8e7639893602345eef5bf15112c3fb03ebfcc9f1977d593be71ada32fbf161d9

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
video2mp3_2.0.3_x64_en-US.msi
Size 4.1MB
Sample261107-p2hs3ax13j
SHA256 8e7639893602345eef5bf15112c3fb03ebfcc9f1977d593be71ada32fbf161d9
MD5 2619011ffad237cef47bca858a761ed0
SHA1 18884e063112e701801e2e7ca6f64bea713cc362
SHA512 5c386b324274e0180b9f67124404f95d9f3e9e4861163791d311e20935f402ac43d04205a64c15117df59cdbf33c0b95ff1c60eeccd23e1454c107cb4a095a77
SSDEEP 98304:QAny5PmtQmN8CPF8vBllny/GoDkxFfxxNpTkYEN2TaDm:Q3xmtVF8vBny3DyFfxLpTbG
TLSH
T11C163387FE435AB2DD2B0DB11536C3108B3E7C24DA59A6636358762DCEF1AC00EB52E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4300	video2mp3.exe

Loads dropped DLL 1 IoCs

pid	Process
4836	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	video2mp3.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\video2mp3\video2mp3.exe	msiexec.exe
File created	C:\Program Files\video2mp3\Uninstall video2mp3.lnk	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a2713.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_799277627\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_499843177\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e5a2711.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5280FE6697D25FC4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7BAF76C2-0CFE-41D5-98C8-F1E39BBA9C22}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C70.tmp	msiexec.exe
File created	C:\Windows\Installer\{7BAF76C2-0CFE-41D5-98C8-F1E39BBA9C22}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{7BAF76C2-0CFE-41D5-98C8-F1E39BBA9C22}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8B6747A8A8CADEFC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a2711.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF241AE5BD810F965E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4AA92A4BD8DBC268.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_799277627\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_799277627\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_799277627\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_499843177\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_499843177\manifest.json	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5800	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\ProductName = "video2mp3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\PackageCode = "E9302DCDCC52B8040AD4AD2BFC9E8ACA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\Version = "33554435"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\ProductIcon = "C:\\Windows\\Installer\\{7BAF76C2-0CFE-41D5-98C8-F1E39BBA9C22}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8C9277DE9F88B615583337D86BC901B8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8C9277DE9F88B615583337D86BC901B8\2C67FAB7EFC05D14898C1F3EB9ABC922	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList\PackageName = "video2mp3_2.0.3_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2C67FAB7EFC05D14898C1F3EB9ABC922\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2C67FAB7EFC05D14898C1F3EB9ABC922\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2C67FAB7EFC05D14898C1F3EB9ABC922\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2C67FAB7EFC05D14898C1F3EB9ABC922	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C67FAB7EFC05D14898C1F3EB9ABC922\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2C67FAB7EFC05D14898C1F3EB9ABC922\External	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
800	msiexec.exe
800	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1548	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5800	msiexec.exe
Token: SeSecurityPrivilege	800	msiexec.exe
Token: SeCreateTokenPrivilege	5800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5800	msiexec.exe
Token: SeLockMemoryPrivilege	5800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5800	msiexec.exe
Token: SeMachineAccountPrivilege	5800	msiexec.exe
Token: SeTcbPrivilege	5800	msiexec.exe
Token: SeSecurityPrivilege	5800	msiexec.exe
Token: SeTakeOwnershipPrivilege	5800	msiexec.exe
Token: SeLoadDriverPrivilege	5800	msiexec.exe
Token: SeSystemProfilePrivilege	5800	msiexec.exe
Token: SeSystemtimePrivilege	5800	msiexec.exe
Token: SeProfSingleProcessPrivilege	5800	msiexec.exe
Token: SeIncBasePriorityPrivilege	5800	msiexec.exe
Token: SeCreatePagefilePrivilege	5800	msiexec.exe
Token: SeCreatePermanentPrivilege	5800	msiexec.exe
Token: SeBackupPrivilege	5800	msiexec.exe
Token: SeRestorePrivilege	5800	msiexec.exe
Token: SeShutdownPrivilege	5800	msiexec.exe
Token: SeDebugPrivilege	5800	msiexec.exe
Token: SeAuditPrivilege	5800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5800	msiexec.exe
Token: SeChangeNotifyPrivilege	5800	msiexec.exe
Token: SeRemoteShutdownPrivilege	5800	msiexec.exe
Token: SeUndockPrivilege	5800	msiexec.exe
