de232fcfe0c3f6d1b3899cf0320249e875c5d16ed712ac89bab840188b7ecc72

Analysis

max time kernel
106s
max time network
91s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
02/04/2023, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Driver.Booster.Pro-10.3.0.1240.exe
Size

24.6MB
MD5

5b4684fd9a7412ae0930045def48347d
SHA1

76d28bfc55747ed0f3cab15698e27a148602701f
SHA256

de232fcfe0c3f6d1b3899cf0320249e875c5d16ed712ac89bab840188b7ecc72
SHA512

d99fb96727241a34b8773d4d492c2f0bb46a003c7a59c8109388948d2c6c6ae4167286c55e3b89e6c45ddd451a9370f71cd51ae393aeee20f735e429e2c1a554
SSDEEP

786432:K9colGvaWg68X2naRO2WO3ME7iz2YrOHEMA+plqH1:K9rlyaWg65aJd7CKHbA+plqV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	Driver.Booster.Pro-10.3.0.1240.exe

Loads dropped DLL 7 IoCs

pid	Process
4056	Driver.Booster.Pro-10.3.0.1240.exe
4056	Driver.Booster.Pro-10.3.0.1240.exe
4056	Driver.Booster.Pro-10.3.0.1240.exe
4056	Driver.Booster.Pro-10.3.0.1240.exe
4056	Driver.Booster.Pro-10.3.0.1240.exe
4056	Driver.Booster.Pro-10.3.0.1240.exe
4056	Driver.Booster.Pro-10.3.0.1240.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Skin\black.rcc	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Boost\WinSvc.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Korean.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Indonesian.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\AppInfo\appicon_128.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Japanese.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Danish.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\AutoUpdate.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\DetectWave.dll	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\History.txt	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Indonesian.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\DriverBooster.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\History\Japanese.txt	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\History\Spanish.txt	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\LDPicon.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Spanish.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Malay.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\PowerMgr.dll	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\rma.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\DrvInstall\DpInstX64.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\German.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Romanian.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Dutch.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\LocalData\InstConf.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Update\appver-ac.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Register.dll	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\RttHlp.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Korean.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\ChineseSimp.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\DriverBoosterPROPortable.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Portuguese (PT-PT).ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\LDPmini.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\LocalData\Apps.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\DrvInstall\SetVolume64.dll	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Polish.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\History\Polish.txt	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\wingame.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\History\French.txt	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Update\Update.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\Other\Help\images\favicon.ico	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Greek.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\ErrCodeSpec\Thai.ini	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Czech.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Polish.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Portuguese (PT-BR).lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Slovenian.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\unity3d.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\Other\Help\images\donation_button.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\vcrt2013.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\AppInfo\Launcher\splash.jpg	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\CareScan.exe	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\MsgBoxEx.dll	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\HWiNFO\HWiNFO32.dll	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Skin\public.rcc	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\AppInfo\appicon_256.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\vcl120.bpl	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Database\sMarUpdateInfo.dbd	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\vcrt2019.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\vcrt2022.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Hungarian.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Language\Romanian.lng	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Wave.mp3	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\jre.png	Driver.Booster.Pro-10.3.0.1240.exe
File created	C:\Program Files (x86)\Driver Booster\App\DriverBooster\Icons\Apps\silverlight.png	Driver.Booster.Pro-10.3.0.1240.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "542853053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BC19F61-D172-11ED-B673-66236AA79184} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31024511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c9f3207f65d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d00000000020000000000106600000001000020000000e545c7c73ba670e23ef46447c1063b8aaa1177c67328c5c9fc093582c5658efc000000000e8000000002000020000000c9f0e032b8c56a6460e32a359b48cc1290afa330983aba4da455f425dada0ca420000000fdaca400c7d34b0451936c4072d2a084d26baf8a63b597ae978523823951772840000000d2d63f9207b3b81abc46f4c13a020872e93021252c1e39ec797503589803fd9e432e8fa6925fc2a056ed602084fe011a68fd19d2f9f57e864a35418524221ad2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506b04217f65d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31024511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "542853053"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d000000000200000000001066000000010000200000004c3218ae62ac71020c1a3240ebac807e606c90ea8b8eb6746260744ea091698a000000000e8000000002000020000000aa54deb6d5fdffa3cb7d4efefe4e1efadba957b95efa6b40884db517dc55c1bf2000000079f6c2abe3bf6eb2c3da3a90296c0ecb387dfabd36b023c000801aa63af4f45640000000bfc41eff0c1ad7b658e1fefb227e9a14021a3b709c8752a49b84ae72ee4d9908f9507250bee95e2abde22b839ac8f1a8ef5db9772e086d3f96be4dc9094b5b21	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{30799A3F-16CC-4A17-8DE6-A42F85B9A00F} = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000e820516b0adca8adbaf6bf65ddc24fb0280a91673e30ab6e07cab2bdb5d8c9a2b1186b3fb11484febaec3258f34f182e40a5193c55ff7598df07de3e	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b60ff6057f65d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{2042519C-AA7A-4271-BE1B-791B5EBE974F}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = c7407ea65a45d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = c7407ea65a45d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3b947b067f65d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3208	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	vlc.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	MicrosoftEdge.exe
Token: SeDebugPrivilege	2612	MicrosoftEdge.exe
Token: SeDebugPrivilege	2612	MicrosoftEdge.exe
Token: SeDebugPrivilege	2612	MicrosoftEdge.exe
Token: SeDebugPrivilege	2440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2440	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2612	MicrosoftEdge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5108	iexplore.exe
3208	vlc.exe
3208	vlc.exe
3208	vlc.exe
3208	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3208	vlc.exe
3208	vlc.exe
3208	vlc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2612	MicrosoftEdge.exe
4164	MicrosoftEdgeCP.exe
4164	MicrosoftEdgeCP.exe
5108	iexplore.exe
5108	iexplore.exe
4568	IEXPLORE.EXE
4568	IEXPLORE.EXE
3208	vlc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 5108	1552	MSOXMLED.EXE	75
PID 1552 wrote to memory of 5108	1552	MSOXMLED.EXE	75
PID 5108 wrote to memory of 4568	5108	iexplore.exe	76
PID 5108 wrote to memory of 4568	5108	iexplore.exe	76
PID 5108 wrote to memory of 4568	5108	iexplore.exe	76

