78330d547c0466f8a4c4ef26200315a188054fa86c7bc459feb9c5ad2b450b80

Resubmissions

21-02-2024 17:30

240221-v3arqscb9t 7

21-02-2024 17:27

240221-v1wlescb5y 7

Analysis

max time kernel
190s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wynntils.Mod.Installer-1.4.1.exe
Size

79.2MB
MD5

05195aa42a52658e1358ee87c71adde3
SHA1

cf25e3e6704314dbd47f6fe4c4f4459214b70eb4
SHA256

78330d547c0466f8a4c4ef26200315a188054fa86c7bc459feb9c5ad2b450b80
SHA512

fbc58e91c1478b5fe0369126974f9351bd7c7503b6801f6497f6651c649b0f8b48359300b30351141a79d2218c35d20327314153cb12219666c9bac4da45fd24
SSDEEP

1572864:FXMrfx66weJbgq2Mt8NrC0rUdEXdH0krPF6cn088d7:FXMrfx66weJbgOt8N+AUuNUoPVt8d

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2984	Wynntils Mod Installer.exe

Loads dropped DLL 28 IoCs

pid	Process
2996	MsiExec.exe
2532	msiexec.exe
2532	msiexec.exe
1080	Process not Found
1080	Process not Found
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
2984	Wynntils Mod Installer.exe
1080	Process not Found

