joker | ef7f698497ec7f0ad7db6f37af6662cca2f9fc6e5ca9867a5a1201e8d81859b9

Analysis

max time kernel
563s
max time network
571s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2022 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AdsPower-Global-4.10.18-x64.exe
Size

173.8MB
MD5

4ba2d52786e2bcd0d9447ec1de087adb
SHA1

a8685d4f9eea009ebd2cfb5e2807987fc0870a45
SHA256

ef7f698497ec7f0ad7db6f37af6662cca2f9fc6e5ca9867a5a1201e8d81859b9
SHA512

b991a8ebf7d68be3aef896f9dcfb6fbf484f3be06cc3478183b2414659499c4d0877a8f169b727e120e9f1f491f20fd202cc322e6b4b211bb81512648280495a
SSDEEP

3145728:8ZwolUi8zduNIAR5Nt0jycVLS0r4uf/MHqyyhSNByH/BbcW+SnXieo01M:ClUZ5QIs/mxVLgu3QqJhSNBsV+e1M

Score

10^/10

joker discovery infostealer persistence ransomware trojan

Malware Config

Extracted

Path

C:\Program Files\AdsPower Global\LICENSES.chromium.html

Ransom Note

<!doctype html> <html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="color-scheme" content="light dark"> <title>Credits</title> <link rel="stylesheet" href="chrome://resources/css/text_defaults.css"> <style> html { --google-blue-50: rgb(232, 240, 254); --google-blue-300: rgb(138, 180, 248); --google-blue-600: rgb(26, 115, 232); --google-blue-900: rgb(23, 78, 166); --google-grey-200: rgb(232, 234, 237); --google-grey-800: rgb(60, 64, 67); --google-grey-900: rgb(32, 33, 36); --interactive-color: var(--google-blue-600); --primary-color: var(--google-grey-900); --product-background: var(--google-blue-50); --product-text-color: var(--google-blue-900); background: white; } @media (prefers-color-scheme: dark) { html { --interactive-color: var(--google-blue-300); --primary-color: var(--google-grey-200); --product-background: var(--google-grey-800); --product-text-color: var(--google-grey-200); background: var(--google-grey-900); } } body { color: var(--primary-color); font-size: 84%; max-width: 1020px; } a { color: var(--interactive-color); } .page-title { font-size: 164%; font-weight: bold; } .product { background-color: var(--product-background); color: var(--product-text-color); border-radius: 5px; margin-top: 16px; overflow: auto; padding: 2px; } .product .title { float: left; font-size: 110%; font-weight: bold; margin: 3px; } .product .homepage { color: var(--interactive-color); float: right; margin: 3px; text-align: right; } .product .homepage::before { content: " - "; } .product .show { color: var(--interactive-color); float: right; margin: 3px; text-align: right; text-decoration: underline; } .licence { border-radius: 3px; clear: both; display: none; padding: 16px; } .licence h3 { margin-top: 0; } .licence pre { white-space: pre-wrap; } .dialog #print-link, .dialog .homepage { display: none; } input + label + div { display: none; } input + label::after { content: "show license"; cursor: pointer; } input:checked + label + div { display: block; } input:checked + label::after { content: "hide license"; cursor: pointer; } </style> </head> <body> <span class="page-title" style="float:left;">Credits</span> <a id="print-link" href="#" style="float:right;" hidden>Print</a> <div style="clear:both; overflow:auto;"> <div class="product"> <span class="title">Abseil</span> <span class="homepage"><a href="https://github.com/abseil/abseil-cpp">homepage</a></span> <input type="checkbox" hidden id="0"> <label class="show" for="0" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 https://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. </pre> </div> </div> <div class="product"> <span class="title">Accessibility Audit library, from Accessibility Developer Tools</span> <span class="homepage"><a href="https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js">homepage</a></span> <input type="checkbox" hidden id="1"> <label class="show" for="1" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but