C:\Users\Admin\AppData\Local\Temp\Driver.Booster.Pro-10.3.0.1240.exe
"C:\Users\Admin\AppData\Local\Temp\Driver.Booster.Pro-10.3.0.1240.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
PID:4056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2612

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Desktop\UnpublishStart.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UnpublishStart.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5108 CREDAT:82945 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4488

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\WaitInitialize.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\Aero.dll

Filesize
17KB

MD5
5155e506b908b41e113bbd7c10d4082f

SHA1
0e0d2d3a6c76c08d434ac7359eb9927f82ac6065

SHA256
9bbbdd180dac3cf4ce36cbc12bd862cdd00880d87027395f92ede5476d1f0dd0

SHA512
a43f04fffb05458a307054caaa45ba81c383b0265d7af798996806ecb07b72bb5350df7bf4d6d7b21a30c82f4308343845bb32cc8e0ad0cd36e352499ca7ccb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\LangDLL.dll

Filesize
9KB

MD5
d6d8addfea0ee1bba9b841e3bec0b5cd

SHA1
a36ba78140600a7b1a502bea25c50c76666f5d3f

SHA256
ccb76172c2565356a838d7867a51e021478fed4d83eb41fe1dbb703f8efa28f9

SHA512
3f85eb0baca0794adbc7460af8b3b21d5b0b9d250eeba842f8524ea9736877aaabd5f51035bee8836ad46bf1d01e416119ca7f296bae32bacdad44622c1715ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\System.dll

Filesize
15KB

MD5
f4e3fa5c852d2bdc41756e58124b21d3

SHA1
a49ec55e50d25efa45ce93366fb64c4fbb1d8261

SHA256
e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c

SHA512
3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\modern-wizard.bmp

Filesize
150KB

MD5
84ef624021ddceb75e61469cc860b69c

SHA1
ff3c72c138ca7d3167c77d331398aaf894cb65a2

SHA256
db1daffe4a5115a2e97e4278dd53b97cd46b62ca91faa37305763241de6da009

SHA512
ae7b3c54f8f14d53292b47bb4376d3aeae793be43ed5de03b3fce1be3a8c8a57bcf2c3ae879b8ea86b203d0abb489a30a553f790b9cbe8f37312404a00843176

