gh0strat | 4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
19-07-2022 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
Size

652KB
MD5

54391783e53e77d358ae3fa2387133ff
SHA1

87e60f6aac8b0dec67c2b6390da2427bff83d94f
SHA256

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164
SHA512

f841c254c6a0dca8fcf4a5efa16882bfe32a5184d3489480234683448a67a4a6cfa3cf409094613d7c5ce69d4ce182ab5c16059eab9e318e93a49636fc4f2fa0

Score

10^/10

gh0strat ramnit banker rat spyware stealer trojan upx worm

Malware Config

Signatures

Gh0st RAT payload 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/640-67-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral1/memory/640-83-0x0000000000400000-0x00000000004A6000-memory.dmp	family_gh0strat
behavioral1/memory/640-86-0x00000000002D0000-0x00000000002FE000-memory.dmp	family_gh0strat
behavioral1/memory/640-85-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral1/memory/1932-115-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral1/memory/1932-116-0x00000000002F0000-0x000000000031E000-memory.dmp	family_gh0strat
behavioral1/memory/1932-123-0x0000000000400000-0x00000000004A6000-memory.dmp	family_gh0strat
behavioral1/memory/1932-124-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral1/memory/1412-152-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat
behavioral1/memory/1412-154-0x0000000000400000-0x00000000004A6000-memory.dmp	family_gh0strat
behavioral1/memory/1412-155-0x0000000010000000-0x000000001001E000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 14 IoCs

Processes:

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeDesktopLayer.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeDesktopLayer.exeOikwqcy.exeOikwqcySrv.exeDesktopLayer.exeOikwqcySrv.exeDesktopLayer.exeOikwqcy.exeOikwqcySrv.exeDesktopLayer.exeOikwqcySrv.exeDesktopLayer.exe

pid	process
1096	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
1104	DesktopLayer.exe
1500	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
1584	DesktopLayer.exe
1932	Oikwqcy.exe
676	OikwqcySrv.exe
1556	DesktopLayer.exe
888	OikwqcySrv.exe
1592	DesktopLayer.exe
1412	Oikwqcy.exe
1624	OikwqcySrv.exe
436	DesktopLayer.exe
2076	OikwqcySrv.exe
2112	DesktopLayer.exe

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1096-62-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1104-66-0x0000000000400000-0x000000000042E000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/640-84-0x0000000000250000-0x000000000027E000-memory.dmp	upx
\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/676-95-0x0000000000400000-0x000000000042E000-memory.dmp	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
C:\Program Files (x86)\OikwqcySrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx

Loads dropped DLL 12 IoCs

Processes:

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeOikwqcy.exeOikwqcySrv.exeOikwqcySrv.exeOikwqcy.exeOikwqcySrv.exeOikwqcySrv.exe

pid	process
640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
1096	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
1500	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
1932	Oikwqcy.exe
676	OikwqcySrv.exe
1932	Oikwqcy.exe
888	OikwqcySrv.exe
1412	Oikwqcy.exe
1624	OikwqcySrv.exe
1412	Oikwqcy.exe
2076	OikwqcySrv.exe

Drops file in System32 directory 64 IoCs

Processes:

iexplore.exeiexplore.exeie4uinit.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AC5622E1-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\VT106TFR.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\9I2XNN4P.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AC5622E1-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A9958BEE-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ABDF1E21-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\EVIXPHVM.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\Favorites\Links	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9958BE1-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ABDF1E23-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9958BE1-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9958BE1-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AC5622E4-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\WDHEIQIT.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[2].ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\FM0AS3R3.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[3].ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\suggestions[1].en-US	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\VT106TFR.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ABDF1E21-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\9I2XNN4P.txt	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A9958BED-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\M16J3S83.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\BXLBNQJ5.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ABDF1E21-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\C8146X4G.txt	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File created	C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url\:favicon:$DATA	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9958BE1-07B3-11ED-A2C6-4A5220D6602E}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\BXLBNQJ5.txt	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe

Drops file in Program Files directory 18 IoCs

Processes:

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeOikwqcy.exeOikwqcySrv.exeOikwqcySrv.exeOikwqcySrv.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeOikwqcySrv.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exeOikwqcy.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px752.tmp	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
File created	C:\Program Files (x86)\OikwqcySrv.exe	Oikwqcy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	OikwqcySrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	OikwqcySrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1C19.tmp	OikwqcySrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1ED7.tmp	OikwqcySrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxD2B.tmp	OikwqcySrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	OikwqcySrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px10C4.tmp	OikwqcySrv.exe
File created	C:\Program Files (x86)\Oikwqcy.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
File opened for modification	C:\Program Files (x86)\Oikwqcy.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB09.tmp	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
File opened for modification	C:\Program Files (x86)\OikwqcySrv.exe	Oikwqcy.exe
File opened for modification	C:\Program Files (x86)\OikwqcySrv.exe	Oikwqcy.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	OikwqcySrv.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8B5A391-07B3-11ED-A2C6-4A5220D6602E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365035354"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEie4uinit.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000004000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff55000000000000007503000058020000	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD3673BF-48A3-41C2-95E6-96B7F21C007E}\WpadDecision = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\Flags = "1024"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count = "2"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count = "5"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\Flags = "512"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\Flags = "512"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ie4uinit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e607070002001300160027002b00490102000000e11a542af65b6546a8a3cfa9672e4291644ea2ef78b0d01189e400c04fc9e26e	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 60994a6cc09bd801	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3c0000003c0000005c03000094020000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	ie4uinit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count = "5"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{DFFACDC5-679F-4156-8947-C5C76BC0B67F} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000a0d6456cc09bd801	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\F12	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aefb041b66cc4d44a9b68a26caeae81500000000020000000000106600000001000020000000ae93387589522bcd409512bfb1e3071d3a0ddec9ebf0f3a5087f5bb0fd213cd8000000000e8000000002000020000000ccba6defc0afc7b998d7925b736bdc654637ea61fd0d0ed44229df1fc95bcb72500000001edb94e138ca1e2b47cb2678545081410e438fa1a1a6d45e5e0641cae9c919e658fce92f9e72ebc4ee7ec9102ea3c28b9b050e36d284d57cd88ecba30eb1629cca048797eb3d31a6dcf75b1074e075d8400000003717ff9a6c42ab4445aebcc71f32c8203058fa11ced38e43780c34fc17000f96f5f36ba0f67dd3d71231353994ccded9cc3fb4b80f7e3d8258bb6df141793781	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\Software	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

DesktopLayer.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exeDesktopLayer.exeDesktopLayer.exeOikwqcy.exeDesktopLayer.exeDesktopLayer.exeOikwqcy.exeDesktopLayer.exe

pid	process
1104	DesktopLayer.exe
1104	DesktopLayer.exe
1104	DesktopLayer.exe
1104	DesktopLayer.exe
640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
1584	DesktopLayer.exe
1584	DesktopLayer.exe
1584	DesktopLayer.exe
1584	DesktopLayer.exe
1556	DesktopLayer.exe
1556	DesktopLayer.exe
1556	DesktopLayer.exe
1556	DesktopLayer.exe
1932	Oikwqcy.exe
1592	DesktopLayer.exe
1592	DesktopLayer.exe
1592	DesktopLayer.exe
1592	DesktopLayer.exe
436	DesktopLayer.exe
436	DesktopLayer.exe
436	DesktopLayer.exe
436	DesktopLayer.exe
1412	Oikwqcy.exe
2112	DesktopLayer.exe
2112	DesktopLayer.exe
2112	DesktopLayer.exe
2112	DesktopLayer.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe

pid process

640 4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe

Suspicious use of FindShellTrayWindow 20 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid	process
1192	iexplore.exe
1192	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
1776	iexplore.exe
888	iexplore.exe
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEOikwqcy.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEOikwqcy.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
1192	iexplore.exe
1192	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1192	iexplore.exe
1192	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1932	Oikwqcy.exe
1776	iexplore.exe
1776	iexplore.exe
548	IEXPLORE.EXE
548	IEXPLORE.EXE
1776	iexplore.exe
1776	iexplore.exe
696	IEXPLORE.EXE
696	IEXPLORE.EXE
1412	Oikwqcy.exe
888	iexplore.exe
888	iexplore.exe
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
2144	iexplore.exe
2144	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
696	IEXPLORE.EXE
696	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeDesktopLayer.exeiexplore.exe4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exeDesktopLayer.exeOikwqcy.exeOikwqcySrv.exeDesktopLayer.exeiexplore.exeOikwqcySrv.exeDesktopLayer.exe