Token: SeSyncAgentPrivilege	5800	msiexec.exe
Token: SeEnableDelegationPrivilege	5800	msiexec.exe
Token: SeManageVolumePrivilege	5800	msiexec.exe
Token: SeImpersonatePrivilege	5800	msiexec.exe
Token: SeCreateGlobalPrivilege	5800	msiexec.exe
Token: SeCreateTokenPrivilege	5800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5800	msiexec.exe
Token: SeLockMemoryPrivilege	5800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5800	msiexec.exe
Token: SeMachineAccountPrivilege	5800	msiexec.exe
Token: SeTcbPrivilege	5800	msiexec.exe
Token: SeSecurityPrivilege	5800	msiexec.exe
Token: SeTakeOwnershipPrivilege	5800	msiexec.exe
Token: SeLoadDriverPrivilege	5800	msiexec.exe
Token: SeSystemProfilePrivilege	5800	msiexec.exe
Token: SeSystemtimePrivilege	5800	msiexec.exe
Token: SeProfSingleProcessPrivilege	5800	msiexec.exe
Token: SeIncBasePriorityPrivilege	5800	msiexec.exe
Token: SeCreatePagefilePrivilege	5800	msiexec.exe
Token: SeCreatePermanentPrivilege	5800	msiexec.exe
Token: SeBackupPrivilege	5800	msiexec.exe
Token: SeRestorePrivilege	5800	msiexec.exe
Token: SeShutdownPrivilege	5800	msiexec.exe
Token: SeDebugPrivilege	5800	msiexec.exe
Token: SeAuditPrivilege	5800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5800	msiexec.exe
Token: SeChangeNotifyPrivilege	5800	msiexec.exe
Token: SeRemoteShutdownPrivilege	5800	msiexec.exe
Token: SeUndockPrivilege	5800	msiexec.exe
Token: SeSyncAgentPrivilege	5800	msiexec.exe
Token: SeEnableDelegationPrivilege	5800	msiexec.exe
Token: SeManageVolumePrivilege	5800	msiexec.exe
Token: SeImpersonatePrivilege	5800	msiexec.exe
Token: SeCreateGlobalPrivilege	5800	msiexec.exe
Token: SeCreateTokenPrivilege	5800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5800	msiexec.exe
Token: SeLockMemoryPrivilege	5800	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5800	msiexec.exe
5800	msiexec.exe
4300	video2mp3.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5800	msiexec.exe
800	msiexec.exe
4836	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 4836	800	msiexec.exe	89
PID 800 wrote to memory of 1336	800	msiexec.exe	95
PID 5800 wrote to memory of 4300	5800	msiexec.exe	98
PID 4300 wrote to memory of 1548	4300	video2mp3.exe	99
PID 1548 wrote to memory of 2112	1548	msedgewebview2.exe	100
PID 1548 wrote to memory of 5576	1548	msedgewebview2.exe	101
PID 1548 wrote to memory of 5576	1548	msedgewebview2.exe	101
PID 1548 wrote to memory of 5576	1548	msedgewebview2.exe	101
PID 1548 wrote to memory of 5576	1548	msedgewebview2.exe	101
PID 1548 wrote to memory of 1268	1548	msedgewebview2.exe	102
PID 1548 wrote to memory of 3092	1548	msedgewebview2.exe	103
PID 1548 wrote to memory of 3092	1548	msedgewebview2.exe	103
PID 1548 wrote to memory of 3092	1548	msedgewebview2.exe	103
PID 1548 wrote to memory of 5596	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 5596	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 5596	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 5596	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 5596	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 1064	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1064	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1064	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1560	1548	msedgewebview2.exe	108
PID 1548 wrote to memory of 1560	1548	msedgewebview2.exe	108
PID 1548 wrote to memory of 1560	1548	msedgewebview2.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\video2mp3_2.0.3_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Program Files\video2mp3\video2mp3.exe
  "C:\Program Files\video2mp3\video2mp3.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4300.6072.16870875455475948094 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView /prefetch:4 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7fff2cc15fd8,0x7fff2cc15fe4,0x7fff2cc15ff0
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1680,i,6874648798393429918,1270531785397301746,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1680,i,6874648798393429918,1270531785397301746,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1680,i,6874648798393429918,1270531785397301746,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1680,i,6874648798393429918,1270531785397301746,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1680,i,6874648798393429918,1270531785397301746,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView" --webview-exe-name=video2mp3.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=1680,i,6874648798393429918,1270531785397301746,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:842140b4ad59a05f6c28f59ea8641c96d05f039a
      4⤵
      PID:1560

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C696ABB19BC09792015023C577DF3979 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4836
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a2712.rbs