Emails

[email protected]

[email protected])"

[email protected]

<[email protected]&gt

[email protected]

<[email protected]&gt

URLs

https://www.apache.org/licenses/

https://www.apache.org/licenses/LICENSE-2.0

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

http://mozilla.org/MPL/2.0/

http://www.torchmobile.com/

https://cla.developers.google.com/clas

http://www.openssl.org/)"

https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS

http://www.opensource.apple.com/apsl/

http://freetype.sourceforge.net/license.html

http://www.freetype.org

https://llvm.org/docs/DeveloperPolicy.html#legacy

http://llvm.org

http://source.android.com/

http://source.android.com/compatibility

http://www.unicode.org/copyright.html

http://opensource.org/licenses/bsd-license.php

https://sourceforge.net/project/?group_id=1519

http://chasen.aist-nara.ac.jp/chasen/distribution.html

Extracted

Family

joker

https://mix-file.oss-ap-southeast-1.aliyuncs.com

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 16 IoCs

pid	Process
4904	AdsPower Global.exe
3620	AdsPower Global.exe
3588	AdsPower Global.exe
3876	AdsPower Global.exe
4072	AdsPower Global.exe
3472	AdsPower Global.exe
2352	AdsPower Global.exe
4772	fastlist-0.3.0-x64.exe
4224	AdsPower Global.exe
4820	AdsPower Global.exe
4488	AdsPower Global.exe
4052	AdsPower Global.exe
4980	AdsPower Global.exe
4928	AdsPower Global.exe
3420	AdsPower Global.exe
4944	fastlist-0.3.0-x64.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AdsPower Global.exe

Loads dropped DLL 35 IoCs

pid	Process
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
4904	AdsPower Global.exe
3620	AdsPower Global.exe
3588	AdsPower Global.exe
3876	AdsPower Global.exe
3588	AdsPower Global.exe
3588	AdsPower Global.exe
3588	AdsPower Global.exe
4072	AdsPower Global.exe
3472	AdsPower Global.exe
3472	AdsPower Global.exe
2352	AdsPower Global.exe
648	taskmgr.exe
4224	AdsPower Global.exe
4820	AdsPower Global.exe
4488	AdsPower Global.exe
4052	AdsPower Global.exe
4488	AdsPower Global.exe
4488	AdsPower Global.exe
4488	AdsPower Global.exe
4980	AdsPower Global.exe
4928	AdsPower Global.exe
4928	AdsPower Global.exe
3420	AdsPower Global.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	AdsPower Global.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	AdsPower Global.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AdsPower Global\resources\elevate.exe	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\libGLESv2.dll	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\nl.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\zh-CN.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\resources\app.asar	AdsPower-Global-4.10.18-x64.exe
File opened for modification	C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\ffmpeg.dll	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\snapshot_blob.bin	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\hr.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\zh-TW.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\id.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\ml.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\uninstallerIcon.ico	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\v8_context_snapshot.bin	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\vulkan-1.dll	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\hi.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\sw.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\license	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\chrome_100_percent.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\bg.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\he.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\kn.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\sl.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\th.pak	AdsPower-Global-4.10.18-x64.exe
File opened for modification	C:\Program Files\AdsPower Global\resources\app.asar.unpacked	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\swiftshader\libEGL.dll	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\Uninstall AdsPower Global.exe	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\cs.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\fr.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\lt.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\uk.pak	AdsPower-Global-4.10.18-x64.exe
File opened for modification	C:\Program Files\AdsPower Global\AdsPower Global.exe	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\d3dcompiler_47.dll	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\el.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\ro.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\fa.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\fi.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\ms.pak	AdsPower-Global-4.10.18-x64.exe
File opened for modification	C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\libEGL.dll	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\vk_swiftshader_icd.json	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\de.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\en-US.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\bn.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\da.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\lv.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\nb.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\te.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\icudtl.dat	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\am.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\es-419.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\et.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\hu.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\mr.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\pt-BR.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\sk.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\LICENSES.chromium.html	AdsPower-Global-4.10.18-x64.exe
File opened for modification	C:\Program Files\AdsPower Global\locales	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\ar.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\gu.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\locales\sr.pak	AdsPower-Global-4.10.18-x64.exe
File created	C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\package.json	AdsPower-Global-4.10.18-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3772	WMIC.exe

