icedid | 45ff00e7a848fdb2c5ecb5fbdf608c492c20fdf68ecbe12637f599ed0aea7f6b

Analysis

max time kernel
596s
max time network
596s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

June-06028_65-Report.iso
Size

1.9MB
MD5

472097d742b7a64531766ec22826bcad
SHA1

ef95618ef18e7feb5b0d0563a47acea38b03b94c
SHA256

45ff00e7a848fdb2c5ecb5fbdf608c492c20fdf68ecbe12637f599ed0aea7f6b
SHA512

3ff26d6c8b7a62ce902006a6f78e1aa5bdb6fe19dc008855f39df2a7de8f5a7ed50c2015dc3183c973ac8fd18a3c310dd9f8f90ce0988a1978226370ab9880c5

Score

10^/10

icedid 3568430872 banker discovery loader persistence suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3568430872

alionavon.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

101 2468 rundll32.exe
103 2700 rundll32.exe
Downloads MZ/PE file

flow	pid	process
101	2468	rundll32.exe
103	2700	rundll32.exe

Drops file in Drivers directory 2 IoCs

Processes:

setup64.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\scdemu.sys	setup64.exe
File opened for modification	C:\Windows\system32\Drivers\scdemu.sys	setup64.exe

Executes dropped EXE 6 IoCs

Processes:

PowerISO8-x64.exedevcon.exesetup64.exePWRISOVM.EXEPowerISO.exeChromeRecovery.exe

pid process

2080 PowerISO8-x64.exe
1560 devcon.exe
1048 setup64.exe
2184 PWRISOVM.EXE
2092 PowerISO.exe
2580 ChromeRecovery.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ = "C:\\Program Files\\PowerISO\\PWRISOSH.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ = "C:\\Program Files\\PowerISO\\PWRISOSH.DLL"	regsvr32.exe

Loads dropped DLL 45 IoCs

Processes:

PowerISO8-x64.exeregsvr32.exeregsvr32.exePowerISO.exeregsvr32.exechrome.exechrome.exerundll32.exerundll32.exe

pid	process
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
872
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
1372
1372
1372
1372
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2080	PowerISO8-x64.exe
2128	regsvr32.exe
2308	regsvr32.exe
1372
1372
1372
1372
1372
1372
1372
1372
1372
2092	PowerISO.exe
2712	regsvr32.exe
1372
1372
2976	chrome.exe
2988	chrome.exe
2988	chrome.exe
1372
1372
2468	rundll32.exe
2468	rundll32.exe
2468	rundll32.exe
2468	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PowerISO8-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PWRISOVM.EXE = "C:\\Program Files\\PowerISO\\PWRISOVM.EXE -startup"	PowerISO8-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

