e5e94056346367f7a8cf31fd7a2a47b4004623f1c8b74cb8f5d6ae110bef134a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8GMgV5a1fsLKxv.msi
Size

4.3MB
MD5

643541e25802b30249ba4fd2f549e244
SHA1

df45dbb9c09775be5567cf8dd92b8bf8e77dcc43
SHA256

e5e94056346367f7a8cf31fd7a2a47b4004623f1c8b74cb8f5d6ae110bef134a
SHA512

8c8aa5e51f22fc9f3edf3c292b535963745599833b2041746141467a3a490ba92274dfafa27b2d896639a3ca25740261779c129c20e004daa0ea56e6937c66d8
SSDEEP

49152:ipUPP9qhCxzT+WKjSXsE6wsGjXZq5+iLirfmiiiiiiiiiQg7Xgnct6NymxAiOYUI:ipUCQHsWPieI5tjT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1760	vlc.exe
2316	Autoit3.exe

Loads dropped DLL 3 IoCs

pid	Process
2544	MsiExec.exe
2544	MsiExec.exe
1760	vlc.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2016	ICACLS.EXE
2332	ICACLS.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\f76a4b9.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76a4b8.msi	msiexec.exe
File created	C:\Windows\Installer\f76a4b9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA709.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76a4b8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msiexec.exe
2292	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2916	msiexec.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeTakeOwnershipPrivilege	2292	msiexec.exe
Token: SeSecurityPrivilege	2292	msiexec.exe
Token: SeCreateTokenPrivilege	2916	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2916	msiexec.exe
Token: SeLockMemoryPrivilege	2916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2916	msiexec.exe
Token: SeMachineAccountPrivilege	2916	msiexec.exe
Token: SeTcbPrivilege	2916	msiexec.exe
Token: SeSecurityPrivilege	2916	msiexec.exe
Token: SeTakeOwnershipPrivilege	2916	msiexec.exe
Token: SeLoadDriverPrivilege	2916	msiexec.exe
Token: SeSystemProfilePrivilege	2916	msiexec.exe
Token: SeSystemtimePrivilege	2916	msiexec.exe
Token: SeProfSingleProcessPrivilege	2916	msiexec.exe
Token: SeIncBasePriorityPrivilege	2916	msiexec.exe
Token: SeCreatePagefilePrivilege	2916	msiexec.exe
Token: SeCreatePermanentPrivilege	2916	msiexec.exe
Token: SeBackupPrivilege	2916	msiexec.exe
Token: SeRestorePrivilege	2916	msiexec.exe
Token: SeShutdownPrivilege	2916	msiexec.exe
Token: SeDebugPrivilege	2916	msiexec.exe
Token: SeAuditPrivilege	2916	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2916	msiexec.exe
Token: SeChangeNotifyPrivilege	2916	msiexec.exe
Token: SeRemoteShutdownPrivilege	2916	msiexec.exe
Token: SeUndockPrivilege	2916	msiexec.exe
Token: SeSyncAgentPrivilege	2916	msiexec.exe
Token: SeEnableDelegationPrivilege	2916	msiexec.exe
Token: SeManageVolumePrivilege	2916	msiexec.exe
Token: SeImpersonatePrivilege	2916	msiexec.exe
Token: SeCreateGlobalPrivilege	2916	msiexec.exe
Token: SeBackupPrivilege	2768	vssvc.exe
Token: SeRestorePrivilege	2768	vssvc.exe
Token: SeAuditPrivilege	2768	vssvc.exe
Token: SeBackupPrivilege	2292	msiexec.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2676	DrvInst.exe
Token: SeLoadDriverPrivilege	2676	DrvInst.exe
Token: SeLoadDriverPrivilege	2676	DrvInst.exe
Token: SeLoadDriverPrivilege	2676	DrvInst.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeTakeOwnershipPrivilege	2292	msiexec.exe
Token: SeRestorePrivilege	2292	msiexec.exe
Token: SeTakeOwnershipPrivilege	2292	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2916	msiexec.exe
2916	msiexec.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2292 wrote to memory of 2544	2292	msiexec.exe	32
PID 2544 wrote to memory of 2016	2544	MsiExec.exe	33
PID 2544 wrote to memory of 2016	2544	MsiExec.exe	33
PID 2544 wrote to memory of 2016	2544	MsiExec.exe	33
PID 2544 wrote to memory of 2016	2544	MsiExec.exe	33
PID 2544 wrote to memory of 1672	2544	MsiExec.exe	35
PID 2544 wrote to memory of 1672	2544	MsiExec.exe	35
PID 2544 wrote to memory of 1672	2544	MsiExec.exe	35
PID 2544 wrote to memory of 1672	2544	MsiExec.exe	35
PID 2544 wrote to memory of 1760	2544	MsiExec.exe	37
PID 2544 wrote to memory of 1760	2544	MsiExec.exe	37
PID 2544 wrote to memory of 1760	2544	MsiExec.exe	37
PID 2544 wrote to memory of 1760	2544	MsiExec.exe	37
PID 1760 wrote to memory of 2316	1760	vlc.exe	38
PID 1760 wrote to memory of 2316	1760	vlc.exe	38
PID 1760 wrote to memory of 2316	1760	vlc.exe	38
PID 1760 wrote to memory of 2316	1760	vlc.exe	38
PID 2544 wrote to memory of 2340	2544	MsiExec.exe	39
PID 2544 wrote to memory of 2340	2544	MsiExec.exe	39
PID 2544 wrote to memory of 2340	2544	MsiExec.exe	39
PID 2544 wrote to memory of 2340	2544	MsiExec.exe	39
PID 2544 wrote to memory of 2332	2544	MsiExec.exe	41
PID 2544 wrote to memory of 2332	2544	MsiExec.exe	41
PID 2544 wrote to memory of 2332	2544	MsiExec.exe	41
PID 2544 wrote to memory of 2332	2544	MsiExec.exe	41