Enumerates processes with tasklist 1 TTPs 38 IoCs

Process Discovery

T1057

pid	Process
2200	tasklist.exe
4308	tasklist.exe
2368	tasklist.exe
1216	tasklist.exe
5096	tasklist.exe
2332	tasklist.exe
4180	tasklist.exe
3276	tasklist.exe
4604	tasklist.exe
448	tasklist.exe
5092	tasklist.exe
4084	tasklist.exe
4584	tasklist.exe
3440	tasklist.exe
2140	tasklist.exe
916	tasklist.exe
4020	tasklist.exe
1088	tasklist.exe
3372	tasklist.exe
5048	tasklist.exe
1144	tasklist.exe
2428	tasklist.exe
4756	tasklist.exe
4480	tasklist.exe
3504	tasklist.exe
3128	tasklist.exe
4276	tasklist.exe
1724	tasklist.exe
3228	tasklist.exe
1412	tasklist.exe
2008	tasklist.exe
480	tasklist.exe
2412	tasklist.exe
4236	tasklist.exe
4712	tasklist.exe
4528	tasklist.exe
916	tasklist.exe
3092	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1596	NETSTAT.EXE
3408	NETSTAT.EXE
2224	NETSTAT.EXE
2680	NETSTAT.EXE

Kills process with taskkill 2 IoCs

evasion

pid	Process
1768	taskkill.exe
1640	taskkill.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\URL Protocol	AdsPower-Global-4.10.18-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\shell\Open	AdsPower-Global-4.10.18-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\shell\Open\command\ = "C:\\Program Files\\AdsPower Global\\AdsPower Global.exe %1"	AdsPower-Global-4.10.18-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal	AdsPower-Global-4.10.18-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\shell	AdsPower-Global-4.10.18-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\shell\	AdsPower-Global-4.10.18-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\shell\Open\	AdsPower-Global-4.10.18-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\shell\Open\command	AdsPower-Global-4.10.18-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adsPowerGlobal\ = "URL:adsPowerGlobal"	AdsPower-Global-4.10.18-x64.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AdsPower Global.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AdsPower Global.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AdsPower Global.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	AdsPower Global.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	AdsPower Global.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	AdsPower Global.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AdsPower Global.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AdsPower Global.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3224	AdsPower-Global-4.10.18-x64.exe
3876	AdsPower Global.exe
3876	AdsPower Global.exe
4072	AdsPower Global.exe
4072	AdsPower Global.exe
3472	AdsPower Global.exe
3472	AdsPower Global.exe
2352	AdsPower Global.exe
2352	AdsPower Global.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
924	taskmgr.exe
648	taskmgr.exe
2232	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3224	AdsPower-Global-4.10.18-x64.exe
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3772	WMIC.exe
Token: SeSecurityPrivilege	3772	WMIC.exe
Token: SeTakeOwnershipPrivilege	3772	WMIC.exe
Token: SeLoadDriverPrivilege	3772	WMIC.exe
Token: SeSystemProfilePrivilege	3772	WMIC.exe
Token: SeSystemtimePrivilege	3772	WMIC.exe
Token: SeProfSingleProcessPrivilege	3772	WMIC.exe
Token: SeIncBasePriorityPrivilege	3772	WMIC.exe
Token: SeCreatePagefilePrivilege	3772	WMIC.exe
Token: SeBackupPrivilege	3772	WMIC.exe
Token: SeRestorePrivilege	3772	WMIC.exe
Token: SeShutdownPrivilege	3772	WMIC.exe
Token: SeDebugPrivilege	3772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3772	WMIC.exe
Token: SeRemoteShutdownPrivilege	3772	WMIC.exe
Token: SeUndockPrivilege	3772	WMIC.exe
Token: SeManageVolumePrivilege	3772	WMIC.exe
Token: 33	3772	WMIC.exe
Token: 34	3772	WMIC.exe
Token: 35	3772	WMIC.exe
Token: 36	3772	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4904	AdsPower Global.exe
4904	AdsPower Global.exe
4904	AdsPower Global.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
4904	AdsPower Global.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4904	AdsPower Global.exe
4904	AdsPower Global.exe
4904	AdsPower Global.exe
4904	AdsPower Global.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
4904	AdsPower Global.exe
4904	AdsPower Global.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe
924	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3620	4904	AdsPower Global.exe	94
