darkcomet | hxxps://youtube[.]com

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe"	upx_compresser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Desktop\\Trojan.exe"	Trojan.exe

Executes dropped EXE 7 IoCs

Processes:

builder #6.exebuilder #6.exeupx_compresser.exeupx_compresser.exetaskhost.exetaskhost.exeTrojan.exe

pid process

4640 builder #6.exe
4692 builder #6.exe
4716 upx_compresser.exe
4760 upx_compresser.exe
4844 taskhost.exe
4872 taskhost.exe
5052 Trojan.exe

pid	process
4640	builder #6.exe
4692	builder #6.exe
4716	upx_compresser.exe
4760	upx_compresser.exe
4844	taskhost.exe
4872	taskhost.exe
5052	Trojan.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

upx_compresser.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation	upx_compresser.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

upx_compresser.exeTrojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\AudioDriver = "C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe"	upx_compresser.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	Trojan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\Desktop\\Trojan.exe"	Trojan.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Trojan.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Trojan.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Trojan.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

upx_compresser.exetaskhost.exe

description	pid	process	target process
PID 4716 set thread context of 4760	4716	upx_compresser.exe	upx_compresser.exe
PID 4844 set thread context of 4872	4844	taskhost.exe	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffebffffff4e00000071040000b3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F0537A6-5B13-11EC-9231-E63C55DA7BCE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1086dbe61fefd701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c4ece61fefd701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3824952871"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d7000000000200000000001066000000010000200000003aee752134ac2b00df81feac843d59ca117632e36d1f369e0ca048ee94bd142b000000000e800000000200002000000087ef4fb201f84e5ae02d59eb490d756881ac52bac443f33b7ff72ae80d59ef8d2000000097f9bf3f04ca56e525ecaacea346c6c56d1ade0d4a560dd65667d9f6ce21fc0240000000554112e41811ee73d1fc5dc2d5d60c1c5fd9b2cc4425e241cc4a4be9afe233c04f715349575abb59d87a0ace8ac7a08cacf6fd6cd75e905a6968ba6d5c9a6153	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30928671"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30928671"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8db62ff13956941acf514a4778508d700000000020000000000106600000001000020000000fe1154be50420b8cff4d358d8d62df555f0b2551a5c4fc41581a72d990a83d94000000000e80000000020000200000008bf1edc4a4930e104f1e3e48af96692fbd3be6c33c1f3a066f0c0ac58a73de43200000001855e4142166e61f5ffe976eb0cc13c6d3d7ef27f0e3cfee739aa2de9292947940000000547ce63abb6b1056781a2a2ed1f9ef0b170da7c80e50e9dea853a2191202a1b923bd23366f63df8449efb94f76db151b5841ac09a43842d5e7bf26ce980b09ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3825109055"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 48 IoCs

Processes:

builder #6.exeupx_compresser.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	builder #6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	upx_compresser.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	builder #6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "5"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	builder #6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\NodeSlot = "4"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx = ffffffff	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1 = 14002e80922b16d365937a46956b92703aca08af0000	builder #6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 0100000000000000ffffffff	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	builder #6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	builder #6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	builder #6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	builder #6.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy	builder #6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeupx_compresser.exetaskhost.exeTrojan.exe

pid	process
2252	chrome.exe
2252	chrome.exe
3992	chrome.exe
3992	chrome.exe
2168	chrome.exe
2168	chrome.exe
1576	chrome.exe
1576	chrome.exe
2872	chrome.exe
2872	chrome.exe
1748	chrome.exe
1748	chrome.exe
2076	chrome.exe
2076	chrome.exe
1804	chrome.exe
1804	chrome.exe
3500	chrome.exe
3500	chrome.exe
4108	chrome.exe
4108	chrome.exe
4196	chrome.exe
4196	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4716	upx_compresser.exe
4716	upx_compresser.exe
4844	taskhost.exe
4844	taskhost.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

