9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
62s
max time network
77s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p28/LV2019runtime.msi
Size

1.2MB
MD5

cc04f6330a5534986e79ad783cc72f7d
SHA1

7b3ad92c97d92537b5765e3d8a6f72f18f45b7b2
SHA256

d9522be66e867cd05849993885a51da913cca2543883d909e4156c4929bbcbad
SHA512

39800d0e6eef1c7c6a21c288eb6839d0c0da3a4f02771952f9245670b0e9e4341d8a01b0aa6bb82e2a80dc7d22393af5f7edd9157323337e054ca22e3ce67763
SSDEEP

24576:LFdtuImo/3rpp+TQNxshTK+63S3ZgTqGgeSZUf/:LFdtroC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Xerces License\Copyright Information\XercesLicense.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\props\varprop.xsd	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\llb.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\NI-Reports-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\English\lvapp.rsc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\cxts\WES.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 012 Single.ctl	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\Measure-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\types\rtglobal.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\Folder.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\props\network.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\PropFolder.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\Control Design and Simulation-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 006 Int16.ctl	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\codecs\NIqjpcodecs_2019.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\mapped\ioalias.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\slided.3ds	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\slider_f.3ds	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\ni_webdavLVClient.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\MyComputer.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\props\logging.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\DOMUserDefRef.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\ProjectConflict.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\VarPropDlg.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\varprop.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 021 Array of UInt32.ctl.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\missing.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\attank.ptc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\SyncOpenFolderStar.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\LabVIEW-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\Measure-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\niSmtpClient.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\cxts\TouchPaneleXP.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\LVWS\strings.ja.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\tb_h.ptc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 020 Array of Int32.ctl	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\logosbrw.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\Warning.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 022 Array of Int64.ctl.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\Measure-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\Qt\plugins\plugin.xsd	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\therm_e.ptc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\cxts\cxt.xsd	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI LabVIEW Runtime 2019 {B20204CA-DD51-4527-95BC-C7D4D15EF68C}.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\LVWS\NILVWSPostInstallerScript.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\LabVIEW-errors.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\mapped\netpub.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\props\industrial.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 017 Array of UInt8.ctl.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\osgText.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\osgTerrain.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\NIQtGui_2019.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\lvalarms.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\dialog\variable\types\SCT 007 UInt16.ctl	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\osgUtil.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\variable\props\updatedeadband.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\MissingProvider.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\sampleoverlay.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\nilvicv_runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\nixalan110.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Framework\Providers\Icons\OpenSyncFolder.PNG	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\NIQtXml_2019.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\meter_g.ptc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\models\toggle_b.ptc	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e582b60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DB3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3017.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5842E8D51B532DDA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E41.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF66D5DB501F8AEE46.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAEC6776A64DA76DD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e582b60.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B20204CA-DD51-4527-95BC-C7D4D15EF68C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B36.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC6BE79EB2D2C9919.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BCE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3037.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30F3.tmp	msiexec.exe
File created	C:\Windows\Installer\e582b62.msi	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
784	MsiExec.exe
784	MsiExec.exe
784	MsiExec.exe
