infinitylock | f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

Resubmissions

07-08-2023 11:21

230807-nghrwsfa46 10

06-08-2023 18:45

230806-xd334adc4s 10

Analysis

max time kernel
722s
max time network
751s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InfinityCrypt.exe
Size

211KB
MD5

b805db8f6a84475ef76b795b0d1ed6ae
SHA1

7711cb4873e58b7adcf2a2b047b090e78d10c75b
SHA256

f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
SHA512

62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416
SSDEEP

1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON

Score

10^/10

infinitylock persistence ransomware

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

unregmp2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

unregmp2.exe

description ioc process

File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmplayer.exe

description	ioc	process
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe

Drops file in Program Files directory 64 IoCs

Processes:

InfinityCrypt.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18252_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR13F.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.DPV.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0292152.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49B.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\RADIAL.INF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01701_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_F_COL.HXK.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZFORM.DPV.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORY.XML.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215210.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285796.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309920.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.Infopath.dll.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Status.accft.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198372.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107342.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00736_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\OARPMANR.DLL.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185818.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00345_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME52.CSS.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SAFRI_01.MID.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NL7Models0011.DLL.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\THMBNAIL.PNG.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\RIPPLE.INF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RECS.ICO.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237228.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15272_.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR22F.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.ELM.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239057.WMF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR21F.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESENDS.ICO.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A	InfinityCrypt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000005eedcb8e74813d0fb555d61978c7c346bbeac7d75280e55c5682592c11ba3fe9000000000e800000000200002000000056b23c6b13458c1d943e8ba89295ef2fe459bc5d187a4ea167af364e380d339190000000edc27c60ee17f31a738222c4d15af59818454c4d83ed5e34f02e94a958624e847a14908327c76b38f7656cdd40444fce39be5f9f32e781fad6078cd173f4b7a735cacb2a4f0a0a8db35cbb07f0d90e2b8c82a37707b3c25c4fdb2cfecef36ed2d6a9ae7f75b1fc52b7909dfa1471cf07423f43fa3a0a835f627498429f71e633d7219adb0a71e5c20ed58921ddd6952540000000bfae78af2b7d62ce3c0bcd63167fc0273c719f2316fd5c7532f10c8bb0422843d9c58d054a8660b02faee45a662712734aa9f2bba9d651d030e7a05aa21389e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803c9b6d96c8d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{973123C1-3489-11EE-AAA1-4E44D8A05677} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b02100000000020000000000106600000001000020000000a32acebe25c5ed3d3e63bf3f59465dc618589976e2a3f954506b8d1381a70f0b000000000e80000000020000200000003fae7386d7991139f9cd2cea0e7fe0afac362042e6bb7dc88a3bf34ad98d848820000000cc0b49285f174fa231bdf00f595b63d1cbb775686f59bb18438a8b0bf9763bc94000000092bd691c93f8f6cd3319581df78ef4c2cbcd282825a7d8c94ba566812c2ed411d3f0555d921420abbdb8d3f29d3b36560b510ccaf07606ff696809be9c954807	iexplore.exe

Modifies registry class 64 IoCs

Processes:

unregmp2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2264 vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exe

pid	process
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exetaskmgr.exe

pid process

2264 vlc.exe
532 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

InfinityCrypt.exetaskmgr.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1580	InfinityCrypt.exe
Token: SeDebugPrivilege	532	taskmgr.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exewmplayer.exevlc.exetaskmgr.exe

pid	process
1628	iexplore.exe
1304	wmplayer.exe
2264	vlc.exe
2264	vlc.exe
2264	vlc.exe
2264	vlc.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

vlc.exetaskmgr.exe

pid	process
2264	vlc.exe
2264	vlc.exe
2264	vlc.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe
532	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEvlc.exeAcroRd32.exe

