Analysis
- max time kernel
105s - max time network
154s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ATLauncher-setup-1.2.0.0.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
ATLauncher-setup-1.2.0.0.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ATLauncher-setup-1.2.0.0.exe
- Size 2.6MB
- Sample240224-w2celsag45
- SHA256 d051b434836408a72c8b8d9be423c30bf51cef3df2f954b5b099740954845ccd
- MD5 9515a0d3a9dfa2c861baee86ee447419
- SHA1 6fa7b3341f3fa7d9bd38a194c80ae8077e842524
- SHA512 ca8fb4775c3c08220e356e44c0b8fd304d7264cd6aa2a924ebf8d4170e53cd5db25fc2460f52f0a6fcdfa4305340d555c7b9ff4bd300ffb2b5ae288bc6b9d8e9
- SSDEEP 49152:NBuZrEUp9VRG26qhJQrstMU9QbKzjgZTUljEXSD:bkLp9Vk2z0J2Qez8IjECD
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 2848 ATLauncher-setup-1.2.0.0.tmp 2800 7za.exe 1112 ATLauncher.exe - Loads dropped DLL 5 IoCs
pid Process 2332 ATLauncher-setup-1.2.0.0.exe 2848 ATLauncher-setup-1.2.0.0.tmp 2848 ATLauncher-setup-1.2.0.0.tmp 2848 ATLauncher-setup-1.2.0.0.tmp 2848 ATLauncher-setup-1.2.0.0.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "276" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "276" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000c03c3ed106bf898781b0819b823b18ac7878f09c9b4afb410d5bcee40171bb23000000000e80000000020000200000002d4e51f4441551f0c0b0136a4ca358be084cac11f6b23f1873e6bfa6ab5e4e9520000000112a19fe9de13d909585b6ac3e86df0bd70896a865b508ff9f6ebc4d967b82fd40000000b7642629581603c7df28472826e6a34766938a89369946065433b1752a0ff918d088d5f49fe39966c85bfc703e463164c7ad266bc3d458af490ab6a3738d1183 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30FCCC01-D342-11EE-95FD-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "122" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "276" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02e95094f67da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000f927adf556339fef868c7bf435346f76760aba814364db3d8294081748f4a88a000000000e8000000002000020000000d1177f91ab5fed8fe93beab9e1d23cba77dfdbfa761853788fbb7357d115446b40010000c2fd8712967213df0e264517a98dcef8bfe50b87d22dbbf54e0e5c842ddcca7ba5d6edbfac2ce4131be5ec19230443883397e5d1c6d687f657c0a91add020571081a3e7b135e946f3b9cf0c919e4963b4c153c67880b2e89f202b39a942516865b284f31d72ea4809be4ec106fa0572b7de248874bc8edd36c2dfa14ee07cf55d7b5a6f814ff1235976e7c0c0eb2e570e8426af52612bba8e2d06f1ebb1856ab35223c69c1e782f0bd7d401ecc56d407efa31e75a93b5ad46d21bc70e89c64e0b2a6aaa436982c609fdce0736f17a95000469995e956ba5220b7f317326c01d7fe171edab0e50dcdb9a780bdeaf3c375e1f88b4489ba7ec2417bfe6239dc2fbeefbff8789d8336cd1290a719e4c18aa09be29f931f490d6c4ab49cf1244df7991e5fe2b1c705e0eba80f6026f625cdabf121b2453ceef671f815d9b7055ed8924000000087c051a34c59f45d68c5744622d920351b0146a9689232fb45364a2a875eef5aa476189921e9a2ab478a5cdca16a84326d0c1adbd859d4020b95cacf17934976 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "229" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 ATLauncher-setup-1.2.0.0.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde ATLauncher-setup-1.2.0.0.tmp - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2848 ATLauncher-setup-1.2.0.0.tmp 2848 ATLauncher-setup-1.2.0.0.tmp 1156 chrome.exe 1156 chrome.