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\nsis-r.bmp

Filesize
126KB

MD5
3f8fcd4f02c84cc281715edbb217f951

SHA1
75e848565a8ce22cc6ad5f6358a38c9037683614

SHA256
7f0bbf37b0df4b934c8be4bd14aca2529c143940b3d89a3f92508fc941947726

SHA512
4a62ecade771350efb8ceafbc2cdefcde7cd3f1acb4f714fa71157bc99aa97286a785d92735da7d961930716729dbc3acdf92c27a8c28c2d87ab8735522a981e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF9C8A67C3ACD9AC94.TMP

Filesize
16KB

MD5
608959716a9ff2c372c8538c5fc0e57a

SHA1
6d328630640e3ccdeba4f9cbcb39d596d3aa9de9

SHA256
6f70291ea5c44ce6c074b22410188556ba5058a0bf4f40fd9aed8df6e78f800f

SHA512
a3816196a0a1f15ecea48aa5348acf13c7f5a78e48425d4ce1035f942df7b28a9429709c94f34220b15376ec085f96d5674492d615fdc7927329284ed0ff1636

Download Submit
C:\Users\Admin\Desktop\BackupConfirm.dib

Filesize
356KB

MD5
53a9572d05ae48708796aa2932d1449d

SHA1
ad96bea3b6762c1013362403d2071802b8d4bcf1

SHA256
d2dab9391fe2e1cf7ea4d70de8d0b92d79ee0e9351802a2d274add66d3a6c1ac

SHA512
54988fd7aef9bcdb9409d57912bd1be12f2a4c7c44552b5922cc24ec8f7f8e24dee0c18861b13d09524fed457398a4fbf7d3d9be8571f2e37ced98420c601474

Download Submit
C:\Users\Admin\Desktop\BlockStop.i64

Filesize
703KB

MD5
c3807be427fa0010b7619b6110fb040d

SHA1
b67a87e7706f7b1a41629ab6d64fd07e061b3ea8

SHA256
85a23d2770aa5f2efa001257d941b767b6ab21dadd51ceeebbc4876ff5ca13d3

SHA512
3cbb89372f5f51d922c745920f4a084f014cf532e85f1bcf2a3038109b6e27dc68ee239249cc37630e4d9ae69b943f36b89f1d124533e78b6b5db6797c48d48f

Download Submit
C:\Users\Admin\Desktop\ConvertMove.xml

Filesize
465KB

MD5
1e6140154c51012cf04fb2729ed4d820

SHA1
c80abe0e1f7b97acad6e7b7e4edc51b3704fa619

SHA256
77bc4bc1f902e8b74f8cb2e5ec9fcacb4370574d8940a66068e1f42c2d3a9b3f

SHA512
eb0b7daf8e5bb1920e405711ffb07b459ce360dd8a8ea316114db1dd91c36f13e314a85f9cc5fcb90e868bbbc8da98e02b865903c452f39feddab720ec9b8f4f

Download Submit
C:\Users\Admin\Desktop\EnableMerge.wmv

Filesize
283KB

MD5
3ad6fd6456eb8da05dcbdd483e4a243e

SHA1
6dce7d779afd9adc0b3443639ac11ab83b38bcb4

SHA256
fcb90a8126b351dc4ef72d0f7bd5f20ba6bc827c738d70abd2da351976e028ab

SHA512
351a2287408028c1df101e082815751232d75c61b7db934b2773ad5e8ae0256fa0a7eb8d8490b9107c08c275299cf9ea7f29afc2194ed8f66aec4b44cf1cee53

Download Submit
C:\Users\Admin\Desktop\ExportEdit.lnk

Filesize
648KB

MD5
581a8ebeb37b4a0ce377a0abc52ec323

SHA1
01166ccb1e80ddbbf4dab3ff38e503e0efcc9e67

SHA256
0569dd96da775fc5edbeef3097c68ff45b8280ee28c2fd6809992c010a26b8ae

SHA512
b762ed6186697c4c3c144bfbf7b167e55b4bd8735bc32c7e70f4e975115f1b2583f5b066ebe9c4ca01a76d5d330bd844e27239e9d4ba5bac71017f30b72ebb24

