338c439af0954b42d3cfd92811f06b5a639e3086b75d78d62c902d17595374a6

Resubmissions

04/08/2026, 16:42

260804-t7ze8avflh

04/08/2026, 16:39

260804-t6ednaam6z8

Analysis

max time kernel
164s
max time network
163s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winiso.exe
Size 6.7MB
Sample260804-t6ednaam6z
SHA256 338c439af0954b42d3cfd92811f06b5a639e3086b75d78d62c902d17595374a6
MD5 a8589b413edc8032d9676714521a8dda
SHA1 c8dbfd4a73fa5a827a35e1c52542bb05588c6b8e
SHA512 93bf7293478fe07ebdae3047274886e6ac4f97ebbeaa15afaeee0559982ed0b555bdeb5bbcc03d2626224ca1f7618bd6370c966a727b2cb8d9cdb0014dff7503
SSDEEP 196608:/TGonqYQnelFLLbCGRt6Hqf0LC9sV7DuYHemav0zd+Z7CatBB0rs:/C2JRFLLxySf2+Syvi+4uf
TLSH
T1B866330453F65B53F4DA21B12ABBA0341537FA1771F4EB9662941336B83E32E4E2F246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\WinisoCDBus.sys	wmnt.exe

Executes dropped EXE 5 IoCs

pid	Process
4696	wmnt.exe
2944	winiso.exe
4348	WinisoCDBus.sys
1276	winiso.exe
3544	updater.exe

Loads dropped DLL 64 IoCs

pid	Process
5524	winiso.exe
5524	winiso.exe
5524	winiso.exe
5524	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
2944	winiso.exe
5524	winiso.exe
5524	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
1276	winiso.exe
3544	updater.exe
3544	updater.exe
3544	updater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\QtCore4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\msvcr100.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\setup\setup.exe	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\pl.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\cue.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\imageformats\qsvg4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\imageformats\qico4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\aff.dat	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\en.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\es.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\codecs\qkrcodecs4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\imageformats\qjpeg4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\ko.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\pt_BR.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\ru.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\codecs\qtwcodecs4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\core\core.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\imageformats\qgif4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\it.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\QtGui4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\drive.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\meta.dat	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\ja.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\updater.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\codecs\qjpcodecs4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\filesystem\hfsplus.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\filesystem\udf.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\tr.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\updater.exe	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\wmnt.exe	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\style.bin	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\ar.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\es_MX.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\QtNetwork4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\icores.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\uninst.exe	winiso.exe
File opened for modification	C:\Program Files (x86)\WinISO Computing\WinISO\website.url	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\codecs\qcncodecs4.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\filesystem\cdfs.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\mds.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\nrg.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\WinisoCDBus64.sys	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\fr.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\id.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\zh_CN.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\winiso.exe	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\iso.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\WinisoCDBus32.sys	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\libeay32.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\de.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\hu.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\ccd.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\bg.qm	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\baseio.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\msvcp100.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\mnt.dll	winiso.exe
File created	C:\Program Files (x86)\WinISO Computing\WinISO\Resources\langs\zh_TW.qm	winiso.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winiso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmnt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winiso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winiso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell\open\command\ = "\"C:\\Program Files (x86)\\WinISO Computing\\WinISO\\bin\\winiso.exe\" \"%1\""	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell\edit	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\DefaultIcon	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso	winiso.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\DefaultIcon\ = "\"C:\\Program Files (x86)\\WinISO Computing\\WinISO\\bin\\icores.dll\",-1"	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell\open	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell\edit\command	winiso.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell\edit\command\ = "\"C:\\Program Files (x86)\\WinISO Computing\\WinISO\\bin\\winiso.exe\" \"%1\""	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell\open\command	winiso.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinISO.iso\shell	winiso.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2944	winiso.exe
1276	winiso.exe
3544	updater.exe
3544	updater.exe
3544	updater.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 4696	5524	winiso.exe	90
PID 5524 wrote to memory of 2944	5524	winiso.exe	91
PID 1276 wrote to memory of 3544	1276	winiso.exe	96