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeRestorePrivilege 2800 7za.exe Token: 35 2800 7za.exe Token: SeSecurityPrivilege 2800 7za.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe Token: SeShutdownPrivilege 1156 chrome.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2848 ATLauncher-setup-1.2.0.0.tmp 2764 iexplore.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe 1156 chrome.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2764 iexplore.exe 2764 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2332 wrote to memory of 2848 2332 ATLauncher-setup-1.2.0.0.exe 28 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 2800 2848 ATLauncher-setup-1.2.0.0.tmp 32 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 2848 wrote to memory of 1112 2848 ATLauncher-setup-1.2.0.0.tmp 34 PID 1112 wrote to memory of 2764 1112 ATLauncher.exe 35 PID 1112 wrote to memory of 2764 1112 ATLauncher.exe 35 PID 1112 wrote to memory of 2764 1112 ATLauncher.exe 35 PID 1112 wrote to memory of 2764 1112 ATLauncher.exe 35 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 2764 wrote to memory of 2300 2764 iexplore.exe 37 PID 1156 wrote to memory of 3068 1156 chrome.exe 40 PID 1156 wrote to memory of 3068 1156 chrome.exe 40 PID 1156 wrote to memory of 3068 1156 chrome.exe 40 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42 PID 1156 wrote to memory of 836 1156 chrome.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\ATLauncher-setup-1.2.0.0.exe"C:\Users\Admin\AppData\Local\Temp\ATLauncher-setup-1.2.0.0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\is-SJFAH.tmp\ATLauncher-setup-1.2.0.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-SJFAH.tmp\ATLauncher-setup-1.2.0.0.tmp" /SL5="$A014E,1526961,1202688,C:\Users\Admin\AppData\Local\Temp\ATLauncher-setup-1.2.0.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\is-DB03U.tmp\7za.exe"C:\Users\Admin\AppData\Local\Temp\is-DB03U.tmp\7za.exe" x "C:\Users\Admin\AppData\Local\Temp\is-DB03U.tmp\jre.zip" -o"C:\Users\Admin\AppData\Roaming\ATLauncher\" * -r -aoa3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\ATLauncher\ATLauncher.exe"C:\Users\Admin\AppData\Roaming\ATLauncher\ATLauncher.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7219758,0x7fef7219768,0x7fef72197782⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:22⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:1252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2192 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1124 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:22⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1268 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3480 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3648 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3824 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3848 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3852 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3888 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2312 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3780 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3788 --field-trial-handle=1352,i,12637552983236983459,5420241245201368558,131072 /prefetch:82⤵PID:2852
