1df31957b1f42c7043f2f38be08950039d54138ca12abb666126cd8bb5d71bb9

Analysis

max time kernel
151s
max time network
133s
platform
windows10_x64
resource
win10v20210408
submitted
19-07-2021 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WiseVector_Setup.exe
Size

33.4MB
MD5

dcc40be7f6bf04ef7c972ee1bc090a0c
SHA1

8758e593589acfa8948e3d89706f9556458eb83b
SHA256

1df31957b1f42c7043f2f38be08950039d54138ca12abb666126cd8bb5d71bb9
SHA512

9c8cc36359e85d271493adae88ce79227359ca65b9996d476f2eb087f574de8b7f0b4b39533d659cfeed77e4b1a7b2480a296c7a51f78a2b45f3918f2fabbe58

Score

10^/10

discovery macro persistence xlm

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

13 2152 msiexec.exe
Executes dropped EXE 5 IoCs

Processes:

vcredist_x86.exeinstall.exeWiseVectorService.exeWiseVectorSvc.exeWiseVector.exe

pid process

2264 vcredist_x86.exe
1508 install.exe
2688 WiseVectorService.exe
1616 WiseVectorSvc.exe
3188 WiseVector.exe

flow	pid	process
13	2152	msiexec.exe

pid	process
2264	vcredist_x86.exe
1508	install.exe
2688	WiseVectorService.exe
1616	WiseVectorSvc.exe
3188	WiseVector.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
\??\c:\ac506cfd761f5ae11abca04d90\vc_red.msi	office_xlm_macros

Loads dropped DLL 30 IoCs

Processes:

WiseVector_Setup.exeinstall.exeregsvr32.exeregsvr32.exeWiseVectorSvc.exeWiseVector.exe

pid	process
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
1508	install.exe
3888	regsvr32.exe
1220	regsvr32.exe
628	WiseVector_Setup.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

WiseVector_Setup.exeWiseVectorSvc.exeWiseVector.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\WiseVector\WiseVectorHIPSO_X64.sys	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\do.mtk	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\lib\helperoneo.pyd	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dat\local.de	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\me.de	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\lib\lxml.etree.pyd	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dbghelp.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dbghelp_x64.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\Eg.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\cfg	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\scan\scan.ini	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVectorExt.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\WiseVectorHelperOne_X64.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\lang\english.dat	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\EgHelperTwo.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\WiseVector.exe	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\bait\sample.mdb	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\cfg\set.de	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\cfg\rec.de	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\WiseVectorHIPS_X86.sys	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\EgHelperOne.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\uninst.exe	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVectorScan.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\cfg\rec.de	WiseVectorSvc.exe
File created	C:\Program Files (x86)\WiseVector\AdvanceScan.dat	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\bait\sample.sql	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\local.de	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\pp.mtk	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\WiseVectorExt.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVectorHelperOne_X64.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\wvsetting.ini	WiseVector.exe
File opened for modification	C:\Program Files (x86)\WiseVector\lib	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\lh.de	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\pa.mtk	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\ppo.mtk	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\update.ini	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\bait\sample.doc	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dat\p.mtk	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dat\uo.mtk	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\lang\chinese.dat	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\lib\helpertwoo.pyd	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\vcomp120.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVector.exe	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVectorHIPSO_X64.sys	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\bait\sample.jpg	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dat\pp.mtk	WiseVector_Setup.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\WiseVector\WiseVectorHelperTwo.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVectorHIPS_X64.sys	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\bait	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\se.de	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\pa.ptk	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dat\u.mtk	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\lang\chinese.dat	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\lib\_socket.pyd	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\python27.dll	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\WiseVectorHelperFive.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\bait\sample.xls	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\dat\d.mtk	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\libbz2.dll	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\lib\_elementtree.pyd	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\update.ini	WiseVector_Setup.exe
File opened for modification	C:\Program Files (x86)\WiseVector\lib\unicodedata.pyd	WiseVector_Setup.exe
File created	C:\Program Files (x86)\WiseVector\dbghelp.dll	WiseVector_Setup.exe