784	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0695336ca0b9a370000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b06953360000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b0695336000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db0695336000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b069533600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\ = "LabVIEWControl Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\ProgID\ = "LVActiveXControl.LabVIEWControl.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LVActiveXControl.LabVIEWControl.1\ = "LabVIEWControl Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\TypeLib\ = "{66D91ADC-F92F-4029-984B-FC3CEDD98620}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\Version\ = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\ = "LV2019ActiveXControl 19.0 Type Library"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AC40202B15DD725459CB7C4D1DE56FC8\FireFox.LV.RTE2019 = "LVRTE.LV.RTE2019"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\Implemented Categories\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FBE9C077-C6E5-44D5-9F79-EDA6180F9B29}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LVActiveXControl.LabVIEWControl.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\Internet Explorer\\Plugins\\LV2019ActiveXControl.dll, 101"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBE9C077-C6E5-44D5-9F79-EDA6180F9B29}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LVActiveXControl.LabVIEWControl\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LVActiveXControl.LabVIEWControl\CLSID\ = "{A40B0AD4-B50E-4E58-8A1D-8544233807BB}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LVActiveXControl.LabVIEWControl.1\CLSID\ = "{A40B0AD4-B50E-4E58-8A1D-8544233807BB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBE9C077-C6E5-44D5-9F79-EDA6180F9B29}\TypeLib\Version = "19.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\HELPDIR\ = "C:\\Program Files (x86)\\Internet Explorer\\Plugins\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AC40202B15DD725459CB7C4D1DE56FC8\Netscape7Plugin2.LV.RTE2019 = "LVRTE.LV.RTE2019"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LVActiveXControl.LabVIEWControl	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\MiscStatus\1\ = "131473"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AC40202B15DD725459CB7C4D1DE56FC8\MozillaPlugin.LV.RTE2019 = "LVRTE.LV.RTE2019"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E5926D78BF8ECB41BDC5B3B69AFD1F3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\SourceList\PackageName = "LV2019runtime.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBE9C077-C6E5-44D5-9F79-EDA6180F9B29}\ = "ILabVIEWControl"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBE9C077-C6E5-44D5-9F79-EDA6180F9B29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBE9C077-C6E5-44D5-9F79-EDA6180F9B29}\TypeLib\ = "{66D91ADC-F92F-4029-984B-FC3CEDD98620}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AC40202B15DD725459CB7C4D1DE56FC8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E5926D78BF8ECB41BDC5B3B69AFD1F3\AC40202B15DD725459CB7C4D1DE56FC8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LVActiveXControl.LabVIEWControl\CurVer\ = "LVActiveXControl.LabVIEWControl.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AC40202B15DD725459CB7C4D1DE56FC8\Netscape7Plugin1.LV.RTE2019 = "LVRTE.LV.RTE2019"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\PackageCode = "440DB837030EBC543BA825503A8B5EF9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p28\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\ToolboxBitmap32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Explorer\\Plugins\\LV2019ActiveXControl.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807BB}\MiscStatus\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66D91ADC-F92F-4029-984B-FC3CEDD98620}\19.0\0\win32\ = "C:\\Program Files (x86)\\Internet Explorer\\Plugins\\LV2019ActiveXControl.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\ProductName = "NI LabVIEW Runtime 2019"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p28\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AC40202B15DD725459CB7C4D1DE56FC8\SourceList\Media	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2660	msiexec.exe
Token: SeSecurityPrivilege	1600	msiexec.exe
Token: SeCreateTokenPrivilege	2660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2660	msiexec.exe
Token: SeLockMemoryPrivilege	2660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2660	msiexec.exe
Token: SeMachineAccountPrivilege	2660	msiexec.exe
Token: SeTcbPrivilege	2660	msiexec.exe
Token: SeSecurityPrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe
Token: SeLoadDriverPrivilege	2660	msiexec.exe
Token: SeSystemProfilePrivilege	2660	msiexec.exe
Token: SeSystemtimePrivilege	2660	msiexec.exe
Token: SeProfSingleProcessPrivilege	2660	msiexec.exe
Token: SeIncBasePriorityPrivilege	2660	msiexec.exe
Token: SeCreatePagefilePrivilege	2660	msiexec.exe
Token: SeCreatePermanentPrivilege	2660	msiexec.exe
Token: SeBackupPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeShutdownPrivilege	2660	msiexec.exe
Token: SeDebugPrivilege	2660	msiexec.exe
Token: SeAuditPrivilege	2660	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2660	msiexec.exe
Token: SeChangeNotifyPrivilege	2660	msiexec.exe
Token: SeRemoteShutdownPrivilege	2660	msiexec.exe
Token: SeUndockPrivilege	2660	msiexec.exe
Token: SeSyncAgentPrivilege	2660	msiexec.exe
Token: SeEnableDelegationPrivilege	2660	msiexec.exe
Token: SeManageVolumePrivilege	2660	msiexec.exe
Token: SeImpersonatePrivilege	2660	msiexec.exe
Token: SeCreateGlobalPrivilege	2660	msiexec.exe
Token: SeCreateTokenPrivilege	2660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2660	msiexec.exe
Token: SeLockMemoryPrivilege	2660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2660	msiexec.exe
Token: SeMachineAccountPrivilege	2660	msiexec.exe
Token: SeTcbPrivilege	2660	msiexec.exe
Token: SeSecurityPrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe
Token: SeLoadDriverPrivilege	2660	msiexec.exe
Token: SeSystemProfilePrivilege	2660	msiexec.exe
Token: SeSystemtimePrivilege	2660	msiexec.exe
Token: SeProfSingleProcessPrivilege	2660	msiexec.exe
Token: SeIncBasePriorityPrivilege	2660	msiexec.exe
Token: SeCreatePagefilePrivilege	2660	msiexec.exe
Token: SeCreatePermanentPrivilege	2660	msiexec.exe
Token: SeBackupPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeShutdownPrivilege	2660	msiexec.exe
Token: SeDebugPrivilege	2660	msiexec.exe
Token: SeAuditPrivilege	2660	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2660	msiexec.exe
Token: SeChangeNotifyPrivilege	2660	msiexec.exe
Token: SeRemoteShutdownPrivilege	2660	msiexec.exe
Token: SeUndockPrivilege	2660	msiexec.exe
Token: SeSyncAgentPrivilege	2660	msiexec.exe
Token: SeEnableDelegationPrivilege	2660	msiexec.exe
Token: SeManageVolumePrivilege	2660	msiexec.exe
Token: SeImpersonatePrivilege	2660	msiexec.exe
Token: SeCreateGlobalPrivilege	2660	msiexec.exe
Token: SeCreateTokenPrivilege	2660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2660	msiexec.exe
Token: SeLockMemoryPrivilege	2660	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2660	msiexec.exe
2660	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5720	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 784	1600	msiexec.exe	81
PID 1600 wrote to memory of 784	1600	msiexec.exe	81
PID 1600 wrote to memory of 784	1600	msiexec.exe	81
PID 1600 wrote to memory of 2000	1600	msiexec.exe	85
PID 1600 wrote to memory of 2000	1600	msiexec.exe	85
PID 1600 wrote to memory of 4908	1600	msiexec.exe	87
PID 1600 wrote to memory of 4908	1600	msiexec.exe	87
PID 1600 wrote to memory of 4908	1600	msiexec.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p28\LV2019runtime.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7725B7AE92499AD7949A25CB7996EB7D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:784
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6917DC5E5B68DCBF7C7236014998B830
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:796