4476 7zFM.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

upx_compresser.exetaskhost.exe

pid process

4716 upx_compresser.exe
4844 taskhost.exe

pid	process
4476	7zFM.exe

pid	process
4716	upx_compresser.exe
4844	taskhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

chrome.exe

pid	process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

7zFM.exeupx_compresser.exetaskhost.exeTrojan.exe

description	pid	process
Token: SeRestorePrivilege	4476	7zFM.exe
Token: 35	4476	7zFM.exe
Token: SeSecurityPrivilege	4476	7zFM.exe
Token: SeIncreaseQuotaPrivilege	4760	upx_compresser.exe
Token: SeSecurityPrivilege	4760	upx_compresser.exe
Token: SeTakeOwnershipPrivilege	4760	upx_compresser.exe
Token: SeLoadDriverPrivilege	4760	upx_compresser.exe
Token: SeSystemProfilePrivilege	4760	upx_compresser.exe
Token: SeSystemtimePrivilege	4760	upx_compresser.exe
Token: SeProfSingleProcessPrivilege	4760	upx_compresser.exe
Token: SeIncBasePriorityPrivilege	4760	upx_compresser.exe
Token: SeCreatePagefilePrivilege	4760	upx_compresser.exe
Token: SeBackupPrivilege	4760	upx_compresser.exe
Token: SeRestorePrivilege	4760	upx_compresser.exe
Token: SeShutdownPrivilege	4760	upx_compresser.exe
Token: SeDebugPrivilege	4760	upx_compresser.exe
Token: SeSystemEnvironmentPrivilege	4760	upx_compresser.exe
Token: SeChangeNotifyPrivilege	4760	upx_compresser.exe
Token: SeRemoteShutdownPrivilege	4760	upx_compresser.exe
Token: SeUndockPrivilege	4760	upx_compresser.exe
Token: SeManageVolumePrivilege	4760	upx_compresser.exe
Token: SeImpersonatePrivilege	4760	upx_compresser.exe
Token: SeCreateGlobalPrivilege	4760	upx_compresser.exe
Token: 33	4760	upx_compresser.exe
Token: 34	4760	upx_compresser.exe
Token: 35	4760	upx_compresser.exe
Token: 36	4760	upx_compresser.exe
Token: SeIncreaseQuotaPrivilege	4872	taskhost.exe
Token: SeSecurityPrivilege	4872	taskhost.exe
Token: SeTakeOwnershipPrivilege	4872	taskhost.exe
Token: SeLoadDriverPrivilege	4872	taskhost.exe
Token: SeSystemProfilePrivilege	4872	taskhost.exe
Token: SeSystemtimePrivilege	4872	taskhost.exe
Token: SeProfSingleProcessPrivilege	4872	taskhost.exe
Token: SeIncBasePriorityPrivilege	4872	taskhost.exe
Token: SeCreatePagefilePrivilege	4872	taskhost.exe
Token: SeBackupPrivilege	4872	taskhost.exe
Token: SeRestorePrivilege	4872	taskhost.exe
Token: SeShutdownPrivilege	4872	taskhost.exe
Token: SeDebugPrivilege	4872	taskhost.exe
Token: SeSystemEnvironmentPrivilege	4872	taskhost.exe
Token: SeChangeNotifyPrivilege	4872	taskhost.exe
Token: SeRemoteShutdownPrivilege	4872	taskhost.exe
Token: SeUndockPrivilege	4872	taskhost.exe
Token: SeManageVolumePrivilege	4872	taskhost.exe
Token: SeImpersonatePrivilege	4872	taskhost.exe
Token: SeCreateGlobalPrivilege	4872	taskhost.exe
Token: 33	4872	taskhost.exe
Token: 34	4872	taskhost.exe
Token: 35	4872	taskhost.exe
Token: 36	4872	taskhost.exe
Token: SeShutdownPrivilege	5052	Trojan.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exechrome.exe7zFM.exebuilder #6.exeTrojan.exe

pid	process
1584	iexplore.exe
1584	iexplore.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
4476	7zFM.exe
4476	7zFM.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
4692	builder #6.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe
5052	Trojan.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEbuilder #6.exetaskhost.exeLogonUI.exe

