c61ecd976b087abf7eba06ba7d8fc9767f3b2bffe79a3952ac8f9c8b1bb0be64

Analysis

max time kernel
610s
max time network
607s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IPTViewr_Movistar+_1-5_beta-1-sp1a_es-es.msi
Size

28.9MB
MD5

7172472c9a8e578dc6b8310601cbc646
SHA1

712976528526ad2c3c9bf82b7939abe652ad7962
SHA256

c61ecd976b087abf7eba06ba7d8fc9767f3b2bffe79a3952ac8f9c8b1bb0be64
SHA512

4a40bd0268399bc3e1a7232550de69b310d967e81941e279c453fc3d47cb4691aaa522805a6ef08a12c9747ec4e283aeee2b09245717a8c5a47df9fb1fd0a04d
SSDEEP

393216:FLb7VqFnDYiFbWptlSPdJ1Zp9O71CeEHL/yEeEEszszuomY05LsW1IK18dZdu0JS:BVch2CdJ1ZOCNH73NHhYDWmz80

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2036	msiexec.exe
5	2036	msiexec.exe
7	2032	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f7fb11a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7fb118.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f7fb117.msi	msiexec.exe
File created	C:\Windows\Installer\f7fb118.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE02.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f7fb117.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1368	FirstTimeConfig.exe

Loads dropped DLL 2 IoCs

pid	Process
1604	MsiExec.exe
1604	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2036	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	msiexec.exe
2032	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeSecurityPrivilege	2032	msiexec.exe
Token: SeCreateTokenPrivilege	2036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2036	msiexec.exe
Token: SeLockMemoryPrivilege	2036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2036	msiexec.exe
Token: SeMachineAccountPrivilege	2036	msiexec.exe
Token: SeTcbPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeLoadDriverPrivilege	2036	msiexec.exe
Token: SeSystemProfilePrivilege	2036	msiexec.exe
Token: SeSystemtimePrivilege	2036	msiexec.exe
Token: SeProfSingleProcessPrivilege	2036	msiexec.exe
Token: SeIncBasePriorityPrivilege	2036	msiexec.exe
Token: SeCreatePagefilePrivilege	2036	msiexec.exe
Token: SeCreatePermanentPrivilege	2036	msiexec.exe
Token: SeBackupPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeShutdownPrivilege	2036	msiexec.exe
Token: SeDebugPrivilege	2036	msiexec.exe
Token: SeAuditPrivilege	2036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2036	msiexec.exe
Token: SeChangeNotifyPrivilege	2036	msiexec.exe
Token: SeRemoteShutdownPrivilege	2036	msiexec.exe
Token: SeUndockPrivilege	2036	msiexec.exe
Token: SeSyncAgentPrivilege	2036	msiexec.exe
Token: SeEnableDelegationPrivilege	2036	msiexec.exe
Token: SeManageVolumePrivilege	2036	msiexec.exe
Token: SeImpersonatePrivilege	2036	msiexec.exe
Token: SeCreateGlobalPrivilege	2036	msiexec.exe
Token: SeBackupPrivilege	3040	vssvc.exe
Token: SeRestorePrivilege	3040	vssvc.exe
Token: SeAuditPrivilege	3040	vssvc.exe
Token: SeBackupPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2208	DrvInst.exe
Token: SeLoadDriverPrivilege	2208	DrvInst.exe
Token: SeLoadDriverPrivilege	2208	DrvInst.exe
Token: SeLoadDriverPrivilege	2208	DrvInst.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe
Token: SeTakeOwnershipPrivilege	2032	msiexec.exe
Token: SeRestorePrivilege	2032	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2036	msiexec.exe
2036	msiexec.exe
2036	msiexec.exe
2036	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 2032 wrote to memory of 1604	2032	msiexec.exe	36
PID 1604 wrote to memory of 1368	1604	MsiExec.exe	37
PID 1604 wrote to memory of 1368	1604	MsiExec.exe	37
PID 1604 wrote to memory of 1368	1604	MsiExec.exe	37
PID 1604 wrote to memory of 1368	1604	MsiExec.exe	37