PID 4904 wrote to memory of 3620	4904	AdsPower Global.exe	94
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3588	4904	AdsPower Global.exe	95
PID 4904 wrote to memory of 3876	4904	AdsPower Global.exe	96
PID 4904 wrote to memory of 3876	4904	AdsPower Global.exe	96
PID 4904 wrote to memory of 4072	4904	AdsPower Global.exe	97
PID 4904 wrote to memory of 4072	4904	AdsPower Global.exe	97
PID 4904 wrote to memory of 3472	4904	AdsPower Global.exe	100
PID 4904 wrote to memory of 3472	4904	AdsPower Global.exe	100
PID 3472 wrote to memory of 5088	3472	AdsPower Global.exe	102
PID 3472 wrote to memory of 5088	3472	AdsPower Global.exe	102
PID 5088 wrote to memory of 4132	5088	cmd.exe	104
PID 5088 wrote to memory of 4132	5088	cmd.exe	104
PID 3472 wrote to memory of 4520	3472	AdsPower Global.exe	103
PID 3472 wrote to memory of 4520	3472	AdsPower Global.exe	103
PID 4520 wrote to memory of 3772	4520	cmd.exe	106
PID 4520 wrote to memory of 3772	4520	cmd.exe	106
PID 3472 wrote to memory of 2988	3472	AdsPower Global.exe	109
PID 3472 wrote to memory of 2988	3472	AdsPower Global.exe	109
PID 2988 wrote to memory of 2972	2988	cmd.exe	108
PID 2988 wrote to memory of 2972	2988	cmd.exe	108
PID 4904 wrote to memory of 2352	4904	AdsPower Global.exe	110
PID 4904 wrote to memory of 2352	4904	AdsPower Global.exe	110
PID 3472 wrote to memory of 3872	3472	AdsPower Global.exe	111
PID 3472 wrote to memory of 3872	3472	AdsPower Global.exe	111

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\AdsPower-Global-4.10.18-x64.exe
"C:\Users\Admin\AppData\Local\Temp\AdsPower-Global-4.10.18-x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Program Files\AdsPower Global\AdsPower Global.exe
"C:\Program Files\AdsPower Global\AdsPower Global.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\adspower_global /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\adspower_global\Crashpad --url=https://logger.adspower.net/api/robotlog --annotation=_companyName=mix "--annotation=_productName=AdsPower Browser" --annotation=_version=4.10.18 --annotation=prod=Electron --annotation=ver=11.3.0 --initial-client-data=0x428,0x42c,0x430,0x404,0x434,0x7ff61eb1d5e8,0x7ff61eb1d5f8,0x7ff61eb1d608
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3620
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=gpu-process --field-trial-handle=1628,11747237252005202305,4054725860001503536,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1636 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3588
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,11747237252005202305,4054725860001503536,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=renderer --field-trial-handle=1628,11747237252005202305,4054725860001503536,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-user-model-id="electron.app.AdsPower Global" --app-path="C:\Program Files\AdsPower Global\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" C:\Users\Admin\AppData\Roaming\adspower_global\cwd_global\lib\main.min.js
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model,manufacturer/format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model,manufacturer/format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get Caption,freeSpace,DriveType /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get Caption,freeSpace,DriveType /format:list
      4⤵
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h C:\.ADSPOWER_GLOBAL"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3908
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1144
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=renderer --field-trial-handle=1628,11747237252005202305,4054725860001503536,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="electron.app.AdsPower Global" --app-path="C:\Program Files\AdsPower Global\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe
  "C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill -PID SunBrowser.exe"
  2⤵
  PID:5092
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3976
- - C:\Windows\system32\taskkill.exe
    taskkill -PID SunBrowser.exe
    3⤵
    - Kills process with taskkill
    PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\system32\attrib.exe
attrib +h C:\.ADSPOWER_GLOBAL
1⤵
- Views/modifies file attributes
PID:2972