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8GMgV5a1fsLKxv.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1BA5F1527A570175732B651F8E9D9F3
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:2016
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files\vlc.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files\vlc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.au3
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files"
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:2332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "00000000000004AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files.cab

Filesize
4.0MB

MD5
c2271e53a3a03b0d87483d4ac6699d59

SHA1
e9a6ab1c3fa3ab19c70508c03677a8caef65c5b4

SHA256
29d7e4bf488c2f8951002648a6233b63df30e771cf03481195fca4580ebd8927

SHA512
c5e66108183f0c5f863e6b1c12d7d0db58113e6416907bbf3d5a897325789f16ac40e6885f5e4e11a58f9ef5fa75062dbad4f17f62dc8acb3f097c0b5bfe5063

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files\libvlc.dll

Filesize
1.5MB

MD5
40ae15c468001502dac0f06eb58fb302

SHA1
3b2599137a27fbc010aacde56b30e6f029bb12ae

SHA256
f7524f192f897d6166284ee8bc1caa16335b4d097bcb686f1247c10bef208762

SHA512
ae8bc69f806cbf40a24b11a3845bda17bff06ad1dd2fd639280da44474c849e06f4ba0ce17a586aebeb9b1ec04597ba16177a9380ebab720312c71a7758a0530

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files\sqlite3.dll

Filesize
1.4MB

MD5
3d5db49880c651f61d664aafd7489691

SHA1
47e1cbf4ceec8b1651a59536851f34a42569e5d3

SHA256
660f2ae4d2441ddafec267ed8d6a9e01d8d30ae81b36b52c62bccfe778059ba7

SHA512
57f55ee986e344cfe7e62ffd7667b8d9e292aeb01d93bb3643067c131cb6d4a828d6712d75178aaf142eda7a62e716dab7592793f13e26cb962d3bf5894a40ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files\vlc.exe

Filesize
966KB

MD5
035860e139ba6db1b38d5346cb6ff5b6

SHA1
d515303cbca3a8ae7a0463fecd418d81b314e650

SHA256
16197a321fc7b0a2a311e689621fe4a7cd50fdcb2d163973a31e4fd6352232d7

SHA512
14dab9108d85af72001631130923b94483dd1440f24a8eedad41756db3030c5e11e80ec894922c389e09c86e8b721bcbd8594bd3646f484560f89963a7e18cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\msiwrapper.ini

Filesize
430B

MD5
84d51433d336df4cefae78fad9965c49

SHA1
463d259e2e70219df7bb015572153013fb016021

SHA256
33e9ddc18c4c15813e58462edcfb610b8196704207b370948d1558e4ed278607

SHA512
e15a386d0b5556b1a9aad9c2c586abcb78b26e04ac5ff12058553949aad9dda452078ae36e03969812c21375f0c6bd0a17ea8745172641cdf087aa23618653a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\msiwrapper.ini