PowerISO8-x64.exeelevation_service.exe

description	ioc	process
File created	C:\Program Files\PowerISO\Lang\TradChinese.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Russian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\croatian.lng	PowerISO8-x64.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\manifest.json	elevation_service.exe
File opened for modification	C:\Program Files\PowerISO\devcon.exe	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Italian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Thai.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Romanian.lng	PowerISO8-x64.exe
File opened for modification	C:\Program Files\PowerISO\PWRISOVM.exe	PowerISO8-x64.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files\PowerISO\Lang\czech.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Portuguese(Brazil).lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Malay.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Burmese.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\License.txt	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Azerbaijani.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Finnish.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Readme.txt	PowerISO8-x64.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\_metadata\verified_contents.json	elevation_service.exe
File created	C:\Program Files\PowerISO\Lang\Bulgarian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Japanese.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Farsi.lng	PowerISO8-x64.exe
File opened for modification	C:\Program Files\PowerISO\PowerISO.exe	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\PowerISO.chm	PowerISO8-x64.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files\PowerISO\Lang\Polish.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Arabic.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\uninstall.exe	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Ukrainian.lng	PowerISO8-x64.exe
File opened for modification	C:\Program Files\PowerISO\PWRISOSH.DLL	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\SimpChinese.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\french.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Spanish.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Belarusian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Bosnian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\German.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Norsk.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Serbian(cyrl).lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\libFLAC.DLL	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\MACDll.DLL	PowerISO8-x64.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\_metadata\verified_contents.json	elevation_service.exe
File created	C:\Program Files\PowerISO\Lang\Hungarian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Urdu(Pakistan).lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\piso.exe	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\libvorbis.DLL	PowerISO8-x64.exe
File opened for modification	C:\Program Files\PowerISO\PWRISOVM.EXE	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\danish.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Vietnamese.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\kazakh.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Indonesian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\7z-x64.dll	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Korean.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\slovenian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Swedish.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Dutch.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\lame_enc.dll	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Greek.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Slovak.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\unrar64.dll	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\setup64.exe	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Lithuanian.lng	PowerISO8-x64.exe
File created	C:\Program Files\PowerISO\Lang\Turkish.lng	PowerISO8-x64.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\manifest.json	elevation_service.exe
File created	C:\Program Files\PowerISO\Lang\Armenian.lng	PowerISO8-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363435920"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B31A78A1-F927-11EC-AA2F-C621D3E3FB96} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000ac6b20663323b483179ee0967fa713a6323178451146dbb6a7609ab7fc507510000000000e8000000002000020000000efcb5b0f61bf6a655583c20a18a92328b423ddd7dcb435a351822870b33ab1d620000000c6d107defd922c39c58376075e673102521c91455fa1c4c34934a3e0064053634000000057cb86d3e10df498d4739e04d880c778f824a738b01e98309e30b0a1119669ee934346e565e8c5e7d291342bc8c3a457860b0b776310806519342aba8d79a3e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b0000000002000000000010660000000100002000000082b77cb8b980787992ee39674fc9a29952dab9a07da7f974a4561892f7491ce1000000000e8000000002000020000000e5e704d9b9ac49c4d11253c872cb3e1706369337d0018d3a4a23b98db39e9a3e900000008bf9eae9ad1f4fee863c7c8fdbd214b7a25e786f727f4cab5da16ed9ae90014a3c49dc208ae2a7aa7a08658c73336d276cc1bc5076d949a91a37b74eb6236c140469d88db4f4fe9c946b5184238ea6f45b2adb57f73837b5a0235bc1b07ac1977d118716844de6b8382eb57d701597472c376cac3090a0113cef0b2ffbc24c38c52ec200b7fee7892a6613c615b61a484000000038b0e7f0f5c81e4e4d79038e7119c1eaf59ca5b315e86e483925d050a44a07b0a02eb15355f430d06dbe956ef2b657b5fa03002bc9234c5ae2bbc1c1c61f34b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9096d88c348dd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exePowerISO8-x64.exeregsvr32.exechrome.exePowerISO.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nrg	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wim	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\ = "PowerISO File"	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdi\ = "PowerISO"	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gi	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EXE	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uif\ = "PowerISO"	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bin	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lcd	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcd	PowerISO8-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.daa	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cue	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.img	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cif	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\shell\open\command	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "PowerISO"	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.daa\ = "PowerISO"	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ashdisc	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdi	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.c2d	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\shell\open\command\ = "\"C:\\Program Files\\PowerISO\\PowerISO.exe\" \"%1\""	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\shell\open	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\ = "PowerISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pxi	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uif	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz\ = "PowerISO"	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ncd	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ima	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\shell	PowerISO8-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ = "C:\\Program Files\\PowerISO\\PWRISOSH.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ = "C:\\Program Files\\PowerISO\\PWRISOSH.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\DefaultIcon	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\ = "PowerISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mds	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bif	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.flp	PowerISO8-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\DefaultIcon\ = "C:\\Program Files\\PowerISO\\PowerISO.exe,0"	PowerISO8-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.uif	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.b5i	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.p01	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fcd	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmg	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8658416-7CCB-4c1d-A021-AFF0A2EB8004}	PowerISO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdi	PowerISO8-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO	PowerISO8-x64.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exerundll32.exerundll32.exe

pid	process
1520	chrome.exe
268	chrome.exe
268	chrome.exe
2904	chrome.exe
2912	chrome.exe
268	chrome.exe
268	chrome.exe
2976	chrome.exe
2988	chrome.exe
1668	chrome.exe
2468	rundll32.exe
2468	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

PowerISO.exe

pid process

2092 PowerISO.exe

pid	process
2092	PowerISO.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	748	AUDIODG.EXE
Token: 33	748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	748	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 55 IoCs

Processes:

chrome.exeiexplore.exePowerISO.exe

pid	process
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
984	iexplore.exe
2092	PowerISO.exe
2092	PowerISO.exe

Suspicious use of SendNotifyMessage 33 IoCs

Processes:

chrome.exePowerISO.exe

pid	process
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
268	chrome.exe
2092	PowerISO.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