Path C:\Config.Msi\e5a2712.rbs
Size 9KB
SHA256 d464925f1bf673c99deb3e7d9682cba11b72168f5fcf657ab2ac86c885607a02
MD5 5f6cb35b69692d5f6ca2080641c11ec3
SHA1 c6d98c35f3ac88d2da1e5878e9670676f343bd6b
SHA512 428d3a4ff469253414be5caf26a0eb5ccb8d0bebd6f129b5fa5622611fd6469fe69e3f49971e294091c9c37e9fc10fb803933fdb49dedaeefb1ab8503ae529c6
SSDEEP 192:vGj6VS+7A0C5SeGqGZeGq/KqVbWnicEKTpp:vc6VS+kceG3eGSPy
TLSH
T1C4222E02A70486E6FC9B2738C7030725B7E2C29BAB88538B15DD90F46F577850FA529F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video2mp3.exe

Path C:\Program Files\video2mp3\video2mp3.exe
Size 12.8MB
SHA256 20774da794f9bc0a84d93c53b5d13adccee5e71a4e12c87650a1d2b69192c7f8
MD5 1259f026eaef73976c6948d778a63e9b
SHA1 e7870755348fb216c7cb50d790577ef914cff92c
SHA512 fb4d79eb8e87f90d208b9eb84af3500cb9c9bb62b9f09f4d702acb47c250351bb50f08f9a4016d088c0e3f029cbf4fb61d8e7e4713b07c002d6ebe7748f425df
SSDEEP 196608:loSCOrqA1UIBzEU6MfjE3bR7CwF/CNtiKPTx:hrqA1UIBzEU6MfjEoW/OiU
TLSH
T182D6E725BA5B996CD05BC874834B8A62493030CF0B35B9BF54D496382F6EBF46F2835D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video2mp3.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\video2mp3\video2mp3.lnk
Size 1KB
SHA256 a75230df2bb5af51e96ccbaf411d8bf5172ce047cab82d7880baf49421b20262
MD5 36ead5608579c20408fe67edc2fdbba2
SHA1 c194f743f325d97e768f89744abd6b7880b5c6d7
SHA512 d2b52308d85628585501deb898a587c0b0d59efc86b5c3f874479d1fbc2bfb99bc53ca7801844dcf27d2ef2d9a4fc390252dbd087450fb03c75901124c4fb2bb
TLSH
T15741DF240BF80769F3B583BA2E730A348736BC06E6946F5B80C541C40934600A5A5FAE
MD5 SHA1 SHA512 TLSH

Submit Download

~ideo2mp3.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\video2mp3\~ideo2mp3.tmp
Size 1KB
SHA256 68059b50222623e61803f93992a76b6a367a9a6cda30233ead9cd91c5270b560
MD5 2af20c750e3b3d094ec9285ef3b4d136
SHA1 dc54b1293d9955bf1e789e093e623fdab57df19e
SHA512 419772d97f8d4dbc8e8cc375198cdd5093f872ceb510c584562e6ee766433f01a0453bde8410a9d8546551c9d4ce20e5ab5acc3767b561fd192f63d2fa95f50a
TLSH
T1F641E2251BF80765F3B583BB2D724A398636BC07E6946F5B80C541C40D34700E5A5FAE
MD5 SHA1 SHA512 TLSH

Submit Download

MSICCDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICCDB.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52b1bf48-eb2c-45bf-b395-132796f0b32f.tmp