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
- Size 471B
- SHA256 ee52d7f679c03b6e7a94abdab70ffcbba90d28bdaeba59fd8aa59e3a2c4e9465
- MD5 504651a1183d5765f59084ea5366ab91
- SHA1 d9065847d2054d7eaab3725958a5e529066f7d14
- SHA512 4b05a0c5eaa4bd7642bd3f8eb5c21bc4e9d358a3f02f282f5c5426ca17a7d109b0a8db5076e04cd024bbb822c686ac5cc5ff73466f884a32434927064faeb0b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 93bf1d4024d94104ee0839f860a4ddabe1d98b8e13236faa1272982d63ba926d
- MD5 87e42acc17e10776dbc67761997851a3
- SHA1 99f29d25a0bbf6d48cd4e0dc4203bcc38acd1795
- SHA512 bbd948920027333f31a61f62b4e1a6126b5030f1304fa477075fc72419690c6dead6fa5a594b7cf66913fc3379fada2a8099f3945be064dd6b6abbb41710bc22
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4eb1b68be8b7270425243140f4f1954bc81fd31ac862d7ba8c9412deab4a902f
- MD5 93a05fd6d2a7ada91831558f231b0f1d
- SHA1 d4a16f314856fbec53b558e44a111fe343a9b7c9
- SHA512 daad22e7590b24c7084fb2f4f9afa17dc31563931915c5902a44bbbb32e08dc66be8a052efa8f395674c8797b98980c0b5e04c6bef51f6c9d51f98efaa57aaa7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d5bdc199a48a8a9db0e53659497cba3858a2da16f7df8dd5ee2d3750218aee62
- MD5 dac6e559c06022c395da0ab3349cf24b
- SHA1 24973e67021f7a30c2295b54cc97516fb83cdcf8
- SHA512 e772a911d4a271bc2d46c12857a5e6b641e94dd08b8cfe9b00bdeb9f87e9c261bf498f286a22e7cbd50009ea11d61537e64b1316f772b72dda033762d589bfd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ebc72be6b08e7b30e1bcd151da3d55b9a50e66ee65473a67d7bee9bb11297d4f
- MD5 deb24b262116247a7313bbe93cee738a
- SHA1 20c54009ba76abeccad9422316da001faddc5687
- SHA512 b03abd6511ed07fd6729c5236dfd2d5424921f7bd6cf17d5f2a9147a04829b07640d50e96badd0e4e4ae5cc684cbdc5c350784d9dad89940e9285229061527ba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b720df005aa3367d356b445c1993616de64d76069b844e30b476f31e4c0186a4
- MD5 828ed9537754eac009fff2d3602a8909
- SHA1 94da70de86a49e33c25c960bbacfa30eae8c58b0
- SHA512 c3f8ad1aaa6fc2097877f681646712004bd1822e4613e14bcbcb58482c9b75e549b4b865a34316f1462ee54245e5b13c40600a4827033f0d7b6487b38629ccca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ad103a07ffc451e7c9329712d78f53a461f85555aecd7da3c362c81bf161753c
- MD5 a87b1dc4cd70b3db10d048d2c8618408
- SHA1 eac2c89600f6058149d7d21ceedb61c0e4b68388
- SHA512 b548ad9642a9a89d81b51eb3a3e590f3a87fa1752687b43879b4a0b0c9c6a99644b9bcc73885d4dbccd0f64728e0cc4e9214cd74449ea755bd765c4216f345be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 109ab7c8498206d4b11ed63aff3f1f47bec16a1a074d6a1038dd1689cb53b5d3
- MD5 bed6df9713dbffc7660f30f3e4d53543
- SHA1 07242d94cbc64b4c6648ec084568c6eb2836db00
- SHA512 62946956d8df66c01e73aa4096558034dd3a214d8e501b5807f80ee8b85441fc8d1de33621482ab1a8330fa502e413d84626563a73fff6cd86d046d3264ded54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 940380f5f81dff5d1b570071200d96b3415778f0efdc352ed730cbf1431fa470
- MD5 cbf80f8f78ee2076fa553d0356befea7
- SHA1 945b316ae7155fe107479fb9634ce2488d9fb327
- SHA512 03239b7a5e2db65f809e56af64b543862cc522e6773adabcd6624a8049d38b82dc6659abd46941dcc906c5128e1849fee9e77f486a7d33808407af8df1f13784