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\IPTViewr_Movistar+_1-5_beta-1-sp1a_es-es.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C561754C0C20EA4BB47222485C48553 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\FirstTimeConfig.exe
    "C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\FirstTimeConfig.exe"
    3⤵
    - Executes dropped EXE
    PID:1368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005AC" "000000000000059C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7fb119.rbs

Filesize
35KB

MD5
84aa5fe97bb0005253e8388939907594

SHA1
5820fa4d87c7a5187cadfb2e9a07da578aeef28b

SHA256
dfdb310585887f93313404aa1e32f3a8706b82e7ce96ae072ea30e3930215fbf

SHA512
a47b259c9b1302664772a0933d01d305d29043e2adbd88f03700617af9cd9d860382b34aade948c68ed7407c372c4dcfe7100c8fe1988557c514aeb7177fc211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

Filesize
959B

MD5
d5e98140c51869fc462c8975620faa78

SHA1
07e032e020b72c3f192f0628a2593a19a70f069e

SHA256
5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

SHA512
9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

Filesize
192B

MD5
dbb26af05ff17d13cb6b2a169725bf4f

SHA1
bdf1433bd5606475fe8ad19c6fcff4bed8360f98

SHA256
fa20a2bf312fe518c9ea49b0d6de0ac805309c7e8041deb61ae9e1c51ee07fec

SHA512
4530b3960d025ac3a3ee01249c50bebfc5a4db8e368c810a8f263938edbacccf59c4c7726210d7730932a0344f46196ebfcfe427cd03e7b22aa26bdac86c2a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5d352cc8d548f8780ceacef7fd459e9

SHA1
7fb8368c6ccef3fa517840a6c8b4e75c6efa46d2

SHA256
bb759a9d5489d0a8034339b9c239e48fe201e3cb34bcace6b58d81cff5fdad77

SHA512
ed2b37682d1ac5a31537fd9c35bf2365bf383c8ede00721813057f681d8b3eb566b107d3fa2c0721c0b07916cf545d8129ac38071f2c8088a8e842e48924a1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4770af6284f55bcceeb2babd274a227

SHA1
824cc8f7befee7dabf199047072d09aca80ad150

SHA256
6d916d2ed9396446e92c4eba6a7b6bfc6c6ff2eef0077ad5e6edb8b1917aab73

SHA512
6584412f3a5706ffece59c349e971062e2591c3f7339a4a26ba78ce8868b5b88205f67d7c572870f9c01c49014c58214c7120baa7d8d3712923f5cb0099ea2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC69B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID926.tmp

Filesize
202KB

MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC779.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\FirstTimeConfig.exe

Filesize
495KB

MD5
0dab9c79fb28dcd12b10f0507e309e94

SHA1
6553a3cb065c3b2bcb505af883239da2584ff91a

SHA256
dd94bf091c7dc0bd78dcc6cce0c5def4d495e463f6606607d2698d1871c5e8b2

SHA512
c18d49039db26f2fdcf4f431efd9ea3bbe6a07d47dc3ceac62b51fb2aedf23eaa450e3525605ac8a917793663471a4d2356e334bd69bc65ebf6c668b2caeffe5

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\IpTViewr.Native.dll

Filesize
27KB

MD5
06bf8a4e93bdb4bfd53fe6d7c7d46c5a

SHA1
6bb632a1be713f990449d2d1b8f815ede97b07e6

SHA256
a9e5686130679fde198c0352d5da92cc58c85374c7629ed27010b1ce4701e69b

SHA512
6ba99af1b0b59fec1e74ba8e9c25f7c4c0b542cd621a09a9880a4d10e45b10c79b39371f6f18167738f4585afe3698e23dda892afd83033f58bf95fa820663ce