PWRISOVM.EXEiexplore.exeIEXPLORE.EXEPowerISO.exe

pid process

2184 PWRISOVM.EXE
2184 PWRISOVM.EXE
984 iexplore.exe
984 iexplore.exe
736 IEXPLORE.EXE
736 IEXPLORE.EXE
2092 PowerISO.exe
2092 PowerISO.exe

pid	process
2184	PWRISOVM.EXE
2184	PWRISOVM.EXE
984	iexplore.exe
984	iexplore.exe
736	IEXPLORE.EXE
736	IEXPLORE.EXE
2092	PowerISO.exe
2092	PowerISO.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exechrome.exe

description	pid	process	target process
PID 2024 wrote to memory of 1916	2024	cmd.exe	isoburn.exe
PID 2024 wrote to memory of 1916	2024	cmd.exe	isoburn.exe
PID 2024 wrote to memory of 1916	2024	cmd.exe	isoburn.exe
PID 268 wrote to memory of 1460	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1460	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1460	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 2032	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1520	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1520	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1520	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe
PID 268 wrote to memory of 1436	268	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\June-06028_65-Report.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\June-06028_65-Report.iso"
2⤵
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ec4f50,0x7fef6ec4f60,0x7fef6ec4f70
2⤵
PID:1460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1052 /prefetch:2
2⤵
PID:2032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1388 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 /prefetch:8
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
2⤵
PID:1832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
2⤵
PID:1984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3276 /prefetch:2
2⤵
PID:1636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3448 /prefetch:8
2⤵
PID:2064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:8
2⤵
PID:2076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3652 /prefetch:8
2⤵
PID:2140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
2⤵
PID:2176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:8
2⤵
PID:2184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:8
2⤵
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:8
2⤵
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3812 /prefetch:8
2⤵
PID:2320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
2⤵
PID:2424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
2⤵
PID:2500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
2⤵
PID:2508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
2⤵
PID:2620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4668 /prefetch:8
2⤵
PID:2696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4764 /prefetch:8
2⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:2768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4368 /prefetch:8
2⤵
PID:2828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4416 /prefetch:8
2⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
PID:3068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
PID:3060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 /prefetch:8
2⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4900 /prefetch:8
2⤵
PID:3040

C:\Users\Admin\Downloads\PowerISO8-x64.exe
"C:\Users\Admin\Downloads\PowerISO8-x64.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
PID:2080

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u "C:\Program Files\PowerISO\PWRISOSH.DLL"
3⤵
PID:2256

C:\Program Files\PowerISO\devcon.exe
"C:\Program Files\PowerISO\devcon.exe" remove *scdbusDevice
3⤵
- Executes dropped EXE
PID:1560

C:\Program Files\PowerISO\setup64.exe
"C:\Program Files\PowerISO\setup64.exe" cp C:\Users\Admin\AppData\Local\Temp\nseFAD7.tmp "C:\Windows\system32\Drivers\scdemu.sys"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1048

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\PowerISO\PWRISOSH.DLL"
3⤵
- Loads dropped DLL
PID:2128

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files\PowerISO\PWRISOSH.DLL"
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2308

C:\Program Files\PowerISO\PWRISOVM.EXE
"C:\Program Files\PowerISO\PWRISOVM.EXE" 999
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.poweriso.com/thankyou.htm
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:984

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:984 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=544 /prefetch:8
2⤵
PID:1624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2412 /prefetch:8
2⤵
PID:2564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=632 /prefetch:8
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:8
2⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 /prefetch:8
2⤵
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 /prefetch:8
2⤵
PID:1660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=656 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
2⤵
PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5304 /prefetch:8
2⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4280 /prefetch:8
2⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:8
2⤵
PID:1944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=940,18162008149550183799,3825456137996483475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 /prefetch:8
2⤵
PID:364

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x534
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Program Files\PowerISO\PowerISO.exe
"C:\Program Files\PowerISO\PowerISO.exe" -pf C:\Users\Admin\AppData\Local\Temp\E496.tmp
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2092

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\PowerISO\PWRISOSH.DLL"
2⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2712

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" r7kom.dll, #1
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2468

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:1832

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\ChromeRecovery.exe
"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_1211053155\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={fde86788-15b7-4bd7-a7a1-98cafb998845} --system
2⤵
- Executes dropped EXE
PID:2580