C:\Users\Admin\AppData\Local\Temp\winiso.exe
"C:\Users\Admin\AppData\Local\Temp\winiso.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\wmnt.exe
  "C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\wmnt.exe" /install
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4696
- C:\Program Files (x86)\WinISO Computing\WinISO\bin\winiso.exe
  "C:\Program Files (x86)\WinISO Computing\WinISO\bin\winiso.exe" -install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2944

C:\Windows\system32\drivers\WinisoCDBus.sys
system32\drivers\WinisoCDBus.sys
1⤵
- Executes dropped EXE
PID:4348

C:\Program Files (x86)\WinISO Computing\WinISO\bin\winiso.exe
"C:\Program Files (x86)\WinISO Computing\WinISO\bin\winiso.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\WinISO Computing\WinISO\update_2318\bin\updater.exe
  "C:\Users\Admin\AppData\Local\WinISO Computing\WinISO\update_2318\bin\updater.exe" winavi_upd_20834
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aff.dat

Path C:\Program Files (x86)\WinISO Computing\WinISO\Resources\aff.dat
Size 312B
SHA256 b4ae553a177904eaec83abc7856c20f0b3c7f272395de4817a3c97bb769fb5aa
MD5 03a0dd68100b5343aace52308787308a
SHA1 865a2e03f65f88b140817b1f7942790d2a0ef751
SHA512 d1f5066538da075c1ba191aaa4cd2e6c1a9d2d2517a889d5e555a301ea91ba37f9d3cecb03b973c2cec3bbe14776a95f38b0fd86b162f1cfc1062ff9a9e800e2
TLSH
T1E0E07D160D88046D74AB26A38656CBC449F010A0A1B1A172CCB897A5975D050F17194B
MD5 SHA1 SHA512 TLSH

Submit Download

meta.dat

Path C:\Program Files (x86)\WinISO Computing\WinISO\Resources\meta.dat
Size 514B
SHA256 3715896ba56dc28de3c60cf74d3b6399cff342021c70f7bbc49e91f46fcf9046
MD5 cf433797e84424f6983a71a3642aee61
SHA1 649b50c9a984d6145752a25c20933d4c2716eb96
SHA512 a7f93e856b404aa7947c481d8b4f709e4bb5eaf2a71019c1bd157d27e6d9298f19113c2774105b552c3b68255608a1911f39419b7ed2137c2a018a819d23cfaf
TLSH
T1C4F0055514D1DD5E5C8512C55EC63E74A1B7AFF211842B265D00B1370F11A15B35D456
MD5 SHA1 SHA512 TLSH