Drops file in Windows directory 58 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	\??\c:\Windows\Installer\f75ba29.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.0\mfcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055415.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_028bc148.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90jpn.dll	msiexec.exe
File created	\??\c:\Windows\Installer\f75ba29.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055368.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_92453bb7.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055368.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90esp.dll	msiexec.exe
File created	\??\c:\Windows\Installer\f75ba2c.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055415.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.0\mfcm90u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055415.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055447.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_4ddc769f.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055493.0\9.0.30729.6161.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055431.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055447.1\9.0.30729.6161.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055493.1\9.0.30729.6161.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055415.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90deu.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055431.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055462.0\9.0.30729.6161.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055493.1\9.0.30729.6161.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055462.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055478.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_028bc148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055462.0\9.0.30729.6161.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055415.0\msvcr90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90kor.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.0\mfc90u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055415.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055368.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_92453bb7.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_730c3508.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90chs.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90cht.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90fra.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055447.1\9.0.30729.6161.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055493.0\9.0.30729.6161.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055447.1	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055493.1	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055478.0\9.0.30729.6161.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90ita.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055447.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2C4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055447.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_4ddc769f.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.0\mfc90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90enu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055368.0\atl90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90rus.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055478.0\9.0.30729.6161.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055431.1\mfc90esn.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210719082055447.0\vcomp90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210719082055493.0	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60810F1E-B89C-4497-911F-4647F86F00F1}\1.0\ = "WiseVector On-Demand Scan"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\TypeLib\ = "{60810F1E-B89C-4497-911F-4647F86F00F1}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0042005b00240070007200510032006f004d003800720048007b00720067003d00320065006e002e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_OpenMP_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F603C2ED760AFE838BC630EDB430219F\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WiseVectorExt.WiseVectorScan\ = "WiseVectorScan Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e00550029004600250024002a0025005a00370038002c005d007b002d007400430064004f003700310000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\ = "IWiseVectorScan"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\TypeLib\ = "{60810F1E-B89C-4497-911F-4647F86F00F1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\PackageName = "vc_red.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}\ = "WiseVectorScan Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\TypeLib	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WiseVectorExt.WiseVectorScan	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}\InprocServer32\ = "C:\\Program Files (x86)\\WiseVector\\WiseVectorExt_X64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60810F1E-B89C-4497-911F-4647F86F00F1}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60810F1E-B89C-4497-911F-4647F86F00F1}\1.0\0\win64\ = "C:\\Program Files (x86)\\WiseVector\\WiseVectorExt_X64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WiseVectorExt.WiseVectorScan\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\LastUsedSource = "n;1;c:\\ac506cfd761f5ae11abca04d90\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}\VersionIndependentProgID\ = "WiseVectorExt.WiseVectorScan"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C49499AC-DC25-478B-B903-E005012B3DD1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WiseVectorScan\ = "{C49499AC-DC25-478B-B903-E005012B3DD1}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e004e002e004b004300300068004d0064007b00340060006d002b00380039004f002e002e003100540000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\VC_Redist_12222_x86_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\PackageCode = "B4E370007AE0BD84C914DF7A9EBB8493"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net\1 = "c:\\ac506cfd761f5ae11abca04d90\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WiseVectorExt.WiseVectorScan.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24CF4FB6-2F9B-43CD-8B58-B9626AA5D593}\ProxyStubClsid32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00690060003700480050004400240062002400350035007e004a007b00730074007e0029006200780000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F603C2ED760AFE838BC630EDB430219F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WiseVectorExt.WiseVectorScan\CurVer\ = "WiseVectorExt.WiseVectorScan.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WiseVectorScan\ = "{C49499AC-DC25-478B-B903-E005012B3DD1}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e004b00520050005200400047006b006e005d0033003d002b004c00380047003600210061002e00490000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WiseVectorExt.WiseVectorScan.1\CLSID\ = "{C49499AC-DC25-478B-B903-E005012B3DD1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60810F1E-B89C-4497-911F-4647F86F00F1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60810F1E-B89C-4497-911F-4647F86F00F1}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{60810F1E-B89C-4497-911F-4647F86F00F1}\1.0\HELPDIR	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006f006f0063007b006200340036003f004500380042006a005f0079005d005d007e004f006f002c0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

WiseVector_Setup.exemsiexec.exeWiseVector.exeWiseVectorSvc.exe

pid	process
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
628	WiseVector_Setup.exe
2152	msiexec.exe
2152	msiexec.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe
3188	WiseVector.exe
3188	WiseVector.exe
1616	WiseVectorSvc.exe
1616	WiseVectorSvc.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

