Overview

overview

8

Static

static

3

1e5eabcabb...77.exe

windows10-2004-x64

8

1e5eabcabb...77.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/05/2026, 10:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1e5eabcabbfa6295ce8be8bfccd6cdb92f5fd2251478460cfdfb921183301b77.exe
  • Size 13.5MB
  • Sample260506-mdncjaft31
  • SHA256 1e5eabcabbfa6295ce8be8bfccd6cdb92f5fd2251478460cfdfb921183301b77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistence

Malware Config

Signatures

  • Drops file in Drivers directory 18 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 21 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 19 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e5eabcabbfa6295ce8be8bfccd6cdb92f5fd2251478460cfdfb921183301b77.exe
    "C:\Users\Admin\AppData\Local\Temp\1e5eabcabbfa6295ce8be8bfccd6cdb92f5fd2251478460cfdfb921183301b77.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPAutoServiceC3.exe
      "C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPAutoServiceC3.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      PID:2488
    • C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPMain.exe
      "C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPMain.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
        "C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\Users\Admin\AppData\Local\Temp\is-I8RRH.tmp\ExtendedDesktop.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-I8RRH.tmp\ExtendedDesktop.tmp" /SL5="$302D8,338260,121344,C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\VirtualExtendedDisplay\install.bat""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4920
            • C:\Windows\system32\cacls.exe
              "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
              6⤵
                PID:1464
              • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r remove "hid\vid_2E90&pid_0052"
                6⤵
                • Executes dropped EXE
                PID:5984
              • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r install "C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf" "hid\vid_2E90&pid_0052"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:5124
        • C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
          "C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4304
          • C:\Users\Admin\AppData\Local\Temp\is-O9QRK.tmp\ExtendedDesktop.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-O9QRK.tmp\ExtendedDesktop.tmp" /SL5="$402D8,338260,121344,C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5548
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\VirtualExtendedDisplay\install.bat""
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1796
              • C:\Windows\system32\cacls.exe
                "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                6⤵
                  PID:5744
                • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                  "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r remove "hid\vid_2E90&pid_0052"
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3208
                • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                  "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r install "C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf" "hid\vid_2E90&pid_0052"
                  6⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6048
          • C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
            "C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5980
            • C:\Users\Admin\AppData\Local\Temp\is-D37KG.tmp\ExtendedDesktop.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-D37KG.tmp\ExtendedDesktop.tmp" /SL5="$6023C,338260,121344,C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4496
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\VirtualExtendedDisplay\install.bat""
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3044
                • C:\Windows\system32\cacls.exe
                  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                  6⤵
                    PID:1176
                  • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                    "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r remove "hid\vid_2E90&pid_0052"
                    6⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5864
                  • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                    "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r install "C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf" "hid\vid_2E90&pid_0052"
                    6⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4936
            • C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
              "C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1800
              • C:\Users\Admin\AppData\Local\Temp\is-F0G65.tmp\ExtendedDesktop.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-F0G65.tmp\ExtendedDesktop.tmp" /SL5="$7023C,338260,121344,C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1136
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\VirtualExtendedDisplay\install.bat""
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1124
                  • C:\Windows\system32\cacls.exe
                    "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                    6⤵
                      PID:3168
                    • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                      "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r remove "hid\vid_2E90&pid_0052"
                      6⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5740
                    • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                      "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r install "C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf" "hid\vid_2E90&pid_0052"
                      6⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4836
              • C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
                "C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2420
                • C:\Users\Admin\AppData\Local\Temp\is-VGVUR.tmp\ExtendedDesktop.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-VGVUR.tmp\ExtendedDesktop.tmp" /SL5="$8023C,338260,121344,C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:948
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\VirtualExtendedDisplay\install.bat""
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4640
                    • C:\Windows\system32\cacls.exe
                      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                      6⤵
                        PID:1328
                      • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                        "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r remove "hid\vid_2E90&pid_0052"
                        6⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5288
                      • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                        "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r install "C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf" "hid\vid_2E90&pid_0052"
                        6⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2200
                • C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
                  "C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5448
                  • C:\Users\Admin\AppData\Local\Temp\is-MI9I4.tmp\ExtendedDesktop.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-MI9I4.tmp\ExtendedDesktop.tmp" /SL5="$9023C,338260,121344,C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:3820
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\VirtualExtendedDisplay\install.bat""
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5760
                      • C:\Windows\system32\cacls.exe
                        "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                        6⤵
                          PID:3684
                        • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                          "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r remove "hid\vid_2E90&pid_0052"
                          6⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Checks SCSI registry key(s)
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5764
                        • C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                          "C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe" -r install "C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf" "hid\vid_2E90&pid_0052"
                          6⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Checks SCSI registry key(s)
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3584
              • C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPAutoServiceC3.exe
                C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPAutoServiceC3.exe
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4628
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                1⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5144
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f1cd0c0f-acff-5c48-9ece-e82433828259}\virtualextendeddisplay.inf" "9" "40d44b15b" "0000000000000158" "WinSta0\Default" "00000000000000BC" "208" "c:\program files\virtualextendeddisplay\x64"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:908
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:11.49.9.809:hid\vid_2e90&pid_0052," "40d44b15b" "0000000000000158" "1a63"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5096
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:11.49.9.809:hid\vid_2e90&pid_0052," "40d44b15b" "0000000000000168" "1a63"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1520
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:11.49.9.809:hid\vid_2e90&pid_0052," "40d44b15b" "0000000000000180" "1a63"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:32
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:11.49.9.809:hid\vid_2e90&pid_0052," "40d44b15b" "0000000000000188" "1a63"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3620
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:11.49.9.809:hid\vid_2e90&pid_0052," "40d44b15b" "0000000000000188" "1a63"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3328
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:MyDevice_Install:11.49.9.809:hid\vid_2e90&pid_0052," "40d44b15b" "0000000000000188" "1a63"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:888