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582b61.rbs

Filesize
102KB

MD5
43422bdb8cb08b0ebfb2f0feccc8e8d6

SHA1
c363d1e06253adfccf8b413e2da66991ff896432

SHA256
4a87d04889e111efd22e389303b88d27ac0e81ee23b9daa51aacd4ccd261a0fa

SHA512
c7f3544705e230783fce3d66d3d51f5c33f7d6e14a46a35ac493d625a1705a394b15120e3ed5f1bef13c56fd2920d3e31002bcd39a1f775c36755a7cb113250e

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\Analysis-errors.txt

Filesize
30KB

MD5
c7010a23e25ceb6eee62e7a3a295e3cd

SHA1
e4e2a21755530fa8adbfcb2c9339db0f9dabfdda

SHA256
6d011e1f2fed9f740254dc16f8ca203611f3ce1b71d66d544547da73595fa1c1

SHA512
01f56d49e6450aa8178d77ee66112cafcbff6e1af356bc2beee132f01ecabbf73416a29e9f769e54d26df59c0ef4bc9de168bf32860cf3b15f3a8d52a13ddfa7

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\Control Design and Simulation-errors.txt

Filesize
30KB

MD5
8be811589aba558933a2be85de54488d

SHA1
9559b6cba9eb048b1abb1aa36454817263980a10

SHA256
06fa2c16e64e6706f166346b3743936aaf4a51d35a563b4d4aaa71d64388ca58

SHA512
4fa40daef7defba40327aa20fb7721e797228573d4d118b1c2d84f52a145968dde077f9e29c8e7f8f0c08a165a962a9c9eea52c5063ff60b0df269d9e83945e9

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\LabVIEW WSN-errors.txt

Filesize
5KB

MD5
1deb755956410ca1012c5f3d87561023

SHA1
3ba066332b970dc0e29ba1d282b92517f254e208

SHA256
00edb3a9d3db74bdcec363b61db5b31f42cfd8ea3123b0e80a7a803454b219c2

SHA512
6158e545228319dbed1b3669bcdc5f3a749bb1bf253dc51637d5ce750d58e03349dfc0b95d8f6c1b3c302495380ebe0b696866f5baadaf6de0afde88718df85a