604

pid	process
604

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

install.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1508	install.exe
Token: SeIncreaseQuotaPrivilege	1508	install.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	1508	install.exe
Token: SeAssignPrimaryTokenPrivilege	1508	install.exe
Token: SeLockMemoryPrivilege	1508	install.exe
Token: SeIncreaseQuotaPrivilege	1508	install.exe
Token: SeMachineAccountPrivilege	1508	install.exe
Token: SeTcbPrivilege	1508	install.exe
Token: SeSecurityPrivilege	1508	install.exe
Token: SeTakeOwnershipPrivilege	1508	install.exe
Token: SeLoadDriverPrivilege	1508	install.exe
Token: SeSystemProfilePrivilege	1508	install.exe
Token: SeSystemtimePrivilege	1508	install.exe
Token: SeProfSingleProcessPrivilege	1508	install.exe
Token: SeIncBasePriorityPrivilege	1508	install.exe
Token: SeCreatePagefilePrivilege	1508	install.exe
Token: SeCreatePermanentPrivilege	1508	install.exe
Token: SeBackupPrivilege	1508	install.exe
Token: SeRestorePrivilege	1508	install.exe
Token: SeShutdownPrivilege	1508	install.exe
Token: SeDebugPrivilege	1508	install.exe
Token: SeAuditPrivilege	1508	install.exe
Token: SeSystemEnvironmentPrivilege	1508	install.exe
Token: SeChangeNotifyPrivilege	1508	install.exe
Token: SeRemoteShutdownPrivilege	1508	install.exe
Token: SeUndockPrivilege	1508	install.exe
Token: SeSyncAgentPrivilege	1508	install.exe
Token: SeEnableDelegationPrivilege	1508	install.exe
Token: SeManageVolumePrivilege	1508	install.exe
Token: SeImpersonatePrivilege	1508	install.exe
Token: SeCreateGlobalPrivilege	1508	install.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

WiseVector.exe

pid process

3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

WiseVector.exe

pid process

3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
3188 WiseVector.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WiseVector.exe

pid process

3188 WiseVector.exe
3188 WiseVector.exe

pid	process
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe

pid	process
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe
3188	WiseVector.exe

pid	process
3188	WiseVector.exe
3188	WiseVector.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WiseVector_Setup.exevcredist_x86.exeregsvr32.exe

description	pid	process	target process
PID 628 wrote to memory of 2264	628	WiseVector_Setup.exe	vcredist_x86.exe
PID 628 wrote to memory of 2264	628	WiseVector_Setup.exe	vcredist_x86.exe
PID 628 wrote to memory of 2264	628	WiseVector_Setup.exe	vcredist_x86.exe
PID 2264 wrote to memory of 1508	2264	vcredist_x86.exe	install.exe
PID 2264 wrote to memory of 1508	2264	vcredist_x86.exe	install.exe
PID 2264 wrote to memory of 1508	2264	vcredist_x86.exe	install.exe
PID 628 wrote to memory of 3888	628	WiseVector_Setup.exe	regsvr32.exe
PID 628 wrote to memory of 3888	628	WiseVector_Setup.exe	regsvr32.exe
PID 628 wrote to memory of 3888	628	WiseVector_Setup.exe	regsvr32.exe
PID 3888 wrote to memory of 1220	3888	regsvr32.exe	regsvr32.exe
PID 3888 wrote to memory of 1220	3888	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 2688	628	WiseVector_Setup.exe	WiseVectorService.exe
PID 628 wrote to memory of 2688	628	WiseVector_Setup.exe	WiseVectorService.exe
PID 628 wrote to memory of 2688	628	WiseVector_Setup.exe	WiseVectorService.exe
PID 628 wrote to memory of 1616	628	WiseVector_Setup.exe	WiseVectorSvc.exe
PID 628 wrote to memory of 1616	628	WiseVector_Setup.exe	WiseVectorSvc.exe
PID 628 wrote to memory of 1616	628	WiseVector_Setup.exe	WiseVectorSvc.exe
PID 628 wrote to memory of 3188	628	WiseVector_Setup.exe	WiseVector.exe
PID 628 wrote to memory of 3188	628	WiseVector_Setup.exe	WiseVector.exe
PID 628 wrote to memory of 3188	628	WiseVector_Setup.exe	WiseVector.exe

C:\Users\Admin\AppData\Local\Temp\WiseVector_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\WiseVector_Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:628

C:\Program Files (x86)\WiseVector\tmp\vcredist_x86.exe
"C:\Program Files (x86)\WiseVector\tmp\vcredist_x86.exe" /q
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264

\??\c:\ac506cfd761f5ae11abca04d90\install.exe
c:\ac506cfd761f5ae11abca04d90\.\install.exe /q
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:1220

C:\Program Files (x86)\WiseVector\WiseVectorService.exe
"C:\Program Files (x86)\WiseVector\WiseVectorService.exe" -i
2⤵
- Executes dropped EXE
PID:2688

C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe
"C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Program Files (x86)\WiseVector\WiseVector.exe
"C:\Program Files (x86)\WiseVector\WiseVector.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3188

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WiseVector\Eg.dll
MD5
ad34d70217e3bd890f485ccea872ed9b