pid	process
1628	iexplore.exe
1628	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2264	vlc.exe
1932	AcroRd32.exe
1932	AcroRd32.exe
1932	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exewmplayer.exesetup_wm.exeunregmp2.exeunregmp2.exechrome.exe

description	pid	process	target process
PID 1628 wrote to memory of 2512	1628	iexplore.exe	IEXPLORE.EXE
PID 1628 wrote to memory of 2512	1628	iexplore.exe	IEXPLORE.EXE
PID 1628 wrote to memory of 2512	1628	iexplore.exe	IEXPLORE.EXE
PID 1628 wrote to memory of 2512	1628	iexplore.exe	IEXPLORE.EXE
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 3012 wrote to memory of 1404	3012	wmplayer.exe	setup_wm.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 2948	1404	setup_wm.exe	unregmp2.exe
PID 2948 wrote to memory of 2832	2948	unregmp2.exe	unregmp2.exe
PID 2948 wrote to memory of 2832	2948	unregmp2.exe	unregmp2.exe
PID 2948 wrote to memory of 2832	2948	unregmp2.exe	unregmp2.exe
PID 2948 wrote to memory of 2832	2948	unregmp2.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 1404 wrote to memory of 3008	1404	setup_wm.exe	unregmp2.exe
PID 3008 wrote to memory of 2452	3008	unregmp2.exe	unregmp2.exe
PID 3008 wrote to memory of 2452	3008	unregmp2.exe	unregmp2.exe
PID 3008 wrote to memory of 2452	3008	unregmp2.exe	unregmp2.exe
PID 3008 wrote to memory of 2452	3008	unregmp2.exe	unregmp2.exe
PID 1404 wrote to memory of 1304	1404	setup_wm.exe	wmplayer.exe
PID 1404 wrote to memory of 1304	1404	setup_wm.exe	wmplayer.exe
PID 1404 wrote to memory of 1304	1404	setup_wm.exe	wmplayer.exe
PID 1404 wrote to memory of 1304	1404	setup_wm.exe	wmplayer.exe
PID 2392 wrote to memory of 2544	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 2544	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 2544	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe
PID 2392 wrote to memory of 1452	2392	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\InfinityCrypt.exe
"C:\Users\Admin\AppData\Local\Temp\InfinityCrypt.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\EditRemove.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\unregmp2.exe
C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
3⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
4⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Modifies registry class
PID:2832

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\system32\unregmp2.exe" /PerformIndivIfNeeded
3⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /PerformIndivIfNeeded /REENTRANT
4⤵
PID:2452

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\BlockUninstall.midi
3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1304

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2264

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:532

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UnprotectOut.3gpp.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
1⤵
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7299758,0x7fef7299768,0x7fef7299778
2⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:2
2⤵
PID:1452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:8
2⤵
PID:844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:8
2⤵
PID:620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:1
2⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2412 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:1
2⤵
PID:2744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1448 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:2
2⤵
PID:2976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3208 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:1
2⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3432 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:8
2⤵
PID:2792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3548 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:8
2⤵
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:8
2⤵
PID:2312

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fba7688,0x13fba7698,0x13fba76a8
3⤵
PID:3020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3796 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:1
2⤵
PID:2192

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:1164

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fba7688,0x13fba7698,0x13fba76a8
3⤵
PID:1920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3592 --field-trial-handle=1204,i,5913015999965650723,18149713558958752103,131072 /prefetch:1
2⤵
PID:2728

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
352B

MD5
68d284128893148baa7d09b37d69cc57

SHA1
926fafc9846f2cbce8ffbbc5fecbbbdcb1b29812

SHA256
7ecfea97ef35637492cd53e24ae3990cda4591a94dc262e079d61db60737d808

SHA512
e115c1c12d5bbb756283ac5ed8644ad9631e7fa9647b469b8f677637bd340293d7ad1ad415127730119343616976b78a4993ef4fc74f1938055eae049e394219