Submit Download

LIBEAY32.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\LIBEAY32.dll
Size 1.1MB
SHA256 ec796c58fa7c46d51eb0e81039cff02ea62c381cbc0477ae283e0da6c3ca0046
MD5 19db2790aece5b15d5d26899674d29f5
SHA1 6b00e74ca106a72b509dc5e73afab5460712a790
SHA512 97206cea3ab357743242ef06d462033b48774cbb6e04708d15c4efa60035c2587d5a2fed1995909be524d2f523e6fcbe73aff942a52da7854c9e32f77c4b0e67
SSDEEP 24576:Xyihz+KpPPlxZx5UGzSa2jFdGb5O1usT9AxBeqqp1DawPV0glqoJ:XfrvD2jFob5kuI9AXeJp1zVTlqoJ
TLSH
T14C45AD07E79598B1E89D967D26B7577F4A379A11032ACAC38FA039818C311D1A73F3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\MSVCP100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore4.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\QtCore4.dll
Size 2.5MB
SHA256 74ae26018084791df388f702063519cdaec65b22675cf57c96281eb95b63d119
MD5 38076ac0f13aef3aebee2b63125e4470
SHA1 928e64ed4f551d9f406d7ea4a32fef70ca080d86
SHA512 7b1681899c44f53911de267c0af830e4bfc5081b92bb51f55e57e179d6e622ccfe1878367e433852f211e61179fd192ce4cdcb3ce27698843bc05ee642ce26ee
SSDEEP 49152:fllS8W/BL4M+tejzGiJsv6tWKFdu9CITuLyvL/6mShMZtmjNUVrciV5P+7QVg07K:f3SFFqaznJsv6tWKFdu9CJ90
TLSH
T1E6C55C81E7EF81F2EAE39375496B921E413BAA5687104BEBD14C2A030C756D17D3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui4.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\QtGui4.dll
Size 8.2MB
SHA256 76b3292006d9e9f0adb21eda44de5a10d76833162a138cdade2a2fad8e4d60f3
MD5 ed555c555ddfc9567ae5ab6cc7cbc604
SHA1 ba38ad7539315b51c3809326fae2f4045b818a0e
SHA512 0f2709521dd61b3a5861493e47a52559c0a30c2385117476874587b3b4857e52d08c255d5c4d4e879a93082720f18a4b6b31d7c848598954dcf8bf171e742109
SSDEEP 98304:7xglZf8xGwqU2sgzQOWVdeACWMIM/giV8YGB7KudwFcD:7xKZfoLOxAC7pFc
TLSH
T1F2868D52F78FC1F1CF8AA1741D6EAA1E852EB54547208BD7E7D82E170921EC27C39386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtNetwork4.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\QtNetwork4.dll
Size 1.0MB
SHA256 d8d16f347d54333e74a5dc7ee64af89010251605f1968de1d2ef7c5983892e76
MD5 cc21b79dd81dc8eba20b1180601d0b00
SHA1 ce998a7a99a3a093e9cffd0ad0a039c81ac6898c
SHA512 faf42be6c8938bea30b5557c63cfa12306e37b2a8d1d181fca82634f41982efbbd91cc374b4efd9c03329b1af0e6b947c2ed1d310f16bb16602476e70f33121e
SSDEEP 24576:L836NWTde03hkFLCKWRmROVttquWZvmVTf:LcA0RkFvWSmquivmVTf
TLSH
