3344	msiexec.exe
Token: SeSyncAgentPrivilege	3344	msiexec.exe
Token: SeEnableDelegationPrivilege	3344	msiexec.exe
Token: SeManageVolumePrivilege	3344	msiexec.exe
Token: SeImpersonatePrivilege	3344	msiexec.exe
Token: SeCreateGlobalPrivilege	3344	msiexec.exe
Token: SeCreateTokenPrivilege	3344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3344	msiexec.exe
Token: SeLockMemoryPrivilege	3344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3344	msiexec.exe
Token: SeMachineAccountPrivilege	3344	msiexec.exe
Token: SeTcbPrivilege	3344	msiexec.exe
Token: SeSecurityPrivilege	3344	msiexec.exe
Token: SeTakeOwnershipPrivilege	3344	msiexec.exe
Token: SeLoadDriverPrivilege	3344	msiexec.exe
Token: SeSystemProfilePrivilege	3344	msiexec.exe
Token: SeSystemtimePrivilege	3344	msiexec.exe
Token: SeProfSingleProcessPrivilege	3344	msiexec.exe
Token: SeIncBasePriorityPrivilege	3344	msiexec.exe
Token: SeCreatePagefilePrivilege	3344	msiexec.exe
Token: SeCreatePermanentPrivilege	3344	msiexec.exe
Token: SeBackupPrivilege	3344	msiexec.exe
Token: SeRestorePrivilege	3344	msiexec.exe
Token: SeShutdownPrivilege	3344	msiexec.exe
Token: SeDebugPrivilege	3344	msiexec.exe
Token: SeAuditPrivilege	3344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3344	msiexec.exe
Token: SeChangeNotifyPrivilege	3344	msiexec.exe
Token: SeRemoteShutdownPrivilege	3344	msiexec.exe
Token: SeUndockPrivilege	3344	msiexec.exe
Token: SeSyncAgentPrivilege	3344	msiexec.exe
Token: SeEnableDelegationPrivilege	3344	msiexec.exe
Token: SeManageVolumePrivilege	3344	msiexec.exe
Token: SeImpersonatePrivilege	3344	msiexec.exe
Token: SeCreateGlobalPrivilege	3344	msiexec.exe
Token: SeCreateTokenPrivilege	3344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3344	msiexec.exe
Token: SeLockMemoryPrivilege	3344	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3344	msiexec.exe
3344	msiexec.exe
1128	desktop.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3344	msiexec.exe
4704	msiexec.exe
4344	MsiExec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4344	4704	msiexec.exe	90
PID 4704 wrote to memory of 3512	4704	msiexec.exe	96
PID 3344 wrote to memory of 1128	3344	msiexec.exe	99
PID 1128 wrote to memory of 916	1128	desktop.exe	100
PID 916 wrote to memory of 2944	916	msedgewebview2.exe	101
PID 916 wrote to memory of 3352	916	msedgewebview2.exe	102
PID 916 wrote to memory of 3352	916	msedgewebview2.exe	102
PID 916 wrote to memory of 3352	916	msedgewebview2.exe	102
PID 916 wrote to memory of 3352	916	msedgewebview2.exe	102
PID 916 wrote to memory of 6108	916	msedgewebview2.exe	103
PID 916 wrote to memory of 5744	916	msedgewebview2.exe	104
PID 916 wrote to memory of 5744	916	msedgewebview2.exe	104
PID 916 wrote to memory of 5744	916	msedgewebview2.exe	104
PID 916 wrote to memory of 5548	916	msedgewebview2.exe	105
PID 916 wrote to memory of 5548	916	msedgewebview2.exe	105
PID 916 wrote to memory of 5548	916	msedgewebview2.exe	105
PID 916 wrote to memory of 5548	916	msedgewebview2.exe	105
PID 916 wrote to memory of 5548	916	msedgewebview2.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AI_yemot_0.1.0_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files\AI_yemot\desktop.exe
  "C:\Program Files\AI_yemot\desktop.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1128.2496.10656061406999731919 /pfhostedapp:0545bdc5ed2c7320671a90baa8aa26c02c1dc704
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView /prefetch:4 /pfhostedapp:0545bdc5ed2c7320671a90baa8aa26c02c1dc704 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9b22e5fd8,0x7ff9b22e5fe4,0x7ff9b22e5ff0
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,3002861785737735405,1710731363434838184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0545bdc5ed2c7320671a90baa8aa26c02c1dc704
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1800,i,3002861785737735405,1710731363434838184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0545bdc5ed2c7320671a90baa8aa26c02c1dc704
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1800,i,3002861785737735405,1710731363434838184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0545bdc5ed2c7320671a90baa8aa26c02c1dc704
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1800,i,3002861785737735405,1710731363434838184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0545bdc5ed2c7320671a90baa8aa26c02c1dc704 /prefetch:1
      4⤵
      PID:5548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA382F4B8B5219A53936576A5EE729E6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4344
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a5e7e.rbs