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\LabVIEW-errors.txt

Filesize
243KB

MD5
ce0ea0e6be0343196791439f03bad624

SHA1
946afe47f078087a3f86a96c3c027599e87b0e97

SHA256
2b0f4a22f1facfaf6e36327d842c33cfb75507d8356257b05bfea81fc88de545

SHA512
005c077dfe68f19f81f6ef61c91eefc51499eada24d094500418a4d405421a572bb12792e80430fab99ddd7e6ba575eaf1aeeeceb7261b966d3b3dc220facc99

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\Measure-errors.txt

Filesize
646B

MD5
5f3676eeb16055dae41bbeb76760cf72

SHA1
8b57660e768e21ddefa0998e0838de07ac794b15

SHA256
bdaf9fe819fa02277fcfedc9fdf0ffb32ecc727def81e4378939434d7d837069

SHA512
51ff95497f140f027e7f44cca72e6faeb62848b28df9040c87a9c5a4763ed9678c943aa7f1557dd2608489fb6ec2f5bc3668cbd92bc6cddb2a83f50d7cf7f645

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\NI-Reports-errors.txt

Filesize
2KB

MD5
0f07a5242e65ef4b458571080a5e3686

SHA1
4e09591e9ade246a611056109e6dc606a5d218cc

SHA256
f6812a1d25b0573187b0b05f9ecbc28bdb67dbd7b98af589c77daa96f82968e8

SHA512
106b5a47aadf53e7a1126ca583146c462f95347d55de82ca5691281ae82dcb3224cd67898c3a89450abf1bd511f0b56d3223e6fabf931f2c54f365206e804cee

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\ChineseS\OS and Network Services-errors.txt

Filesize
10KB

MD5
401cfead9f724db2539e609217a79dfe

SHA1
d544489432cc41f022b84780684237e39bb509e8

SHA256
8407acc64f6177bf914a7316e32b8a76b3853a0253d4ccbe6c79aaf7eaa88e4f

SHA512
67a384bee2c1631997e4f143b25c02f18215b704481682e4e22ad8febe23c1429186e6f0fee055aa961e09860c704439591a70af8024c01af4cd534fb6bc2a13

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\Analysis-errors.txt

Filesize
40KB

MD5
4fc09447c78cf0b9901ca07a6734a00f

SHA1
a2dfd9ea44b56f998b67e09e90d84e6d4d59d208

SHA256
2c56ed93618008742faf861652456e624d4a3618f2a093967102d39ae31345a9

SHA512
d685b66f8d4d193f8ba3e8ddf2ab7d5adff099ebba183ba5e4b1d267c0b83617da7061081abf50f184032ae3bf50855c300cb8cfa5d56968fbc79cf851aee0d2

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\Control Design and Simulation-errors.txt

Filesize
44KB

MD5
f8d5d09191505e64eb5cdf0bd7c1f04b

SHA1
5aff7a692d3d9316fd0e1e38390b9385c883102c

SHA256
7f2740959e515fce63ec5b0715356bf1715af90fac5bb17d716875536c6bf2f0

SHA512
01e9067179c96508d30174860f764b53a649cf805f35f66b354cdadb1948ece25818e78d5c429d95c336dd7ff4f9ce8bbb39da6b19d62ae68dda3f98b593f3f1

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\LabVIEW WSN-errors.txt

Filesize
6KB

MD5
9cafaed5903635cf95027936df93a076

SHA1
c9d8403e7d3fdbfe7cc6086805ba986c71715bae

SHA256
352e02664c54d04f12fce17b3df97d60b89a8130417eb56659d4f19874eb761e

SHA512
dfe80138fbaf70d8b3b1939163f815fe6580055c52810720c36144d5f9e8364949786119a1dca579de66f1cb1bba0be02d98672f098228e4e7f549b092500a8f

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\LabVIEW-errors.txt

Filesize
322KB

MD5
81ab26fdc9e35a02c9b52e09c1f58cc8

SHA1
96dc929cacd6b7471b6dc36f7290558acaf3e3a5

SHA256
2972f7a3743dab641757a4cd873b2260f80ed1db0f5dfa904f1a90c28f4e2da6

SHA512
05de0c417892254300e28e43752011ced6865efe9ca5861803da696f8a24c24e51255dd74b90f120914294345b656aa775c239d77228d323104ed0bd3ba431d4