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d97740c8e46ab670f53db96f320ea4b6d6b6aaefa2e85378dce49832bc7970ab
- MD5 2b78fd20ac153c8b713e7a871e5dc741
- SHA1 0e1b98736f4d249ab99b27978fb6499c53606b65
- SHA512 c282f441f0932ce52857d7c5a318647c1644c21ce3b74b1ece8fb4297a793ccfd91ea4228bb1e3ea16f7f9c0c362d1dbe98d3f59011a1ff820de2c02291ed779
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 feb3c0539394058da70794b1512060047fd6cb4661901dea9385d4b23518bd7d
- MD5 df68712fb0df3556a6dbd25c237d8778
- SHA1 7da709c70e88c79697878cbe46edf5b6117dfb4b
- SHA512 e836ed106e053cb9f910a6d19c930e156b5fcb16bb869d78f9f1bd2ee305e8caa671dd43e4e7b0e11d87bdbd93f38e1cd44c74cd5fdae500c1be4413c6642c0f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e0f711ade4f90baa75622e0a2ae62cade6b8a59d6eb3254064241774fe43e265
- MD5 25b502b685999e6a694b281057382450
- SHA1 22bc7571802b1a66ab7c69838e48c13e2a21ea10
- SHA512 f38ba301ed4b5ac8d2f0a37da729a0f1740753b8427386351089d832b7694bd47ace6589b8cb3730d31ff1667414f67a01eeb03fcfc9a3ede89a1809a37721b2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 9850f5b96610fb8fe2378e649dd26efe6be325b63a7d486715005fd6ed30a00f
- MD5 3b14df7a24697b947457a139d44688e3
- SHA1 1d67a0443443963c782b879e74a0cfd520da7da2
- SHA512 f32504b6fca5bbec1e141f0eceeb41d57d7ad91d01670fd33f8d00fc66ca0da525b7ae4bd2aa02e25ba2bad7f4f2237539cf61a97a9518555dc0d5dd492ee5cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 92ac5f55d1171da7ef91d66f5e92892d8fcfa28fca175abdc34abff11f74251b
- MD5 91c72dfbe80959353fd253be87bcef72
- SHA1 c9d345cd7d120999dd08934a51b641a1717e7d0a
- SHA512 3a19fe60e9df2b5d4b70e24d6f4c80853d946999bcca589c3326c088dedb35283c25ada28e259b042811b5199caf2c19873c06ff769ed9784e9158acdb256c3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b60f835cbece509117dc2c5789a7da981beea340d2b45aa3df468edf84a9c985
- MD5 7df3c1169dffdbe3b66b71cfaffa1d3b
- SHA1 3fd18af70abe177696a2e856cfaea66ee11bfdbc
- SHA512 24e87aeac157acfd4dd21bed198fcd60667d2bfd10bd12c580c55ffc56cc68102e66ee12ea7fe6bd4a1cd9d372bc593e307291cbe597a0efce1ece9d62f18178
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4c9c2b2df745d6fe34c21aeba5abb1d8b3d2763a677dc26b55306363d8c97ef7
- MD5 01529095dc160d191fa5979c6c91a804
- SHA1 de7944768bcd2dc1c08d20b9c6195d221214629a
- SHA512 b8080e0c792bf070659fe3930195aeb1cb24b2c64e42f420e8a6bb18a1f60c1fc0feaa0f02b48b6331d0923be673c359d6764afd820eaed559b671882746fc5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 2ee69977d8b4bfa6f0cb5b9f347628314fa5ff63cc0432e6e2c6f1d2c9b437da
- MD5 cdce3ad8bac20275a3a3694191ad53a7
- SHA1 d0d3cbf1cf33c8cb67fcb3fd9ecb7e41dc3d14bd
- SHA512 2ee4112ae6f408e5456436b3294b752579891f7e0c7410962171994968d721fdd49b8faabfa684c34f507d917ad890cb28b1a7ffff6f316d04cbe6fbf896a8f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
- Size 400B
- SHA256 2770b71538233627b1dd8de19c59e9e9135d6053748c174d3e21f2524d2c067c
- MD5 8225414e789769cd6723d40e1818cbaf
- SHA1 92df3932e38f1730658f6a108f58b40e549e845b
- SHA512 cb71bf5b108b8fc8a7ca4651d203b3202e63eaa1e30edfbde525b868a2f688a4fed3242801ad52a9c9e7506816f0f97415aeec8783f4634b4a0461de22f7955a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 89d6f5b94f95a5c852bcfca5f1a95e58e3297fb367ed94b5f84b5d4056a73369