Path C:\Config.Msi\e5a5e7e.rbs
Size 9KB
SHA256 84122822063d4662a0b32eee2c897543c25e66b87509b3e4947c366fc517ee5d
MD5 531097931cc887ca526d4cab65b1ac0c
SHA1 6ca9da478949fb3dd63759bde01807f2a23f0311
SHA512 0cabc68f4b3d3ab29f25ed48637a3f3922ab284c31ace12569ecf7f8a97c525fbd404ead0738e7ab417462a3c5d21e9e20c3aa8e7f9988b3f96db44c376d591a
SSDEEP 192:HJya7vB2luRCCVGSFGXSFa74t6WBimppY:HYa7vB2lu8ScSYx
TLSH
T15A22FD036E0086D7FA962B3CC78727133BB3D28E9714A74B959C90255E477C90FA62DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.exe

Path C:\Program Files\AI_yemot\desktop.exe
Size 9.7MB
SHA256 c5b6ae76652c8a8552775b83154390f063e494bf7979958302c73816765fce04
MD5 68cc60aee18750dc270a6d3657227075
SHA1 95f39b8db2115bb788fd1947cdd389f245205419
SHA512 c56ecc4cc72df70d4c7eb703567b0ceae703fe24b3acecabb951b618b7e5fe8f21b789144ff811ba0645808dd1d5d58574e5ecd480d42692feba4311a26b458e
SSDEEP 98304:6QPWSvcjG1CzkUT30LUlUvfJr/WWTg6Gn+3:Nc0CzkUTEoQRWWTg6M
TLSH
T19BA607C2F1D54164C136D9B28FB9F33A9F72F9B42D613356C704127CADA7AE0AA17224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AI_yemot.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AI_yemot\AI_yemot.lnk
Size 1KB
SHA256 94aa01e2e0c5ece53e05d1ac5b4b6712f632bd1176be1d5b6bda4417b7930907
MD5 1566b5b781fe23de3d116453eff33a75
SHA1 9307939f475cd526ba85061547baaa20870844f7
SHA512 34ee47b643c3e0beb3e826af882cf4c8259b7c2b964f3dfa282ba360311338a4813feed31601f9826efc53fc9fdf9a49f906d0890005c7c74a64396b8ccfe4ba
TLSH
T1FF41F1101BE107B6E3720B359B7B1252937ABC05E624CF9A81CA41840CF5211EDB5F2F
MD5 SHA1 SHA512 TLSH