T1DD25281EFB5F8AF6DFC5A1F54C15D70E0B7AA9014B621ED3F2492B7A08652C17C3A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseio.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\baseio.dll
Size 48KB
SHA256 5d1242a1ef8e05946ea60f838e221ddc2a4d504bc33fa13d44704fc43a0f33ce
MD5 e37eea0f9c47f5bd9e7110521e21f709
SHA1 5901616e486e5bec9db629cb9b7bb65f4bc8f9af
SHA512 fcd9cc2cdf295126c7ec52bf293a6e2b06daa073400157b35308f31ccb82ac163d507d87fe04b28956199c3ba3973854975745081030c2cdb22f5ad7ccea9255
SSDEEP 1536:ncak+sPOVtXjIjbW/0vfBSkXtdaHOnuQ:ncak++OVtXobTv0kX3aHOnL
TLSH
T12A239DE0A71AC0F1C28A96765E26DB5F042BB3724FE141D3FB4BAF1B1CB51D2A930255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\core\core.dll
Size 119KB
SHA256 c2d495fd8b2f1a7f5bc25b9a592880b5ef728b43fea8f6bd8e23278f8f7a9733
MD5 38efebd09e2d3b389ba091744d451bf7
SHA1 d7d6876095a48a143d84d9ce7a6c314672c9fe1e
SHA512 1ed7f0146b25cd8b1830559b6b98b01cedd6896067d817712e2959b77dd2becc057481a51d5f98ef3688e11d8f39b73d8d6617a9f86f9e3aa7e3d33b88677e92
SSDEEP 3072:AIq4s9zIGb0V+SZCTK1vVQGQw0wQsync2PL2oQONR3AOfca:AI49zI40MOCTK1vGdrwQst2TR3AOfc
TLSH
T151C33A91B75AC0B6C5CF117E1A15D70EA23BA1B7CF220AD7F6186F7A0C341C2AD35686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdfs.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\filesystem\cdfs.dll
Size 84KB
SHA256 892ae7bdadd0f1172f0c61e8715faf05e6aa0b0b8d3c4414999a01ed891b0961
MD5 be49248ea1484c26aa4bd540e70c789a
SHA1 30e6a43f3bd69d33c16b6c1d9e4588391277af07
SHA512 2ffe36d447d228537283e165b64212497fdcf98a340513283e8775351e41f8580ac086c1ee13e782d1b7042e930b4086981b6590bf4547ff41c945cdf7accac9
SSDEEP 1536:7TP31OhJnZo72VOHnQkdOm74/4ty3pRfs/rS+wzt77iGnGXFnOfUf6Sx5:7z31OhkIkUm+4M5ROrS+I7+GnmFnOfUZ
TLSH
T1DB830B4277EAC07AD6CD62BE0F05C72AA12B6276CF9056F3F2586F9D18342C2BD36145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfsplus.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\filesystem\hfsplus.dll
Size 50KB
SHA256 23f599058e32ed2fa906155ca0d5b3866943bb25eb32d384ddf4d71901980740
MD5 1a2ef3e48c704a746c5f0db12ea5b67b
SHA1 b307a91f57f616d08dabf550f41b6c6e4b127565
SHA512 5ad3296328b9ffed94ea9c0c5282d11caf975055ec54071f2e23739e03eeded13dbee27da52f766a1236cae43f00825e65bed5ef31532e01d82388ebc189b80a
SSDEEP 768:lxXJcrmM5MR2g8XF9biZwNtV5jgQEYxkG+Orl8ZSxtT7UVeJOfKdkbm:lBJcT5MRZ8GkV5jLR5pltx9UkOf5b
TLSH
T184331950B75AC0F6CA8E02761D36F36F1439AD839B9456E3FB593F6F18302E1A831646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