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    install.bat
                    • Path C:\Program Files\VirtualExtendedDisplay\install.bat
                    • Size 780B
                    • SHA256 77bf91fc6146b299b247267a088fdf9d59d864b8b28f87d0ca2869b904736002
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    unins000.dat
                    • Path C:\Program Files\VirtualExtendedDisplay\unins000.dat
                    • Size 6KB
                    • SHA256 a0c7a1e8fe50cd692db1c3d522ab5d151b81ec3262aabf09f800bf9ce765c542
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unins000.dat
                    • Path C:\Program Files\VirtualExtendedDisplay\unins000.dat
                    • Size 10KB
                    • SHA256 eb208906aee5350881b0cbc5f3655d98e2d4077334618017ba9f62c74f2de4b8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unins000.dat
                    • Path C:\Program Files\VirtualExtendedDisplay\unins000.dat
                    • Size 15KB
                    • SHA256 f1b31ba44338599de4440674cc27a8009ccb8c5710b0be0e6f7cf9e8be4fe260
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unins000.exe
                    • Path C:\Program Files\VirtualExtendedDisplay\unins000.exe
                    • Size 1.2MB
                    • SHA256 c0faecfaf008a2f18662b477e3fd8e9d9278ad8c0ad2cc62069449a038c0f6fb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    uninstall.bat
                    • Path C:\Program Files\VirtualExtendedDisplay\uninstall.bat
                    • Size 588B
                    • SHA256 e47f538a4fe4c19ddb50b11eb4c303f2f134d9aa41fb8d43e34c8480cc0082f2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    VirtualExtendedDisplay.inf
                    • Path C:\Program Files\VirtualExtendedDisplay\x64\VirtualExtendedDisplay.inf
                    • Size 4KB
                    • SHA256 9f82fe14f90a98c2587104171a3249f0379efc18458e37b6379c4269b8eb4910
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    devcon.exe
                    • Path C:\Program Files\VirtualExtendedDisplay\x64\devcon.exe
                    • Size 89KB
                    • SHA256 810081b7f455e2005c660c5870a5f9f9a05ae9216a0cc46e8fce99e2206fabf2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VirtualExtendedDisplay.dll
                    • Path C:\Program Files\VirtualExtendedDisplay\x86\VirtualExtendedDisplay.dll
                    • Size 115KB
                    • SHA256 03ce8b62f0a27186e0124713daa1f084629ac922fd56d429133d86b7079062e4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VirtualExtendedDisplay.inf
                    • Path C:\Program Files\VirtualExtendedDisplay\x86\VirtualExtendedDisplay.inf
                    • Size 4KB
                    • SHA256 abce3a82fb851b73e28d588f8c09a19e4d0d250e1b6a70cc21654efa6d6ed430
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    devcon.exe
                    • Path C:\Program Files\VirtualExtendedDisplay\x86\devcon.exe
                    • Size 83KB
                    • SHA256 74dd7b37af728a5a853a34630b7b4a9e9be9afc25942dc8f9d81ea4b6ac7f50a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    virtualextendeddisplay.cat
                    • Path C:\Program Files\VirtualExtendedDisplay\x86\virtualextendeddisplay.cat
                    • Size 8KB
                    • SHA256 a1cbfd5ba142dd9fa27e5be2e0e7aa800956e27b9754773cc37318b8ff164bd5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    BLU-WMF-APPAutoServiceC3.exe
                    • Path C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPAutoServiceC3.exe
                    • Size 1.5MB
                    • SHA256 857caa1f846208580d8474b35c34fdf515d1240fb85d74965810ddee69deea20
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    BLU-WMF-APPMain.exe
                    • Path C:\Users\Admin\AppData\Local\BLU-WMF-APP\BLU-WMF-APPMain.exe
                    • Size 11.8MB
                    • SHA256 8f369e50f27faa881ecddc1f9fbc5c99d946928408479faca4fb5006d678f942
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ExtendedDesktop.exe
                    • Path C:\Users\Admin\AppData\Local\BLU-WMF-APP\ExtendedDesktop.exe
                    • Size 768KB
                    • SHA256 a7ad0bef8a995ede80e218c98287c0da21211e3c41eef776b6ffa446dd89da34
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _setup64.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-6LTSI.tmp\_isetup\_setup64.tmp
                    • Size 6KB
                    • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ExtendedDesktop.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-I8RRH.tmp\ExtendedDesktop.tmp
                    • Size 1.1MB
                    • SHA256 263b5b39b4c8adc1b020932bcbad5251db9528689e5edb468fab457f6e169aec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WMWSetupTool.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\is-VHGA8.tmp\WMWSetupTool.dll
                    • Size 84KB
                    • SHA256 392529d0ba29a894fc976e2551adef6f77c4d45ba2e5f537163a26ebf972da3f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VirtualExtendedDisplay.dll
                    • Path \??\c:\PROGRA~1\VIRTUA~1\x64\VirtualExtendedDisplay.dll
                    • Size 132KB
                    • SHA256 e326dd653336ba4aa0fdb9327bc35c8937c0ee8158c4c03abad04625fa6a4eea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VirtualExtendedDisplay.cat
                    • Path \??\c:\program files\virtualextendeddisplay\x64\VirtualExtendedDisplay.cat
                    • Size 8KB
                    • SHA256 6f3da6f24b2b10322c91be6d85f6360c2700ac03844f2930e01f082268f224a0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/908-144-0x0000018294220000-0x000001829422C000-memory.dmp
                    Download