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
224B

MD5
47a331203bea9c738745033c35c7e1fd

SHA1
d7045713689bc174694861e477da14b9c3f88c66

SHA256
6981e9ab4edaec476274f2565b0633d437a7a8bffe6035314264d500bdc9d431

SHA512
03266ec7b56cc3f5cc7313cc2665ab8d68707672b1974cb8324380969da47f985b6a46d4108feabebc329c894f3e1868c56777de585a6123c55391dadc3ce1be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
128B

MD5
92dead582caf1ac040eed7c908d97878

SHA1
5cad02d45a3669dc07171a071cbf550ddf927d60

SHA256
1184ab268bba01392da9d4f0111eee8218fd663ba8662f68ced1947da837924f

SHA512
c3a68b2ee59c67108f4beeb6d6db0518bcddf89c377dd04bd6fbe6dd5e8dcd38d8917f66e35fe1327964e280fc195cea37ec73130e3d5af9a6ef2f691242e609

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
128B

MD5
c89cfc5554c9f7250c525ce0525f3806

SHA1
1d8a00567329e4af87b3d1da2345c02e8c3b706b

SHA256
95ede7049a6c74c1c705cd8b92ecc0ea07c1f6114d86a97d9eb0df3777fca121

SHA512
55aafe13c254f3ea513662dcf79931292e6a32e1423b64ce0ed030f51ab73e4e11245423c9fca10c76988b73ad50193ca90c6411a56a515f43ee39dd2a88b595

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
192B

MD5
bdeac5f80c7ec9c26c6855af519ede5f

SHA1
1e528ebc72579af9fbd07d5581b20c2db7175522

SHA256
6e84de651d989672481c05c88ed757e7f06d165cfcbde8dfdd2e71e3e0ad74cc

SHA512
930072c3f967d39db5d18343b33dddfccd56c67116d4575a448a89711591f73b965ec95933b130d3f1061fbefd213425e4c34fd809eefff198d4ff9de409242f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
512B

MD5
2b711c09df333b279677b968f9e9652a

SHA1
9149e2cd281cfcce8ca09c574d79a5578d611dd3

SHA256
d2400ad0db43db615a39f9eb8288118a74fd2b977eb99256e241d0d4fdd604f3

SHA512
6d7d46dfb0edd27e5505d58a26094ed9c1a83e0d9d135e8cfbb8739cccd357d09f775b3e521fda85e44ec147f921f0be57308eb1cc6022944d312f26a02970aa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
1KB

MD5
68f15a664ea051c4ab9a6b6a1bb61bd6

SHA1
99a8e0c76e2ce6854abdbdf3167587c4ceae1b62

SHA256
b98b43b92a6cf1f81307da185d507ce5a99d8d32ae5b43ae73e28fe046196155

SHA512
566d672761ef5f0ba6d1020b1144d9e5f6763e38858a3db2bc02962d02e06b98bdd5ec2640bba44d0642604b1cd9c838ade52b6c0c36d22fdfbb4a0020d6a7a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.658D544412EE908173B4C4ABCC772D6759548B7D7043525358A7FA262524123A
Filesize
816B

MD5
723659573333146746539fd5a4cade44

SHA1
a22f10695698bf80880931375ebca9ff22c1bfdc

SHA256
f6fd9deb85d5a802f57542837bb5c0b47703d502964472ffd2536122c28e608c

SHA512
5b1c6a771f1bcb78dd18d0076fdd43b761c0ed926106b136d6ef98d7327ca9992384eb3331cce7e811ad9a8f5577214b75d75c41e10de6a476b07e3ebb460b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
937c464cf06f1b6fccb72bb77d64ca86

SHA1
1004bb283246f9dfd682e9072e708d40f5c53dbb

SHA256
f50ce83cddc7e6289fc14765d56e32b79a42420526605a59a5778c36ce312726

SHA512
1de501744d7670374cbcbd65306f5e8131d8ab29e67f76cd4d178c19fbfdd5984ba72ad5b9d555db248dbfb48c48dd4f791d0f97ce29da5ad0228a6307715e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2c5b7faaf1e3ee8776481054fd92bc68