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\IpTviewr.Common.dll

Filesize
36KB

MD5
934097b95dadb2f2bdc43d7828b0940f

SHA1
9806364e6d0c895a192456366b38babfa41910b7

SHA256
a6b927b50bfaabbb7b83c7f6a87804e26a86c31bb70229bc9e1947ce0732b443

SHA512
cb83fce48004bfc88e58fd0c22eb73398bbe337ebb2cc5f314251ba7efd31cef9a52c58bf22560812b3305079891ae5d95a4b13a12a36a92e8f58bba29df6b08

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\IpTviewr.Telemetry.dll

Filesize
19KB

MD5
c519061adbb260bd0dbbac01b3cd054d

SHA1
c7c492cfd7dabbe7fb527dcb481b873675b02f0c

SHA256
4973081531b5ec2fd060fd6c8ee14c4ff95d50f7928892be01ca1612fc99ec8c

SHA512
ded350d58a160650495261c42db18fd951cc5601a607152099ef64f1ab1ba5e21d86801a78fd19112c847b7b114bca20c48f40c1f14152df4c698722c0f2bf7f

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\Microsoft.AppCenter.Analytics.dll

Filesize
22KB

MD5
825eaf4df1e08196d5015b70466b026c

SHA1
cf974b0615bebfc2472bbb3af4669ad294c26828

SHA256
5c99b5c0991b98dc1cec11f4b2a83595f6d0de224105b72e23e90318dfe22217

SHA512
76fcd73f373896b034e321aecd7d630326040f89f1c50ab03a7481dc9a2e3f11a9d40c866e799f6bc2e1b283ba2da8d0dc8f48e75e8faefb903f0e58377d385f

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\Microsoft.AppCenter.Crashes.dll

Filesize
50KB

MD5
017cd1faa21e8e1b99c835d3fae49626

SHA1
a8fa47538cac3a24b3bb62051c73fb3cbfc9e5f0

SHA256
48029564881e5091e1562a43befb1e42e1279ef267c9f9dce020beed7b7a3b8f

SHA512
ac2368adebb2daf994610db1b914b43aaa50f0eae5b38598dfadf31e47aa45b1b3b7605a7c53821881061a5fe1e978ed74e674a3a4a62ae30bb03b76f0d3474b

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\Microsoft.AppCenter.dll

Filesize
133KB

MD5
2bd1307c211ae53acd2e39085a0e5dac

SHA1
5e37dbbd42400880d9b102516c7bbbe5eef47fcb

SHA256
83355b80d15813703c3d0e563328f46355c388426eb1afb3312748497da8a677

SHA512
be9da4538ad3292e97f0129cce6f59759038de9fa9145ceebcd6df2c57e82fdc152ea01d796270bf6b4e8493a32b3619750d0946625b3a2044e704238901d682

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\Newtonsoft.Json.dll

Filesize
683KB

MD5
6815034209687816d8cf401877ec8133

SHA1
1248142eb45eed3beb0d9a2d3b8bed5fe2569b10

SHA256
7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814

SHA512
3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\SQLite-net.dll

Filesize
87KB

MD5
7a46ddf0945aa9ada3bc767bafb51cfe

SHA1
545fba74961a567581d3e72fe62c3211e2c29c01

SHA256
e679bd9e238c081d9f8264581e0159d8110b4c0c3b80e79c769384a31169e731

SHA512
ad0ffce79d50c7c0d8b1cc4e71ddfebcb0aa4be619e2325f76d58254bd8023a5ba74b6e8bbdcc41f8e13324a053edf189f34c9368345ba33d2d60fcdca93d771

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\SQLitePCLRaw.core.dll

Filesize
37KB

MD5
368a54998f44548028dce205b4bd8fb2

SHA1
d3f53fdc858440b1e9e60ee644c8a17ffa5329a0

SHA256
0c1cf0a93aa8bb63be0f117f7c8dd2bc18820a42af8c96ba34b76de28c469072

SHA512
57b63aaa5797380039b31e69136d71c6ba3f49feca19217ca380d2909f7b863e7a2146fe4d5b5a13465a4e20beab118bfd4e5f1b52426885272bebd1473a8767