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\Measure-errors.txt

Filesize
847B

MD5
69711aaa83327ebaf009eb8f1deeccf4

SHA1
1f9b87cac1843c379c7ed20958ee0c1e31f1c358

SHA256
f6b1cc995702616a5fb69228f61626b9c3b40eeb907385129729e04b97ea7d73

SHA512
ee2cc997dde90672d53e657a63aab599948325653da19b3dfe85884242a71ff38cabdde67e8617a00172cfb2830ca04abd483f4d33450d379485ce30604f0fc7

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\NI-Reports-errors.txt

Filesize
2KB

MD5
89b87e9deab36a2657765eda6e5407e5

SHA1
3deca3f14caad6f5e19942fb490f4bdd2049ebd7

SHA256
616d26c9503d5347731d9a99237f24bb1f5c51964fe426ad202ffdbd048e6a25

SHA512
be9a75aec4eff57fa576da5dffa6da6daeb26408e82c797c824de290e2e521ed0ff0e4134522b381667182517726ac3b59060bb457bc474ea46e1fdef7842613

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\English\OS and Network Services-errors.txt

Filesize
11KB

MD5
afed0322f9369b72407d4b5c9ce6e7b3

SHA1
4aecbadf47d871922be4eeb8a3c6083f46377bdc

SHA256
d0fe59b531030ad1a8874e6844b00cc36debbdc8f89a1dc8452ba82ebb5f742f

SHA512
b178860230d4313438eab999431a7ad127656897c814e0c30d8501879ea13d9eaeac29c62927b2958791aa25a339703e5639483f2d5dfe35d33591eda596b406

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\Analysis-errors.txt

Filesize
43KB

MD5
af106d7cadffa4dcd3a34d87aa6b26d8

SHA1
3ee3c575521e804946aafea167813723d914b659

SHA256
73bec3c2028f62d427a3ca745dda259367bb886a1084e7f5a1c1e852693a97d8

SHA512
e4244625fa33ff3add95b6f684e4578d0cdc58c40b28067e76d50ccc01c198ec248b3df3601afae92aa675515151353ff7aac8831c49cb7e53fe89f1d9bfd18d

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\Control Design and Simulation-errors.txt

Filesize
52KB

MD5
af1053595aa041e73331c3a1ed4578fe

SHA1
bdd20564a8d4f290e11e734db3f771ecbf306971

SHA256
8bdf3377aca573fb699242807a2d396ba4fea4d5aa09cea600f30e2cf899e5b8

SHA512
e19928351392a532409a991c778681d26657fe47631adb48b8f823dcaaeed6fd62bbea7c5d5af5087f973305d69816ca2768afe4d16839a4166695f6bbfa3b4a

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\LabVIEW WSN-errors.txt

Filesize
7KB

MD5
af9b94fecd0aa4a20d8c360633710e13

SHA1
2bc9240fb349387767b7bc2a6e97293bf8f87b76

SHA256
44029d27758504137bec911840350a5d7d782d243aa941b403563e51b3fdc4cc

SHA512
e5d34b2b10491291843fb90e29011ea10f4fe46b831ec279e3d83b8c19e02a871fcea1b84b1c890fbd2939c1c1c1ef9fd9ae291abf74d006c0e9cd05f3246a88

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\LabVIEW-errors.txt

Filesize
359KB

MD5
1e2676743e5a7e180369d1bbe4a56597

SHA1
816db2bd8def7ee1e81d1f0e048fa308cb6d0f26

SHA256
1e8f9a833108a76d09af2e1232fa5ed726d92bef194da23db7ed1e764b87987e

SHA512
52a791baaada1fe26458ba0437374210c21b8895761ee6da083129d21f60dc71f1adc3f5729a11c3c9b98cd834ceb75a494fe8adea815a7ca7707a12ecf04f51

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\Measure-errors.txt

Filesize
904B

MD5
77d3b370ebd5e6fb37a154de859fcc87

SHA1
f70b34ad8438ed0bf8777e5992b53494bafc165a

SHA256
7a80a81bfccf34b53604941432b78dbaafd924cfe11f1b461d0aa63239425c5f

SHA512
d68a1b1abfe2b2a0d2ce1f22f6924d9f3ac05461bec6cb7d2e03e8f47b7fec583f327502cdc50a3a8dd316b8200207f09c3fff07701c99b19f425cc4585e5e51