Filesize
1KB

MD5
fdfd6a313adef1a368e536f721ed8bfe

SHA1
eb8ee7c971d9ddccf0a1669b04fd926612120bbf

SHA256
86aee41e6abd28e5514555ebc9f77bf7a1b122fc4bb7ceb3e35bd6ae4a2aa76e

SHA512
baded1cd8a0e96cc5a02f3ccb83836772e14cc27523d8953817262650d7c60f5542686037eb87e495c31d98c7e126e6104821fdc79961f0b9bfe82a8286bbc40

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\msiwrapper.ini

Filesize
1KB

MD5
910a47894b2d13c30e44e593f5f4752c

SHA1
72c14992ebef049ff157bf0454139ffd5d9fb6b3

SHA256
bb60aa927547f3b40fb147bc40e284c4a4697e6cb0ea5a4d819cc65541a3fb65

SHA512
2433f35064e88de5f946e6d08206b3fe012efe5c0b205b42556166e2651bba4fde7db98c87cfb7062e852f78b2f3a3b597cb8385b5e914806857a09863763ad8

Download Submit
C:\Windows\Installer\MSIA709.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\temp\Autoit3.exe

Filesize
587KB

MD5
9bcdfd0c8bf7ffe1fa38377a1dafbd1d

SHA1
b9b918861042aaad985c9c3405cd5a997341067a

SHA256
fcda800304368f1c5dcd270a5270f83fccd2f47d6157ef56de3de77dc468cdca

SHA512
a763530811500e05613faad4226ca88ba5bb24aeba86157e20a1a5046250caf5dcd62586aaa63127fbb720afb4684445e71f820716508b183766ec51ff70f2bb

Download Submit
\??\c:\temp\script.au3

Filesize
377KB

MD5
1c93800db8d0f45459bc0a53f081f7e6

SHA1
8d24db8cc33421e50a24897c107185af0c83d8a5

SHA256
12355c2b883740dc391c69690c3bd9855304c38b2cd612eafb404ff2a7d68985

SHA512
66dd906ca6d7bd8d41f427847eb477ec7921dd97c47ff452b688b5746a53f386e13a384b12621d3a04dedf6018c06cef51371b51a54a7bab23576182c17c5c29

Download Submit
\??\c:\temp\test.txt

Filesize
76B

MD5
5e21c8ec8315c76c2e60eb1ff99040ca

SHA1
5b691e8bcf0967cc2b46aeb6dd7af91d8992ea25

SHA256
9e6861ac7aa15474d2d00afd67b2fdec473cf67a13116fddecf1495088e853ba

SHA512
ab10cda631047028e9321952430a9f7b1cd9a78cb59c8c192aaa72cc5a95cdeee96ef432f422e11bcddeb72170d97ba0093e29cc0ad07bb78e1c61c571f2553b

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e9ed2d7a-e5b0-4e10-92ac-9bb1fb0b6072\files\libvlc.dll

Filesize
1.2MB

MD5
6e92e20813eb0aa1903bfa9db03e0c0a

SHA1
aa943d06efd7631130a5ef0de507b5666f2e2c68

SHA256
2bee72d9534b045cae89ecc03c32d019a0ee35e0aa8d1d3de294f73bb18ced7c

SHA512
3dcafe6bf5903b1d362aa7d8bc2f6413a88c45d3771bc7c60e562bd58fd9b184fe5802a3308182f1e88e50c8e584efa06e141e83f3b9c12fb1e701d9ec5927be

Download Submit
memory/1760-77-0x00000000020E0000-0x000000000227E000-memory.dmp

Filesize
1.6MB

Download
memory/1760-87-0x00000000020E0000-0x000000000227E000-memory.dmp

Filesize
1.6MB

Download
memory/1760-85-0x00000000742E0000-0x000000007446D000-memory.dmp

Filesize
1.6MB

Download
memory/1760-84-0x000000013F9A0000-0x000000013FA98000-memory.dmp

Filesize
992KB

Download
memory/2316-94-0x0000000004B80000-0x0000000004ECE000-memory.dmp

Filesize
3.3MB

Download
memory/2316-93-0x0000000003700000-0x00000000046D0000-memory.dmp

Filesize
15.8MB

Download