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.desktop\harfbuzz.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.base\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.logging\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.base\icu.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\kotlin-reflect-1.6.10-a22187e37e39a1cdb6a53970fa714d.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\conf\security\policy\README.txt	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\snakeyaml-engine-2.3-e4ca89474b36d8f322e1237b308b972e.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.base\cldr.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.desktop\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.instrument\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\lib\fontconfig.bfc	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\foundation-desktop-1.1.1-03fa28d74362f230ba3c9b35c06cd8.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\kaml-jvm-0.37.0-b8976c7df52c9af2dbc29b7e6fa9b39.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ui-geometry-desktop-1.1.1-e1e37184fc307a8e966ee489e77af59d.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\lcms.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ui-util-desktop-1.1.1-614de32fa765806ea805778a966cd87.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.xml\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\javajpeg.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\desktop-jvm-1.1.1-a0fb36d5ce8399d2836e3e8fb6f5737e.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.base\unicode.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\jli.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\animation-desktop-1.1.1-bce4fdbafe19e6e7b8c698ed3766b22b.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ui-unit-desktop-1.1.1-4ca199ff81734ba9808b68d1c7ee9293.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-profile-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.desktop\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\Wynntils Mod Installer.exe	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\foundation-layout-desktop-1.1.1-364c1b4717a757d2b134a36ec827fa3.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\conf\security\policy\limited\default_US_export.policy	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ui-tooling-preview-desktop-1.1.1-597f98f6b3c92d798357a1163f7e8d0.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\lib\psfontj2d.properties	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\skiko-awt-runtime-windows-x64-0.7.16-77be4ee89592fdb7cbb2f5436a94b5d.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\nio.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\lib\security\default.policy	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.base\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.datatransfer\LICENSE	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-file-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\prefs.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ktor-utils-jvm-1.6.8-5a793a8a33e1f6c7c1d88702c30e59b.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\lib\security\cacerts	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\mlib_image.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\zip.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.base\zlib.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\runtime-desktop-1.1.1-becf68489230f33217981f5c0809daa.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ktor-http-jvm-1.6.8-ca9e6524b9f04f297e4d9511119ab46.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\material-desktop-1.1.1-306fe28a43e1c47de42b7d9cc793.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.desktop\jpeg.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\Wynntils Mod Installer.ico	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\BrowserLauncher2-all-1_3-b699319d44fb3dd46efb91111bf0f076.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.xml\jcup.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.datatransfer\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.xml\xerces.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ktor-client-core-jvm-1.6.8-d4fb2e305e387583c6a5dba7a2cdaf8e.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.xml\bcel.md	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\ui-graphics-desktop-1.1.1-6bad8a1962b75c3af64e8597a978645.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\app\kotlin-stdlib-jdk7-1.6.10-bdf996a12ffcd3f8a4ec3d235f8894.jar	msiexec.exe
File created	C:\Program Files\Wynntils Mod Installer\runtime\legal\java.desktop\freetype.md	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E59.tmp	msiexec.exe
File created	C:\Windows\Installer\{26347C0B-40FB-330A-B05B-AD5B50EABAA4}\icon_1151126796	msiexec.exe
File opened for modification	C:\Windows\Installer\{26347C0B-40FB-330A-B05B-AD5B50EABAA4}\icon_1151126796	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3CD2.tmp	msiexec.exe
File created	C:\Windows\Installer\f763c56.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f763c56.ipi	msiexec.exe
File created	C:\Windows\Installer\f763c55.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f763c55.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{26347C0B-40FB-330A-B05B-AD5B50EABAA4}\JpARPPRODUCTICON	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\{26347C0B-40FB-330A-B05B-AD5B50EABAA4}\JpARPPRODUCTICON	msiexec.exe
File created	C:\Windows\Installer\f763c58.msi	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wynntils Mod Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Wynntils Mod Installer.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B0C74362BF04A0330BB5DAB505AEAB4A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B87D726BC749C5F4F9B3EA20FB9AD780	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList\PackageName = "main.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259398134.tmp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\Version = "17039361"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\ProductIcon = "C:\\Windows\\Installer\\{26347C0B-40FB-330A-B05B-AD5B50EABAA4}\\JpARPPRODUCTICON"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B87D726BC749C5F4F9B3EA20FB9AD780\B0C74362BF04A0330BB5DAB505AEAB4A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\ProductName = "Wynntils Mod Installer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\PackageCode = "AE245E96810D54641A51BC46C05FCD69"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\259398134.tmp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B0C74362BF04A0330BB5DAB505AEAB4A\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B0C74362BF04A0330BB5DAB505AEAB4A\AdvertiseFlags = "388"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	msiexec.exe
2532	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeSecurityPrivilege	2532	msiexec.exe
Token: SeCreateTokenPrivilege	2340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2340	msiexec.exe
Token: SeLockMemoryPrivilege	2340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2340	msiexec.exe
Token: SeMachineAccountPrivilege	2340	msiexec.exe
Token: SeTcbPrivilege	2340	msiexec.exe
Token: SeSecurityPrivilege	2340	msiexec.exe
Token: SeTakeOwnershipPrivilege	2340	msiexec.exe
Token: SeLoadDriverPrivilege	2340	msiexec.exe
Token: SeSystemProfilePrivilege	2340	msiexec.exe
Token: SeSystemtimePrivilege	2340	msiexec.exe
Token: SeProfSingleProcessPrivilege	2340	msiexec.exe
Token: SeIncBasePriorityPrivilege	2340	msiexec.exe
Token: SeCreatePagefilePrivilege	2340	msiexec.exe
Token: SeCreatePermanentPrivilege	2340	msiexec.exe
Token: SeBackupPrivilege	2340	msiexec.exe
Token: SeRestorePrivilege	2340	msiexec.exe
Token: SeShutdownPrivilege	2340	msiexec.exe
Token: SeDebugPrivilege	2340	msiexec.exe
Token: SeAuditPrivilege	2340	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2340	msiexec.exe
Token: SeChangeNotifyPrivilege	2340	msiexec.exe
Token: SeRemoteShutdownPrivilege	2340	msiexec.exe
Token: SeUndockPrivilege	2340	msiexec.exe
Token: SeSyncAgentPrivilege	2340	msiexec.exe
Token: SeEnableDelegationPrivilege	2340	msiexec.exe
Token: SeManageVolumePrivilege	2340	msiexec.exe
Token: SeImpersonatePrivilege	2340	msiexec.exe
Token: SeCreateGlobalPrivilege	2340	msiexec.exe
Token: SeBackupPrivilege	2872	vssvc.exe
Token: SeRestorePrivilege	2872	vssvc.exe
Token: SeAuditPrivilege	2872	vssvc.exe
Token: SeBackupPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2456	DrvInst.exe
Token: SeLoadDriverPrivilege	2456	DrvInst.exe
Token: SeLoadDriverPrivilege	2456	DrvInst.exe
Token: SeLoadDriverPrivilege	2456	DrvInst.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2340	msiexec.exe
2340	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2340	2356	Wynntils.Mod.Installer-1.4.1.exe	29
PID 2356 wrote to memory of 2340	2356	Wynntils.Mod.Installer-1.4.1.exe	29
PID 2356 wrote to memory of 2340	2356	Wynntils.Mod.Installer-1.4.1.exe	29
PID 2356 wrote to memory of 2340	2356	Wynntils.Mod.Installer-1.4.1.exe	29
PID 2356 wrote to memory of 2340	2356	Wynntils.Mod.Installer-1.4.1.exe	29
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34
PID 2532 wrote to memory of 2996	2532	msiexec.exe	34