description	pid	process	target process
PID 640 wrote to memory of 1096	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 640 wrote to memory of 1096	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 640 wrote to memory of 1096	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 640 wrote to memory of 1096	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 1096 wrote to memory of 1104	1096	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1096 wrote to memory of 1104	1096	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1096 wrote to memory of 1104	1096	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1096 wrote to memory of 1104	1096	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1104 wrote to memory of 1192	1104	DesktopLayer.exe	iexplore.exe
PID 1104 wrote to memory of 1192	1104	DesktopLayer.exe	iexplore.exe
PID 1104 wrote to memory of 1192	1104	DesktopLayer.exe	iexplore.exe
PID 1104 wrote to memory of 1192	1104	DesktopLayer.exe	iexplore.exe
PID 1192 wrote to memory of 1980	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1980	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1980	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1980	1192	iexplore.exe	IEXPLORE.EXE
PID 640 wrote to memory of 1500	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 640 wrote to memory of 1500	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 640 wrote to memory of 1500	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 640 wrote to memory of 1500	640	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
PID 1500 wrote to memory of 1584	1500	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1500 wrote to memory of 1584	1500	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1500 wrote to memory of 1584	1500	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1500 wrote to memory of 1584	1500	4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe	DesktopLayer.exe
PID 1584 wrote to memory of 1532	1584	DesktopLayer.exe	iexplore.exe
PID 1584 wrote to memory of 1532	1584	DesktopLayer.exe	iexplore.exe
PID 1584 wrote to memory of 1532	1584	DesktopLayer.exe	iexplore.exe
PID 1584 wrote to memory of 1532	1584	DesktopLayer.exe	iexplore.exe
PID 1192 wrote to memory of 1484	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1484	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1484	1192	iexplore.exe	IEXPLORE.EXE
PID 1192 wrote to memory of 1484	1192	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 676	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 1932 wrote to memory of 676	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 1932 wrote to memory of 676	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 1932 wrote to memory of 676	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 676 wrote to memory of 1556	676	OikwqcySrv.exe	DesktopLayer.exe
PID 676 wrote to memory of 1556	676	OikwqcySrv.exe	DesktopLayer.exe
PID 676 wrote to memory of 1556	676	OikwqcySrv.exe	DesktopLayer.exe
PID 676 wrote to memory of 1556	676	OikwqcySrv.exe	DesktopLayer.exe
PID 1556 wrote to memory of 1776	1556	DesktopLayer.exe	iexplore.exe
PID 1556 wrote to memory of 1776	1556	DesktopLayer.exe	iexplore.exe
PID 1556 wrote to memory of 1776	1556	DesktopLayer.exe	iexplore.exe
PID 1556 wrote to memory of 1776	1556	DesktopLayer.exe	iexplore.exe
PID 1776 wrote to memory of 1712	1776	iexplore.exe	ie4uinit.exe
PID 1776 wrote to memory of 1712	1776	iexplore.exe	ie4uinit.exe
PID 1776 wrote to memory of 1712	1776	iexplore.exe	ie4uinit.exe
PID 1776 wrote to memory of 548	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 548	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 548	1776	iexplore.exe	IEXPLORE.EXE
PID 1776 wrote to memory of 548	1776	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 888	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 1932 wrote to memory of 888	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 1932 wrote to memory of 888	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 1932 wrote to memory of 888	1932	Oikwqcy.exe	OikwqcySrv.exe
PID 888 wrote to memory of 1592	888	OikwqcySrv.exe	DesktopLayer.exe
PID 888 wrote to memory of 1592	888	OikwqcySrv.exe	DesktopLayer.exe
PID 888 wrote to memory of 1592	888	OikwqcySrv.exe	DesktopLayer.exe
PID 888 wrote to memory of 1592	888	OikwqcySrv.exe	DesktopLayer.exe
PID 1592 wrote to memory of 1948	1592	DesktopLayer.exe	iexplore.exe
PID 1592 wrote to memory of 1948	1592	DesktopLayer.exe	iexplore.exe
PID 1592 wrote to memory of 1948	1592	DesktopLayer.exe	iexplore.exe
PID 1592 wrote to memory of 1948	1592	DesktopLayer.exe	iexplore.exe
PID 1776 wrote to memory of 696	1776	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe
"C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1096

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275460 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1532

C:\Program Files (x86)\Oikwqcy.exe
"C:\Program Files (x86)\Oikwqcy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Program Files (x86)\OikwqcySrv.exe
"C:\Program Files (x86)\OikwqcySrv.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:676

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\System32\ie4uinit.exe
"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1712

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:406533 /prefetch:2
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:696

C:\Program Files (x86)\OikwqcySrv.exe
"C:\Program Files (x86)\OikwqcySrv.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:888

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1948

C:\Program Files (x86)\Oikwqcy.exe
"C:\Program Files (x86)\Oikwqcy.exe" Win7
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412

C:\Program Files (x86)\OikwqcySrv.exe
"C:\Program Files (x86)\OikwqcySrv.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1624

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:888

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:888 CREDAT:275457 /prefetch:2
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Program Files (x86)\OikwqcySrv.exe
"C:\Program Files (x86)\OikwqcySrv.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2076

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2112

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2144

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Oikwqcy.exe
Filesize
652KB

MD5
54391783e53e77d358ae3fa2387133ff

SHA1
87e60f6aac8b0dec67c2b6390da2427bff83d94f

SHA256
4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164

SHA512
f841c254c6a0dca8fcf4a5efa16882bfe32a5184d3489480234683448a67a4a6cfa3cf409094613d7c5ce69d4ce182ab5c16059eab9e318e93a49636fc4f2fa0