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" r7kom.dll, #1
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2700

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\r7kom.dll
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\PowerISO\PWRISOSH.DLL

Filesize
325KB

MD5
751457ed43b489beb89b86fa01d0edf6

SHA1
e5c8c98de0e3e13f3102a89546ee811cbd4c9bf6

SHA256
dce4c19e87fa27dcbd82750edba77a95ef8e40845fbc8eb9f928bce0ea22179e

SHA512
5a9eb89f6fc27d2200db12cc01a670fe3382a9d5993cd9fcb7670b9ccbc2278a02a1aab92ec0cfa820f3f161dbcfa035e930cb9585d9e3bd3109fb5a2dac9590

Download Submit
C:\Program Files\PowerISO\PWRISOVM.EXE

Filesize
449KB

MD5
af7ede04850080dee68fe70e4e774530

SHA1
ca364f1790e31f4414d8a3f3b475e4008dd8f4b5

SHA256
526b768cd980f474751037bbc4db979764e0090c629cb40aa3fcfc107f04a641

SHA512
f4c0a27a3db4f73082f99a79cefaaa21f96583fc416a83896b83876e39264413cb3de5e8abb97be34c61e1d068c60c56b02ef7bb5c98913b9cd244a3ab789ad2

Download Submit
C:\Program Files\PowerISO\devcon.exe

Filesize
69KB

MD5
9d199564b65a91a531b23844649459e9

SHA1
8d84359ced1c51d14e70cb5ed36a6083c8b914cf

SHA256
8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42

SHA512
ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1

Download Submit
C:\Program Files\PowerISO\setup64.exe

Filesize
18KB

MD5
edda92af8f1a180c165f92951ed55a42

SHA1
1eb86ca757395527fd5d32bc3f8dbd482e3f6b51

SHA256
4d23f626854a739b5805199e710f9d4c55c4e89aa9dc00491cfbb0b990707738

SHA512
26a6f72544c8f4ea89af3b16a60e2a9f0d1e5f9575a14a43f0c96b78a6e8f29595b38c109688bd21418955b57d45805980dd2d1ea76504e08c94e09bb506f873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ezmz917\imagestore.dat

Filesize
9KB

MD5
5af5e4dd7376a0b402b380bb6b9e543a

SHA1
cbc5e0ca2637f39d0690dd23a15e58401e57f631

SHA256
2f2aec1087f6d91e37dcff2c53e4d887c6db487d363c28be9aa790cb99ece15e

SHA512
300ad8483a4331e38b3dee82b49e97a26aabd645db3b9b6b576ae5d9c8e2da8a9fcc26c896b406a01f83d7e90bc1eeccc316511e938642c9e5722a375a6aeac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseFAD7.tmp

Filesize
135KB

MD5
92eae8dec1f992db12aa23d9d55f264a

SHA1
add6697b8c1c71980e391619e81e0bada05e38ee

SHA256
d01a58e0a222e4d301b75ae80150d8cbc17f56b3f6458352d2c7c449be302eee

SHA512
443a12a1a49e388725ee347e650297ba5268d655acd08e623ea988cde07ae08ae861620b600fb223358339eeab926fee1c8377386501310c68a3eb9515649441

Download Submit
C:\Users\Admin\Downloads\PowerISO8-x64.exe

Filesize
4.3MB

MD5
7749f78b2213b9d29ad0a615cd9811b7

SHA1
ee24f55ecb0a4e2318f9a5a8a73af2679a395a79

SHA256
ddfda881e7f0806cec42e0148c9b357d0b877e95c03db491c5a66f516f4ba4bf

SHA512
16b9b2a669ad846934612fe2957cdb8799b7062f2a08bb9a68e16f222ff3ea1436a030e67ec43584255e51746d70cb6ce6a5e70101e7a9fd245e23ee34693446

Download Submit
C:\Users\Admin\Downloads\PowerISO8-x64.exe

Filesize
4.3MB

MD5
7749f78b2213b9d29ad0a615cd9811b7

SHA1
ee24f55ecb0a4e2318f9a5a8a73af2679a395a79

SHA256
ddfda881e7f0806cec42e0148c9b357d0b877e95c03db491c5a66f516f4ba4bf

SHA512
16b9b2a669ad846934612fe2957cdb8799b7062f2a08bb9a68e16f222ff3ea1436a030e67ec43584255e51746d70cb6ce6a5e70101e7a9fd245e23ee34693446