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\NI-Reports-errors.txt

Filesize
3KB

MD5
e2cbd470de01c1f82d630ead1f2617bf

SHA1
3c3cf8fd05c5486dfb5bff08ff9483efbc61a3f0

SHA256
fe79954f8065ae1c578c187cade5869e148e1635a0a6cc1e9f5564878518a13f

SHA512
a0436c2eaa6f69f6ae542b76e22f3ca5279c47c7a36643c442cc0b4e924be684f3ce4de42fcca22c9e42ec314de0097e2d5d174a8dfa9d2e3a56b19deb1b8716

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\French\OS and Network Services-errors.txt

Filesize
14KB

MD5
577d844d9a8be1daefd4decf3a3b5115

SHA1
f62a0a8a08ad37574f8cfdb2a83f305b6195a490

SHA256
0b0d0b79418adccfde7bff76a8d4da5e1d20c793fa20230cf890019ba4af235e

SHA512
d89cc14b902a3ef3901933a68f3147671ee324f41dc10ba2dd18ebbce6dcbd100ddbe5658035fc00a13fac70b831f5a052229ee0d2a8457da774742306cf8e95

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\Analysis-errors.txt

Filesize
43KB

MD5
4e4d7337f5b885dca21430709c20f1ed

SHA1
a8806cd1c9403af6cc2cc9b32c6f52eccca747d2

SHA256
1b987128a236fae7cb0a362caee18631a160465f6a08d15f22ee4fc4f3b6f676

SHA512
a48e9d407702bd801e1d71558c3207d7b2ff15a6e904e27aa5de51e49f8fec0886f664ef2740b26cd54e0352a456c1c183b23eeb568da9c4a340f204d1f4ce6e

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\Control Design and Simulation-errors.txt

Filesize
46KB

MD5
f60887d8a306e5083fe30cd629802803

SHA1
b21a21504902015c5ea99648816500385e6f759a

SHA256
9572798d51e9c1a6db5a57b730514fe28696adfd2626f4cec88f97b73d4b580e

SHA512
a742e7c50ac4832ca45335d951abc0387c6242b27b9e0b096b6eb0f3bc678ecd150589f5235da9aa3ee64f48dd65c131ea07ce7d40ce02baca97ad5872a26684

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\LabVIEW WSN-errors.txt

Filesize
7KB

MD5
82fd05775c85b55eff19dc6d6955d816

SHA1
901315a57d37cee5af180bc481785c6c149ee390

SHA256
e94f5fe7751f8050444ad207a5cbe23ca325ab8349a95834a42117a03b73e6e5

SHA512
986fe162e368d155f6e51fa63bcc6e53f9e28f6ff7a4f60805b969d85cdfa8090b3c7d39ea2375e913a216542838d8e920fe1d7f56185899b4e24a2aefdb830a

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\LabVIEW-errors.txt

Filesize
359KB

MD5
d6b7c9bcd9523d34f19e34e21091944c

SHA1
be8a80dac25d0a30c615b3602d1b59ce77ce0cca

SHA256
6fc7a9dc3f2802bf56ce53237f6f90b1e56e3eee51f206f47715c9dbcdd1bd87

SHA512
c43491bc7aaf611ffd6406fb86235d1064f14ddc80ac71e0026a504885ab65e5f3bf2b8816b6c7eced92886a9cee9e1053701982b24c5533cd74d27abfd87813

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\Measure-errors.txt

Filesize
889B

MD5
e8d41742daed7edae1fbeec27ba3edda

SHA1
d3d42a3b13b6abe426a1106579334ae6c4ef8901

SHA256
7a69d328db69663f5dfbc7222d664ccc6772632fbc23b2ee38381441b260999c

SHA512
0edededf6f38b436df6f948db396c96ab12820b4ec2e6f8d14bcbb5ec37754f9368aa749e0eba570068ba8cef9406582cc91dfc128b451de27b8737c4d423322

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\NI-Reports-errors.txt

Filesize
3KB

MD5
bb446b2cba5b7e96a426d36dcd50d5e0

SHA1
10fae37d15cf1b365bd81ca45c021e51c43f734e

SHA256
c0e79ccb75e9601f4845bce0c57c31144afe9043c58449ecf5138a3c5db3f6a0

SHA512
d9f8f23717c1b958578f260b43e87890980fc1615187980b6eb7fd77d7259b75e41d1625ea7fcfecfd27ae1d1dc1ef4dac61833f4e51919cd7978ec9e53ec7aa