Download Submit
C:\Program Files (x86)\Oikwqcy.exe
Filesize
652KB

MD5
54391783e53e77d358ae3fa2387133ff

SHA1
87e60f6aac8b0dec67c2b6390da2427bff83d94f

SHA256
4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164

SHA512
f841c254c6a0dca8fcf4a5efa16882bfe32a5184d3489480234683448a67a4a6cfa3cf409094613d7c5ce69d4ce182ab5c16059eab9e318e93a49636fc4f2fa0

Download Submit
C:\Program Files (x86)\Oikwqcy.exe
Filesize
652KB

MD5
54391783e53e77d358ae3fa2387133ff

SHA1
87e60f6aac8b0dec67c2b6390da2427bff83d94f

SHA256
4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164

SHA512
f841c254c6a0dca8fcf4a5efa16882bfe32a5184d3489480234683448a67a4a6cfa3cf409094613d7c5ce69d4ce182ab5c16059eab9e318e93a49636fc4f2fa0

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0RY99WT6.txt
Filesize
608B

MD5
9b36c5d895f4ea6257a44866593faad9

SHA1
20ec71d0fe1936437b2b1f3f26a26aeb94f0dbb5

SHA256
84f0c9ceb2909b0f0d185ab1322abb67b1693afb241749a2f487e983b5ba066a

SHA512
95df4e1c1a99cb0350c573418e2c39a633da54399aba787c371ee4c93dcb8a1e8f508a7d2dd299698c031ff80435fa33de00b961caf058bf86f0e3db125310e0

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Filesize
402B

MD5
881dfac93652edb0a8228029ba92d0f5

SHA1
5b317253a63fecb167bf07befa05c5ed09c4ccea

SHA256
a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

SHA512
592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9958BE1-07B3-11ED-A2C6-4A5220D6602E}.dat
Filesize
6KB

MD5
dc67a41f3e80ec67953234ac4f052b78

SHA1
e9cd73e1453c18725505917946d56b2c03444f9c

SHA256
e919242895c7e6df570ef88e77f380d79b261db82363cca28eebd5730f8dfbbf

SHA512
c4ffd644a93dc6605562a457e2f8f68e4c7745b6955971a5cb97315f8decd71bbb6d5f79b4b8292a99640af377247e13c8a9fe50b24eca79b45f28d424e1f7ef

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ABDF1E21-07B3-11ED-A2C6-4A5220D6602E}.dat
Filesize
5KB

MD5
6063b2f8ab1b6b47838873dd320361f6

SHA1
0f07159971070e77b0618c2bdc19a7792d01f336

SHA256
f3b80f1853d90c0c09bba35a383ffbc77b2071701ab053b95f87dc073333444b

SHA512
79db88f7d9bf468a9a3bd5fc26886d99aa637c4ba7405db4f5785f229cae57ea7709f7b0953cde071900ccb7720298ccbb5f6508b8f085a92214ee63f33ab450

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\OikwqcySrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\4fc60f75b420041eef18cd7134b1785b112eeb3f8331fa05c655204a18436164Srv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/436-131-0x0000000000000000-mapping.dmp

Download
memory/640-54-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/640-156-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/640-84-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/640-67-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/640-83-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/640-86-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download
memory/640-85-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/676-95-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/676-89-0x0000000000000000-mapping.dmp

Download
memory/888-105-0x0000000000000000-mapping.dmp

Download
memory/1096-56-0x0000000000000000-mapping.dmp

Download
memory/1096-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1104-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1104-61-0x0000000000000000-mapping.dmp

Download
memory/1412-118-0x0000000000000000-mapping.dmp

Download
memory/1412-155-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1412-154-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1412-153-0x0000000000260000-0x000000000028E000-memory.dmp

Filesize
184KB

Download
memory/1412-122-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1412-152-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1500-72-0x0000000000000000-mapping.dmp

Download
memory/1556-94-0x0000000000000000-mapping.dmp

Download
memory/1584-77-0x0000000000000000-mapping.dmp

Download
memory/1592-110-0x0000000000000000-mapping.dmp

Download
memory/1624-126-0x0000000000000000-mapping.dmp

Download
memory/1712-99-0x0000000000000000-mapping.dmp

Download
memory/1932-123-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1932-87-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1932-124-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1932-116-0x00000000002F0000-0x000000000031E000-memory.dmp

Filesize
184KB

Download
memory/1932-121-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download
memory/1932-114-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/1932-115-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2076-142-0x0000000000000000-mapping.dmp

Download
memory/2112-147-0x0000000000000000-mapping.dmp

Download