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:924

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:4712

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:648

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4060
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - Gathers network information
  PID:1596
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - Gathers network information
  PID:3408
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - Gathers network information
  PID:2224
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - Gathers network information
  PID:2680

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:2232

C:\Program Files\AdsPower Global\AdsPower Global.exe
"C:\Program Files\AdsPower Global\AdsPower Global.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
PID:4224
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\adspower_global /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\adspower_global\Crashpad --url=https://logger.adspower.net/api/robotlog --annotation=_companyName=mix "--annotation=_productName=AdsPower Browser" --annotation=_version=4.10.18 --annotation=prod=Electron --annotation=ver=11.3.0 --initial-client-data=0x428,0x42c,0x430,0x404,0x434,0x7ff61eb1d5e8,0x7ff61eb1d5f8,0x7ff61eb1d608
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4820
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=gpu-process --field-trial-handle=1556,1662887745248583131,9357829766271808043,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1564 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4488
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,1662887745248583131,9357829766271808043,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4052
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" C:\Users\Admin\AppData\Roaming\adspower_global\cwd_global\lib\main.min.js
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model,manufacturer/format:list"
    3⤵
    PID:2680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model,manufacturer/format:list
      4⤵
      PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4768
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4320
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1216
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=renderer --field-trial-handle=1556,1662887745248583131,9357829766271808043,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-user-model-id="electron.app.AdsPower Global" --app-path="C:\Program Files\AdsPower Global\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  PID:4980
- C:\Program Files\AdsPower Global\AdsPower Global.exe
  "C:\Program Files\AdsPower Global\AdsPower Global.exe" --type=renderer --field-trial-handle=1556,1662887745248583131,9357829766271808043,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id="electron.app.AdsPower Global" --app-path="C:\Program Files\AdsPower Global\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  PID:3420
- C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe
  "C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill -PID SunBrowser.exe"
  2⤵
  PID:3504
- - C:\Windows\system32\taskkill.exe
    taskkill -PID SunBrowser.exe
    3⤵
    - Kills process with taskkill
    PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\AdsPower Global.exe

Filesize
120.4MB

MD5
87d8afaa4289a5576e1c9741661913f7

SHA1
270e5c325e3ced01c06365d4ec015921c8a936b0

SHA256
233d27e371c04dedb2796f9d2e72d59bbc3955296b153ed8a7e173a1df18ce21

SHA512
01435e2cc9049006bf4a955f1ed5a895ecaff999e6ac1b3f1012cc530c41bd1da11b9f08ceb5b38895de3c815a2e90017aab2d77ad30f3391cb2e53da2543b81

Download Submit
C:\Program Files\AdsPower Global\D3DCompiler_47.dll

Filesize
4.3MB

MD5
e7e8d933de822f88addf8591485eebb2

SHA1
335e521636acaea7766870596434d119f99a7a2b

SHA256
c3680d1f1f61b92bbca4bcaed71b14b5aef0e7b54c63fb9959e830499a6cb071

SHA512
2ffd454e021738f0651bc0bc80402353823c8140ea423e547248485b1a771ff71b37e507c99f78322d31896c1084303336dced279f9b6f3e9089e6dda7633f66