Download Submit
\??\pipe\crashpad_268_PLOQLELMBLZOWHYQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\PowerISO\PWRISOSH.DLL

Filesize
325KB

MD5
751457ed43b489beb89b86fa01d0edf6

SHA1
e5c8c98de0e3e13f3102a89546ee811cbd4c9bf6

SHA256
dce4c19e87fa27dcbd82750edba77a95ef8e40845fbc8eb9f928bce0ea22179e

SHA512
5a9eb89f6fc27d2200db12cc01a670fe3382a9d5993cd9fcb7670b9ccbc2278a02a1aab92ec0cfa820f3f161dbcfa035e930cb9585d9e3bd3109fb5a2dac9590

Download Submit
\Program Files\PowerISO\PWRISOSH.DLL

Filesize
325KB

MD5
751457ed43b489beb89b86fa01d0edf6

SHA1
e5c8c98de0e3e13f3102a89546ee811cbd4c9bf6

SHA256
dce4c19e87fa27dcbd82750edba77a95ef8e40845fbc8eb9f928bce0ea22179e

SHA512
5a9eb89f6fc27d2200db12cc01a670fe3382a9d5993cd9fcb7670b9ccbc2278a02a1aab92ec0cfa820f3f161dbcfa035e930cb9585d9e3bd3109fb5a2dac9590

Download Submit
\Program Files\PowerISO\PWRISOSH.DLL

Filesize
325KB

MD5
751457ed43b489beb89b86fa01d0edf6

SHA1
e5c8c98de0e3e13f3102a89546ee811cbd4c9bf6

SHA256
dce4c19e87fa27dcbd82750edba77a95ef8e40845fbc8eb9f928bce0ea22179e

SHA512
5a9eb89f6fc27d2200db12cc01a670fe3382a9d5993cd9fcb7670b9ccbc2278a02a1aab92ec0cfa820f3f161dbcfa035e930cb9585d9e3bd3109fb5a2dac9590

Download Submit
\Program Files\PowerISO\PWRISOVM.EXE

Filesize
449KB

MD5
af7ede04850080dee68fe70e4e774530

SHA1
ca364f1790e31f4414d8a3f3b475e4008dd8f4b5

SHA256
526b768cd980f474751037bbc4db979764e0090c629cb40aa3fcfc107f04a641

SHA512
f4c0a27a3db4f73082f99a79cefaaa21f96583fc416a83896b83876e39264413cb3de5e8abb97be34c61e1d068c60c56b02ef7bb5c98913b9cd244a3ab789ad2

Download Submit
\Program Files\PowerISO\PWRISOVM.EXE

Filesize
449KB

MD5
af7ede04850080dee68fe70e4e774530

SHA1
ca364f1790e31f4414d8a3f3b475e4008dd8f4b5

SHA256
526b768cd980f474751037bbc4db979764e0090c629cb40aa3fcfc107f04a641

SHA512
f4c0a27a3db4f73082f99a79cefaaa21f96583fc416a83896b83876e39264413cb3de5e8abb97be34c61e1d068c60c56b02ef7bb5c98913b9cd244a3ab789ad2

Download Submit
\Program Files\PowerISO\PWRISOVM.EXE

Filesize
449KB

MD5
af7ede04850080dee68fe70e4e774530

SHA1
ca364f1790e31f4414d8a3f3b475e4008dd8f4b5

SHA256
526b768cd980f474751037bbc4db979764e0090c629cb40aa3fcfc107f04a641

SHA512
f4c0a27a3db4f73082f99a79cefaaa21f96583fc416a83896b83876e39264413cb3de5e8abb97be34c61e1d068c60c56b02ef7bb5c98913b9cd244a3ab789ad2

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\PowerISO.exe

Filesize
5.7MB

MD5
5bcf67b332de5c126694d0247af2fc37

SHA1
55a6c8ac48c79f69b1be5e88e0ef8ac87bfa500c

SHA256
1cdeb23890e8017cb0cffebc5c8fdfda4f0eb1f2bc556ee7e078081ad3e8918e

SHA512
35b237312120a282fa667e9b6392b3e29a775f1fc1bc98eadf9bbcf8c32586db8960c5353588df0fea33e007dc1ca37612896e828253992a0b44329a55190796