Download Submit
C:\Users\Admin\Desktop\FormatSync.m4a

Filesize
429KB

MD5
e485b9a6a6ac1473a7291d09b6175954

SHA1
5dae8ab01cda26a87b239d03d2928c03c5c95047

SHA256
cf682b5e9fe142617f5459bc7e03e259beeedd4fa5edb00e0d18592782d86f47

SHA512
a54d8bae6d64a0f1507325b462dbcc4898d4e09b2ab2b004a8261c0ac650cc6b7bc68d9108d05e7b340b88b5737cecd220cf5829378901d9b53fbf60aab2d580

Download Submit
C:\Users\Admin\Desktop\ImportDisable.eprtx

Filesize
684KB

MD5
a7e5475c2cc750d5ade4944d119e1400

SHA1
f7f5096cebc9ecf35b0f474ee9470565d16aab8c

SHA256
49d36baef3bd68ef701b42c656192f8f94a51c6fdc56a148aaa121a96232d20c

SHA512
676a650662e3300046781882fba5a9dfd77dd25b943d6f96404e998119a1d5dd99bf947fdcbcb1d3d5cc085d8c6f4c69d825daf5a6be7c579267788313393d49

Download Submit
C:\Users\Admin\Desktop\InstallFind.mpeg

Filesize
410KB

MD5
03e7b218b0f61f7275bca0f07dbaac00

SHA1
9dafffdcd26159a5558ba23f4a37188156cbb3fc

SHA256
f5a377aa76db8855d4629a90a611c56a56d598df6e7eead1553613d975d334fd

SHA512
54cfabda525201a35b48b79345143f2c7354af79f1fd4ef1618aff851955a652d2b756c3750d659d342960d65985700cd292e3271daee2903eba3d4cb7d58643

Download Submit
C:\Users\Admin\Desktop\InstallSearch.crw

Filesize
264KB

MD5
f8b9a3d2ed7e7bbd87eddb107bdc2f87

SHA1
e9638d66de53f1ee5214ae69a0a4214aaf84bc7e

SHA256
c7a5ec9179d7cf24568f1ba9fb28a0d9681051e10e8652c0d222bda61e5cbe83

SHA512
5924ce98030857fbac061faa2c4f7f07a4aaa19895087cfaa7f698ef561acc93cc9b7f69b5336781619a354e23ccdba363a54560f7859a338068dad63f29f420

Download Submit
C:\Users\Admin\Desktop\LimitExit.m1v

Filesize
502KB

MD5
2d95cf9353f0f37b38b8e3a0691fb956

SHA1
aad6ae0b37875fa69fbecbf5e955d68854e80046

SHA256
fe949c74d4b9ccc6d046519c199c5a4085e91d03e95ce982f23b17584f488bfd

SHA512
abc54e58e2b771cea0e799249922c2cbbb4259f3857618be2e29249396ab0b0c67a804c81392ca4bcc0c03fb4b9eafa53a38bf041885ab755077afd18da19f19

Download Submit
C:\Users\Admin\Desktop\MergeConnect.mov

Filesize
666KB

MD5
f821eed6e67dcacd114bd0ab1d17c2af

SHA1
0a9e76f69cda170c35a765e647ba4c830a15cd78

SHA256
51c0f99f5a500d8cfdb3a821517c7a7331a02b2c96cd500f57fe622243e74776

SHA512
3aa002e06d1251ef851a3676ad5d280259331596b692a5ddbaaecbc064306350e1fc3410a1155b1b096d3724482a7dee02d5c0914ed3c1d47dd5b0441552eb36

Download Submit
C:\Users\Admin\Desktop\MountMerge.xml

Filesize
593KB

MD5
d82a1001a981ab7cd42a35965d09331e

SHA1
e3e344e0f19c03c6da02ca7f4ff3c5cfffacc12e

SHA256
eea6a47a04065e6357aa6d22e07d2b9fb2b82a2bf38c2a080628a1f9b394a25d

SHA512
eff0265171c89108f5f8dad3aa53e970fda7e63cd52da67196f618f31363005ecaf854b5bca05d878f9d30a8ef0609597960f3efd02a96ae817729cdfe10acbd

Download Submit
C:\Users\Admin\Desktop\MoveSave.exe

Filesize
301KB

MD5
4cc3b94e25b5ccf083ba4b0afd859647

SHA1
448804f5fd90e945ad66717dce81f6e952f3ddd0

SHA256
bdff7dcea5ab43efed7a8c1c236cc5de95eda0d21a870b735743ab3ed5bb406a

SHA512
5ba1cdca83af6b8756ea50df0c36f04084e026a41f27401425b7a6b7891b198d420131407875f45f2fea6dfeda978c572c7de6d68b08206fb89dc1a3edad4883

Download Submit
C:\Users\Admin\Desktop\OutMove.doc

Filesize
392KB

MD5
6af69993297c34f0e5bc0ccd9be61e1a

SHA1
f01982850814fd6898bd694bb6c2a07e1110fcd4

SHA256
fb32b971b9816c26923603d40a7692778735f9143f69985f51dd899648fd68d2

SHA512
b3f601eaf56b7efd2a5c72be57a6c0d39b4429c2a59ebde0284bc98feebcc254848d76b38331ac8c4217ff8584f6e07019372f7759c4183568ed864cb245c9d4

Download Submit
C:\Users\Admin\Desktop\OutSync.jpg

Filesize
520KB

MD5
7218534b213bc4d21f7ad839ee1dc2c3

SHA1
3c5f330637fdce9d8a0191c9e9b6090313db241c

SHA256
de59a02a11ac4e8ca8feac986d85e52d7bd5c4443eb4ae372c16ea3a9c9aa071

SHA512
0d75afec5db593caac38103176796fcc39039bfe6bf713e97e9126e2914459e35996687cb1ccced8a94ae98ea00b20a76f21265e2b88c268b351c3b578c3c3c2

Download Submit
C:\Users\Admin\Desktop\ReceiveRead.jpe

Filesize
374KB

MD5
2c35a8a705a808278a46bae44e0d1121

SHA1
ad729152c728052197aee5444a8d8f7ddb68c00c

SHA256
64cd41d034f412a9e8e47569576cacc74aed5b409ff24f06f027dd6b183a3054

SHA512
54f4a26e5f4f20fbb25b61c3dbd6bf1c4db3e7b524bf34c8fa3c42355cbf60425e0eac432f0ddab66acc2ab72095edcaaa481b69510bc7dc3208b56cabeb91bc

Download Submit
C:\Users\Admin\Desktop\RegisterGroup.cfg

Filesize
483KB

MD5
c79c0fb335828f644e904a014df9f0c4

SHA1
82c25ed1fa983efb374a0f29b8ea1dc02da0a15d

SHA256
821cd948dc6f99e0193e1a9c12b6aef7870b1211cb0a0aafd16d680fd3a66caa

SHA512
a70ae0e7816bca3738ee914395e140c51dcfdd0528f42f299ad95b099b3853b7f812f33e9309119e9b634bfa7bb1358ba74c49e28aef5007731e4bd8d37e62e1

Download Submit
C:\Users\Admin\Desktop\ResizeCompare.xlsb

Filesize
538KB

MD5
5786d23d37bdb4e045132b74d3f14e09

SHA1
162be2ce3cffc4c8b102f75f3afd28e21c7615a0

SHA256
20aba97e643cfd70232f61a73dd80d84fd3d01af75665151a7575d12a125e316

SHA512
2f5f615ee79f4f7bf0c14d3bb0bfa0c4e639ef789a71d697f05b749bfa7319b4fa0778dc485ce0ec4cea359d11ab70dae5563b885c0e60c1043ef9ed7bdbd1ae

Download Submit
C:\Users\Admin\Desktop\ResizeExpand.html

Filesize
447KB

MD5
a351ca2660adf3f3091eb44b1f2cd9ce

SHA1
e625a9b77cdefc5a20bf8c50ce73a318dfc6082d

SHA256
235b808a7bd0d6b31809f57584653599dfed607a07fcb6c293e91c96961c1a94

SHA512
c96b9af8d83a12351c30d7faba32f138dd999e274ecbe57f0bb31ee45c89049636242d421cd36c57a58789b2dbdbb404ab04ea2ae7ecd12a58377586422b81cc

Download Submit
C:\Users\Admin\Desktop\SaveDeny.mp2

Filesize
246KB

MD5
166e7b1c54a4fe0b146e80ad9fcb3e56

SHA1
75214ff17ae3631db1941a453a6a7d6b75627536

SHA256
3ec0ac735a7f77771b4a45b8256133415940d50bb8d91368854e39b91101590d

SHA512
3074e2365bb21126040e5c339a5dbb9bf55633ac98fb3c604f59c6cdc41d5c94b0b5bb254ca2b6759cb91c601be8c937d86ac54c1000f6ab5fce5cba6096fa8a

Download Submit
C:\Users\Admin\Desktop\ShowUnpublish.js

Filesize
611KB

MD5
542655655f549d94601f4e403a872b4d

SHA1
cac21c2fca4e73524fb550fcbe8185824a15459c

SHA256
bdb7cd80d0f8c4c70be34532798512a404574c9637fc6c5d9bb38a73eb9725d0

SHA512
95b3c60798315111bb97f61f77cc51fd3ecc1c34c5bd1c7256acd0156543275af8df4194b998aa7afa68149c266e7c139b2fec02eee368fe874ab4430da59413

Download Submit
C:\Users\Admin\Desktop\SplitWait.ini

Filesize
967KB

MD5
11883974da9438a62781de9c04caf68e

SHA1
11caf4997820bcc12e0036819c6b47bdafe44a79

SHA256
c9032bc1c638273a54db61ee8aa5bfdd28507a4d87b642444f0b4d0be6d25ac7

SHA512
2efedb7a981c476a36a8508893f14c1ad107c8ce6362de76bfcb7944a21479e62095dfd1ae796949a70941cda69f6eab2f10604351f86d30b781be425594289d

Download Submit
C:\Users\Admin\Desktop\UninstallConnect.vdw

Filesize
337KB

MD5
1b20bd4b23adf20548a7c9b82d7b8906

SHA1
2ec4f51730e4ef0dbde5102c9a7ac0a85287b65b

SHA256
69fd56cc456e3f3ff58f88fade2b2b3d5e184be635e32a2cd0ece9491bb28b8e

SHA512
5b152aa44a7756243422826eda2249bc1404cf431781e0a1336f57ffccc9f6ff42ad5cf28087ce39fd515117907a79ab0c6434d0b95599dcbac7eac8c8809197

Download Submit
C:\Users\Admin\Desktop\UninstallUndo.vstm

Filesize
556KB

MD5
d2a5086e1fb608fac060443a24c82ebc

SHA1
b2161e48e4f3ebb768776c9934641e72b6400bda

SHA256
016a938ad5fed6446cc21c2edbf03a3a4cefac7dccd5bff9353aff2ae6ba4d51

SHA512
e5bc9066fab68ec6bc538f301b03fe57e124d02b3f00c080067e719fbed652ba754bbb1bc686f5b3f826b66e6e3158beec02fd62f482aa7d4cf960d334321c0e

Download Submit
C:\Users\Admin\Desktop\UnpublishStart.xml

Filesize
629KB

MD5
ef819ce0c467d9b9bd5d833289032114

SHA1
e47891f7ca0c2ca7caeb776309822078d305bc59

SHA256
39c06738cd9189744d0fe7899eccbadfffc1b15a8c46f6d81b8a30f21e8627c5

SHA512
581713575e87fc276c2a941a54029e0ceeba4a4cc23e351af3472f42a78580dc799e94f4038947e932bdb3797c3ef89569fb09b31436ba08fce03f7dba30ca83

Download Submit
C:\Users\Admin\Desktop\UpdateUnblock.wdp

Filesize
575KB

MD5
296d91d5dba8ef70eaecbb026091fe24

SHA1
a814af87c1ba5b611b1db1bcc4fe05d202721b55

SHA256
6eacc3b2b0f42b88f70ee160d7867d22d9c2b2c8edc738d16b6dfec685486803

SHA512
e3482db477b897ff0cedc3ee3176d3148ae5222bc9f801a2106f73534262e53013ed93940105acd9ad676e125694cd07fc2d96ba7cb8e899f55ad652043d1b8d

Download Submit
C:\Users\Admin\Desktop\WriteReceive.mpe

Filesize
319KB

MD5
83a168724338bcaba1b3fbdf11b8ecae

SHA1
0a7717f8c09a2da0e0f63cd66b92f22eb349e58f

SHA256
7763612500e6b074e25375312ed9507cd750a4e53371f74ad9f531b9ea623fb2

SHA512
24b4508b931f2667459f911a29f2f9878bb9c27f885e08a3fe30e4807c6797755a172a0390fafe37570a54e9a28bd46adab4ba14bfaaf6e3a2ebc715df65de12

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\Aero.dll

Filesize
17KB

MD5
5155e506b908b41e113bbd7c10d4082f

SHA1
0e0d2d3a6c76c08d434ac7359eb9927f82ac6065

SHA256
9bbbdd180dac3cf4ce36cbc12bd862cdd00880d87027395f92ede5476d1f0dd0

SHA512
a43f04fffb05458a307054caaa45ba81c383b0265d7af798996806ecb07b72bb5350df7bf4d6d7b21a30c82f4308343845bb32cc8e0ad0cd36e352499ca7ccb1

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\LangDLL.dll

Filesize
9KB

MD5
d6d8addfea0ee1bba9b841e3bec0b5cd

SHA1
a36ba78140600a7b1a502bea25c50c76666f5d3f

SHA256
ccb76172c2565356a838d7867a51e021478fed4d83eb41fe1dbb703f8efa28f9

SHA512
3f85eb0baca0794adbc7460af8b3b21d5b0b9d250eeba842f8524ea9736877aaabd5f51035bee8836ad46bf1d01e416119ca7f296bae32bacdad44622c1715ec

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\System.dll

Filesize
15KB

MD5
f4e3fa5c852d2bdc41756e58124b21d3

SHA1
a49ec55e50d25efa45ce93366fb64c4fbb1d8261

SHA256
e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c

SHA512
3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\System.dll

Filesize
15KB

MD5
f4e3fa5c852d2bdc41756e58124b21d3

SHA1
a49ec55e50d25efa45ce93366fb64c4fbb1d8261

SHA256
e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c

SHA512
3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
\Users\Admin\AppData\Local\Temp\nsz60B5.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/1552-455-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-451-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-452-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-453-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-454-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-458-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-457-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/1552-456-0x00007FFC52780000-0x00007FFC52790000-memory.dmp

Filesize
64KB

Download
memory/2612-414-0x000001F0B66F0000-0x000001F0B66F2000-memory.dmp

Filesize
8KB

Download
memory/2612-412-0x000001F0B2000000-0x000001F0B2002000-memory.dmp

Filesize
8KB

Download
memory/2612-373-0x000001F0B1B20000-0x000001F0B1B30000-memory.dmp

Filesize
64KB

Download
memory/2612-389-0x000001F0B2400000-0x000001F0B2410000-memory.dmp

Filesize
64KB

Download
memory/2612-410-0x000001F0B1CE0000-0x000001F0B1CE1000-memory.dmp

Filesize
4KB

Download
memory/2612-415-0x000001F0B6770000-0x000001F0B6772000-memory.dmp

Filesize
8KB

Download
memory/2612-447-0x000001F0B0CE0000-0x000001F0B0CE1000-memory.dmp

Filesize
4KB

Download
memory/2612-443-0x000001F0B1FC0000-0x000001F0B1FC1000-memory.dmp

Filesize
4KB

Download
memory/2612-440-0x000001F0B2050000-0x000001F0B2052000-memory.dmp

Filesize
8KB

Download
memory/3208-472-0x00007FF6EB9A0000-0x00007FF6EBA98000-memory.dmp

Filesize
992KB

Download
memory/3208-476-0x00007FFC74230000-0x00007FFC74342000-memory.dmp

Filesize
1.1MB

Download
memory/3208-473-0x00007FFC86330000-0x00007FFC86364000-memory.dmp

Filesize
208KB

Download
memory/3208-474-0x00007FFC75F10000-0x00007FFC761C4000-memory.dmp

Filesize
2.7MB

Download
memory/3208-475-0x00007FFC74AB0000-0x00007FFC75B5B000-memory.dmp

Filesize
16.7MB

Download