Submit Download

~I_yemot.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AI_yemot\~I_yemot.tmp
Size 1KB
SHA256 55009a70254293b3ad8704fbd32c5cece93f9e57fe677c12585aa921ab7ba54b
MD5 aba6beef05a0360204c7cd58de22a066
SHA1 f31f26b89447ee5b79666ec674bb3dfda6234a6c
SHA512 3ffab8b40692940ba6be268a603a5ce4eed76cdb067e8cf23d792fbbcf0ab74cb5bd881eb2f437a088aaf092ca5153a370696bfe66b1670b75224c0b742767a5
TLSH
T16D4105115BE507B7E3B20B359B7712129279BC05E524CF9E81CA41880CF5201EDB9F2F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI2EF.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ad201e8-3c54-4542-b40a-c53b8081d8fb.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\5ad201e8-3c54-4542-b40a-c53b8081d8fb.tmp
Size 4KB
SHA256 ba08777428f354efd83ab438f2f40355299df62d92c04183c80a1491b2635990
MD5 e0bbd7ab5a7c40edfd7be0d07df966e4
SHA1 f75a8781c70c8c80a0b68ff3a771602acfccd1a8
SHA512 6c82d47f957633bd61e96ccedb7c554eadeb0248725d7db8018563ecea97e252c222e6982229f1f36ac8009d8136947d11fd7f32feb465b2888c6ba22ccab88a
SSDEEP 96:7NkE93fmbzL038kh/cI9URoDoto+5s/Blil6cGcVyK7v2SZKkZ+T0J2a:7Nl+fLCeoDUholixVyK7vIk26
TLSH
T165A19732E860A6379CF6D744B9473747A7B54163A9C52F94CADC1F0C428769D2387C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b143677-c849-475e-b801-f610ae1dd2db.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\6b143677-c849-475e-b801-f610ae1dd2db.tmp
Size 3KB
SHA256 937f8af4b53dbccf99e3a7310c18188afe439bd2193f740067cbb3db6810814b
MD5 0c0dcc9bbd2b2a203b62e4f893299fa6
SHA1 0185e878a1057c96d745f932c693c4d54c71bedd
SHA512 dd8ad066273001822da856e6a903c3bea68ac2f0228da0d94374a43c880c3b6101ac05be275bb68a3045acf749696bf7d95f822a2365292d0f79b1e1c010b803
TLSH
T11B6164376960AA379EF29A05BD862B1BA7B55023E9D13F55D6EC0F0C01D72993382C17
MD5 SHA1 SHA512 TLSH

Submit Download

7add7a25-4f07-477c-a105-96b75ad4a40e.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\7add7a25-4f07-477c-a105-96b75ad4a40e.tmp
Size 3KB
SHA256 a70ba47bc96d984c58588078e6eb7a0b7daf69c78106ec9753ea61664747c632
MD5 c660a7dfdb28f7cfa68b15f1b30309e4
SHA1 47cc552bc67e5408e8d2392f5d6fdfea4ecf0bec
SHA512 495491424ea3043b9238aa434028f66f44f3bb560f7af02f768358d0809789d5c81a26722f6a12d9f48acf5479ab8602ed9f1bfb8d54cbd8ce293fe612ec6682
TLSH
T122716536A564A9379DF29A05BD8A3B07A7B55063E9917FA5C6EC0F0C01DB2892382C17
MD5 SHA1 SHA512 TLSH

Submit Download

7f757fe1-463c-4fb1-b8a1-67bd5700ff0a.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\7f757fe1-463c-4fb1-b8a1-67bd5700ff0a.tmp
Size 3KB
SHA256 ff383906486a8d8edd34b541025231f64dba55e1b0942ef00bd8fe090ec31e69
MD5 9dad67038c06989b4aea1bd392a751ee
SHA1 95aa37b18e5f0b45f3ff85ebe0ddc4f8328e325e
SHA512 418dc06a646e4e468fea5f759a8ff1a03e526b842e29073722607961d5570cdb743bc807c7b9ebd6f45c318d4c4f41cee1eb49e1b7e0578ba818e4b88a2bfbbb
TLSH
T13C716536A564A9379DF29A05BD8A3B07A7B55063E9917F65C6EC0F0C01DB2892382C17
MD5 SHA1 SHA512 TLSH