SHA1
aa8531c8a83a3298c2c6792ad826d67ef5f79950

SHA256
2125c35ead9281b8d1ce475abd89fe5a9bd108720f3ee2318d904fdac26d5d38

SHA512
09e05b7f62826bfcd6b4eeecd5c84f5675d4b887a538ecadbed24e1cd2fb4363f7dc87eba6959648c4d4d17dfb89e5d8c8c25ed81fd768d2f9a9740c8925aaea

Download Submit
C:\Program Files (x86)\WiseVector\EgAddtionalHelper.dll
MD5
b486326f7d16c0373fee6e7a20cf2b15

SHA1
03bfdea3bb892a00ac75153d946902b7908f16d0

SHA256
43a6e1c08964e709d934192d8485609922abe9772424ecac9c7ec451b3ea7cbd

SHA512
f3d715306b91b667ecd7c45855739b03ecfd924ff0bdfa188d5a8bbdd6ca73d273afb3de6d9585eaddb6d4159eeb43114b5ac0f0ea0aea2cbf0c08e63df46322

Download Submit
C:\Program Files (x86)\WiseVector\EgHelperOne.dll
MD5
72ed5b0c1fd49dbe441b8f3c76b34271

SHA1
40091faf48b0f174936b2d942862a509d62e28e8

SHA256
8cfb6a5677b0b012fd0bbac8acacc98e097853c26a64547888c762ff70179b6f

SHA512
14bc13c95e85802861220a06fd3fe861028f777c8536ad460c0622a389b045e9bac6d6241113a304396fe861805affa18637a91fd029de54895ec90dea50dd91

Download Submit
C:\Program Files (x86)\WiseVector\EgHelperThree.dll
MD5
d1bbbb3ab51049deb5143aaa593131bb

SHA1
0d7a2812e258ffd6585982350e1246382dd86463

SHA256
47afad03a77ec17621fd688ecc4d160347363adf9890f98db90a3057005568dc

SHA512
5ee3d453ccaf822a23227782c85573feed84c2276e5cb2c46cf4dfa727a21f8286c53984a7905eee54feefeffa59b668edd09e3a275588ba031ae4526ef09121

Download Submit
C:\Program Files (x86)\WiseVector\EgHelperTwo.dll
MD5
ee10816a9b0e6fe7c504e59c5e01c947

SHA1
a8de2dc9fec813cfedecff0431ba64666aed7a8f

SHA256
3ceb8aeaa245fbf1c6afa10bf0362f1c0ddb178e9a592eb2ccb81919728a5061

SHA512
548e23b359784ffe3232e69894ebc6b8d63062c96931b4e6fa3a1565e75424aaaa6a30ec487aff9b5b74e194d866bdc35ba554dc82d6b29a6e5299df1168db33

Download Submit
C:\Program Files (x86)\WiseVector\VCOMP120.DLL
MD5
27bc360d67f269a61bb052e10c9fceeb

SHA1
8d81406c8dd3ed8894d8aee07dd718dcfd2035c5

SHA256
fc12360ff09830bf08b7a2a238016eea2b9e9475cbea4c22043b264e76b3420c

SHA512
2807af25e00ea11c0acfae20d44ee0f02b2331c469f14f5d42814805ae16b7b2a11fbcd7f9046f3e11adc434133057dadab62beca63eb70793fd755f3f827755

Download Submit
C:\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll
MD5
fdea85a1f81fee19e6481060757e0d4e

SHA1
9d6b99d75873f44bb155db3a3ec50a1f66cf6fd4

SHA256
dd2a3b68994ffb5b5e84d2cf9171ada5d0be41f49ae756f7f08c7285c1ff3e8d

SHA512
2474bed7a5890d9746c664916cf756d022373351ac7ae994d3601ca902be9ceda454c56a97c11824c2891d4e08214b2df85cf830298da0a0d690bc46872582db

Download Submit
C:\Program Files (x86)\WiseVector\WiseVectorService.exe
MD5
5d60ea055299fa16d6b19d28e486796d

SHA1
f8f8e509b0dabf2840e0b76dfcbf21dd481b1148

SHA256
bdf797a309e2323efe4ae8177a7f80892e66a85c406b7316012076a9da6069d0

SHA512
421f21e0afe090ee8788cb28ecb4fa238f2accf01e4c2da1ac12a0c0b796a92fec3339c977bf6564366ab1816708d708826c4c2ec774fde736c28ae4128e4a45

Download Submit
C:\Program Files (x86)\WiseVector\WiseVectorService.exe
MD5
5d60ea055299fa16d6b19d28e486796d