SHA1
4ca3d6a5773d4f5ffb332783960fb75da691a94a

SHA256
ac4f720eb48a9c8fd45f1cd71bafdbe34524d7b415cd7feaf662e9e15056f2e0

SHA512
676ac32ffd52d389d7c448984d02acc480ba82f4b7dd758ab9089a80aac2e539d7694262b69675a5ea448d3d41ff4568f265078d31fb0c340c5aabc8971142de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ddc79a5f56becb53b3f92eb9dac23660

SHA1
945c31d522434411a1015702b96b0f415641bba7

SHA256
a8fe13885ecf2f047990e76d629374692d6891f43a279270d5b9842ae0f91f0e

SHA512
afb21c97bcb1e2c924a2f5b91c703c0646b3acd7eb9259b66c0c84281fcb6e0da157c4329d66ee8df57617bf6f558e5a0750f5af3f70212643af275ec9a27fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
69e0f92761e542c6964c70ffd6521243

SHA1
de3a2508565baa69c5dc8fd00dd79894a0cb01cd

SHA256
474818e2dd8be777222d6fec4222271f7237f2f3ae4b8bf21893ec215a052a70

SHA512
18a35655af1607877ee96b0822aff292815b423e41b70c4470f41f84bfc2bed0b9e497400f188d4a425151d6577b004761c3781cf887be69ea15b3e440eed3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1702fc0ef396addaad1f1353272c1095

SHA1
7330ded8683f79251d88c00e974d606c0bbe56db

SHA256
0fc08cf598ad204f1f140f03a2bbf005d2d3b9112adf61833d0290765fc555fd

SHA512
2e61f9fb3499f74dae2766ea21abe75304ebb360604365c68737be8ec659a93854264c11e4a2ea7f0b7cbe9f7fcea38d4b2c2aacddeb8ad3280d95126c79e601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f1f4edb7eabad514fce9d52764e09aa9

SHA1
f61c88c4328b6f70658c55bdd4d7f2d231661f30

SHA256
7045918ef79033132a089d9866c19351b59fcefe4ce53c41e8b3665956a6fcab

SHA512
a43ca4cc229757da596d21b685c935d6e20275dc123175dafa5933b7886317049a7daa0206b27697d186d70781262389eaebc7d55f5be8756e9c6e7caa7d68b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7da2d5ce473831332ee73248d3a7e30e

SHA1
3f2169d6f6462524aa0fb69108b877a55fffd3f0

SHA256
5da1d2c80d8d15cfb4e703c00e0534247648c1ff79593e09f0f413a432283015

SHA512
f4f2ed55b67847fa52da47ffca9c612081f856ff5f2816993c49c39571da42b416c32ada23435a1b45db51b595d3ed33e533a1fac619f46463f2302515c6b7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
32fb576dd19027a635f4cac7ea60ad3f

SHA1
0456d822b08788c921df75f2c12d274fb38d0f33

SHA256
c0d34a05c8e9c679772b5bb37a426bc2d1a695b1b24cfafbe6cbfabc6c943c56

SHA512
6ba08b439b4ffbe0f9fb06dbc30e056070cfdcd7ef4f4d40e87eb160d510699a39e7458677f4dc8a83d2b32cce1bfb9b0d3dcfed1cbfb976dd4d56dbab9ec55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
89734a6f4cda47153bc89b0d644f9a17

SHA1
b687fde575434eaf8c3c9b2b5ddbd7112d040c15

SHA256
91f74dbb301dd36a7e74e88d2def09fb1ec4aa722a9eadc7fa521920e9ddd38f

SHA512
3166e515c7790dcc4e851fe44d1f63a77e608089d805c0076cf8f12c3334ae749d2f3d8e9e8d7fc35645749fe731eabad47504082e139d8ebaba262c39d8c533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f515eef-9ab2-4edd-9cd0-439e61101cf5.tmp
Filesize
179KB