- MD5 b5341da4adba9d7413c493e86c7129a7
- SHA1 9325e343aea90b4c94bc8a6fcc0e21c8f04cd21f
- SHA512 78c93d071bb73adf76e566b701694a0db27c7ab5914c9356df48ee1b231a194334c0530505d5409c08d962d5b537a864bc54fbd6eefa59bf56ac348385017dd3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity~RFf787475.TMP
- Size 1KB
- SHA256 c1797898ab8fe75f23367fb242d368d6b11a983e9557234d4add2481c9664650
- MD5 0b97b53ca44182645bdac81e5701c9af
- SHA1 c1f5f5312e2b1f48aeff5271ec6687738f4800a0
- SHA512 413545816c968b4cd55e965053fb3c598ce6d47b4719917c41d7dce475c4de6a437bae74d2a9f22a8afe757cd69ea07db675e79b2272b6c08e20cacb036f121a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 03e39d57f17048d4751bd5d73bb81418bf460e43ad1e1b0e6c0416f65c793fab
- MD5 82f89381b8875f31b929e3ef346684f0
- SHA1 6a5b0c01ece610db91dbbe140095a4ad63feb634
- SHA512 bfc94890008d029e2afc5842d635dbe84531ffcdef925dec79f96f299ae332249604f2e1dd42d12b16392c59b5e432d1fcf141ddd3aa13f8372420f995dfef67
- SSDEEP 96:1L4OZKIVLld8iZRy7Di+6MsmdeDIOBYzyjV39:1LdZr8syy+FqnXb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\OP28285L\www.java[1].xml
- Size 13B
- SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
- MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
- SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
- SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jre0bgm\imagestore.dat
- Size 1KB
- SHA256 dc754cec52693ee106bd80a3811e869c2312f9f80af5cced6a7348054beade6f
- MD5 7ce81fe7fbdc019e8d9852a3ce64b2d8
- SHA1 d0054abdfd2ba6eca0cc8221a1988927ba259db8
- SHA512 cb6d120a025e848d20bb2b6830a36a3f9e2620332eada1598a8f2b88b4d7fd3d071f6fd5554d2c2d8b363e9fe06354f4e6beebcb5fa92be73565133fcadf8b0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B4HDT8MX\favicon[1].ico
- Size 1KB
- SHA256 872bad18b566b0833d6b496477daab46763cf8bdec342d34ac310c3ac045cefd
- MD5 8e39f067cc4f41898ef342843171d58a
- SHA1 ab19e81ce8ccb35b81bf2600d85c659e78e5c880
- SHA512 47cd7f4ce8fcf0fc56b6ffe50450c8c5f71e3c379ecfcfd488d904d85ed90b4a8dafa335d0e9ca92e85b02b7111c9d75205d12073253eed681868e2a46c64890
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab7EF2.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar7EF3.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\is-DB03U.tmp\jre.zip
- Size 105KB
- SHA256 1a91afe681b12df111edf9ebe5b39e63c5f9addab49fd525e8caea488a59aaa2
- MD5 eec52396a9ded6168f1f1660c0e154e6
- SHA1 3fe610d0d9c4b2665be5b1663022bce412f45ee0
- SHA512 731f619e14c34cdfef4ccf46272d4d8889ce8f07a14b53ee8f9c513bd32df663259b11230ca8f74bd552df0b3d07fa512e1a024835701bcc88d1548b9372abbd
- SSDEEP 3072:/uggmClrl+beEqSD4PX2Wq4OMRrBlzgjrowneYMYd8oHHHk4:ommJiqmU0EzuEVYdPk4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~DF96206D2781E31CCC.TMP
- Size 16KB
- SHA256 1d2f35b7c9a27fa345bd24c38f138cd3e72dde0f0ffc1ca5b6a9a953428bb7b6
- MD5 773f80c0e2a9ea2cfa31831294697cee
- SHA1 0e9670f8bb5d3dcc382cabb0a93059f87afa374b
- SHA512 281474cdbf4f67e1d3c7f6f4b024f7e1ec9874b7efb9c30938c4ff48da5bb1b85c89be011065518ad48b88e9f97bd3fa415d06e3e0c307ab59f1f928ae0ce53a
- SSDEEP 6:G0wj2AdlsNYAUFAlkx6OVEZx8mX19Xh9XRClcclGk5/uxZX645/u:GJIcq98G37qVrhOxh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ATLauncher\ATLauncher.exe