Download Submit
\Program Files\PowerISO\devcon.exe

Filesize
69KB

MD5
9d199564b65a91a531b23844649459e9

SHA1
8d84359ced1c51d14e70cb5ed36a6083c8b914cf

SHA256
8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42

SHA512
ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1

Download Submit
\Program Files\PowerISO\devcon.exe

Filesize
69KB

MD5
9d199564b65a91a531b23844649459e9

SHA1
8d84359ced1c51d14e70cb5ed36a6083c8b914cf

SHA256
8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42

SHA512
ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1

Download Submit
\Program Files\PowerISO\setup64.exe

Filesize
18KB

MD5
edda92af8f1a180c165f92951ed55a42

SHA1
1eb86ca757395527fd5d32bc3f8dbd482e3f6b51

SHA256
4d23f626854a739b5805199e710f9d4c55c4e89aa9dc00491cfbb0b990707738

SHA512
26a6f72544c8f4ea89af3b16a60e2a9f0d1e5f9575a14a43f0c96b78a6e8f29595b38c109688bd21418955b57d45805980dd2d1ea76504e08c94e09bb506f873

Download Submit
\Program Files\PowerISO\setup64.exe

Filesize
18KB

MD5
edda92af8f1a180c165f92951ed55a42

SHA1
1eb86ca757395527fd5d32bc3f8dbd482e3f6b51

SHA256
4d23f626854a739b5805199e710f9d4c55c4e89aa9dc00491cfbb0b990707738

SHA512
26a6f72544c8f4ea89af3b16a60e2a9f0d1e5f9575a14a43f0c96b78a6e8f29595b38c109688bd21418955b57d45805980dd2d1ea76504e08c94e09bb506f873

Download Submit
\Program Files\PowerISO\setup64.exe

Filesize
18KB

MD5
edda92af8f1a180c165f92951ed55a42

SHA1
1eb86ca757395527fd5d32bc3f8dbd482e3f6b51

SHA256
4d23f626854a739b5805199e710f9d4c55c4e89aa9dc00491cfbb0b990707738

SHA512
26a6f72544c8f4ea89af3b16a60e2a9f0d1e5f9575a14a43f0c96b78a6e8f29595b38c109688bd21418955b57d45805980dd2d1ea76504e08c94e09bb506f873

Download Submit
\Program Files\PowerISO\uninstall.exe

Filesize
137KB

MD5
e4895fbcee307538dc6344371e649cc1

SHA1
9c2f028694e7d34215acb06901b2f1e4bb44e416

SHA256
5d987f547ac3dc7e9f28a6746af08d7c6fcfb869f2f2bcebf5ad54d1d89bd4ca

SHA512
d7a747f3f391122642d8e0598343d09399ee23934931ebc6995219892432eb2c9cb0dd4e4982ecab355a8984b1f69ee3884f692bf37385d71abbc6ef56dea418

Download Submit
\Users\Admin\AppData\Local\Temp\nstD56B.tmp\InstOpt.dll

Filesize
25KB

MD5
6a45ec125830c244261b28fe97fb9f9d

SHA1
f30e65fa3a84c9078bf29af4b4d08ec618a8e44f

SHA256
fa8b56b52dc7130d924d0060633b5763c032408385a47ec7438d5e1d481d2fe5

SHA512
5387439a2a1f235a2ffe934570db8ab200e2688496d2be39d8f6a47dc7fb55e6e30e957b5b2f6d79799581278bd57c03dc81908afa5e9707375a14ec8a34e4e2

Download Submit
\Users\Admin\AppData\Local\Temp\nstD56B.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit
memory/1048-96-0x0000000000000000-mapping.dmp

Download
memory/1560-92-0x0000000000000000-mapping.dmp

Download
memory/1916-76-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download
memory/2080-84-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/2080-82-0x0000000000000000-mapping.dmp

Download
memory/2128-109-0x0000000000000000-mapping.dmp

Download
memory/2184-113-0x0000000000000000-mapping.dmp

Download
memory/2256-87-0x0000000000000000-mapping.dmp

Download
memory/2308-118-0x0000000000000000-mapping.dmp

Download
memory/2468-129-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/2580-135-0x0000000000000000-mapping.dmp

Download
memory/2712-127-0x0000000000000000-mapping.dmp

Download

pid	process
2080	PowerISO8-x64.exe
1560	devcon.exe
1048	setup64.exe
2184	PWRISOVM.EXE
2092	PowerISO.exe
2580	ChromeRecovery.exe