MD5
de98e137ec71981bd60463e69b51e188

SHA1
f85f5ac35b556a76c79cf089fcb583b878af6b5e

SHA256
545ad6e4d0ec5bdc91e5781f0bfc3af15887b5d8022eb7a9b491f285d52fd1fd

SHA512
132c3914bb8dcc60a84497d1a8928a125824bf355c5cb37a5f783bf8125b5d44ee857b12989b8a9118b01d29b498316c64c473d6f7d4b25cbab85317d13b1cd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3dd13d75-d64c-411c-92b5-fe241bf5c812.tmp
Filesize
4KB

MD5
8dafb939637fc635701fca73ef6e8e95

SHA1
a04e07f908030254529a41c5f63d0a0908ede5b5

SHA256
0ce8c6b7f6d6015c9934c845490dc84da889eb21159698a7c886c7f0ca532902

SHA512
ceb8d34717059803a498b29237843cf1823dc4b9b3bc9780645e61ec3784f312ec692b86ded576a486945c699351135cacc2981dd29cfd4458b7940806aefcbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
359B

MD5
84e4b3463c8f859233954470a817f1cf

SHA1
7329df58df9081d8c5816318726641b37b03a809

SHA256
d2c13ae2a7329ce8c729ea4d3e5ff3a590e4fb5bd1bc2aa0b74a5f1c4d62cb9c

SHA512
148f9ff87ed3167d429021b53be9f0666d924641769976f15d966b96f10af4ff4777b40a812a7669089b574665bd0fd3045890655def3bfc4d7bee2abe3cd493

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
179KB

MD5
86056b18de8015253250da418498eaeb

SHA1
83c5b96db33db3a977cea8289245f88853c67017

SHA256
4c359ff758371990aabbc0c2051697ee3eb0dd8a4c2a86d56d4f896bcaf81df1

SHA512
6dbfbebf9069f5de6c62317c98818ed5bf16cbaad665ca24d6d49f19fa7ec93d9ce80b0bca521f08c6fbe7f7d74de3ec21e20bf8b1dd91bb8366182a63cf1789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
179KB

MD5
fe9e4c693c88968d849bfa52ca0ba5cc

SHA1
b35a44bbef73c227daf4158789034de51d9bfdbc

SHA256
3732337c8c8f0e72e0674c24902f635ef6e80f3fcff421d739afdf0cee029eab

SHA512
43618be1cb5a5526131bc4380cf3f67406f66b7e6b21bfc69107c96c40dd9d9240b3586f4306dfb9905af7bf03c4a1616e6ba7fd17e6982a908a843b2a611c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb
Filesize
1.0MB

MD5
bb09856d9add55842e7a824b9e21d2cf

SHA1
6f08e98d5ae3dae8d8ed2a45ef7b1c5d7e52913b

SHA256
35c7f76df3850f6cc658b7a0f7921b560482ddc15baca545d25d4a586086e3de

SHA512
f4349e6f5528d4a709389aeacc69354e7028eb4cbb1e10af3e9c25d1733a155a2f7e2c962d89a307f892bbd7c22af49fa09b3e71805f2e677c2b8ea58403fc2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab932E.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95C0.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Filesize
3KB

MD5
7bea898b959c5f0404bfc2a0e25c3d82

SHA1
445b30471ca826c23c636043bd95b93d2bfbbfd4

SHA256
6eabf5f229df30826eb0e29f4f0aa8736445247348000e24bb17e6cab746f4f7

SHA512
26537b49ed0ed97ffd3f07650f7c6d0f0ea46fba90e309e594cbe9ab0d0be945c8243129509f8f8e7850cc8a0bce643dd9e715ce5aeb414cd2538b4a9f2cdc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFB9E74AD275615CF9.TMP
Filesize
16KB