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\German\OS and Network Services-errors.txt

Filesize
12KB

MD5
1176982c9365130273c529e1f095468b

SHA1
68a4069f5e5c09275872253f316649cdad9c5ff7

SHA256
4da1848d4f5630e313ab99c0c34560ccd936319ac0d9eb44a6d4906ac04fb5b4

SHA512
dc4f594a294cfe88359eccb730b7a7b54dcaa07621b3cd048bb4ecc9c9379920d08070063775ad498dd7bd80eb4793f9267737742dbacc5e0f48ae3a3e79dc4f

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\Analysis-errors.txt

Filesize
38KB

MD5
ecfd387801327b1a7f608cfa5ec3aa64

SHA1
91cbe6846f6e516cbcd88c29c92082095330d8e1

SHA256
2a2d9f92b1860feaee97f02f99725004f20597cc8928465ca018c6a8c2d5e6c0

SHA512
5b2ed32cdbeba33f2e1aced1f9d50447d91ba2e778bf6381f868b0504185689de13d28d091d7efdd1ab93c74d4d726a13c0dffb2d33b92bf86cc06db2b8d21f1

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\Control Design and Simulation-errors.txt

Filesize
41KB

MD5
a65a58c57d82b5b7491740d6ccec9d5a

SHA1
5cc7dc4275f0e040ff66c6126f9518021afccc81

SHA256
d196c23604efa7c096053a606cacec2a992f63612f3a945f41d0c4a5f746ed5c

SHA512
59ae592bb133dae76512c73d52ef89a303d1c6d7e437e73c5f6a2b748391bc1fc56e1e0e2d400b2f891a0fcae10784c6c2f984f27a04a195958eca336a35995f

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\LabVIEW WSN-errors.txt

Filesize
6KB

MD5
711e36771d44884399a7c06be885ec13

SHA1
03491547af658a1a687a346416f69126c87dbec5

SHA256
a4f803ed9565511d4ca29e5fc5696eb78ce2bc389fb2f4f407932c71a398756c

SHA512
8ff06fc8ba6719b1b8cc6c3c6737be4e5cf4b20ad8b74c0eab8b13203fd18ddd03e1c4dc9cc48059098e78c53a24c2b9166585918c227bff561c7d6584ec20b9

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\LabVIEW-errors.txt

Filesize
324KB

MD5
1e19aeae846e08d045ff6e68d58bf220

SHA1
d8bbbf3be38b8be2961b86572dd8a46348f91907

SHA256
e7ac23aa8fd9db940ee5958366d1db06a63d874bf314aef9a994f1e8fe26d90a

SHA512
d3f2ee3910622986b4ce713e31a76bf1b67e2368b9e1e77286b4ac0904a9fe5bc67497d2df86600effba8bec9b79eb469c06229cc0f65b67bc585340f33883b6

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\Measure-errors.txt

Filesize
835B

MD5
38b7214316ec5f4ec7e2ad5f4fcefd75

SHA1
b5150ab2d582eb953b7f58aa17f1510dfc6f36fc

SHA256
211021356145431b52b5ae23cd4b83b5893f1da8b176590eb55bae8af61dc111

SHA512
ce940836619614f1fe422809229730b1a6eb357fd19df845efc20a250e0c2e7ca218c173b2e786343001327db7735aba4b72e9825cd92c54cbed1bc06b75e9cb

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\NI-Reports-errors.txt

Filesize
2KB

MD5
d54c557ff6f5f9152b0d799cf3d6836a

SHA1
bb07a50a46766b3c0529eb790efe5b949b9b738a

SHA256
2210c3d3488e5c9b12b85a660ab00857473afed11d300afa587092766612fef8

SHA512
d7145c059de4e3b16e8ba87cccd1f67b1bdedd6ea28ee1405d62ad1d471502691058e0fd67ad1ca4954fbce8a6598dc98264e2ba6753da00c98cab07fb99acc0

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Japanese\OS and Network Services-errors.txt