Download Submit
C:\Program Files\AdsPower Global\chrome_100_percent.pak

Filesize
121KB

MD5
06baf0ad34e0231bd76651203dba8326

SHA1
a5f99ecdcc06dec9d7f9ce0a8c66e46969117391

SHA256
5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189

SHA512
aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

Download Submit
C:\Program Files\AdsPower Global\chrome_200_percent.pak

Filesize
181KB

MD5
57c27201e7cd33471da7ec205fe9973c

SHA1
a8e7bce09c4cbdae2797611b2be8aeb5491036f9

SHA256
dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b

SHA512
57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

Download Submit
C:\Program Files\AdsPower Global\d3dcompiler_47.dll

Filesize
4.3MB

MD5
e7e8d933de822f88addf8591485eebb2

SHA1
335e521636acaea7766870596434d119f99a7a2b

SHA256
c3680d1f1f61b92bbca4bcaed71b14b5aef0e7b54c63fb9959e830499a6cb071

SHA512
2ffd454e021738f0651bc0bc80402353823c8140ea423e547248485b1a771ff71b37e507c99f78322d31896c1084303336dced279f9b6f3e9089e6dda7633f66

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\ffmpeg.dll

Filesize
2.7MB

MD5
8bf15122c6ed5a35354067aba38278c3

SHA1
85b5be6325404fa68c560d8de8bbf07125b738ad

SHA256
af323df235e6103dd434143692c5f286a08d9561a1b0bf788f24af36baea4c65

SHA512
14ce489e109ecf1662fc850b6e22495070c5c59c7abc27c4301bed3d5294073f1a97257bcb2db20ce9cc5adb59ea98ff7e5c6d94a68561dfa152bfa6106e3cfd

Download Submit
C:\Program Files\AdsPower Global\icudtl.dat

Filesize
10.0MB

MD5
ad2988770b8cb3281a28783ad833a201

SHA1
94b7586ee187d9b58405485f4c551b55615f11b5

SHA256
df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108

SHA512
f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

Download Submit
C:\Program Files\AdsPower Global\locales\en-US.pak

Filesize
83KB

MD5
bd8f7b719110342b7cefb16ddd05ec55

SHA1
82a79aeaa1dd4b1464b67053ba1766a4498c13e7

SHA256
d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de

SHA512
7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e

Download Submit
C:\Program Files\AdsPower Global\resources.pak

Filesize
4.8MB

MD5
d13873f6fb051266deb3599b14535806

SHA1
143782c0ce5a5773ae0aae7a22377c8a6d18a5b2

SHA256
7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506

SHA512
1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

Download Submit
C:\Program Files\AdsPower Global\resources\app.asar

Filesize
142.9MB

MD5
5a8a5fa7922cdeb3acd31ef09ae42457

SHA1
b4ebe87d41d4e0d517630d5dd4b979ed1c5ef7f0

SHA256
5730db096e98fc650e1847bb002e630b6c2ca5627ed7a6ba36e1773b3cf64b11

SHA512
6f9f138e4d38ff135ca3b632eea39046e9373dbd60f759a1e86723b72e0c5b6a11529f7ed793bdada3b88b3cf1692a85c3e5d15835b0004f7c4a0f96edacf2ed

Download Submit
C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\index.js

Filesize
4KB

MD5
32385488335d3acbac238ae79c09256b

SHA1
6945ac03e7581574c5e9dc0b943d89f13eb6bc81

SHA256
fb267dc224440784ece7cac39c0143d79420a206ac8054d5cec1bc702a885a9c

SHA512
76fbdc4e34e68acdbac018c73d937a3da3cad307e417174f9b52db26959388d23f9bb502f9b4f64e44f62565d675dedaabb4f4f3b0f3dbae088b284c96a8bfbe