SHA1
f8f8e509b0dabf2840e0b76dfcbf21dd481b1148

SHA256
bdf797a309e2323efe4ae8177a7f80892e66a85c406b7316012076a9da6069d0

SHA512
421f21e0afe090ee8788cb28ecb4fa238f2accf01e4c2da1ac12a0c0b796a92fec3339c977bf6564366ab1816708d708826c4c2ec774fde736c28ae4128e4a45

Download Submit
C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe
MD5
acbbe91e9e827ac17787c59bcc279a87

SHA1
ffd2d339fad34bbea0291ce4990f62c2037cdcec

SHA256
13b1a4819e7e448ff87661be094c7858f1ff45ac2268c7ce5916f82879ca723e

SHA512
7c299096ff3c5c69931bb6dcc3323bd90424316a363e0f27f1fe4025edc61121765c8a4a40270ad4619a0038ec03f505b7ae834471f3794db502bcec2e8d3abc

Download Submit
C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe
MD5
acbbe91e9e827ac17787c59bcc279a87

SHA1
ffd2d339fad34bbea0291ce4990f62c2037cdcec

SHA256
13b1a4819e7e448ff87661be094c7858f1ff45ac2268c7ce5916f82879ca723e

SHA512
7c299096ff3c5c69931bb6dcc3323bd90424316a363e0f27f1fe4025edc61121765c8a4a40270ad4619a0038ec03f505b7ae834471f3794db502bcec2e8d3abc

Download Submit
C:\Program Files (x86)\WiseVector\lang\english.dat
MD5
1a7da7e2c4824f86017afb49548ee113

SHA1
79f78d895a3151973b5a6b7ba0d39234896f6eaa

SHA256
e616a32ca4a81baa3158746c4bfcd6c631697afc77af537dd1bb461ab40e97b0

SHA512
e096c6c2a821dea3f557a6e9eb82814bbadc01c88fb4004f959cafde653b417ff7865f4ca734bac04e43e23d52d0c9c2c6a54464a6e42cda3e105972915a1391

Download Submit
C:\Program Files (x86)\WiseVector\libcrypto-1_1.dll
MD5
07827fe7caab1fe3afef23cda7b51478

SHA1
6618cccbda50c921260eaa56afe502153156bcfe

SHA256
16be78b4ebaa90cd1ee7f18983fef4e7a81910d63e34afc66fa877d72f510501

SHA512
8366ccda02e43d953248bb04388ecc283911ebd857a6d1bd0eafde615890660eff48988882ec3d7044b70c2f2919b3ad9e9243d0884d03e27e1a4c9121e7b706

Download Submit
C:\Program Files (x86)\WiseVector\python27.dll
MD5
ffc6f8636ed28f50b4a509f21658dfb2

SHA1
b302af28714af84a498e14fa61e1173008245c6b

SHA256
58159c2b3b27e60a533401b516b0f4f71bab420f2650cfc620a5134209106787

SHA512
d795f52ccb6e949da5455cee4a5f763ca64de9472a1a1e87a3c80e611c2393762ec74107aac85e3fa9660d547d6b1afe281da286abe4fc7de3607fea420b09a6

Download Submit
C:\Program Files (x86)\WiseVector\tmp\vcredist_x86.exe
MD5
35da2bf2befd998980a495b6f4f55e60

SHA1
470640aa4bb7db8e69196b5edb0010933569e98d

SHA256
6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

SHA512
bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

Download Submit
C:\Program Files (x86)\WiseVector\tmp\vcredist_x86.exe
MD5
35da2bf2befd998980a495b6f4f55e60

SHA1
470640aa4bb7db8e69196b5edb0010933569e98d

SHA256
6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

SHA512
bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2140.txt
MD5
7dfafd18f57038579014d93ceaf49a5a

SHA1
cda014d21e675b2f43cb0eeef6af7738397e9992

SHA256
447084fb888427ece23c7721a19dc850ee2a9a2bb450bc908d1fcc64ed2402d9

SHA512
4d41b7e6b564a298ebbbeda08c02c3fd24371b63e80da2402a2f06314339606732040b36c0a4f523e4990945a46f2ed2fe9f3957e0a2c80b11df6f1e8c358f81

Download Submit
C:\ac506cfd761f5ae11abca04d90\install.exe
MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\VC_RED.cab
MD5
0ee84ab717bc400c5e96c8d9d329fbb0

SHA1
be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a

SHA256
461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d

SHA512
4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1028.txt
MD5
f187c4924020065b61ec9ef8eb482415

SHA1
280fc99fb90f10a41461a8ee33dbfba5f02d059d

SHA256
cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2

SHA512
1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1031.txt
MD5
3168ed3b48c1dc8d373c2abc036574cf

SHA1
7ffbcfb6cd9b262a0e9a55853d76055693f60c60

SHA256
3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321

SHA512
9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1033.txt
MD5
162fc8231b1bd62f1d24024bb70140d5