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\UiServices.Common.dll

Filesize
983KB

MD5
e332b587fb34859d14ad3d14effbc20d

SHA1
8f9a5850105764de70601e24ddebf6cd3b4d7f69

SHA256
2fb7837c5f7e7cfa743a95aa94de0fdd6b30efaa081c7d5eccf488d60dca24af

SHA512
6b95290dbfaa2549a2f5d0b0bf6946bd1f7787b6ed3e637a61973c05db0703638d5a7ae870707e280b8c8fc235f0fd196a288f5ff2ead8101c3e38724f6a4f85

Download Submit
C:\Users\Admin\Documents\IPTViewr\movistar+ (v1.5.1105.0 'Kruger 60')\bin\UiServices.Configuration.dll

Filesize
564KB

MD5
b2559bd40a1c61e201d69653415ca1e8

SHA1
a16505b06dd1f5f765db6e2e42212b8d4943d993

SHA256
387a4565a3ff0b2bf96a03826219aa535d4477e0c74c78ea8f82512fc39d6e14

SHA512
18246e600ebfe45b1fa6c140779b976c8d26e6a647169906a2c2ed54aaa6dc6689d125ab7ac87f23fc20d6e978102df9fe3dba5eeb911ca8e648aefcb89825d8

Download Submit
C:\Windows\Installer\f7fb117.msi

Filesize
28.9MB

MD5
7172472c9a8e578dc6b8310601cbc646

SHA1
712976528526ad2c3c9bf82b7939abe652ad7962

SHA256
c61ecd976b087abf7eba06ba7d8fc9767f3b2bffe79a3952ac8f9c8b1bb0be64

SHA512
4a40bd0268399bc3e1a7232550de69b310d967e81941e279c453fc3d47cb4691aaa522805a6ef08a12c9747ec4e283aeee2b09245717a8c5a47df9fb1fd0a04d

Download Submit
memory/1368-480-0x000000001B0E0000-0x000000001B0EA000-memory.dmp

Filesize
40KB

Download
memory/1368-486-0x000000001B7D0000-0x000000001B7EC000-memory.dmp

Filesize
112KB

Download
memory/1368-373-0x000000001B200000-0x000000001B2B0000-memory.dmp

Filesize
704KB

Download
memory/1368-478-0x000000001B2B0000-0x000000001B2D6000-memory.dmp

Filesize
152KB

Download
memory/1368-361-0x0000000001300000-0x0000000001380000-memory.dmp

Filesize
512KB

Download
memory/1368-371-0x000000001B090000-0x000000001B09C000-memory.dmp

Filesize
48KB

Download
memory/1368-365-0x000000001AF70000-0x000000001B06C000-memory.dmp

Filesize
1008KB

Download
memory/1368-482-0x000000001B0F0000-0x000000001B100000-memory.dmp

Filesize
64KB

Download
memory/1368-369-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1368-363-0x0000000000150000-0x0000000000160000-memory.dmp

Filesize
64KB

Download
memory/1368-487-0x000000001B7F0000-0x000000001B7FA000-memory.dmp

Filesize
40KB

Download
memory/1368-488-0x000000001B2E0000-0x000000001B2E8000-memory.dmp

Filesize
32KB

Download
memory/1368-489-0x000000001B820000-0x000000001B828000-memory.dmp

Filesize
32KB

Download
memory/1368-490-0x000000001B800000-0x000000001B808000-memory.dmp

Filesize
32KB

Download
memory/1368-367-0x0000000000B60000-0x0000000000BF4000-memory.dmp

Filesize
592KB

Download
memory/1368-492-0x000000001B830000-0x000000001B840000-memory.dmp

Filesize
64KB

Download
memory/1368-493-0x000000001B830000-0x000000001B838000-memory.dmp

Filesize
32KB

Download