pid	process
1584	iexplore.exe
1584	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
4692	builder #6.exe
4872	taskhost.exe
4692	builder #6.exe
1244	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 1584 wrote to memory of 2944	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 2944	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 2944	1584	iexplore.exe	IEXPLORE.EXE
PID 3992 wrote to memory of 1424	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 1424	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4064	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2252	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2252	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 2128	3992	chrome.exe	chrome.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://youtube.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff98d2b4f50,0x7ff98d2b4f60,0x7ff98d2b4f70
2⤵
PID:1424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1524 /prefetch:2
2⤵
PID:4064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1860 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 /prefetch:8
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
2⤵
PID:1056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
2⤵
PID:880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:8
2⤵
PID:584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:8
2⤵
PID:3184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
2⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4628 /prefetch:8
2⤵
PID:1540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:8
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5060 /prefetch:8
2⤵
PID:644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
2⤵
PID:848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:8
2⤵
PID:584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:8
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5344 /prefetch:8
2⤵
PID:1196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
2⤵
PID:3568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
2⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
2⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 /prefetch:8
2⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:8
2⤵
PID:1724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
2⤵
PID:3744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:1776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:8
2⤵
PID:968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
2⤵
PID:1464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3792 /prefetch:8
2⤵
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1980 /prefetch:8
2⤵
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4460 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
2⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6720 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1512,9340056300055147828,16863717792482057439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 /prefetch:8
2⤵
PID:4516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4376

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Сборник WinLocker Builderов[Пароль от архива 123123].rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4476

C:\Users\Admin\Desktop\builder #6.exe
"C:\Users\Admin\Desktop\builder #6.exe"
1⤵
- Executes dropped EXE
PID:4640

C:\Users\Admin\AppData\Local\Temp\builder #6.exe
"C:\Users\Admin\AppData\Local\Temp\builder #6.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4716

C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Users\Admin\Documents\AudioDriver\taskhost.exe
"C:\Users\Admin\Documents\AudioDriver\taskhost.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4844

C:\Users\Admin\Documents\AudioDriver\taskhost.exe
"C:\Users\Admin\Documents\AudioDriver\taskhost.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4996

C:\Users\Admin\Desktop\Trojan.exe
"C:\Users\Admin\Desktop\Trojan.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5052

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5076

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad8855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
3f35a3844e16f03b5a60b7d276e887f1

SHA1
612a6a3b3ae655c18c85dfd2d0dcb7f4ee3a305f

SHA256
cc318426da54dc585faa68d9f6b7d29f1ae2ae1572e86ce7053df5dfcae09d94

SHA512
f29b740f5422f25187d72ee492a0e9f1414bbca010f868eb6bab27d73e45e0d19e5ab9ad3f10a1068c6810c0ae54f50866d9ccb7fe149b7afb60464e630165d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_76F26EDEF7C1087F80A272B48769819E
MD5
da9e2a6ff6021a01b9994f954c0c3b38

SHA1
511262ecb22a96d48e9db54f6c3ecd943e076f10

SHA256
873c7a0f931466ed1745f887e1090177e9ee5b837b8795749386ccf8e99eddb4

SHA512
ebddb6578cce49b806db2e8583460dd4f6b80ab9d2eeb59ed3f0da32602673cc97a4b56bbdc51bed113feaae0f5de24e440cdfa04c918915a1bb98fa10d20c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_30F32374BEBB4A72181B36E407396E90
MD5
810acb1cda9a9171078c57f6f1569413

SHA1
3ce341fdafd6af03f935780bfe9dfcf7226232b7

SHA256
9e59fedee59905f90a2d7ef18c09a59f661bce98f747c878bfb92d1f38f43418

SHA512
1d945acb14202ffbc346e1f5f6abbc5ceb470170ab23cf0887a0abfa0461271c112a68c21862191c3ef359a98b4f272fb2585ef6723730e52e23e381e1ee78fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9641559E442FE3E0D68934A8083C5D76
MD5
901c296fbb83dfe266931aeb4b3bfb8c