Submit Download

9c6c8bd8-9939-4703-8c7f-917ae2fd6ca2.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\9c6c8bd8-9939-4703-8c7f-917ae2fd6ca2.tmp
Size 4KB
SHA256 fc95de6ca8e1b726d24e9a4227449d7e0df1440aae64ab7bc4db98d72824e6e1
MD5 d55e693d31b950561ee66e891a75827d
SHA1 38837390c1eb21cb9e27028d49831d07a56ae0ab
SHA512 50bd1071644a43c05ce78e403c90690345873c45c608207cb23a7ed23119dba3f73ee616c888c0234dda7719e9ca67cd2642d3a9807fd430f07347d93baef448
SSDEEP 96:7NkGS3fmbzL038kh/cI9URoDoto+5s/Blil6cGcVyK7v2SZKkZ+T0J2a:7NBS+fLCeoDUholixVyK7vIk26
TLSH
T128917532E860A6379CF69744B94B3B47A7B54163A9852F94CAEC1F0C428769D2383C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b8d7eff6c28ce7c3531801cce233ef349455c842d3f7292886723fc710091640
MD5 45d1648518b0765824915883cbe9c024
SHA1 805bcd841891f2dff667d9889bd7cea8fd46ed5d
SHA512 cb870c5a37bf13783edf0a5ae0409f2146842314defb0e8f4f576a2b7ffbc365f4716a05a27613b19578e20e7067aeaeaaf3ad565e52ff62abc4f759ecec2ee3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 86e2525f38463cf8826303fbdd43469cce40d57c738b3b14a9e2625342ab4ebb
MD5 2aa9a1da7ba1e79724f864d8ae078e5e
SHA1 b61c6e2ec2e9fa05161badfd912dbd644c77c6a4
SHA512 ffb007adf9e4fe3f32cc36c4a09c86cf15a976fbf40e417df1897c8e2f455df0a4ca118bd54dd8229d82c45ab4e45a50836bd10ad77f6c3090bceaba9ba2d312
TLSH
T10ED0121632014278C01424330042B30C0801D11B420E4004A429971F6E480700D02482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 00c4466e1a13d40394ee70d88b34ffbf5fecc589e9733ea96e8f721897c2df4f
MD5 7f506d11c5184c35662246735a4f681d
SHA1 5de0c74b541adb863790936d050b02db15e6f4b2
SHA512 91fb2ea633d42d36c343960799208eb11e8beecfcea5cbec9fe671e37502cff9087e36feefd5a6a966b205f4a0d98e0d3576f264f443977c4cb20dbf3617c868
TLSH
T179D08C78028E0292E716EEF201F176A43571C811A5338F77C5FD763888C1F444529F1D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 7570bbcdbbecc610d9e0fb097191b02e20f2d54fc7075a5a38c7b1985574decf
MD5 453855f011f1b478d3b852d675622171
SHA1 0c9a326c8e03822729cdd82285502a8f927fb70b
SHA512 c55a40472e0519646258aa1bd361d9394e9827c4351caff8d8a5deac004bf716ffe5d7cc1dd2859fd07be77c689f70b6e939c0c8cb6f742fd96f3c5d2878d802
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f0f0a229-5322-4206-9894-5b4505d9902c.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Default\f0f0a229-5322-4206-9894-5b4505d9902c.tmp
Size 6KB
SHA256 805d3bf81c69d460037a0f8bdec9c9c247ecdb5aaf5a2c76ae7ad382bd4f6b49
MD5 2cfd63a97dd007bf31cc11a929a6fc54
SHA1 d698b096a2bbfd587ca13d14064fc47aef2e5b9c
SHA512 fd3a543d67fcd3e6f0779a9f25d24c6ab5793778635f78b2ce35ed6afe5c2bf5b4a3223655897322e410120dce1242de1136f2813c82eab890018346e735c538
SSDEEP 96:stAz/dyzBSb9vwkEo5h16Z0es7/x+6MhmuecJUj1ejeKK+ghf28XM1C7K:stArc5nonesV+FdUjQjSrG6K
TLSH
T153D186016E28797B8CC6E519BE29BB0BE2F5507260D51E58EBFC4A2C04DB6DD730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\Local State
Size 1KB
SHA256 fe74715b8722fc2537d34999591042b7fa9d852750e527ddda76dd9211c8967e
MD5 6b5b0a002ee5ddbfd3313b871a3e452b
SHA1 23adcb206e6afa40a1b6dc76f25f109c492a0f87
SHA512 c93f343131674ff0eefcfa5499d9b4da85b8dfe84d323d689194431093e1ae667fedf12f6a4818d057e0c2f3afc2a403920a32c203c21b1b9daa3232347454cf
TLSH
T19C2165B2A5A0AB32FDD6271A36577B5B5F311077D2518E0051ED4B1C02D754EB1A7C33
MD5 SHA1 SHA512 TLSH