SHA1
7fa4601390f1a69b4824ee1334bee772c2941a24

SHA256
c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b

SHA512
a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1036.txt
MD5
c360851dfdf51b6ddc9cfcc62c584898

SHA1
f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6

SHA256
3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9

SHA512
a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1040.txt
MD5
04b833156f39fcc4cee4ae7a0e7224a1

SHA1
2ffa9577a21962532c26819f9f1e8cd71ab396bd

SHA256
ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66

SHA512
8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1041.txt
MD5
031fab3fb14a85334e7e49d62a5179fe

SHA1
12370185ef938a791609602245372e3e70db31be

SHA256
467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961

SHA512
7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1042.txt
MD5
6fcd6b5ef928a75655d6be51555288c7

SHA1
eafdcc178343780b83f1280dad9d517aaedab9e4

SHA256
3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b

SHA512
635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.1049.txt
MD5
bc3a8865b60ec692293679e3e400fd58

SHA1
2b43b69e6158f307fb60c47a70a606cd7e295341

SHA256
f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3

SHA512
0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.2052.txt
MD5
ec4b365a67e7d7db46f095f1b3dcb046

SHA1
d4506530b132ef4aad51fcbc0315dadc110c9b81

SHA256
744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27

SHA512
5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\eula.3082.txt
MD5
c2d1221cd1c783b5d58b150f2d51aebf

SHA1
3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60

SHA256
c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132

SHA512
c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\globdata.ini
MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.exe
MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.ini
MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1028.dll
MD5
8c2c1df03574e935277addc6e151bdbe

SHA1
33f7eae718d6704ea99d7c7803207dbe0d1ea3a0

SHA256
1074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e

SHA512
735c438da7fd3e4e0e4738ac11c87a73ce3cacbaa24b21994ec76868e70fc485469337eb6e067e20bb92210995ffb3c385677fcc986c4c34f24bfde6b91ba0c8

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1031.dll
MD5
6f22a8ecc5a917c61f1478ef4ad53949

SHA1
180c370698091e53f203d23eb6c839467deebfb9

SHA256
2c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa

SHA512
8513f09da143983d436368c6067a62f1829d5d66776a168026f7562f8337d8e1bc8df2ff9ab421f4cc7d75757a0e9b8a75f3761c9e8aba7d0785d2fcb1b00a93

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1033.dll
MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1036.dll
MD5
4d431f94a7d0945f4a7f13b7988632aa

SHA1
61461b14b57382eebb3bf4621b7dadb0cb2475b3

SHA256
cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6

SHA512
e4197801c20dfce7dc14d5d74aa572de18954dceaaca77a75bf989427c6ff7d5889085e5c325376a993ad290ee43ab25e0f6bea074fed3d5158e0fd4c785aeca

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1040.dll
MD5
ef1ccfe8572cdaaefb1940efbbff6d80

SHA1
b1d587c8fdb3ca82c320d08379ca7bd781253e3f

SHA256
709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8

SHA512
98538c82d56b6e0e9f0ca7cf47a6ce57e0acd18b2a64b90304a95a3c7270920efb835731272200afa16e45dfd461df94f95da04f39c2436915dc6969a4a0ebce

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1041.dll
MD5
6bfb58958d58bf38e9242b2056392b8c

SHA1
f4c4653e061eb903ddae29f0d6a798db6ab5bdf4

SHA256
f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332

SHA512
672727552812c7d7b775896096d556851d6990b2d9c24c0e2c728f6c720b47c156d2ec2ce7ef23126fd222178969aff848f06568f695d154d6f7836ecf222d88

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1042.dll
MD5
ba91e387d54b94689644ebd23ff264ba

SHA1
267b0af1774b6440cac00fad6524f277fde09457

SHA256
16fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767

SHA512
79e818ffc57880a9881d771c0ea607d64a2cbdad29b28a270138d4d03edb8b026e7536e89396968c8454c56c740d198e67a75cac3e2447ca120b7cffefa4c0bd

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.1049.dll
MD5
9aac6ce2ad6c7aee5481e46ddb0ad0dd

SHA1
dabd5e299a4595b1341f47313ac26c663d79a7c4

SHA256
3de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e

SHA512
97e00a50d3e8c8954854cc44f36049d63d8f1860e547a511feccf4214ff0560079b5512053aea4c2a40769d58738934d69c1a45186092ff11af1b907395dd126

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.2052.dll
MD5
208f1260b7145b19434a8c95ff7c0474