Download Submit
C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\package.json

Filesize
522B

MD5
fab8c951d36e58fc69feaeb3a5edc356

SHA1
d304db544078dd0a5095d4a86ef92c650a176895

SHA256
6784a7400f302ef6ea92423c0542ebb4babbe8f42c3d9ab857243f58a962f2ad

SHA512
ab09b51d7d0f0f029b563b8aef9371419c9ae414703742a9c8802acbe3a30111beaa7b485eafb5aeb103b8cf2f2c75853f9bb7b098809e6969cbaad8878003c2

Download Submit
C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

Filesize
276KB

MD5
e3de22ec02a5b612b587dfce8a0c4e65

SHA1
d492978a519c728dc1aaff0fa6356e3b2ec7d673

SHA256
4611d321af4f2696520d77c42a83f3cfb30b796b50833718cd94dc45177594a1

SHA512
3dda71c68d0fcf7080e3f89d428ed4d5fc0d69b65ba6cf54bcfa2ffe05c3e96768a983802942b9c73abbe208e684f8c88faaba365e9ff0f8a83d89eb134b91d6

Download Submit
C:\Program Files\AdsPower Global\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

Filesize
276KB

MD5
e3de22ec02a5b612b587dfce8a0c4e65

SHA1
d492978a519c728dc1aaff0fa6356e3b2ec7d673

SHA256
4611d321af4f2696520d77c42a83f3cfb30b796b50833718cd94dc45177594a1

SHA512
3dda71c68d0fcf7080e3f89d428ed4d5fc0d69b65ba6cf54bcfa2ffe05c3e96768a983802942b9c73abbe208e684f8c88faaba365e9ff0f8a83d89eb134b91d6

Download Submit
C:\Program Files\AdsPower Global\swiftshader\libEGL.dll

Filesize
471KB

MD5
d00b35304c31b123974011d0ab047497

SHA1
ffbfb9ba8d3362f8b4d454d9e16579a0d2aeec73

SHA256
afad38069e5f427362132ba71215c3f0c97b6b28123190a47216a30e93b1af16

SHA512
9032d851092db10e6dbbb50973a49ecccb257751b6a8a7f10560452833291b7121badc3dfff8987f6fcfdfca05612e66d028f6488dabaec2e672f2a984c8a3b1

Download Submit
C:\Program Files\AdsPower Global\swiftshader\libGLESv2.dll

Filesize
3.1MB

MD5
d8d23801b094e61ef5a935b8c04f3709

SHA1
7d07e2e6365036c52ffe64e35c3f8bfaee365156

SHA256
00e131c30ef2ce1762fc8368f30656db2034e6787eb6b76a285f615c3951413b

SHA512
8d4595f6afda6da6b7c7d59cbf3cc6466548b0c1f1a4f719272024a43bf981f24880425ee7d1cccad75792dacf3aa65e1e37a9d03ed65b1eae135bf585219c79

Download Submit
C:\Program Files\AdsPower Global\swiftshader\libegl.dll

Filesize
471KB

MD5
d00b35304c31b123974011d0ab047497

SHA1
ffbfb9ba8d3362f8b4d454d9e16579a0d2aeec73

SHA256
afad38069e5f427362132ba71215c3f0c97b6b28123190a47216a30e93b1af16

SHA512
9032d851092db10e6dbbb50973a49ecccb257751b6a8a7f10560452833291b7121badc3dfff8987f6fcfdfca05612e66d028f6488dabaec2e672f2a984c8a3b1

Download Submit
C:\Program Files\AdsPower Global\swiftshader\libglesv2.dll

Filesize
3.1MB

MD5
d8d23801b094e61ef5a935b8c04f3709

SHA1
7d07e2e6365036c52ffe64e35c3f8bfaee365156

SHA256
00e131c30ef2ce1762fc8368f30656db2034e6787eb6b76a285f615c3951413b

SHA512
8d4595f6afda6da6b7c7d59cbf3cc6466548b0c1f1a4f719272024a43bf981f24880425ee7d1cccad75792dacf3aa65e1e37a9d03ed65b1eae135bf585219c79