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\52b1bf48-eb2c-45bf-b395-132796f0b32f.tmp
Size 3KB
SHA256 59291033b468e755db053d5128974da8ae8f3d7c38c90378757761a7b4f45bd4
MD5 936ced14f20c216d34ac59e6121b7da6
SHA1 1b5d6eaac03d1392529eb1a4e110c6b4539ced01
SHA512 7e6c5d3fa8e14d1a8b8d91020753d1f2134314a44f838f4d740ad8f7dfb5a7084cbc08b5b2f50e91a96ad582edf902906f3dcee35b5db4f0aaf1f3d1316c17b4
TLSH
T17061AA37A974AA379DE39A04B9852B06FB659027E5C53F90CAEC0F1C01D738C1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 13c89c32418b604ed6390ce3433997003eff5f2ab715b2d1348f6787dfc0617b
MD5 322efe82d0edb1ccd7a177115104e345
SHA1 9f1d9cb356e06653847817e0890aa5a7ccb53084
SHA512 1b878ace7c30c41b29e7341a1725ebdf650d1355929837a84ba6196524ae4c5944e1c7647fbf9e4a209c31c09fcdab96a32ce40650ad78e2a4e0cec9cd09af50
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 adb6c782045df185115b77298747dfb2694f1c53bb916c7cb0034aa19abe74d9
MD5 cd8466a69992be7ea82a69198c1ef80e
SHA1 24e41c13593e5da8eec4f1414ab136e9aada1d37
SHA512 a8c8ceeac29200e10d730abf819545f7679ddbb1aadb8157775ea172299feaeb2acf61a20b4f5d8169335b8a98d629609957c19e589447b2eb2ddcd89614b067
TLSH
T17ED0122332090274C8103173010375082420C11B8245400455298A2D1E045540902441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 0e7163e1cd0c5b3c646eb6ef2faacb0beb5f56ef95d094643294116042c95ef4
MD5 94dbadbab4f79407f51afa55f075ea72
SHA1 e1efae76250214424df9894233314725697ac4c6
SHA512 f3ae46886c107127e5b5a25c54592f1b85ac0db22d3e227ae60782af8d9f5fa4ee6dba45243dfe84f3f57eb4c34d1d820f28951772070604694b1a558a40942c
TLSH
T1DCA00254195C8557C58907B824D725837B34DD504713471190942C6DC891745B145A54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bc0777eb47416f160bb116b6c44518ad4280aac2c2cd4acf4968d17d2df3f6f6
MD5 b6f27999bef2590ea6fcee4bcd1b3941
SHA1 72f6931134e3781874a8c2b1d6072c89f9b9d864
SHA512 aeea4fd6dc5b29ccf6662cc2fcd1c2727b2a9d498905b16cc439adc9787c1187fc13aa3effd6877046528d70238f610ed433c8fc74c7b91008023d30ec287115
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c0892cb6-691b-4cc8-bb08-fe2f0aa97934.tmp

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Network\c0892cb6-691b-4cc8-bb08-fe2f0aa97934.tmp
Size 821B
SHA256 e89a11750620fd6308202e79eca7c290d90b6a4969fa38efb96b7aed606bafa8
MD5 3e47f1d2645a5ec67ce39f1cb2c44091
SHA1 b35d6a3537bba1db21964c3c9bba8ce9730db02d
SHA512 a243163e6ddf3979c7d5782958d8357b4054457073155907c890e7a18e31d54137928301799bf0c20c63854cfb6938afe0b7f1027639dd61513ff4ee7b80e4e6
TLSH
T1CF018EA2C3D4C67D8A4157E427347817CD2E091992286D27CDFAEBDA57E2071D11054F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

da653455-c188-4c7f-8183-4e5cbd8c5aa0.tmp

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Default\da653455-c188-4c7f-8183-4e5cbd8c5aa0.tmp
Size 6KB
SHA256 10b33985524071f93d4a7150fc89796fe44d0f938891b97115c1801a4bb30f74
MD5 7bdbd60f4c6988c138abed259aa75f48
SHA1 06f0dd3b7498230530e8b0a3258cfa00a053212b
SHA512 8296c7ce339c571bf79c8647f1d192a54043048a44d9d800d50baa7f120acd983d19246988e3310388651b93f94c4cd94bb185cda9717f79cc6d9fcb9722cc71
SSDEEP 96:st1/dM+lVsHb9lukYo5h16Z0Ys7/x+6MhmuecJkx1eje9K+gf28XM1C7K:stpOYvhonYsV+FdkxQjDtG6K
TLSH
T1BFD1A7065E28797B8CC7E109BA39BA17E2F6903274D51E58EBF8462C04DB6DC334790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\Local State
Size 1KB
SHA256 3b67ca12df1369970c22d92975445b9795fab2af27c3f771bd779573862d1e25
MD5 9351c7cf371d9120fb93b22473b363d5
SHA1 4ff4acd1f746fe861a0f49a6a00074f615e1075e
SHA512 d9cdf119482f404bdbb2ad65b2c4d6e60a74e4f7818672dc075b3d7e8fd2e791a55dd3edaa3381d7145b9b94205e55ac1f894087084b742d18199efdee16d2c2
TLSH
T1D12187B2E5646F73BD8266457106AB476D3150AB92854F0066DD4F2D0AD304CD79EC33
MD5 SHA1 SHA512 TLSH