SHA1
c10153d43d11a28e91a08c25d151b67332378a92

SHA256
f86a74540a21e46eabe03e2c0914f99e8bce78108530b8108c327a947dddff8f

SHA512
c46a1c0e189fd3e93fc9ff909956e020d19f1913630faf9b89159a020fbe78c0ac5db2350a959036a2d780b7a5a450bec1b2373f8d8b21a8d31abea785ab2ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
0a6e14aa152f8deb8e2aa79403d3fbd1

SHA1
6ccb0ac000bcb4bd287dfa76aeddd9d96b26094a

SHA256
bef05ecf60b49bdb68c9040f13369b2e35e5b16368c14dc3b7e647bc2b771190

SHA512
187f4805733740b87746c965b9d4ad9cecfb2b8c58f9b7a7cdd738431af8ae1075c3f2f3bc0e3cf0b9a5341a4366ec7ad6ebc23d37cfc263b7d3ee7de471ee24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_76F26EDEF7C1087F80A272B48769819E
MD5
81bf2262d07dcd8dabe5d063273b3b82

SHA1
1a8ea0d04519e90c9aa699e20dedade3ef89528f

SHA256
d7a3b7a45383065ec0d5c52fb6db62f6b8923f9021cafd3b1a88052e5bf6c0ca

SHA512
301f054fa470a090d058da743ee95e418b062aebd0dec9efa82546213a840e5c5cff8fc78ee5aa46998111042f93fafae2231692a5404e410e9f6c620cfb4e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_30F32374BEBB4A72181B36E407396E90
MD5
17614ccc0e2163ed9fe0d4294c512427

SHA1
76332424660a13324beb5289cec4ee212b9c1b60

SHA256
413210387395fd55153d566ca253486b5de7786a5cf793cab68197fe57ee047d

SHA512
2813cfdd7019e37aa7edb8038a38bc70a6ef31ba5fd64daaaf58b0ca33d87b1e055fb12f147de793557050a2643cc7f6149ac135845367adefc1f0696147a5a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
d6b3a63f257f20dc976de24fee5e265f

SHA1
f07273bf11527287c3103175f2be8aaf20a5ab43

SHA256
4baca42f564efabff3292e3dbb038beb8afc0d861b1820b524d149ad5f7ad699

SHA512
ee9715fcdc5669c1e3c13dd2fc650acc82edab34e251c1a16939d9957ac805202bcb64f9f6504863d29b8856038a94c89552a5f928ff5cba67d296881411dc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9641559E442FE3E0D68934A8083C5D76
MD5
e2ff814164748ac73fbb079e974f0af9

SHA1
2585381e0b19c08a91c6d689b7a14414b54538b7

SHA256
e833ae81c6f1998e01f658d97755a667a803c8f1ebae2cb212dd9a2b7da2dfb1

SHA512
2be8da07069ff3d5b684aa060bf323818fe51ca2a95b634ad08494554566aa7977d7a67296da45aa2c3625ba3e31e4b0a8c10f0b994102091bf31d47baf911f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\38DZIYGX.cookie
MD5
1125437a62bfc20380f4647cc439616b

SHA1
691026db2b431a93c72a111025089635f8f89f9e

SHA256
f6458db840bbafdc3d0cbe261bec5a87dd324f3e285e6709de327f63ffc59cb7

SHA512
71fa5953026df79e4727382027530d9f9f575634fe02aa5bef04d6afe19ee270e83102b0c9a1e16746352fea37d4c1862570df9172688881f34844db0d0f9c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\builder #6.exe
MD5
9729d33f5cc788e9c1930bcc968acffa

SHA1
68c662875f7b805dd6f246919d406c8d92158073

SHA256
3711a334cb3c6e2a92461067f2d7db2946e9b139f1517b214bc929ba42a86aae

SHA512
af12beee6da79e5498eb292eb4a122667bf5dcdf840def97a5476adb31e0701a2aa0585b4266547bb4307c3524c7f9733dbf32f2a87c87b33fadb4bb1ecd0c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\builder #6.exe
MD5
9729d33f5cc788e9c1930bcc968acffa