Download Submit
C:\Program Files\AdsPower Global\v8_context_snapshot.bin

Filesize
168KB

MD5
c2208c06c8ff81bca3c092cc42b8df1b

SHA1
f7b9faa9ba0e72d062f68642a02cc8f3fed49910

SHA256
4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3

SHA512
6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AdsPower.lnk

Filesize
633B

MD5
76b4d867c07c355bd77bc55b66ea564d

SHA1
67dbecee88cc7595ce1473e0587c4b28df5643ea

SHA256
e6082bf393ebb45286c3a36492b44ad38976b9f3ae97aa8f6abfcead03e6b476

SHA512
66815e5f0d5a3ce8da6b9c8a54128e2e22c95745f4eea103b022bf32a0ab82500ed0dac4da176a06faee3c6bb1afade2e8e04880a0743420f61b701113e29511

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\nsDialogs.dll

Filesize
9KB

MD5
466179e1c8ee8a1ff5e4427dbb6c4a01

SHA1
eb607467009074278e4bd50c7eab400e95ae48f7

SHA256
1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

SHA512
7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrCCFA.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\adspower_global\Crashpad\settings.dat

Filesize
40B

MD5
5190ae4da9b2026cf61516281a59ca04

SHA1
4eeee94f618a0ab367309d9cdf32e956e40796c8

SHA256
d1c8a3d9dfcc1325c6fa625e32377304383a6f2a0bc999b419023a43f92002fb

SHA512
b9cb966c2b42d142e4b3e7569304b32eb2e88217c4d65d8a54a23f6d196e24ea762bd1b59f4ad4352c3f532c811c5ce162d59fdbb3e7d78c5d58538d45776165

Download Submit
C:\Users\Admin\AppData\Roaming\adspower_global\cwd_global\lib\main.min.js

Filesize
5.3MB

MD5
f2134a6d6ae8a7adbd085515177a40c9

SHA1
ef0c402331793480439c9ea5b100dbcd0546fab7

SHA256
4b343c978f9b0ab91cd78053fe56bf530fccf0f32c12b4debe9e11f7bf15e5c0

SHA512
e66f8dda4d2c1806bd5242397f6c49dbbc62f7f4e0640e4965bc684ea2eb8d458e3aabaaa30338326d8ddecc674973ed09ec38b9b14a995e4f7fb80848ef1518

Download Submit
C:\Users\Admin\AppData\Roaming\adspower_global\cwd_global\lib\node_sqlite3.node

Filesize
1.4MB

MD5
56192831a7f808874207ba593f464415

SHA1
e0c18c72a62692d856da1f8988b0bc9c8088d2aa

SHA256
6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

SHA512
c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

Download Submit
C:\Users\Admin\AppData\Roaming\adspower_global\cwd_global\lib\node_sqlite3.node

Filesize
1.4MB

MD5
56192831a7f808874207ba593f464415

SHA1
e0c18c72a62692d856da1f8988b0bc9c8088d2aa

SHA256
6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

SHA512
c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

Download Submit
C:\Users\Admin\AppData\Roaming\adspower_global\cwd_global\source\conf

Filesize
12KB

MD5
b901a454971eb1a23be6d0e5866736e5

SHA1
860e59bea2c1e467d595ac037a6bd920a3a54818

SHA256
dcd65622039e40c6edfefa34750adf98cf00a1e6b8c6e5e7c6c8f4410f5edd14

SHA512
f153f42e79a4778070c1e485c92fce953989ff9ddd00ded95819b0e9e1b5ea5674a75d7ef998ddc7ca308af8f4f83855b46788abaceee77b42390620498a17ee

Download Submit