Submit Download

a1d937af-2633-4382-bde1-1ed7371e32b8.tmp

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\a1d937af-2633-4382-bde1-1ed7371e32b8.tmp
Size 15KB
SHA256 2fbee7f66f7c678064a83b6cd0966e7d9c6bc88371131c1904fff0ff5b3e750c
MD5 79ed9b13b3a57c8c8edb7f4378df1f26
SHA1 94f95d919bfe8a9da126de210ebf51b1e29b4a05
SHA512 b9ea83dc436e19c424491545b2a427606d9ec2b4881dc54e14d98f1243a086b5f623c5e7e1ca733e6b575ea950b6418fe2a6cff5f6d9f9ea7623859f78992fca
SSDEEP 384:o+OBqImmJvGBLx3NaFMJFNNBSvHs3Wg6rL:RcvGtlNGEAH
TLSH
T17A72BF3A1C256F236CF78509BA8E634BCB65A293C0D53BD4CDEC9F0F416F0441392955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6d72b36-6149-4102-a924-00c1293c895e.tmp

Path C:\Users\Admin\AppData\Local\app.video2mp3\EBWebView\c6d72b36-6149-4102-a924-00c1293c895e.tmp
Size 2KB
SHA256 021ab9ad82976b13f4ac6b8af0b9c0645ef7e4959b5f8eaffac98556c5b38899
MD5 fff7f322f6a33858b62d576b9c8d56ab
SHA1 a8aac030c6a2d3d17c001b2403ced0271a832f51
SHA512 e1ae66d171d1082530493aec11b91d422684e1359dce0ce49c62b546faea866cd641ecaa65f37334561b6b0a6bd9083068c4f48d0e9d5ebf8c949cc5130c6fa7
TLSH
T1B851B833B914AF37DDE35744B94A6F13DE3690A2AA962F509ADC0B2C05D714C1386C77
MD5 SHA1 SHA512 TLSH

Submit Download

e5a2713.msi

Path C:\Windows\Installer\e5a2713.msi
Size 4.1MB
SHA256 8e7639893602345eef5bf15112c3fb03ebfcc9f1977d593be71ada32fbf161d9
MD5 2619011ffad237cef47bca858a761ed0
SHA1 18884e063112e701801e2e7ca6f64bea713cc362
SHA512 5c386b324274e0180b9f67124404f95d9f3e9e4861163791d311e20935f402ac43d04205a64c15117df59cdbf33c0b95ff1c60eeccd23e1454c107cb4a095a77
SSDEEP 98304:QAny5PmtQmN8CPF8vBllny/GoDkxFfxxNpTkYEN2TaDm:Q3xmtVF8vBny3DyFfxLpTbG
TLSH
T11C163387FE435AB2DD2B0DB11536C3108B3E7C24DA59A6636358762DCEF1AC00EB52E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_499843177\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_799277627\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 fd68551bccd39783a0267114c0c6fda84f01fc1ee3179fe785fc97b9694897f9
MD5 7e92502196798c27e2c5941a0b909075
SHA1 3f955da579c95e154d61a7c9b738e3346ff3ab11
SHA512 d656fcd9904c14b612b8ef942193c5fab20d4642b728d9aa8c831e953d5bfe12b0e29f834ea07491981782f3170fcc0de00634d13bd89de2f1f2bafe70ebfc3c
SSDEEP 24576:RFo3DMPDdoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeQ:PHw
TLSH
T19857042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e401d74c-5524-42b9-a494-df40b191d2f7}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e401d74c-5524-42b9-a494-df40b191d2f7}_OnDiskSnapshotProp
Size 6KB
SHA256 e526b45575d4b6d4bf7c135609f5d4214263ea35fc1f5f11c98bd913355d81f2
MD5 7ffe3c5e46283e40f23d1aff238ea137
SHA1 6ab40938a120d21e8a472e68f0e485df37f5c172
SHA512 935ae7ed752b5a92544a8675cc52a9916f257cb4423b1ba405d8fa8792e4442b1955c1d114e1fd1a1184cc5c56a26511886660d862fddb5a39dc99496f11c177
SSDEEP 96:FiyAFAfvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:rPTb++uVmN
TLSH
T16BD189185AF54711E2B3AB7128F18557A477B911EF33CB8E0198238E2631A10F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-326-0x00007FFF4F340000-0x00007FFF4F341000-memory.dmp

Download

memory/1064-327-0x00007FFF4ED50000-0x00007FFF4ED51000-memory.dmp

Download

memory/5576-70-0x00007FFF4E8C0000-0x00007FFF4E8C1000-memory.dmp

Download

memory/5576-264-0x0000029657BC0000-0x0000029657F3C000-memory.dmp

Download

memory/5596-143-0x00007FFF4E8C0000-0x00007FFF4E8C1000-memory.dmp

Download

memory/5596-265-0x00000277AF430000-0x00000277AF7AC000-memory.dmp

Download