- Size 13.1MB
- SHA256 b2c381a4aa50d75ec3dd5fe641bc326d397a2973d4443c428e4932eb7aa8af7d
- MD5 c22c5cdd942a0431e04504aed4dead91
- SHA1 d861de0eec33a3525356d805031f24d2a8bc0bd1
- SHA512 d35ac051180d06cb7fd18235fb505edc66f20e633c1f874983a540e0468b3eff2f51a66f20127fe1a061fa1376f966ea8eda669ca61646e0683a480cf2751702
- SSDEEP 393216:woS+kjsiwoKBgOPvIxXTSuAHy0g5+n9Q6C:tkI6rSy08k9Q6C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ATLauncher\ATLauncher.exe
- Size 8.7MB
- SHA256 7e3a780a7617ceb2d98cf42895f9a24ead4a33f4265761dfd947e5ec3056723c
- MD5 838a375654bb3ed90bad427a6aff2bd7
- SHA1 eef93ca71548eee3a684a543d9328ccc143193d1
- SHA512 dc46b3f892f4c24e9d7d3e23064d791c37600bcf98c4cac8c6e581d255eaf9d9d84bfc64a38b0a7821561b815afa50c77d64be57a5660d9a07b269e61a1d1ad9
- SSDEEP 196608:womPlXq2OQrjOmjAml3sgwoPp9z6B+G2OjXkWvIxQSGL4Sush3e:woS+kjsiwoKBgOPvIxXTSuF
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\is-DB03U.tmp\7za.exe
- Size 722KB
- SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
- MD5 43141e85e7c36e31b52b22ab94d5e574
- SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
- SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
- SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\is-SJFAH.tmp\ATLauncher-setup-1.2.0.0.tmp
- Size 3.4MB
- SHA256 5b15c5d2b573d06a78b1774a6b5ed549fef9eace60b1b137f5186a3dac25ab68
- MD5 fddfc2fd95d94fcc4f4c3d3abc482dd7
- SHA1 c82ffaf7f1972222de8e260f009f746cba33554b
- SHA512 ab316f9da61b552d1f11e4873d228c35cc091846530297dfd3c2d2fd3a971d42406ee58f8969538e8046eb111a3e3e0c63017e97cb9f9eafe4ff04b703698152
- SSDEEP 49152:vWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbv333TK9NW:htLutqgwh4NYxtJpkxhGw333TK9I
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\ATLauncher\ATLauncher.exe
- Size 7.7MB
- SHA256 0293be1344770030e42826e1b7b87071bd94147fdc784a97a419f261910f9a09
- MD5 5dba9feea4ca5d20b4eb066c6058e653
- SHA1 324abff125548062380e0e9173050483a9004f51
- SHA512 72c2a29636cac7c8efbfeb31d4fdf346ac8dd3585d0f02007c4d0f1ff36b91b7dfdcac6f80abc09af584e64b6071cb7c225436c5ad421c8441360a6249c70eea
- SSDEEP 196608:womPlXq2OQrjOmjAml3sgwoPp9z6B+G2OjXkWvIxQSGL4Suso:woS+kjsiwoKBgOPvIxXTSux
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\ATLauncher\ATLauncher.exe
- Size 8.2MB
- SHA256 1d422d08aef48641c3fff6cb060e81ea7517043a1d5d9ed488b8172d6a823ef2
- MD5 46babdf4588dbaddf2755f4f38cf379a
- SHA1 7d80bd57223bdefad63e63d495631cf9036031d4
- SHA512 9c7102bf46796294f9de8a0c75253a2f2245d6b6992a3cd657b167bf9ec81db51dbbcfda625ccac83788b6bd2ec26c6aeaafd05d437e14a5db95b99a23f10296
- SSDEEP 196608:womPlXq2OQrjOmjAml3sgwoPp9z6B+G2OjXkWvIxQSGL4Sush4:woS+kjsiwoKBgOPvIxXTSuT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\ATLauncher\unins000.exe
- Size 3.4MB
- SHA256 3fd61b0ec5df2bb0f68dc1705e97d10da7180c83e22d592a3e490e25610fb037
- MD5 2068497455ac45c110cfbc3fa7bb724d
- SHA1 499945491cf48b8ba69d1968d9dc6bd269db31a4
- SHA512 f502644d15c5f645b5ec5387a56b62aebc2225d9461883c5656cb17f799b0c3ee58e5724a835d98d964176bbfa1907771b7326f09a9781897d5dccd36fea66d8
- SSDEEP 49152:XWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbv333TK9Nd:ZtLutqgwh4NYxtJpkxhGw333TK9j
- MD5 SHA1 SHA512 SSDEEP