Filesize
12KB

MD5
88c64f6897034fc5bd452217fc2b6be6

SHA1
ff266cebe41c8ce894e878a6ecf1177f651647d7

SHA256
ed5b9189a4ba67b8f427b89c1e05d77aade37fafe2b8910fc9dda6956f9cbd28

SHA512
4e3f7ab182354a52746dc118e89e4b3516bbf9dffbc85930472fe0e19aba51bc0ca76c9aa528c683823fb00b45e4d17e2a66b11d42510d434d547ee396f08ff1

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\Analysis-errors.txt

Filesize
36KB

MD5
15ac2977b30a2472bb4b6c716eadf307

SHA1
17a1ed53e7d87266589f457475db509e3261dba1

SHA256
38c33e72ba55e5bc896076a50e539dca6fb4903b35bf33460984657919884844

SHA512
b35493a618736937d770ff560401b4194e7a0b76a84e8b8c4d4adfbaff85132075d928f5751a3d57cdb76504b7a2cbb209bbb786632e9e6289e370766fe56139

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\Control Design and Simulation-errors.txt

Filesize
41KB

MD5
7b5da73b5e5c377c1afe96d87cfa1611

SHA1
c69636e750b7084ddd54c841576b53f7cd74ed15

SHA256
2e27b0164b511622f8bdfd1a49bc57699733a0cb116f0e1ea2c2115f27e34811

SHA512
7c318c575ce428c02dd1c5c2eb3d456edee7059a50e4f288bc03cac6de4ccdd241e6474efa6b0c41ff0b0837fc4f93e5bda5660fc4b9f44a28655ca3df15a5f0

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\LabVIEW WSN-errors.txt

Filesize
6KB

MD5
d1dada69f7e46226912fd1e5926d482e

SHA1
8145a87a6c08be02dee6e6346583f48eabd63785

SHA256
8a9e3e5ee80aa37326a5ed98b26efd1d173202edb497addb9809a0ee9dd93aa1

SHA512
ede1a37edf904ce9291c3c802cad595b84d05671327de2f8a6a538923d6f0dbedf1c73226ec46fe32ce07a2e926b1015edd4828845228a9eb2270c075aa1b982

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\LabVIEW-errors.txt

Filesize
310KB

MD5
2d146b90bb688b98d626d244d3a3054d

SHA1
d708a17054d0a8be441524cdad52e8d6ef2c38e3

SHA256
41460324ed35c5c494e5df6b18b781b7a38b3aa0d4c8078b8885058537b14a07

SHA512
3928cedf2cfa50b2f85a642b39b62e14f32e063bea97e1ab1b5496df5039cc50d068a8030191c8f16c9bb8d7e03b6086a0527c6e7d60a82c76ced15edf82b1d7

Download Submit
C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\errors\Korean\Measure-errors.txt

Filesize
792B

MD5
068d9b6a504466800987966b364ec375

SHA1
d8df76083bf5c0cedd6d200866867e4e1d9595a5

SHA256
9e7cd6c2c65892cd120e8812aa960b756cf6ba03a57cc853b15b86ab501b3346

SHA512
356f8704daf3395acc808a738bec1afd1390a746a2c6d107a49decf327d8d8271ac85a12c5d703c783556417e470c302d96e43a4a446f0a5dc8f4a9f806ef3bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9431.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
a54df918b51e1255f68be84219859234

SHA1
69432e836e18dcdc0181c1fb82411322985b91f2

SHA256
12c85851620c3a7db47d71b34ac3f1b92cdf0fe51ab4c6b47fdc779bc08e87cf

SHA512
50d7f6ab6a4231205d0c0233a08f40564ffe47ca66dcec4c7438eb248654ebb9ae00d5c3c684fb5e13d778b3e83f4fa95bfee73a9b9a81a75530df43ce56e74e

Download Submit
\??\Volume{365369b0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0e96f1b9-c63b-4ab0-9658-cbd40038c411}_OnDiskSnapshotProp

Filesize
6KB

MD5
e55d9db0e307a1bd2b60f617994626f3

SHA1
2aa76625075c1c20ad6a48d8b9d54b5d49da11f7

SHA256
0971b97d129e9c759ab0209fd674054069c7eb221fdcc76c880232ce6a0d4652

SHA512
61e79bcfd150ca697154465e2821eb58ba2062140a7113e618e2210a77f217df04fb6b4a26ca142a970675ee1a5a693693e1f6120d24059e0c2a30e2bc17c61d

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads