b7569d56a8ba896cbed8b5f82b8712d15cdf16a892e77db9af19b3b8833a9e17

Analysis

max time kernel
180s
max time network
181s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WebPhotoGalleryArabic.exe
Size

167.5MB
MD5

c48de482c0685aafa5c647f4061a802d
SHA1

960e445280d2b5a088822b6cca065f3bddb14281
SHA256

71eb54e617c119a4e57433099651e0fad2df171f7bc6406053b5424f9e260f9c
SHA512

3a030bb052b69c930ca34c89226f3f341e1ef3fcc5b27a37b718b2299c10fae416ae7dcf979fd366d75b673ef7404198cd91484313f999f17cddaa0370d73315
SSDEEP

3145728:VnVTMT5Y6o+irlLEwwHlmNKHccNeueLX58HOVX2oXcXAI84itAOGQISKrN0Ja6hL:zq5QEwwHlmN+Rc1LX5pVX2oU5ZhBOr

Score

7^/10

evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1404	MSI4E57.tmp

Loads dropped DLL 10 IoCs

pid	Process
2728	MsiExec.exe
2728	MsiExec.exe
2728	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe
2268	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2184	msiexec.exe
7	1816	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSI4E57.tmp

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\X:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\T:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\W:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\I:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\U:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\I:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Z:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Y:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Z:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\T:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\E:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\G:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\O:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\Q:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\X:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\G:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\S:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\W:	WebPhotoGalleryArabic.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.PivotGrid.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Scheduler.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Web.ASPxHtmlEditor.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Dashboard.v23.2.Win.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Dashboard.v23.2.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Dashboards.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Web.ASPxTreeList.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.ScriptRecorder.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Xpf.LayoutControl.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Xpf.RichEdit.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Xpf.Spreadsheet.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraDialogs.v23.2.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Web.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Diagram.v23.2.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraGrid.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Dialogs.v23.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Images.v23.2.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.HtmlPropertyEditor.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.ReportsV2.Blazor.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.BonusSkins.v23.2.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraEditors.v23.2.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Data.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Notifications.Web.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Reports.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Snap.v23.2.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraReports.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraScheduler.v23.2.Extensions.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Blazor.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\json resources\dx-spreadsheet.ar.json	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraRichEdit.v23.2.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraWizard.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraBars.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Security.Xpo.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.RichEdit.v23.2.Core.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.PivotGrid.Web.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Validation.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraReports.v23.2.Web.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Release\msedgwebview2.exe	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Office.Web.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Web.ASPxSpellChecker.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Xpf.CodeView.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraLayout.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.ViewVariantsModule.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Pdf.v23.2.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Xpo.v23.2.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Validation.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraTreeList.v23.2.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\MetadataExtractor.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.XtraEditors.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Workflow.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Pdf.v23.2.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Sparkline.v23.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraPrinting.v23.2.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.ReportsV2.Win.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Spreadsheet.v23.2.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\WebPhotoGallery.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.Security.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Xpf.ReportDesigner.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Printing.v23.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Utils.v23.2.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.ExpressApp.ReportsV2.v23.2.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\ar\DevExpress.Snap.v23.2.Extensions.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.Data.v23.2.xml	msiexec.exe
File created	C:\Program Files (x86)\AiSoft\WebPhotoGallery01\DevExpress.XtraLayout.v23.2.xml	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f7847ba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5654.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI751C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4A1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E57.tmp	msiexec.exe
File created	C:\Windows\Installer\f7847bd.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f7847ba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9F0.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000000814877c4cf8482b78b2b38818a26f700650fff8249936f4c61d3fb9214b6c4c000000000e80000000020000200000005f02f0d50917bf52eb9dd4bbae3b9766bf6ffcee27be5a2f320de9ea3e7a975520000000371ff7554ce9b3f3acc6d94ee33156c6ed837f29a960384ce10c2b6594ec7a444000000028b53730e254fea7168d720d0d81b4036316451a9faf2643ebcb686adaff5ade1577ac9ba06cfbee8e433340539618372d5dd20c0b41efd49d3a3a28320797c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\webphotogallery.store\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8C97A61-E610-11EE-8210-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000a0f7dc79a817c821c764edcd4c964ebd5281bc4115861980d2d4b23791456d4e000000000e8000000002000020000000b85770d5b1f48333c38c520f25452e9231de4b469e7b717c0e7de0b7f7415ff19000000019a33ee866dedb231788df36da34f622c95022d463bf87a95b75c4a28fa476832c4b8bd26200ff549100a12a150f4870d7c71301a46cf6ffca6883e9bfb751251fef22858c46534e8887bc17039075d274024d31c91497e69c5498ac68331dc47784f083ea2e56c96e30685aed0ee60fc8dae88a5e3345b864fb87aff7e4f677ac83b6d642be69a7639dee283d3436cb40000000d54dc0344bdd1cc97caa2af0f20a3a81619d5e43d14f2e8be56a8a86c97dbba5e20341ea7ebc71ebd9ed68b0ed30762e35b46f6cabe8261785753176c29ac45f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40447fbf1d7ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DOMStorage\webphotogallery.store	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WebPhotoGalleryArabic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebPhotoGalleryArabic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebPhotoGalleryArabic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebPhotoGalleryArabic.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	msiexec.exe
1816	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1816	msiexec.exe
Token: SeTakeOwnershipPrivilege	1816	msiexec.exe
Token: SeSecurityPrivilege	1816	msiexec.exe
Token: SeCreateTokenPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeAssignPrimaryTokenPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeLockMemoryPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeIncreaseQuotaPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeMachineAccountPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeTcbPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSecurityPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeTakeOwnershipPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeLoadDriverPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSystemProfilePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSystemtimePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeProfSingleProcessPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeIncBasePriorityPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreatePagefilePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreatePermanentPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeBackupPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeRestorePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeShutdownPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeDebugPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeAuditPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSystemEnvironmentPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeChangeNotifyPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeRemoteShutdownPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeUndockPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSyncAgentPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeEnableDelegationPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeManageVolumePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeImpersonatePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreateGlobalPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreateTokenPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeAssignPrimaryTokenPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeLockMemoryPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeIncreaseQuotaPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeMachineAccountPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeTcbPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSecurityPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeTakeOwnershipPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeLoadDriverPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSystemProfilePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSystemtimePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeProfSingleProcessPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeIncBasePriorityPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreatePagefilePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreatePermanentPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeBackupPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeRestorePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeShutdownPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeDebugPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeAuditPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSystemEnvironmentPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeChangeNotifyPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeRemoteShutdownPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeUndockPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeSyncAgentPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeEnableDelegationPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeManageVolumePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeImpersonatePrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreateGlobalPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeCreateTokenPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeAssignPrimaryTokenPrivilege	2972	WebPhotoGalleryArabic.exe
Token: SeLockMemoryPrivilege	2972	WebPhotoGalleryArabic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2972	WebPhotoGalleryArabic.exe
2184	msiexec.exe
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
1596	IEXPLORE.EXE
1596	IEXPLORE.EXE
1596	IEXPLORE.EXE
1596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 1816 wrote to memory of 2728	1816	msiexec.exe	30
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 2972 wrote to memory of 1068	2972	WebPhotoGalleryArabic.exe	31
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1068 wrote to memory of 2184	1068	WebPhotoGalleryArabic.exe	32
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 2268	1816	msiexec.exe	36
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 1816 wrote to memory of 1404	1816	msiexec.exe	37
PID 2816 wrote to memory of 1596	2816	iexplore.exe	40
PID 2816 wrote to memory of 1596	2816	iexplore.exe	40
PID 2816 wrote to memory of 1596	2816	iexplore.exe	40
PID 2816 wrote to memory of 1596	2816	iexplore.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe
"C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe"
1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe
  "C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe" /i "C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ "EXE_CMD_LINE=/exenoupdates /forcecleanup /wintime 1710607510 " CLIENTPROCESSID=2972 CHAINERUIPROCESSID=2972Chainer ALLUSERS=1 "AI_UNINSTALLER=C:\ProgramData\Caphyon\Advanced Installer\{DEFFB9AA-5E58-4B78-9DDC-26B20F415404}\WebPhotoGallery.exe" AI_FOUND_PREREQS=".NET Framework 4.7.2 (web installer)"
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WebPhotoGalleryArabic.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1710607510 " CLIENTPROCESSID=2972 CHAINERUIPROCESSID=2972Chainer ALLUSERS=1 AI_UNINSTALLER="C:\ProgramData\Caphyon\Advanced Installer\{DEFFB9AA-5E58-4B78-9DDC-26B20F415404}\WebPhotoGallery.exe" AI_FOUND_PREREQS=".NET Framework 4.7.2 (web installer)" AI_UNINSTALLER="C:\ProgramData\Caphyon\Advanced Installer\{DEFFB9AA-5E58-4B78-9DDC-26B20F415404}\WebPhotoGallery.exe" AI_EUIMSI=""
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2184

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1D057BB9F4317D0B27646125EA49199 C
  2⤵
  - Loads dropped DLL
  PID:2728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9633191C24CF8A2700BB61F4B629F5E9
  2⤵
  - Loads dropped DLL
  PID:2268
- C:\Windows\Installer\MSI4E57.tmp
  "C:\Windows\Installer\MSI4E57.tmp" https://webphotogallery.store/log.php?clickid=1
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:1404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2128

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000324" "00000000000003E0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7d211a08214df8cf60edbeec564f016

SHA1
dec206d113a90039af9b7e55db06bf542e75c2e4

SHA256
955ed3c06578efde12fbf6764c36c59fd5d86464864725439fe7937204d35c87

SHA512
0fb615f861007ae46e2cc07cf8334dfff4a3347bcaf0ab94d4f93047b3ebe70bf5b641f57274232145fbb75646f77c30eb4b879859f81f6962512a76ef7b1632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbca7412da178c75752ae76e06cf4723

SHA1
9a1d6dea770812c47996fa7fff1ed3b462d8b3c7

SHA256
f4715cd1706abd10dad1a17e43d2eda587abe26a2a3466e5e1fad0869a0fad84

SHA512
7da8e6f2cf7bbb0e768b656a06ceaadccc329627adbb888382df33f20674a3ae72cec1a2387e8f4840331b8159678077c27fbf61e5a3d3aaf38bb7a3e50b4931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
759d798c2ac033b98ece5dc9c528d840

SHA1
8e4d0eb30039aae2531ebccffbaae52dcb02e791

SHA256
e521740540c496da67eafce2e02e2f51fec0fc4750960dff42d2ae0633c1ccb2

SHA512
dc5f32fca02a56d87ef5e50d9ae8a226a74e375810bfdbd34aa046cc77d1d04ae6c5119dd90216f76a6c9a0119e653d9a260c7a890a49dbf860eed649bda5d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119f08c40c4fdf36063d4ef8a69718cb

SHA1
0082fee5bd290f3b29c821fad3b35ecee15bf646

SHA256
7d3fa56c180d1fc7f28de3a69f49d27cc1bde9eaa4fb12d6cb2542549fe68e3a

SHA512
d719beb02a810dd7dcad0f4e6d1071666b4c7161a63441b4ffbe9979df5c88a737a6560cea0cb45aaf9db33cb5c8e1fbd9a7e496c35e53d4de4fa48518810375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f5c83d7de70c813175b0d7fdb2314b

SHA1
a3e274e676cc369a77d000b5bdbabd526bf3f2e1

SHA256
16e828102c6dfe41121581c14723ff4801afe6f66b262f253bbe9fbae132c4ae

SHA512
e3aba1b7d7b9d8a6aaf45b91b5220bfec8c2df8279fb3f829b3b3dea2862fa2a0cc41b203517a3a191ebdc9d9f7ce88daa0b5b085e6e48d061d66caa5cf8bdae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c162394884aa5bd57b841b98363c6df

SHA1
05df088af19c768ece2e46d74d9cb5db992a5ba8

SHA256
a2bf7eca47d78531e60ed77e1e2b4863c571648a2158519ef5235b5566d4c7b9

SHA512
e2b145a49133e1b037bda8d7c97600d7c271a178055697bda92a30b360411d9e6a3978327135d951b581efca00c9b8c40f998593c34d759a1e26c06cadff5739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9f3555ffb124989c6a931c700b33ff

SHA1
3819a4c06ee7ef2d3ff006fe80ea05bc465cce31

SHA256
1d028466b67338d41bc465550504e6513d51dd84759a64fca959cc10a6466112

SHA512
b188ff192f014bfd72f0185ba98606293d617bda34ff3bbd1c56ecb467b0b33e29ac2e99db8bc84e61ed38a1a3e142afe8a1d13dd6e416563efd5238060b2762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19a5d90b8aff56f14c7e9f48b116c32b

SHA1
cc521bd10c4390bb48374d8d577e6775ef7e1179

SHA256
9b3805ece54d2e74fa7a8b4a983008d63b9c6e0d742c5b7bcf6534c9a02d3200

SHA512
f43335572d1015d66354e175c1fd2ffad6adf598682b1d21635f22254b3c0c8d1ba933793a3aaa5835659346ddd819d1d21e50f1d16cf3ce1d0700691258682a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c096167af094fe7820846ccff731289b

SHA1
0503e630143ef550e44c0af6b810bb080dbbe836

SHA256
ea21738aee615c9c260a173fa6ba6365b28a35b40cfb798adbb7cff4f8c7c8f9

SHA512
1034994635d5ed20695b4e90b491cc385128d599467b8946792968eb29481253791aa954203a636b45b6adff494c38444d8d6cc1740699ea048c8020022bb971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50116d8064da1fba702bcb2178866c78

SHA1
951888025845bf1a8813d1c031688b779ab05327

SHA256
6430a41d026ee7c8731a02674714f70c9269ac339a53a455d1c8fc3932a64054

SHA512
05158acee12aee521f01fcb77177cbf99b817f6247b33a6685c81dcb151859fedcb1566d2fa05f60b59bd100429f3cf4aaca239f66f2ff5d5c2e4aae70cee22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d624fa3298bd4976888771134bcc14ac

SHA1
4fda62ff28c7606d6b9b871e16c3c34c8bea9106

SHA256
29ec466156c75e715fae9df2791114e4de68bf4103c872d861218c0ff47d9893

SHA512
1d2cbd307cfafd1885b5b34fc75d0cf159a279657a30cf2343a68ff75ba8e415361b3ce3e3c4cb78b9cc45e9cca93b5857406f4a39e61592f63980ed7fd1cd84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48363eb7b2cff8a146ba7c770cce42fe

SHA1
30aca0c8740a91caaa7028c5616d90a0e45d91d9

SHA256
92641f16207d0a417053ec6511a7c7ce01ee52a5bd2e3779b74ea10809a5660c

SHA512
93329625521e45a20eeba2f5b912243e44694fa8d747d331a64db1022dbd95b1adb5e38769480ef6e12e729a447eb6de0d1769974042d5892444d40d9e744c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40ccd2b47c716b2626a2b99934438cdb

SHA1
e40533fdcf4a22ddffd2cc3a199fdae8e30f19ff

SHA256
65c1b7808e8d1569b13244ec5c9bb2505d95e4b804d477f5a9673e00f7a622c2

SHA512
9f50de1ef6921977817bd944262f0e351b9026f1c55af136d3e6be31b684e2a227af5e2ed8502312613c4b76ff89508187a4b82f44cca36f3dcc72b86d0a360a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cadd6cf162db167214c182fb3fdf6b7

SHA1
941f42e0829a77ef84b425994107d78ef3293390

SHA256
6a53b2b7b549ce4fd5ff4f830bd148acdd7240a7daaf5f7aebc1d7c6309b45bf

SHA512
f5ef1c886a467d2a498152c1c47a54157f592c77dfcc25cd96e91548534f61b30deeba3436a22a7c02bec9b1828bdfcd0e4c40576293dd3989a0fec131044806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ded7443ec40cc8bff4a22cb2f0746465

SHA1
873cf463ce1d06f1242cf8e0b79469536260c5ec

SHA256
9a50a20a542d65343c0612ef46db702d20026650567554bac93bc6de14743944

SHA512
71010b1d2451d20748d0001e4b0d6861fc3d5c6778c804aebe5651818439cd0a535e74245ba4aa7674790ece02ed585d9711c1fbcb8b1c0bdb2fc8590d07ee0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efaa2338007d2e38ba67d3f970e57341

SHA1
4a4f7684bc728a74acf945b0aee46591bd1d783c

SHA256
694744707e414b27a97bb7e995d0b015e6a56712cdb0d5e2be2975e27d8953ed

SHA512
064d097bb7ebcac5eb9cc42fac87a105b56c442679e16c1a6bdcd83f3c2a5bd06c7666331ef9a6ee70942bcee96dfed27a785bcc2d8857bc00c589fcef18e08a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c600917bd663ddec12e66f81e33a16c6

SHA1
795a9d6554bf6529072a8764033554ef41c96f6a

SHA256
97f568a87a739434d76a7861e8859aab3e4736cfcef56247fe2b2eade113ff96

SHA512
40b85f1a749ac73bc871c5b50b8cb99bd3967bd98c8db1c5d3b400f2ca70300c3de00bcf37b4f5343b1d83ee424138d4a44ac1b0003a4a77b49b68912d29235b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3528c144c3c80e21304708ea657fa44

SHA1
dffa9d186a3c850f725be67801b4e9df5eca6539

SHA256
b01d26ea5f8add0f159bacc747b5cc0db9a5755e49b056825890259129b3d71b

SHA512
677d5b7416288a4c816b42cf415bef8e81bd5a8ea50b2b1c509e3e59161b86bd2ebc83923f3adf550c5820e2ae771eb3cd510a389c834309b496768e3bf69f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3041e623e19d58aed84a4981285aeb

SHA1
6f17598c21791761662fb89c6786b731920209c7

SHA256
03b8b13425990c066de6be100685e912d0f7eedd7d1ca9ede02314a7b3a4942f

SHA512
aee8dcbdf588e7a6f2cb9e960045959d2d95e111bb2054ab3579eff63e7b1067ced79531d8c0691606c12ff6e8a10922d2f099ce27aa91ecb4f62e4927dd47c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a2bf2a952a4ffa68e6a18aaf46cbe6

SHA1
9ae91d9677e333d58a019cfb9751238afeb52850

SHA256
58eb689bcf620871e1a8b82ef8de8ca9776b55cd458dc957f107a555b5d0e533

SHA512
4fde0349c02986e95a4a63ac1aba2694a118789dc446cec54153d33ba1d0497b8c4f9d19cd99d82d72eff95e269a7f35e125c351c58591927b114dc1edf16e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29c02a9d41d662b2514d3abddcc96e98

SHA1
ed55d68113ae92962ed46f0d820fab44ec1d00e2

SHA256
ece8e31828d6566b99642703355c169cd6d40158811856146e7bdfcc5d4fe8c9

SHA512
c814d3e83a5364e8bd208d5ff445c569b82659b51ecd84f3ccb3c71f70c7c1da854fbb38c9f55eec61b880b97ef66bf8b2e8c586401b35853d02971e2713aaf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c2e05d6ea4d720a6416c1b0565a83c

SHA1
ba5caf7a402678cc031adee17158af18d3946f17

SHA256
79b53d86f10c8bdb0eb549cc24bd875d4c92061d1c49eed457904611f4c5e410

SHA512
44fd14b00ca382b534f1dcf6f3bf7ecf5214dc3ee103dc4a4500dd873f5d140c3981047b9a102f3ada9dbfcefe0c3c4da0792b4c4cef15b67e905ae8cd507083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe98d819d23a45c5097a9f8691d6c0e3

SHA1
690ee78eca9d6e78fdcd2514b9a5450391cddea9

SHA256
ccb3a31c0894d839b52492dde7e2bf656648b521e10fd3a90ae491da1f49fcff

SHA512
a80a2a5f94b383cd80714a2ca8455080e3528456259c5cf7aaa78231c8b7b46392e7351f0251d848a36672ec0de2c1193aa333ff7098240cb0a0c37297ed5fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ead4a1b806a0e27c83d22e4e5861964

SHA1
b9dcdbe3ca490e9f2dbb410deea5416938952419

SHA256
a2050f1b69e190c2eb7d6c2272022b53c7fbb027ca454abeb68c0e3564310a5f

SHA512
3dd29dace519403bf6adfdb18bc396b81c17e32a1b1205d9255561251b59f0eaa9922e863a8575d07d8bb8d6eb49566d6777e8fbbf9dabc1b35279476ce6e9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a515dd4cbec112fed25ecca132f568eb

SHA1
b43e7d33724c5afe17efe4e7b4465d0f7cd0215f

SHA256
c2f0deaef92a0d8426b04438ea8197accb79825a2283d2fabd867e6060083dc5

SHA512
4a5d2ceab7dabca309ba91a3f0509cfea3cd67ceaa65760bcc146ea826922bf99adfe57cc30eaa5f98c5ed0660090df1ab028c6fd466ad378b28e011d4f7a897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243f38af41785893bdeae303ae9b7094

SHA1
647ba5d930e210dd483ceb609a573d5f2b21e9f0

SHA256
93b5e8d10cc69c2c54dab9b79626f4e57f26d583a7dc965d19184a519a988b7f

SHA512
7fb93818d396cf8dacf35de2e98c3218e3bfa98d69f89a8a9beef4342506037395de7560fdaee84234ec87d29dbb8cd9b0187c625e3a237ba4d94a1ae6a04b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc35e343476de885dbd5f12bf19f5172

SHA1
100558e05bd82c6b0d64a43baf9ab74f3b67a577

SHA256
17ffaddf5555b77696204b8b570a74e378c85360069a14c1a37dd46c110a65b3

SHA512
f9cded1d0080d775e563c41bce544f87f31af5770000b6f8d0b4e4bfd0103fe828bde96d00ee30dad17c3d5ea1f13a1b749b987bd9d6be742f12924bdbb607f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31f3a4ea7d4a894a4312c2b83ec7e00

SHA1
3abd013b2d661f407f00b315a6b24dba5c9655de

SHA256
9dbcd0a981aefb83e9d081998dd4c5a68d392f5922e8b087bf81d6ce8409a9f7

SHA512
dd7f85f4b714d4d4d30e43ce0427973c662c6ce397e59231d5c00ce272f0af9b93ad05fd627e0b37264c24c6db9bc5f3d48a13512a95633ac8ec3ac76a9c0712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d2a5e29e4a818f4442e5329eaed1487

SHA1
b91e11f9c81a15a2c54c16241176209f07150273

SHA256
5f511be00398275a45b53fa6b7a61cde1a9569cf5bbe023ec72360dce85a29e6

SHA512
cafdd24b34ad6b6b94c716b645849b97a239faa2489f97315c0cb1582ed0f588647794b29b1dc8456984188836b728fafac2c18fecfc01a71b472c46a546bd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b760e3dacbf621b574ebf707089540

SHA1
abfb501780c6cadbd12784f5c9ec3eaeeef3e9ba

SHA256
1eb38c632252c1e07f975b10d368060f807891f9b6ee9a40c9a3be5c04f9bc36

SHA512
bab567ad6b14455bf8c1d63d38acc5e752d5d87012874c413395d7480a2de5c9b450188e8f3075387faa061f4f08560554e03ab28d0e4094b08e0aa0bb7ac346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693e3e65c2b90103f655b968b5242a72

SHA1
0ba5d01b682b3d5199f7c88f87f44a32f937317b

SHA256
88e3a0f5f31a6b8d68b1b9a79aeb9b0e75b78ae59a4bd284d9813575586bb017

SHA512
53094709d23b127819105d6146a76ee1d8dc7aeea069e938f5c14e20a632d4c5dbd86327ba54723841155a6940559b3afdd7f1d7279c71ffd02859500d43f781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
bc0d433e12672ad1ee31bf819fb71d17

SHA1
27d8a33be5e75945cf5c26ae87d1b32f6f6dc321

SHA256
2769b08794a6dbf91aad0da6fcc65fd52ad807f0ea8900dfd9e7a30d195d70aa

SHA512
f8b491abd90bb2fc4d1be909de60ee7dc6f1792d9235dd3321ceee69c5e34ee1bf7bc9a1ee2acf28b6906fe43b75ea155d9c00b421a39ee7a5a631e0ce5e6c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jqfjk0y\imagestore.dat

Filesize
47KB

MD5
94d0457fc662fb5ecfecaaaa8672bf9d

SHA1
44ba18464ec65210b41d40b928b8c4a0bb880b41

SHA256
001195626f93bf87bc240db11e1a043cca6c51744f29b116af329c3f0345c49c

SHA512
7ecd104c489f90b7785f4ce854874b8a6a612b5f49ff3e7c74e6c8f1d131c91a05f8f602f4f6170d6265c65798500cd4c72e7ee130866e1853f10fbfefc96a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKDEMF4Q\p1-768x768[1].jpg

Filesize
47KB

MD5
180d9b906bc1d626910c0733482b6007

SHA1
c0f7aa4614d17b52ba7daf7ab095f2ea339a741c

SHA256
9a2f48ff7f142ae32d581e06c96ff548b1f7822b63b7dc0ee836325abe541fc3

SHA512
2e9170a1e4110aeee196dd790fdb2141c6f22eb8dec82a8a46e7a994fa260d9c95924fa78d447c4bdf1c191221a702b3373558f5eb7782e59e7b6bdf30a2ff28

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_bottom_left.bmp

Filesize
66B

MD5
1fb3755fe9676fca35b8d3c6a8e80b45

SHA1
7c60375472c2757650afbe045c1c97059ca66884

SHA256
384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21

SHA512
dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_bottom_mid.bmp

Filesize
66B

MD5
71fa2730c42ae45c8b373053cc504731

SHA1
ef523fc56f6566fbc41c7d51d29943e6be976d5e

SHA256
205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd

SHA512
ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_caption.bmp

Filesize
206B

MD5
8641f45594b8d413bf1da25ce59f1207

SHA1
afebb23f5a55d304d028ca9942526b3649cddb52

SHA256
0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707

SHA512
86a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_left.bmp

Filesize
66B

MD5
30384472ae83ff8a7336b987292d8349

SHA1
85d3e6cffe47f5a0a4e1a87ac9da729537783cd0

SHA256
f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a

SHA512
7611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_left_inactive.bmp

Filesize
66B

MD5
4b84f29fbce81aab5af97a311d0e51e2

SHA1
60723cf4b91c139661db5ecb0964deca1fc196ea

SHA256
c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55

SHA512
775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_top_left.bmp

Filesize
154B

MD5
1966f4308086a013b8837dddf88f67ad

SHA1
1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190

SHA256
17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741

SHA512
ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\frame_top_mid.bmp

Filesize
66B

MD5
4e0ac65606b6aacd85e11c470ceb4e54

SHA1
3f321e3bbde641b7733b806b9ef262243fb8af3b

SHA256
1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee

SHA512
7b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\sys_close_hot.png

Filesize
276B

MD5
17242d201d004bb34449aab0428d2df1

SHA1
77a332c6a6c4bfc47a2120203cfeabb8a2268a6b

SHA256
15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033

SHA512
605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\sys_close_normal.png

Filesize
225B

MD5
8ba33e929eb0c016036968b6f137c5fa

SHA1
b563d786bddd6f1c30924da25b71891696346e15

SHA256
bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5

SHA512
ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2972\sys_min_hot.png

Filesize
180B

MD5
1a883668b735248518bfc4eefd248113

SHA1
1112803a0558a1ad049d1cac6b8a9d626b582606

SHA256
bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e

SHA512
d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F84.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI25E2.tmp

Filesize
588KB

MD5
b7a6a99cbe6e762c0a61a8621ad41706

SHA1
92f45dd3ed3aaeaac8b488a84e160292ff86281e

SHA256
39fd8d36f8e5d915ad571ea429db3c3de6e9c160dbea7c3e137c9ba4b7fd301d

SHA512
a17e4512d906599b7f004ebb2f19ee2566ee93c2c18114ac05b0a0115a8c481592788f6b97da008795d5c31fb8d819ac82a5097b1792248319139c3face45642

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2789.tmp

Filesize
1.1MB

MD5
8e3862ecc7a591df93cb916906eae863

SHA1
1c9f1f80be421f8c87662b5ab11749dd7604fcf2

SHA256
b980c67b11cc39f006535303151273749e4ca69dd370cf45b6110a0b5af77b68

SHA512
5d58c26f1f4ed448578e118c526a67159284e68b58062a0ff74492a38785fc94608ca09aadb5473f66dd0161fccdbad3ea4a2ed5c65396bef5e3d6572ac607ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI298C.tmp

Filesize
736KB

MD5
8dd026145833182777a182a646df81f3

SHA1
4f5cb840193eea97df088c83a794fb6e8f67ab07

SHA256
3071af6be43a2611db45205f0d3f1f25aba05acf5f70992fce2fffd63ee9c85d

SHA512
f6c860bf563a24c046a7d76a6bc1e2f6bbfc80a87ac4513de331049f35198dcbbdbb5be7f5d49100e1d1c8ab680ecf3eaaa4fdb8f744c9fd5479a1ba64079391

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2033.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DB8.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\URL4E6E.url

Filesize
73B

MD5
1bdff2774df11e8a48ad29008ac02c65

SHA1
2cdc2b34134ab7819440606d4aa36d50491293d2

SHA256
5e1ec253f9c4f079bed2f7f185dc2923554817bf33334093bfaf0449a6060c61

SHA512
eac1ceec70c1cc9636c001b7363409bf1cc3716059b6bdba87d55fd9527025d2d9355ecc395cffe862a36acb430e8c588d2a8e463944c9379ae34019f1295b9d

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi

Filesize
3.5MB

MD5
fde611d26e23151614541400b136bd57

SHA1
66fba422787f65ae6314663f345ca68678dbdd03

SHA256
d17c550338b309f673cfbdcd49edf69d825c98d4de20638a2de38185f336ee86

SHA512
c511cfde784f2710bc5c75eeb103afdb7018f3d0f8dc6ff43691be98b496f10ba4ad430a9ad84299eb921be0d6a5d98bc6297ca6db8e4698acbd63f423504851

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery.msi

Filesize
3.3MB

MD5
08a5c6d3be41e8f680794f1d73e488f0

SHA1
c6fa9e4438f75302329ac1873745b2a7b851a032

SHA256
96408b8b6fa320b7a0c7e4177549e541c9b4facfd7aa20b198cdaa7ceb561368

SHA512
111a25e2bbe69f9e89220ff66548b24968ee850f9d03f78756317f7d5cdc1251263a28b5280b24a6e2c17d12345d15be212d944b844da961e0d0713138c886fe

Download Submit
C:\Users\Admin\AppData\Roaming\AiSoft\WebPhotoGallery01 1.0.0\install\WebPhotoGallery1.cab

Filesize
12.2MB

MD5
9c1760f60c170fff8f1ab0b80e751e7d

SHA1
233e4ef8187066fe3ccced34424ff57460122421

SHA256
9906dd37ced32d4f39f3ed5e608b585cfddeb8acca8bcf5a51f8f3d140a66869

SHA512
9fa7a12683021523fd47fdae07e39e4ed28354e8104b6912a5145abba8bbe776f012af9fd68a1327214857922ff4e14e95498ab737f3f1756e569c42b6278fc4

Download Submit
C:\Windows\Installer\MSI4E57.tmp

Filesize
426KB

MD5
7ccfb5fbbb3b769867f5131c75de07f4

SHA1
764aba63906630e3e4e460ac1d2cadd7c2c57597

SHA256
533671c03f5d4651ceb57f00004f0b52286b9a20f17d24cd35d6230474861d93

SHA512
6d9e51cd742120d3f2abf2f179e4ec71222a92821bf13f7fca5147f5325ef82ef7b09ab1fea19ed00a108aaa08c5546e50d8dd5e1a89a8da34e66af445deee11

Download Submit
C:\Windows\Installer\MSI5654.tmp

Filesize
256KB

MD5
1c5e9c67ddefb786f3599c87ab72d5f7

SHA1
37979f3ad1511965dc69eff39b2a2f2935da222a

SHA256
dbc6e7471772980dd06db1d8afbe3f6dd6380e6e6fd537808c55176d4b0611e9

SHA512
cd6f6e5e584ca05f282cd32e11a4d68beb07c0841b23ec69aeea66cd319f636c36ffe2454218ee2ad59c181bad1e814ad54288ffe668a585cd8aa83b9e756665

Download Submit
memory/1404-318-0x0000000002590000-0x0000000002592000-memory.dmp

Filesize
8KB

Download
memory/2972-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2972-268-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download