                    memory/948-411-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/948-415-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/1136-358-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/1136-362-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/1628-154-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/1628-155-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/1800-314-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/1800-363-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/1800-357-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/2420-373-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/2420-416-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/2420-410-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/2488-359-0x0000000000CC0000-0x0000000000D3C000-memory.dmp
                    Download

                    memory/2488-26-0x0000000000CC0000-0x0000000000D3C000-memory.dmp
                    Download

                    memory/2576-0-0x0000000000D80000-0x0000000001AF9000-memory.dmp
                    Download

                    memory/3900-27-0x0000000001F00000-0x0000000001F7C000-memory.dmp
                    Download

                    memory/3900-28-0x0000000006C60000-0x0000000006C67000-memory.dmp
                    Download

                    memory/4304-228-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/4304-225-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/4304-170-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/4496-295-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/4496-296-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/4628-25-0x0000000001290000-0x000000000130C000-memory.dmp
                    Download

                    memory/5008-39-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/5008-153-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/5008-156-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/5124-152-0x000001EB7C010000-0x000001EB7C01C000-memory.dmp
                    Download

                    memory/5448-432-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/5548-226-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/5548-227-0x0000000000400000-0x000000000052E000-memory.dmp
                    Download

                    memory/5980-297-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/5980-294-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download

                    memory/5980-242-0x0000000000400000-0x0000000000428000-memory.dmp
                    Download