MD5
e9b9a961df094e42596fafb769b42b3f

SHA1
bfcfb7e33f5b9e4b702dd28e474c5aefe6a73a0d

SHA256
a268a61fd9d0ebe655ba3ecfdd66ba6d5bcc8cfd225fce29d050b1bd72bfac23

SHA512
42c3636428d7e3aa2816b5b737b6ebce5c94007e15444b31211f59ddf584f58db19a9b10fefb6ca4d59316739a1a2bb04768ba6c9d710859e32b222b4dbd9c5e

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
6d2524723ef12c9769af106100a64937

SHA1
dd4210702632c2b9bed427ee69295c2b5040f314

SHA256
356332881db55bb4e243e6120985e93f46465283dfadd450baadf7bee45f2e64

SHA512
6b5f9c37943a95abb847a22793cb59469520e3e06c14978648b6f529915d6352eb006539f3239a3c59a387c9bd1b0cb5f6a691a1d6b97ea8205c597a482caa34

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat
Filesize
40B

MD5
036dfdcb3272e3838300aea466821d57

SHA1
81eaff1acca28bdc0545ff0468c425422c9e403c

SHA256
c9bde4a028aceb74183f636ab3c6f54c4fd9fb9eb4843e7df11be87433c7619a

SHA512
280cd9f391aec5e5d5b12b6c2b5959558afb45faec9b1d6a67afba92b205eced47c1514c58d230bb5b79cb607c8a47de898266865bd9119e7af067870d1d1ae3

Download Submit
\??\pipe\crashpad_2392_WTLUZFJRXMZSLAKF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/532-5913-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/532-5914-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/532-5915-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/532-5916-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1304-5847-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5859-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5844-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5849-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5855-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1304-5857-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5825-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1304-5848-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5858-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5860-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5861-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5862-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5846-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1304-5845-0x0000000003950000-0x000000000395A000-memory.dmp

Filesize
40KB

Download
memory/1580-5856-0x00000000012F0000-0x0000000001330000-memory.dmp

Filesize
256KB

Download
memory/1580-55-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1580-56-0x00000000012F0000-0x0000000001330000-memory.dmp

Filesize
256KB

Download
memory/1580-54-0x0000000001360000-0x000000000139C000-memory.dmp

Filesize
240KB

Download
memory/1580-5843-0x00000000012F0000-0x0000000001330000-memory.dmp

Filesize
256KB

Download
memory/1580-186-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1580-189-0x00000000012F0000-0x0000000001330000-memory.dmp

Filesize
256KB

Download
memory/1932-5900-0x0000000000BA0000-0x0000000000BB6000-memory.dmp

Filesize
88KB

Download
memory/2264-5883-0x000007FEF6D20000-0x000007FEF6FD4000-memory.dmp

Filesize
2.7MB

Download
memory/2264-5884-0x000007FEF4380000-0x000007FEF542B000-memory.dmp

Filesize
16.7MB

Download
memory/2264-5882-0x000007FEF71C0000-0x000007FEF71F4000-memory.dmp

Filesize
208KB

Download
memory/2264-5881-0x000000013F750000-0x000000013F848000-memory.dmp

Filesize
992KB

Download
memory/2452-5833-0x000007FEF6360000-0x000007FEF6431000-memory.dmp

Filesize
836KB

Download
memory/2452-5832-0x000007FEF5300000-0x000007FEF5428000-memory.dmp

Filesize
1.2MB

Download
memory/2452-5839-0x000007FEF6440000-0x000007FEF6502000-memory.dmp

Filesize
776KB

Download
memory/2452-5822-0x000007FEF6440000-0x000007FEF6502000-memory.dmp

Filesize
776KB

Download
memory/2452-5841-0x000007FEF5300000-0x000007FEF5428000-memory.dmp

Filesize
1.2MB

Download
memory/2452-5842-0x000007FEF6360000-0x000007FEF6431000-memory.dmp

Filesize
836KB

Download