Submit Download

bb6cdc29-15f2-458f-b089-0d2e21e5a1d9.tmp

Path C:\Users\Admin\AppData\Local\com.aiyemot.app\EBWebView\bb6cdc29-15f2-458f-b089-0d2e21e5a1d9.tmp
Size 2KB
SHA256 a4631806b2c501b5e22cf79434f92d31132c6c06f770ba49816d06a264a9812e
MD5 5d08b5af835a4d5283801a205f5c2daf
SHA1 21179821a334410a699cb1bb6cfbb3da258bf719
SHA512 0f64ce56623d9c5127764ed20949f8a26fa66b6f7d7097bc3451e9bb84352b97eacaaf629d085c230cbe53d7124ff06639051d95fa60c25005787a2ae73e2b71
TLSH
T1105184337910AB37DDE25B097D4A3B17DA3650A2AA912F1196DC0B0C01C765D3382C37
MD5 SHA1 SHA512 TLSH

Submit Download

e5a5e7f.msi

Path C:\Windows\Installer\e5a5e7f.msi
Size 4.2MB
SHA256 acf4ac18dea358efc825cf5c5528672f5c85421b55705e05d5340634b5627bcb
MD5 e8d98f7f423df53403ef9f5fd5ab809b
SHA1 9355959ec4efb822979a4da3a09af7239e9f219c
SHA512 3ca7b155eb8421ad9922cdcb9f4182a34c0431720925b4d4e7bdd8e14b7b86c95a4ae47a1606a4155aa3757bec3d8562659c19c01c1eda31b71191fa47a87f9f
SSDEEP 98304:KaLiuL9EP5AbM0+/Fu0VaP9s1X+FS2gy5ceUviuoZgQ5zOQm:jZ9UdH/Fu0Va6MQKnqVGzS
TLSH
T1402633AB3EC18427C84C0DBB5072CB71AB2D6C584A14380B775A735EEFF52E09DA56D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 fb965459a42b394e813d88806792ba64ac863038d8e3501d2775002adb17ff72
MD5 fdce3fdbe0f22437f20ebcc4edef3eb7
SHA1 1a08457cfc3916cc48ab922c10b7753061f18b63
SHA512 9e36baf90da09d194cce1be9409c7eae8e20ef9ce363e3b4f4a3ca57af00a57d65b460856eeea83ebade5b5b2b17131e116a672339a5600a5c0434c833fb525d
SSDEEP 24576:vFo3DMPzdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+j:pHc
TLSH
T17257022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6f861186-bb75-4cf0-a63a-ba8cd7c9b217}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6f861186-bb75-4cf0-a63a-ba8cd7c9b217}_OnDiskSnapshotProp
Size 6KB
SHA256 4f53b0062f54d895ce230c15f6d2eab6eed6a6fb45fa2896d4ed82219ccefb74
MD5 0aab82b1cf22445a87e2b2a05d905b5d
SHA1 83e7d3080f971298f635be7ea56725801ea14be5
SHA512 1e0e045f151967332008a59e1531cb5dd24d3e942e191e26cff9a144192bf79efad9ca95e116139e597dcfc3f4f47fbdf19a71168526d36f1efdba029b823b40
SSDEEP 96:F1Opjgvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Dvb++uVmN
TLSH
T179D188185AF54711E2F3AB3129F18557A877B811EF33CB8E0198238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3352-74-0x00007FF9D4370000-0x00007FF9D4371000-memory.dmp

Download

memory/5548-79-0x00007FF9D4370000-0x00007FF9D4371000-memory.dmp

Download