udf.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\filesystem\udf.dll
Size 61KB
SHA256 33d5e877f0a354bdebf9e1bbdbb14be3a20dc0c864408ca8cd4e1e8ac6fe4b3d
MD5 31dc9f7c6c8c4db77c796e933bbaac53
SHA1 b651e69dcb9caa193c7be18d9929da685c2b0f3b
SHA512 1fba602c443c84861096d559422fb948c8d33811b735f4db329b9d76e0930ba813b8199576f539cc5aa013a55c44539d69e27c2005c3a834201a6add9648709b
SSDEEP 768:CY6AqAkjUDLwedeiYBS/EhFETdPAyAwDwy/P+ftwX1CNJ99MYSflOfKdeC9Av:KD3GeA/eF0oy/PSwXdrlOfvCq
TLSH
T171534B916B0AC0FFD78D50B1161AE72A292DA6534FE006D3F7661B6B9C315E2BC32347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccd.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\ccd.dll
Size 33KB
SHA256 edfeb462b279dc221aaa11f10f97c504470fa9e527ad563c2faf645ece81f4e4
MD5 1f769ec639cd4fd66aa354104712aa76
SHA1 52b3a157add9f928c0960c7cd6920a84a54a1180
SHA512 f138de5ff25d19e09074a58c3f24d69e201f6b3a248d79cfb44d8e8d55de67becdfd58fa9245ad024583471105eaba90cf350068119c1fe23996bfc8652a996b
SSDEEP 384:DAurAoxWESNorKEu1nRtLGxEgzW5wlVfjc62pjSIPR+egbxBfnW47OfKPV5JcsIB:VLURtIjvlVfQOIPUrNOfKdYVh/
TLSH
T1B1E20901B756C1F1C7CE617A1915E39F017AA1618BD142F3A79BABFA2C313E2EC79102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cue.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\cue.dll
Size 26KB
SHA256 469c8683066865c1715ce9e6675afece8e06abfc87edb5ac83fe89d22d3a9c77
MD5 8cf1a353feabbc527f6d04c9ff72f860
SHA1 91108777ee16c8bb0e3fcad1cbf026190ade2339
SHA512 a3e9f00180035cf2729d87b8efea2a4dde45bc199b09ec3287f2c078271618d8634c26a96a4d71f0022aebb27d957bd9946ce06dc2d283cd4702b20ac0560514
SSDEEP 384:vHMTc+V3lElejYNSeOB3e2M+xmmiS//CU+9ZSeg6oJjENV7OfKPV5aD4DZw+9:vF+KSeO9ZvxmrSCUJHCOfKda4y4
TLSH
T139C2D992765A80E2E78E62351915EF5B502DA2B25BE2C1F3EB5BEB3D0C621D3FC70105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drive.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\drive.dll
Size 24KB
SHA256 8971be20966f83f1a011fceae010bb2ff33713ed15fe1bf112dd981f0569d1ec
MD5 1243ed2bc7f617fdd0c0be2a5bd1216d
SHA1 3459be9ab3d2c14d0bce345b898bde598e7cae13
SHA512 5e5c6ac2443e3544ca5c8dcac79b22528cea90cfd5931441da64ad9e1c0093ff4d1f4096364a8183e41c6fbefbafa55adf99ee83aa21677283e781e242edabe8
SSDEEP 384:j3zKuHOrKUa4poTEEX9qspEEB7JvDnSVTY5bmQfX2sbTeP07Of2zPV5rlbnL:HHV4aTEcqkBJvLSVTtKvOfAdLbn
TLSH
T1ABB21A90B71BD0F3E50E52762916AB0B002E93B24BE245D3D7576B6B1D702F2FCB5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\iso.dll
Size 14KB
SHA256 cbf2b2d80fcda644914449d6f9dde64827d70988724f2631f6e51a12cd06b4cb
MD5 a4551723687de9b63d81ab6268857fa1
SHA1 a831131005bb9d2f85c0497ae05a14d93d402920
SHA512 20aa75ff0f9f684bc22200fae1237ecd02f274258875ccef4b13c894f270a6ccd2ad52acaf2224b918d2382b63b744075dcb2e289ee9a61669f53ba594eaf385
SSDEEP 384:4cp8oI/evpgZAfvpidRNapiHzegy7OfKPV58Lym:4cCceAXpiFapiT6OfKdUym
TLSH
T1A5521A117B25C0F2C79D16B60D17A36E053AA2710BE261E3BF576F2A2C602D1ED3360B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mds.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\mds.dll
Size 29KB
SHA256 99a36a6b4772b138f141e8cdedb124f63fda57376c44b1ba0c94034df3560ef9
MD5 2043229a2b394d299d510265c7975048
SHA1 d525de3ee5895feba7aad1a1ba4051e0d7a4db21
SHA512 a58f3c6d5de92a82ec91168fed08b485b7d0d19c368e77bea28b0b8b332afd64f15fa037c691f4cacf02e351362153c62d173483eee4536343f275a4e1d798dc
SSDEEP 768:yUftnol1EGTeOr3dRXxsWyanMlWrocOfKdgd:yUftn21EGFdRBszanGoOf1d
TLSH
T1B7D20829B237C0BEC39F21BABD05D39E5669B010C7F985E3EFB65A5E28511F5E834006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nrg.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\format\nrg.dll
Size 22KB
SHA256 b43916e92710d3006b98da2a5684c68fd528e1bb498ffa750941465266dc0834
MD5 69a7cdcb8446dca614d50bc0c25e6252
SHA1 17d422e6c2edd60624a81c923a26824f413faee4
SHA512 8d218300427b06665d581409e117fc367e335d38e186db6c42f090baf7af05ca2d21246107132a784772e56c8c10ccc600e4ce056201d8a2549cf379ea56d35f
SSDEEP 384:buj6JiGStH+3soaoOt/ftCBMnMvFIC+M3k5CHzjH6rraQOIOnKPV5H7tJ:pvsoaTKviC+MU5MUPOnKdltJ
TLSH
T1DCA2F811BF56C0F1E69E12771D16D3AF002AB4224BE295E3BFDB6B6E1C202D3693150A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinisoCDBus64.sys

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\WinisoCDBus64.sys
Size 199KB
SHA256 ff4725171c6d4bde6b258fd19949c7d624f1f8693a26ab1e2e04103fc46484cb
MD5 bc67c1e4b36063968e54c3b2e4db8978
SHA1 480044bd0dbe69a2c85b52cc612908128d2cdc00
SHA512 d45f2a7a7cf5b732a48b21ab176820952986c97f7b036d4d47684b453ac9848d2d3a25b8422b05af52997f4ccc3027fe1a110114bf9b7c4a64285d38b64f0035
SSDEEP 3072:h+YTMPoplyZ5QhghSEOqklZUTAKgXnMkP6MdmNnmGo9dDRamL:9BmhS3PPJxMo6wmYGYdD
TLSH
T12814F897E2AA50D4D5BBC17C8652A127FBB27864433097DB57A04B266F13BF4AE3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmnt.exe

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\mnt\wmnt.exe
Size 101KB
SHA256 549fa43526e6ad5327af7e2643beb30fc3c42427cdcade103ec29bb3aad33fee
MD5 662c67d895dcaa61fdf89244694aa0f8
SHA1 3a9a16141cb497c76cc17a3ea709bac50766a6e3
SHA512 ac254dae72e2e790cede25392a3b302d54352fe068d502214ef61975db8f7c9c7c65bb942ff4f6d5650a68f96fdf569c3f830a7efc900a8b6fb888ce9c87bcc1
SSDEEP 1536:dNEhJcOmHYtUhD/YpGYW5F1nv0KJilfkYPr0de4UBzx5HgJRJ:dNoEHYUCd8wHae4UBzxxYJ
TLSH
T1FEA35C227690C032F5E225354AB89BB25A3EB9325B7980CB7398077D1EB07D15B7B317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winiso.exe

Path C:\Program Files (x86)\WinISO Computing\WinISO\bin\winiso.exe
Size 1.1MB
SHA256 fb1446cbaa1d0d423f0834ae1f39b4287943907266a652b41d54b236015cbcdf
MD5 c9a69d6bc570d4ab1c5f4baf70c0cb36
SHA1 70acd8fe4352f0c03458ee7ca3a38d378e28019d
SHA512 6b509849d1feaa0727b37de5729751e031f00e638887bedd7c4c182d5c528af1009b271066b3e101005183ea4686b54122a350d4e076ec8a90ee6d922ccc82f9
SSDEEP 24576:IEW4PoG1XtxXWMfliL8rYG3SlmBfdSuiF:IEBxGMfEL8bi4fdSuiF
TLSH
T19A455B43B39BC2B5C26522F90315861AC527B1C5476D7BF3931CAF7D28B92C26FB901A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellExecAsUser.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmAD2F.tmp\ShellExecAsUser.dll
Size 8KB
SHA256 fd16be229c013ba83d757b88974f9c1f01834eb8158e32f68c8042bdd156077a
MD5 b097e2c1d916411e3a32031e4d4e9481
SHA1 15e3db5b2263c53f545451e19d11a005f4650eda
SHA512 ee33900f3911953b0b4ce9624a3a45bcd171316048f4b6c5f048ebe1249ccaf8fb77c62077c0a40405a658733d764b8bf83046f77c00593cedaae183dbe21549
SSDEEP 96:/fGTLKs+g/+wTqMFIpkNT1RY7eTR1cgGpJsPBSWB6KLuIn+ISIFXOU2:bIzxRY76YgmU0W4KLu8pOU2
TLSH
T17C02E763A1C65C76E2772A741FFB564E96BDB87003B0A01F5467840A0E319BEDD31393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmAD2F.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmAD2F.tmp\nsDialogs.dll
Size 9KB
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
TLSH
T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-182-0x0000000140000000-0x0000000140036000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads