36d19d6b9767c26e891c5e29c56ab61b7ee51af074e20d0ad76ed1a1700111bb

Analysis

user interaction
yes
max time kernel
114s
max time network
103s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.exe
Size 54KB
Sample260824-grnbsstbre
SHA256 36d19d6b9767c26e891c5e29c56ab61b7ee51af074e20d0ad76ed1a1700111bb
MD5 801741908c0f0278ee4d977ee8af58db
SHA1 5bdfbb3ea586703d10263eb2434332341d5fa5d7
SHA512 5f725bd9f2c5932f30ced8decde79dde1ba50933e372ef59a5a971fead2465bc25baafe955393530002ea629fa3048efdc7bb6a4c40545c43e3984124d779e80
SSDEEP 384:bngGN/nfNVcpJjhOOdwEc3rOan5SxB/Bi:sS/fUlOQwn3Z5Sn
TLSH
T14C4373656900C8D2F5C44CBCCC2521F4B53EBD62EE50D2DB203A7FAEBA76046DB23915
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
29	3064	loader.exe
17	772	launcher.exe
28	524	hotwdlc.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	hotwdlc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	loader.exe

Executes dropped EXE 3 IoCs

pid	Process
524	hotwdlc.exe
3064	loader.exe
2816	vcpkgrcv.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
28	raw.githubusercontent.com
29	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Microsoft\updatelogs.txt	loader.exe
File created	C:\Windows\System32\vcpkgrcv.exe	loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3064	loader.exe
3064	loader.exe
2816	vcpkgrcv.exe
2816	vcpkgrcv.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\steamapps\common\Mount & Blade II Bannerlord\Modules\Multiplayer\Submodule.xml	loader.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
524	hotwdlc.exe
524	hotwdlc.exe
524	hotwdlc.exe
524	hotwdlc.exe
524	hotwdlc.exe
524	hotwdlc.exe
3064	loader.exe
3064	loader.exe
524	hotwdlc.exe
524	hotwdlc.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
3064	loader.exe
524	hotwdlc.exe
524	hotwdlc.exe
3064	loader.exe
3064	loader.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3164	wmplayer.exe
Token: SeCreatePagefilePrivilege	3164	wmplayer.exe
Token: SeShutdownPrivilege	2408	unregmp2.exe
Token: SeCreatePagefilePrivilege	2408	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3164	wmplayer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 524	772	launcher.exe	86
PID 524 wrote to memory of 3064	524	hotwdlc.exe	92
PID 3064 wrote to memory of 2816	3064	loader.exe	97
PID 3164 wrote to memory of 1988	3164	wmplayer.exe	110
PID 1988 wrote to memory of 2408	1988	unregmp2.exe	111

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Public\hotwdlc.exe
  "C:\Users\Public\hotwdlc.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Users\Public\loader.exe
    "C:\Users\Public\loader.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\System32\vcpkgrcv.exe
      "C:\Windows\System32\vcpkgrcv.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2816

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 316B
SHA256 9066534b093088a317bb7df20fec902d509d2b711c016a7d7600e2716cb4a79f
MD5 89d8bd33620c0cc6a7066158cc9551a9
SHA1 f358fa3cd3fc34fdc112817e3ac8489ac78de970
SHA512 d34f5dec12f5487e260ec7e5f257341e8bac0bcab006bb98e6a0b7b8c244cb330c2254529dd6dd0a1ea6c48c485a1a481aeae71d1c6e5091b2c39843fa85728d
TLSH
T1B1E0722A6B0C46843AA3CF2407E89C733C6A518964921215681897E20A426EEC30F29A
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 172KB
SHA256 28f771a64e047b97718ecd42c15cbdccc1971bb075b76d81b869d86b978ea14c
MD5 74c69348fd99b1f13433eb2a5ec51153
SHA1 469b078b124dc7d526d0c6a4c028f9396884f0bf
SHA512 6926bb0e8308c937702cd726ea81d640a626b5d569c5a7cd9d8c4d4329033ec45aae63af1ec98f121ad8ddd559a11a043362bb2c035da9abfba6c4bce059c820
SSDEEP 3072:v6xnYMFwK35egXrXgYHYpW/AmyFQUHcbv7x1:v6KuwKB7QCYpW/C78bvV1
TLSH
T1DB041BA85C3BB6A3AD07CF524DAEF69612E591C52912732E3E347E505C13ABFDA13C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9A1FE8299CD2832973A0AA5F6FB0A7B0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A1FE8299CD2832973A0AA5F6FB0A7B0
Size 281B
SHA256 23e136c8df760799998ca6d5d72dd816706bc6cc2a277ab0e39a44794939b5cb
MD5 ec1d152758e41fbe0f971deaa984447d
SHA1 a3dae4727a1a07bb2fefa76fe128b800b7fd0ff9
SHA512 69b72c9294da22b420ea21cf26fb25d891b40b2c34e3e7e8b73b6a5e3d43c9baa8656a89f4b8cf3a408f9870771b3f196a9cff53d21def21e2e19936fb7539b2
TLSH
T1CED02B8683BE9CC62C16EF608AD8C6BC312635F367E3141A6D449A6B48009B9DD092CA
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 978B
SHA256 06e16fc816cd78ffb99afac3ddb8b50e6aec5ca8ccc83e66de02bdcaae6d3567
MD5 51184e69ed2cb5631bf01411ef13d33d
SHA1 84c61f6ada63505cd720ca6ee0ac30270c5acb41
SHA512 15b935ce752932e8289f8523ed04c757bc6d4b011d385b170321b1ac6361cf7d413e43e9b355393e7fb14e276476ebbf58638670d1513fb9065755b7e0752296
TLSH
T1E91121C29FE4A09085F786B0CBF8D5337C7870C62DEB30C12C81C59220967186B1903F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 fa1d9647b2e01ca8e7f2280ed1aa6e94f4cad36f2ee42f24b55ff44f79d961df
MD5 bd4a518fbb6f0ea2f794f0bded28ce04
SHA1 5800525ec88d138aa3384766561b34e8c51d4bfc
SHA512 36ef2a00554b270e7f8c6900854c526ac356dd876e68ad0d8650b41d2f89e2d460330c47e28d04fa8fa9cd3f70c287b2895042ca4a0ce0edfa300818254f718c
TLSH
T1CCC08C1C1AA20A26F2A8437C06C13D039B208111E3418F052BF12A08C996B162838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 5344403648fd81958a03be9832014925cc866cddcadf5b243b677f1bed9d6bed
MD5 8175b3fd681492f8a47b327b22cc60f8
SHA1 b7ebe63ffb0cff41002fa65a130a4edade378a5e
SHA512 fee8d88d8046485b7dbac6a9c3174fe5a824f297ff525958d4485298eee12794de8bc3bc94e7041863b45c169e777003e5f02aaac632e5a6e2bbe2696fde4cd1
TLSH
T126F0553C16F841BDE07ADA388FD9A7A25C15F13324044AAF2AD10B8EAB03F025C82479
MD5 SHA1 SHA512 TLSH

Submit Download

49A7F8B8A2FD8A9E65352CD7C88B1D10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49A7F8B8A2FD8A9E65352CD7C88B1D10
Size 248B
SHA256 08a58746dd538dc3333bab667162b0d7145d1a947298e5b4efd1e7d8208efa02
MD5 7b31b5c454541a8f46839f79aa6f5460
SHA1 c8c605d9cbd3e3a5fdb79026bc20702503d48c4c
SHA512 d30f2e64dcae028d0b4681bf44f0cfbfe07a57010ee973d4162a8e09e53f17b7c572ca80531094cfd8a38063fcdc014ec839900919b87fa2f80f626e0dad9d86
TLSH
T18CD022241B640236FA20037E04210F85CF20B523B0528F0C2F79202D4828D002D63D1D
MD5 SHA1 SHA512 TLSH

Submit Download

9A1FE8299CD2832973A0AA5F6FB0A7B0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A1FE8299CD2832973A0AA5F6FB0A7B0
Size 488B
SHA256 adc532314f1d28404070df55c172d7d1cd760744921f156853dc8cc95b017a14
MD5 dc65a7dcef8bda1022e0784404e0be5a
SHA1 48f5c2ec077c9a06f47ff77264b5cf9a8eaf4421
SHA512 aa5a19fd0165e860edde5c4694c901d3189cb453240e6a77f564c0ee99f64a13bb0cded4c54eba0c23b92067fda6371975efd1065a1eca7b240bbfaf7ff9adbe
TLSH
T157F0AB2410BD0008E0F7E53483C868F679BAF019BD09A2F61BE007896B05D002D8313A
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 be4f312092b431cf937f64f0194c3f8c41bf6c7157ebe68782cd7ee3a4cdf17f
MD5 e58783a20ed35d986e6e5ae7ee60cd9b
SHA1 6497119e2a8584c5f2c0325ebd2e37edf656a7a0
SHA512 1b45350fbcb646d87cf49451147dc63b2d6d67bc012211f84da8e152c1a4b5569ac732ad3b6e66ef60a45b651e3f8f1f32365ad8ca59b180082ac7573d388c43
TLSH
T170F0A32457D1401EF27276394EFE93ABED15B1523401CCD426E6070AED07E405D1153D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 1bb45eb3b47d379b122705ec2011f04c3a18302e54601aefeb1549afcd9a02aa
MD5 c3ae18322bf0e7058d9cccee12fd3ce2
SHA1 929b9c816fee7e85d0a4b4bb302a67775b7ba70d
SHA512 a052c59f3b5cfa2908d22dc785c6bc0a03b4ac3fad7c7ce6e451f8686c7479d5b058e8b29e5bca2269e33b8a631f9e8f6ea1f073373ed94dd7995769d1724bde
TLSH
T111C08C1C06610606F2A883B802C23983CA618121F3819F0126B12A08DD64F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 be0166be6bf247fc9c618b14c19b911297d9bee4276e4d32f956e9e91014de6c
MD5 0ecc7b5302e20e6f58367b715cbd794f
SHA1 61b6db6f87e00be1d537bbaa566c3758f3256449
SHA512 6ee0454ffdec0252bf71343bdea05a29a8c601b1eeec66522e1be060e16cfef027e3a6a23c444129a4d55df1ee8f99458e39fd56a2bb6fd916b8f71e400ddccb
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbam:rZP2tFP3vqY8/qEMfTaBacgR
TLSH
T167258537D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubModuleorig[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K20AJ31L\SubModuleorig[1].xml
Size 5KB
SHA256 a327a41d4d44da023017d8aff7f305a782d9970bd578b9d378bcd37c4f320e5e
MD5 5b632af861c8090a1400935be898aee3
SHA1 b6f157e0ae66ff71d0a2a7fb3103f921e600ac89
SHA512 468f1fa5821ae31285f661dd0eb0869b607bd6fea9cff1e7645461abdff9f37cd43d8823b721dd395faff635e5990cf52eaf6caf34edc2ac9031034173bfe909
SSDEEP 96:7Xf+x0KwKKHKwKMKrKlSKJKvwKvKMKvZ3KzK2KoHSheDMNR4XOaBEnu+SDsrTqSv:7Xf+x0DZHbVsQSqIwIKMIZ3exvHSheD2
TLSH
T160B18A267B7E9DDE4A320CD7D93658882D4FDC93022626CC781D24F328E9D89437729A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 09caae4e1d69abdb53b447ad69b0e23c05c8073a1ca678ff2af1e52d765c4c31
MD5 9eab8fbe38a06498c70afd45fa991220
SHA1 c427d67adcb5f2e903d59183fde9cd014558b09f
SHA512 73738c6b0de9f5c56fe28f712f09772d8c76e0ed4efad2ef49cc7c98acc17be18adecf43f9234809c507acc24fd29ac4745ad172f05e8ecfc970fab1a2caff49
TLSH
T184115E970A8A98B1C9A003E31EDCCE3673B7C3CE87A0E066724D9079480113D6B3E46D
MD5 SHA1 SHA512 TLSH

Submit Download

hotwdlc.exe

Path C:\Users\Public\hotwdlc.exe
Size 116KB
SHA256 17600080b6a45049c1595c0583d2d1db8b552161e763dcce0b5746088219b6bb
MD5 b470eec50f60a738881504807a6c52fc
SHA1 605f8cb76d47c0d71887f8f81da9018135830a17
SHA512 312664dfd7f775019b1c47c9baeadedd6f9c8e8d593791b6a418c7db0c3be252f0939ac6ef09c3c362ca0f8382118dc02a408ae1ef59021be12189ad7b55c5be
SSDEEP 768:Og2/JHS9vD3T5SnTVRglqC/4ajIb96xwgGTduLkJkEnKzNlYZcnTzCCKNNCmbNxn:OVlVRgqCgaH4J6zScPCLNCgMmJ0IgDc
TLSH
T183C3D4645813C09CF0A4287ACB6154F1B16E7C32EA589EC7E0257E1C76FF1728766BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Public\loader.exe
Size 12.0MB
SHA256 84e2eef044389a7a1d2ee4dedde5a7b296f1432e579ed7aba32aecc446eec693
MD5 24f82545e7ed44ccd850677ebdacffd1
SHA1 b22f60ce5b293bee1428cc6c248b5337491fd0a1
SHA512 2786da1191420a525523d13f12b586434ac06c34908c8bae1a0bdda819b2d1e74f0a5a7f8027f0cd416e45fafaaf5b708d6b6a0affb74071fa0c4153a7ec69fc
SSDEEP 196608:veoUvZEHgHLGaKsZ5CJaUzoeEYBpGnS1OXe3AP+sRWEv6e+dwcC6jguiqko6fjr:GoOscqaVwaSfzGBMqTY0P
TLSH
T171C623F505D152B0C1E74700608B535EB8C1A59D82FD6E1E3CD2AC821B5DEFE294EABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updatelogs.txt

Path C:\Windows\System32\Microsoft\updatelogs.txt
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

vcpkgrcv.exe

Path C:\Windows\System32\vcpkgrcv.exe
Size 12.2MB
SHA256 4a392eaf10921003e22036eb08ab1cdcaaddbf3d8289879864cd37c930f1ef68
MD5 bd5090ed2f835540adc1a149127e803a
SHA1 dc4aa75488888f0f0c7bd020670ca6de38da5d8e
SHA512 3b7e1aadd3233d8289ff4f7b2ed8aba986ba7c61ae8db904e6d79151388c05f3ad8ce94b2eba69922f626691b827a19ec99f6219a88c708361b7377ae7d212a5
SSDEEP 393216:t36xdgPrX7zE49Xc0fEZN0z24j3shyraat2e28K:V6wX7gF0fEZNeVj8hy2e28K
TLSH
T106D623FD65D022B081E74B10A187439E7181A94C86FC5E093DD25D421B9AEFE358EBFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2816-83-0x00007FF8E75D0000-0x00007FF8E75D2000-memory.dmp

Download

memory/2816-84-0x00007FF8E75E0000-0x00007FF8E75E2000-memory.dmp

Download

memory/2816-85-0x0000000140000000-0x00000001413B7000-memory.dmp

Download

memory/3064-60-0x00007FF8E75D0000-0x00007FF8E75D2000-memory.dmp

Download

memory/3064-62-0x0000000140000000-0x0000000141344000-memory.dmp

Download

memory/3064-61-0x00007FF8E75E0000-0x00007FF8E75E2000-memory.dmp

Download

memory/3164-126-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-124-0x00000000082C0000-0x00000000082D0000-memory.dmp

Download

memory/3164-129-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-131-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-130-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-128-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-127-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-132-0x000000000A730000-0x000000000A740000-memory.dmp

Download

memory/3164-133-0x000000000A730000-0x000000000A740000-memory.dmp

Download