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Wynntils.Mod.Installer-1.4.1.exe
"C:\Users\Admin\AppData\Local\Temp\Wynntils.Mod.Installer-1.4.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\msiexec.exe
  C:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\259398134.tmp\main.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2340

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3152DEA8E9177D74B2AD17475E1C5FA4
  2⤵
  - Loads dropped DLL
  PID:2996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B0" "00000000000005A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Program Files\Wynntils Mod Installer\Wynntils Mod Installer.exe
"C:\Program Files\Wynntils Mod Installer\Wynntils Mod Installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f763c57.rbs

Filesize
54KB

MD5
7bbf9b818d9e06c7f59238c0c48ea4b1

SHA1
5b9cf1041c310cbd97626f6d2627561175f8cf8d

SHA256
5b025961129638ce3a7913c5fcb87f71252a565a506fc4d8116215cdd19b6be5

SHA512
adbfa42926402cfc322b487dd611203ab3e90a6e1f4d66f7925a36ed8bdd73aa88e10da46103255f45af332a92da8af0ca066f926b83caa0abd3652bcf9f305d

Download Submit
C:\Program Files\Wynntils Mod Installer\Wynntils Mod Installer.exe

Filesize
530KB

MD5
19dd42a7065b2e5a255df40de20318ad

SHA1
e63febab52f99c6c8a1ea60cc54527594bd9c86a

SHA256
8d80387b2212a0395c073ce23b81573298506d6e93391f2c19fb68883b895c29

SHA512
0b1a54ebb51517a0aba311cbfc30475c3668e48978877864e64d1bc650a814dc08917a26a1a8390f9ba7bc47f1874cc63ae3c139b27caaa36cd51d885040a528

Download Submit
C:\Program Files\Wynntils Mod Installer\app\BrowserLauncher2-1.3-cf6ef231e6a61f6979e89f8dadcf.jar

Filesize
65KB

MD5
0c0f6ef231e6a61f69790e089f8dadcf

SHA1
68231cab1b3daa1a51b0f582967e188faad65d74

SHA256
a6deeb1db866ed2f9cc84eeebb890880e7ce020a6d612f699e90403ae3f7ef5a

SHA512
acf85fdaed82bdf1b4cc2aff95eb5316bfc8888e85db781722e182d73ca52a1da158c2fd43bf0bfab72e3947d51cf4663d039c44223dc98fbaf2eb4728be8cb2

Download Submit
C:\Program Files\Wynntils Mod Installer\app\BrowserLauncher2-all-1_3-b699319d44fb3dd46efb91111bf0f076.jar

Filesize
182KB

MD5
b699319d44fb3dd46efb91111bf0f076

SHA1
80c1a5f40ae52bad38be3bf914131a8febf44a9f

SHA256
45445b2eeaddf70a0f79f4b3c45cffe097bbc16ac76ec59ab9224562ccda2bbd

SHA512
529195a94b757578afb3863c6b53cf16584097c659c576167fcbf86897cc484d80092c8d6e409ba1fdec69cb4f4a42b65c89c881663ae64bbc0a0a496309da5f

Download Submit
C:\Program Files\Wynntils Mod Installer\app\Wynntils Mod Installer.cfg

Filesize
4KB

MD5
6863d65c41ec7d024e27a43e802ed82d

SHA1
dd83ef4ee73fa7859937ddc75a5557e0b145070a

SHA256
bf17ca7aa0e1233e9470759dd35d731c3a0e9cdb356599fd38d166152d46d61a

SHA512
8971477411dfd668daae3e121c8f0c4ed1648e1e7c08b16ecf2038444b1a1d6b947c990b84c16d8923da2cb350a0cc4e001d7e77600b6bab80ddfd278e927b71

Download Submit
C:\Program Files\Wynntils Mod Installer\app\animation-core-desktop-1.1.1-1ec13229368db6b6b4917b4e80d2fc5c.jar

Filesize
292KB

MD5
1ec13229368db6b6b4917b4e80d2fc5c

SHA1
35cb8857d549cceabc442af169cd3205cbe14555

SHA256
138a6a3226ec444465b8a1c1907e07e02cfd6dec561c1f3119e841315df78252

SHA512
d2cd599a02ebe31b697c195302a26868c94abec206acf38fa7d178672cc321161aef6ea16f9d3e39fd3f710805852c34c6f601144d68d705fbe46a166a331060

Download Submit
C:\Program Files\Wynntils Mod Installer\app\animation-desktop-1.1.1-bce4fdbafe19e6e7b8c698ed3766b22b.jar

Filesize
274KB

MD5
bce4fdbafe19e6e7b8c698ed3766b22b

SHA1
183763d41b1e2ebca2f86418934fa7f1908d5b80

SHA256
108b3ae68365c421bf675c5d43cdddd268a6f2066c74ec5a5b384577c8b9cab9

SHA512
d609c4285de7d1a68986c757a81e480b22917b77cdacb38a4e0b6ee7c005539e1242616b028a16ad25948e6739b39c8a8a50d838d3eec5077eb43f9c4b210dd1

Download Submit
C:\Program Files\Wynntils Mod Installer\app\annotations-13.0-f4fb462172517b46b6cd900358515a.jar

Filesize
17KB

MD5
f4fb462172517b46b6cd90003508515a

SHA1
919f0dfe192fb4e063e7dacadee7f8bb9a2672a9

SHA256
ace2a10dc8e2d5fd34925ecac03e4988b2c0f851650c94b8cef49ba1bd111478

SHA512
5622d0ffe410e7272e2bb9fae1006caedeb86d0c62d2d9f3929a3b3cdcdef1963218fcf0cede82e95ef9f4da3ed4a173fa055ee6e4038886376181e0423e02ff

Download Submit
C:\Program Files\Wynntils Mod Installer\app\desktop-jvm-1.1.1-a0fb36d5ce8399d2836e3e8fb6f5737e.jar

Filesize
7KB

MD5
a0fb36d5ce8399d2836e3e8fb6f5737e

SHA1
5ee1b0cb95662b9ec8e19c2d7f94b38673fdbe14

SHA256
c898b5cb62c45c06a22c3153b7511a9037e190709ccdcd50d50f3d000732da37

SHA512
cf24b3f1bceaa511548e72d3feb44643c3bbc862f27ab9278ba18d9312f97d2c78beb7e796f472fc0eab1e628301429579341d6afe920d6ee1e1fdb0ce63f29e

Download Submit
C:\Program Files\Wynntils Mod Installer\app\fabric-installer-0.9.0-874b5a17ece1b7f9b15ce1b7387dbcb8.jar

Filesize
168KB

MD5
874b5a17ece1b7f9b15ce1b7387dbcb8

SHA1
c04c1d3d9f478bc31bdefdcc783bd4defda4db9c

SHA256
11bf2058eb2d0441e1af38f570c5b920571449dadb2e316fcf021ba78443592b

SHA512
80b5e7c571676e3489185df140d638bd8d12eebfcddedccd2dc469f6ee0522a0992354ac3411b2356a93d6b2f10ec706209d862d85ae84a02faf8e8761f6846b

Download Submit
C:\Program Files\Wynntils Mod Installer\app\foundation-desktop-1.1.1-03fa28d74362f230ba3c9b35c06cd8.jar

Filesize
1.7MB

MD5
003fa28d740362f230ba3c9b35c06cd8

SHA1
37301aed12391c2b359b7ae4628da760b0dae2c3

SHA256
08fe4e1f303d2de0372ba65ceecbd5bf3e57530af0c64f9fecea4c6085f453a2

SHA512
41e46e138724fbde9a606952e4fd7f3ddf46331fda6447db80ef44b588fd308136b0f0d0e1ea52a70f64174d0c1af14bcc5298134d424bc78f96c4c69cc03795

Download Submit
C:\Program Files\Wynntils Mod Installer\app\foundation-layout-desktop-1.1.1-364c1b4717a757d2b134a36ec827fa3.jar

Filesize
347KB

MD5
3604c1b4717a757d2b134a36ec827fa3

SHA1
491f6db7b259e08bef4635edb1edefb16054eb50

SHA256
9df39a5e6c1628572bd710dfa65178f519badb7620e4fbf0bfb46fc6cf4ca0f4

SHA512
52378577aec15ec9b990decfd84ae6fd7242961c5f4a04925257527adaa6a82ec789d7bc580d75ce6f0d76e4a9eeab08ac9f96e9889e7f96cb741d4b75e34255

Download Submit
C:\Program Files\Wynntils Mod Installer\app\json-20210307-f73834fd29b7186597a4c6ace1517a.jar

Filesize
68KB

MD5
f73834fd29b71806597a4c6ace15170a

SHA1
528c8df3757e8bcf151817b1d7b9b434f6aa08d5

SHA256
e2c55b1fc13ce0f9b227a4981ee44157ca2c68616bc71f058ff83acaa632876e

SHA512
794c56a89e1428fbfd564312ced35af970f376106914c84965c18c061a7a013453f58a1fb465dcd30978f05359792e5eb3012f05e046e3ad58a727232df2eb63

Download Submit
C:\Program Files\Wynntils Mod Installer\app\kaml-jvm-0.37.0-b8976c7df52c9af2dbc29b7e6fa9b39.jar

Filesize
134KB

MD5
b8976c7df52c9af2dbc29b7e6f0a9b39

SHA1
e4cc90d4bbaa98a4cc26b53ab0f3601b25674949

SHA256
5799d24732054fc1c6beebc6995b243e9ee44a287daf2673516b7202f7e28617

SHA512
20d79e7241fe17d8075ca405067777397f1b3f7a1f2b52def6f2c0fa68eb5c52c2bd3b2ddb786a15866a2936d208e40b6e2f05611daf4ed921b5b3dd32746392

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
d53637eab49fe1fe1bd45d12f8e69c1f

SHA1
c84e41fdcc4ca89a76ae683cb390a9b86500d3ca

SHA256
83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087

SHA512
94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
c712515d052a385991d30b9c6afc767f

SHA1
9a4818897251cacb7fe1c6fe1be3e854985186ad

SHA256
f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1

SHA512
b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
f0d507de92851a8c0404ac78c383c5cd

SHA1
78fa03c89ea12ff93fa499c38673039cc2d55d40

SHA256
610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27

SHA512
a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
ab206f2943977256ca3a59e5961e3a4f

SHA1
9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e

SHA256
b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a

SHA512
baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
96da689947c6e215a009b9c1eca5aec2

SHA1
7f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60

SHA256
885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82

SHA512
8e86fa66a939ff3274c2147463899df575030a575c8f01573c554b760a53b339127d0d967c8cf1d315428e16e470fa1cc9c2150bb40e9b980d4ebf32e226ee89

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\java.dll

Filesize
133KB

MD5
a1ce357c5c6daef57fa720b2784b28b1

SHA1
e547cd452b0377281d0817f64debb4fbd1b2632a

SHA256
4499713348eec9a638cf4736228a859e389e8ac005f3aa33d0402058f79c9e3b

SHA512
7c5485e2cfeacf70a59d953dad2d410e345dc006bb6155a3205f8e7a621bb76cf7f46c7d823fb237c37a5fe91581c15bc327c98ed5095b4be4d84b9e8dc8acb2

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\server\jvm.dll

Filesize
768KB

MD5
958743d193fc95cc3407590a56ddd40e

SHA1
057c2351c32e79807ddabe4168b042e0834224f5

SHA256
9b106920ee70ade2a74979af0ded5b50f210fc2afa8e46239bded2185bb19c89

SHA512
51fa672dbbf486883ebe60a0868c01a7e8153dee8c8ecbd3842f7c0b80b24656931b6f87d45d663f2287030e376860f1a3a2a516525cc04ac5797917af70bc17

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\bin\zip.dll

Filesize
74KB

MD5
7d6ab7008fa1298f2c48060946b60641

SHA1
b1138304f8e8809ea04537cc5dd00d7341181a6d

SHA256
42e34551cdb4b6adce1162b7a29c70c3a1063818489d628f32c3e84b2a9f054e

SHA512
95caa3efab47c0db7d48b7e2dda49324db994f13eaf7b86064470d7480c4d806133999ddc824011e7a8c8f96ef213e305ac4d5d37e7f601f4177dbd604396d8d

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\legal\java.desktop\LICENSE

Filesize
33B

MD5
16989bab922811e28b64ac30449a5d05

SHA1
51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

SHA256
86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

SHA512
86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\legal\java.xml\ADDITIONAL_LICENSE_INFO

Filesize
49B

MD5
19c9d1d2aad61ce9cb8fb7f20ef1ca98

SHA1
2db86ab706d9b73feeb51a904be03b63bee92baf

SHA256
ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9

SHA512
7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\legal\java.xml\ASSEMBLY_EXCEPTION

Filesize
44B

MD5
7caf4cdbb99569deb047c20f1aad47c4

SHA1
24e7497426d27fe3c17774242883ccbed8f54b4d

SHA256
b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a

SHA512
a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\lib\jvm.cfg

Filesize
29B

MD5
7ce21bdcfa333c231d74a77394206302

SHA1
c5a940d2dee8e7bfc01a87d585ddca420d37e226

SHA256
aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

SHA512
8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

Download Submit
C:\Program Files\Wynntils Mod Installer\runtime\lib\modules

Filesize
576KB

MD5
b30360cb45c1fda8194f819f8f90e5be

SHA1
64825ef7cdea62a365eb6b23c560f266bbe6b3c0

SHA256
8b506ca193872fd382c012a3c26cdbae588c425a3add6c4d892ffda40f1053ca

SHA512
f3afce73100b09dd0afa6079e7b70bcd422867c0c665522c7ea6797ee21f86494beef48d52212e52519b72cb63b32617f94ec7f76698acb0612420ad4ebc387f

Download Submit
C:\Users\Admin\AppData\Local\Temp\259398134.tmp\main.msi

Filesize
78.8MB

MD5
fb27984d8acb9bc0454e6d694260682e

SHA1
9b178fc2e86ad4c5afa9d7c0cd4a58288b6ad322

SHA256
14f5d1f597fc8b3b832fb2d2d455fb470082a418f55692f7b7b7694de1a529dc

SHA512
d1394cad7bea0ad25d891569c73804dcc77bf38a621ca08664978d87dae313fac28cb1e3d91a577ac47dd65a5ae8d7e6eff8d04fb4f4f979f4e9fb2739f6fbab

Download Submit
C:\Windows\Installer\MSI3CD2.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\f763c55.msi

Filesize
56.7MB

MD5
be1449ce6913bc90f40c88617838d015

SHA1
88b8bd867d71d5104b868f98f76973436fc4b8b7

SHA256
ff65ee546eb4612389d9518d7ee853ff099d78ca34a64dcd0b2c69172a34a9b6

SHA512
7c8f00eab0b4becda9a91f6314e6efb5ad83caac549a0cde33f4f565d16a0b27db4aef26b9dbb8043e837ec73f17246a634fae630b4c4e38e25382477e028d26

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
f9e20dd3b07766307fccf463ab26e3ca

SHA1
60b4cf246c5f414fc1cd12f506c41a1043d473ee

SHA256
af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a

SHA512
13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
4dd7a61590d07500704e7e775255cb00

SHA1
8b35ec4676bd96c2c4508dc5f98ca471b22deed7

SHA256
a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499

SHA512
1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
8b9b0d1c8b0e9d4b576d42c66980977a

SHA1
a19acefa3f95d1b565650fdbc40ef98c793358e9

SHA256
371a44ab91614a8c26d159beb872a7b43f569cb5fac8ada99ace98f264a3b503

SHA512
4b1c5730a17118b7065fada3b36944fe4e0260f77676b84453ee5042f6f952a51fd99debca835066a6d5a61ba1c5e17247551340dd02d777a44bc1cae84e6b5f

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
76e0a89c91a28cf7657779d998e679e5

SHA1
982b5da1c1f5b9d74af6243885bcba605d54df8c

SHA256
0189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577

SHA512
d75d8798ea3c23b3998e8c3f19d0243a0c3a3262cffd8bcee0f0f0b75f0e990c9ce6644150d458e5702a8aa51b202734f7a9161e795f8121f061139ad2ea454f

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
6b33b34888ccecca636971fbea5e3de0

SHA1
ee815a158baacb357d9e074c0755b6f6c286b625

SHA256
00ac02d39b7b16406850e02ca4a6101f45d6f7b4397cc9e069f2ce800b8500b9

SHA512
f52a2141f34f93b45b90eb3bbcdb64871741f2bd5fed22eaaf35e90661e8a59eba7878524e30646206fc73920a188c070a38da9245e888c52d25e36980b35165

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
54f27114eb0fda1588362bb6b5567979

SHA1
eaa07829d012206ac55fb1af5cc6a35f341d22be

SHA256
984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1

SHA512
18d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\jimage.dll

Filesize
23KB

MD5
b5a1f3dac97df8bcb6b2d4b67c9ef37d

SHA1
9271aa9035abd8a37399bff55dd1910626c8e838

SHA256
dada9e7f297003c8b5d73779302ed16c22facca9835b182923b570de3cc1f8df

SHA512
cc51e18c9986663ca9df2b16204904c5c9ae81061b4d1371b3873951f02327ea4f826f241d0fca2e81638d56b131d1beb2ef6addab771b5433ebc0144bfa4524

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\jli.dll

Filesize
75KB

MD5
e8366c47914b30473527452798f654fb

SHA1
21148ddab4788adcdb49c33423c62f1750c8e296

SHA256
f5c985e067672e2cb8eda9f4c072fee87b98fadd73ee2c34c223b0834bf7e04b

SHA512
63cb9a3fd934e47b48e53017721b20613537ed8c1316557ee81ddf90dc2d7b0d65aa194dc24991042dd7a0b16d44e4f125f1ef97b901b6895b404c48aa56cfac

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\msvcp140.dll

Filesize
576KB

MD5
e74caf5d94aa08d046a44ed6ed84a3c5

SHA1
ed9f696fa0902a7c16b257da9b22fb605b72b12e

SHA256
3dedef76c87db736c005d06a8e0d084204b836af361a6bd2ee4651d9c45675e8

SHA512
d3128587bc8d62e4d53f8b5f95eb687bc117a6d5678c08dc6b59b72ea9178a7fd6ae8faa9094d21977c406739d6c38a440134c1c1f6f9a44809e80d162723254

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\net.dll

Filesize
83KB

MD5
f550550dc00186866ba9e3f4e78e1f62

SHA1
ea3cf4083e26ca7f62b3b8a10a3ec7f8dbebbde5

SHA256
885553fa09dfc5d7bf7eb26734a6e6b45a1b8e127426cf966895ef89fa187ba3

SHA512
f66dcf3bccaf2d94a565d32f56bae6b8f16b821c510f7f71eb05d949467f17caf73c580dfdbbf3e5b3020e487aead470668768255d7987ffd5cd5ca8220a294d

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\nio.dll

Filesize
57KB

MD5
56fb3c4d5e9734ca5eebd191c71d55bb

SHA1
14d902d557db2404c73b7d6f8446510f739d7652

SHA256
dc299018745f4388566550a307a16da54a9e09b652cb19230a62be10a0587e2f

SHA512
bec28a386450c6e1619f38763f1c2872061632f34f3a9653b6f6c2fab482b2ea4ad0d6df8e284f9c34b2c00a44196c718f7e30942775b9c2af58c29ce4522c46

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\server\jvm.dll

Filesize
640KB

MD5
b849c867bcad5b2a808a36926536675d

SHA1
73dc5fe5137c4a60dd0f1e4e2564948cb3a819fb

SHA256
2f9d6ae7a4d79cd097535e4932fdf20370ba351194cbd779b8c32e76eb206045

SHA512
64c33fd32151381bb95752f42ee9b99fe42d0ebc676b5a672614bbacc341fe9d7b1fb9a9a24c4dcd65a94a5af85bbd4131ed803e946797b25858cdb7893debbe

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\vcruntime140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
\Program Files\Wynntils Mod Installer\runtime\bin\vcruntime140_1.dll

Filesize
43KB

MD5
21ae0d0cfe9ab13f266ad7cd683296be

SHA1
f13878738f2932c56e07aa3c6325e4e19d64ae9f

SHA256
7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

SHA512
6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

Download Submit
memory/2984-300-0x0000000005590000-0x0000000006590000-memory.dmp

Filesize
16.0MB

Download
memory/2984-321-0x0000000005590000-0x0000000006590000-memory.dmp

Filesize
16.0MB

Download