SHA1
68c662875f7b805dd6f246919d406c8d92158073

SHA256
3711a334cb3c6e2a92461067f2d7db2946e9b139f1517b214bc929ba42a86aae

SHA512
af12beee6da79e5498eb292eb4a122667bf5dcdf840def97a5476adb31e0701a2aa0585b4266547bb4307c3524c7f9733dbf32f2a87c87b33fadb4bb1ecd0c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Desktop\builder #6.exe
MD5
5b8424091039427183735ad7957dcbf4

SHA1
f6e8c595d397f7510c17f6e932d080b2040ede00

SHA256
9b106ec7ed3ba6caf1370e573e03d1de093516ce2746bb8fe1f23b6d9b328cab

SHA512
5a77c01ac24b0cda39384aa68fce7c823d4b0474e8190fe380dc30ce1d9c416c8bd98b1715c38471dd16304024b96627f46504afa87854b4f11914b5109d6ad0

Download Submit
C:\Users\Admin\Desktop\builder #6.exe
MD5
5b8424091039427183735ad7957dcbf4

SHA1
f6e8c595d397f7510c17f6e932d080b2040ede00

SHA256
9b106ec7ed3ba6caf1370e573e03d1de093516ce2746bb8fe1f23b6d9b328cab

SHA512
5a77c01ac24b0cda39384aa68fce7c823d4b0474e8190fe380dc30ce1d9c416c8bd98b1715c38471dd16304024b96627f46504afa87854b4f11914b5109d6ad0

Download Submit
C:\Users\Admin\Documents\AudioDriver\taskhost.exe
MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Downloads\Сборник WinLocker Builderов[Пароль от архива 123123].rar
MD5
ca30cdb3e3d150f290973d9e734266d1

SHA1
7f7f9d43571d34a4c0b1b8735cdd2a061a63d43f

SHA256
e4fa53900a2b1f7adfaafa94e588e4f7ac0c7c0cae6df89ba9f65ee6678f18d6

SHA512
624d63d8b34a16a9ea0e5cc68b58b3addbb165d4e00942fd2c303a57a537c8f9a784f04e0252d14835e347c6bb488a60aa9c2d207865d4b88ddfef3b246265bd

Download Submit
\??\pipe\crashpad_3992_WNQBGIQVSRFPFJGK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1584-141-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-132-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-144-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-145-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-147-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-149-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-150-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-151-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-155-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-156-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-157-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-163-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-164-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-165-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-167-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-166-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-168-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-169-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-173-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-115-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-176-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-179-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-180-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-116-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-138-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-137-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-136-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-135-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-133-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-142-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-131-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-129-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-128-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-127-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-125-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-124-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-122-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-117-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-123-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-121-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-119-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/1584-120-0x00007FF99D0B0000-0x00007FF99D11B000-memory.dmp

Filesize
428KB

Download
memory/2944-140-0x0000000000000000-mapping.dmp

Download
memory/4692-208-0x0000000000000000-mapping.dmp

Download
memory/4692-216-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4716-211-0x0000000000000000-mapping.dmp

Download
memory/4716-217-0x0000000000660000-0x00000000007AA000-memory.dmp

Filesize
1.3MB

Download
memory/4716-218-0x0000000000660000-0x00000000007AA000-memory.dmp

Filesize
1.3MB

Download
memory/4716-219-0x0000000000660000-0x00000000007AA000-memory.dmp

Filesize
1.3MB

Download
memory/4760-221-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4760-220-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4760-214-0x000000000048F888-mapping.dmp

Download
memory/4844-222-0x0000000000000000-mapping.dmp

Download
memory/4844-225-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4844-227-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4844-226-0x0000000002360000-0x0000000002369000-memory.dmp

Filesize
36KB

Download
memory/4872-224-0x000000000048F888-mapping.dmp

Download
memory/4872-228-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/5052-229-0x0000000000520000-0x00000000005CE000-memory.dmp

Filesize
696KB

Download