SHA1
6a0a74affdc8f988873841b7073f428056a8aa5d

SHA256
f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4

SHA512
2e9cf1ed7944a6246a2f3febee99d0a36759191664e83aee3c14424b64785a134fe9c50e9e5deaaab1095ae298a2f49aac2037f64a127d250af973a077a7e03a

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\install.res.3082.dll
MD5
dbbe392a7536c76ec60a21e211eb3210

SHA1
e1cead8b1e0fd41e9ed79f4921c5e40c2d739dda

SHA256
8de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f

SHA512
f725bc786076947874cc58b9591445064b3f133c75865bb1d661e95f29f1a9556447ee3f385a38f9438561e35e6cfa8208dbc938d3304c415cc25ed85c29f15d

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\vc_red.msi
MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\??\c:\ac506cfd761f5ae11abca04d90\vcredist.bmp
MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
\Program Files (x86)\WiseVector\Eg.dll
MD5
ad34d70217e3bd890f485ccea872ed9b

SHA1
aa8531c8a83a3298c2c6792ad826d67ef5f79950

SHA256
2125c35ead9281b8d1ce475abd89fe5a9bd108720f3ee2318d904fdac26d5d38

SHA512
09e05b7f62826bfcd6b4eeecd5c84f5675d4b887a538ecadbed24e1cd2fb4363f7dc87eba6959648c4d4d17dfb89e5d8c8c25ed81fd768d2f9a9740c8925aaea

Download Submit
\Program Files (x86)\WiseVector\EgAddtionalHelper.dll
MD5
b486326f7d16c0373fee6e7a20cf2b15

SHA1
03bfdea3bb892a00ac75153d946902b7908f16d0

SHA256
43a6e1c08964e709d934192d8485609922abe9772424ecac9c7ec451b3ea7cbd

SHA512
f3d715306b91b667ecd7c45855739b03ecfd924ff0bdfa188d5a8bbdd6ca73d273afb3de6d9585eaddb6d4159eeb43114b5ac0f0ea0aea2cbf0c08e63df46322

Download Submit
\Program Files (x86)\WiseVector\EgHelperOne.dll
MD5
72ed5b0c1fd49dbe441b8f3c76b34271

SHA1
40091faf48b0f174936b2d942862a509d62e28e8

SHA256
8cfb6a5677b0b012fd0bbac8acacc98e097853c26a64547888c762ff70179b6f

SHA512
14bc13c95e85802861220a06fd3fe861028f777c8536ad460c0622a389b045e9bac6d6241113a304396fe861805affa18637a91fd029de54895ec90dea50dd91

Download Submit
\Program Files (x86)\WiseVector\EgHelperThree.dll
MD5
d1bbbb3ab51049deb5143aaa593131bb

SHA1
0d7a2812e258ffd6585982350e1246382dd86463

SHA256
47afad03a77ec17621fd688ecc4d160347363adf9890f98db90a3057005568dc

SHA512
5ee3d453ccaf822a23227782c85573feed84c2276e5cb2c46cf4dfa727a21f8286c53984a7905eee54feefeffa59b668edd09e3a275588ba031ae4526ef09121

Download Submit
\Program Files (x86)\WiseVector\EgHelperTwo.dll
MD5
ee10816a9b0e6fe7c504e59c5e01c947

SHA1
a8de2dc9fec813cfedecff0431ba64666aed7a8f

SHA256
3ceb8aeaa245fbf1c6afa10bf0362f1c0ddb178e9a592eb2ccb81919728a5061

SHA512
548e23b359784ffe3232e69894ebc6b8d63062c96931b4e6fa3a1565e75424aaaa6a30ec487aff9b5b74e194d866bdc35ba554dc82d6b29a6e5299df1168db33

Download Submit
\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll
MD5
fdea85a1f81fee19e6481060757e0d4e

SHA1
9d6b99d75873f44bb155db3a3ec50a1f66cf6fd4

SHA256
dd2a3b68994ffb5b5e84d2cf9171ada5d0be41f49ae756f7f08c7285c1ff3e8d

SHA512
2474bed7a5890d9746c664916cf756d022373351ac7ae994d3601ca902be9ceda454c56a97c11824c2891d4e08214b2df85cf830298da0a0d690bc46872582db

Download Submit
\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll
MD5
fdea85a1f81fee19e6481060757e0d4e

SHA1
9d6b99d75873f44bb155db3a3ec50a1f66cf6fd4

SHA256
dd2a3b68994ffb5b5e84d2cf9171ada5d0be41f49ae756f7f08c7285c1ff3e8d

SHA512
2474bed7a5890d9746c664916cf756d022373351ac7ae994d3601ca902be9ceda454c56a97c11824c2891d4e08214b2df85cf830298da0a0d690bc46872582db

Download Submit
\Program Files (x86)\WiseVector\libcrypto-1_1.dll
MD5
07827fe7caab1fe3afef23cda7b51478

SHA1
6618cccbda50c921260eaa56afe502153156bcfe

SHA256
16be78b4ebaa90cd1ee7f18983fef4e7a81910d63e34afc66fa877d72f510501

SHA512
8366ccda02e43d953248bb04388ecc283911ebd857a6d1bd0eafde615890660eff48988882ec3d7044b70c2f2919b3ad9e9243d0884d03e27e1a4c9121e7b706

Download Submit
\Program Files (x86)\WiseVector\vcomp120.dll
MD5
27bc360d67f269a61bb052e10c9fceeb

SHA1
8d81406c8dd3ed8894d8aee07dd718dcfd2035c5

SHA256
fc12360ff09830bf08b7a2a238016eea2b9e9475cbea4c22043b264e76b3420c

SHA512
2807af25e00ea11c0acfae20d44ee0f02b2331c469f14f5d42814805ae16b7b2a11fbcd7f9046f3e11adc434133057dadab62beca63eb70793fd755f3f827755

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\BgWorker.dll
MD5
33ec04738007e665059cf40bc0f0c22b

SHA1
4196759a922e333d9b17bda5369f14c33cd5e3bc

SHA256
50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be

SHA512
2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\BgWorker.dll
MD5
33ec04738007e665059cf40bc0f0c22b

SHA1
4196759a922e333d9b17bda5369f14c33cd5e3bc

SHA256
50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be

SHA512
2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\BgWorker.dll
MD5
33ec04738007e665059cf40bc0f0c22b

SHA1
4196759a922e333d9b17bda5369f14c33cd5e3bc

SHA256
50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be

SHA512
2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\System.dll
MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\System.dll
MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\nsNiuniuSkin.dll
MD5
00b5a327b44faaaf7fc373176cd454ed

SHA1
e58ea8e7de259f5d577c01eeac28cc8f72b65094

SHA256
f125ed6489f16f1681ea92e30f6670f72e0951cd7948df9a043e04ee512ccbeb

SHA512
a7c5955652e1dd6f33e6596f0861a2127e4a259ae7abd256a44b3ffc36c1861e29fe3e9a2b60aa5a0230430411c737ef2b2e9170e4f0f42f737039451326340a

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\nsProcess.dll
MD5
88d3e48d1c1a051c702d47046ade7b4c

SHA1
8fc805a8b7900b6ba895d1b809a9f3ad4c730d23

SHA256
51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257

SHA512
83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\nsProcess.dll
MD5
88d3e48d1c1a051c702d47046ade7b4c

SHA1
8fc805a8b7900b6ba895d1b809a9f3ad4c730d23

SHA256
51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257

SHA512
83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\nsProcess.dll
MD5
88d3e48d1c1a051c702d47046ade7b4c

SHA1
8fc805a8b7900b6ba895d1b809a9f3ad4c730d23

SHA256
51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257

SHA512
83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7

Download Submit
\Users\Admin\AppData\Local\Temp\nsyDA1B.tmp\nsis7zU.dll
MD5
06a47571ac922f82c098622b2f5f6f63

SHA1
8a581c33b7f2029c41edaad55d024fc0d2d7c427

SHA256
e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9

SHA512
04b3d18042f1faa536e1393179f412a5644d2cf691fbc14970f79df5c0594eeedb0826b495807a3243f27aaa0380423c1f975fe857f32e057309bb3f2a529a83

Download Submit
\ac506cfd761f5ae11abca04d90\install.res.1033.dll
MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
memory/1220-161-0x0000000000000000-mapping.dmp

Download
memory/1508-126-0x0000000000000000-mapping.dmp

Download
memory/1616-168-0x0000000000000000-mapping.dmp

Download
memory/1616-186-0x0000000068E20000-0x000000006F409000-memory.dmp

Filesize
101.9MB

Download
memory/1616-187-0x0000000068DB0000-0x0000000068E12000-memory.dmp

Filesize
392KB

Download
memory/1616-188-0x0000000068D40000-0x0000000068DA1000-memory.dmp

Filesize
388KB

Download
memory/1616-189-0x000000006F820000-0x0000000072D51000-memory.dmp

Filesize
53.2MB

Download
memory/2264-123-0x0000000000000000-mapping.dmp

Download
memory/2688-164-0x0000000000000000-mapping.dmp

Download
memory/3188-190-0x0000000000000000-mapping.dmp

Download
memory/3188-191-0x00000000687B0000-0x000000006888F000-memory.dmp

Filesize
892KB

Download
memory/3888-158-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads