b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InternetSecurityGuard.exe
Size

6.1MB
MD5

04155ed507699b4e37532e8371192c0b
SHA1

a14107131237dbb0df750e74281c462a2ea61016
SHA256

b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
SHA512

6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
SSDEEP

98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8

Score

9^/10

bootkit discovery evasion persistence spyware stealer

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	InternetSecurityGuard.exe

Blocks application from running via registry modification 18 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	InternetSecurityGuard.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\host_new	InternetSecurityGuard.exe
File created	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	InternetSecurityGuard.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpro.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntrtscan.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundle.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedriver.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prizesurfer.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idle.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntvdm.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pgmonitr.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiaudit.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jdbgmrg.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\optimize.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gmt.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Identity.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpps2.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedriver.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aplica32.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lookout.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\inetlnfo.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpd.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\e32a8\\ISd0f.exe\" /s /d"	InternetSecurityGuard.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	InternetSecurityGuard.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	InternetSecurityGuard.exe
File opened (read-only)	\??\J:	InternetSecurityGuard.exe
File opened (read-only)	\??\O:	InternetSecurityGuard.exe
File opened (read-only)	\??\R:	InternetSecurityGuard.exe
File opened (read-only)	\??\U:	InternetSecurityGuard.exe
File opened (read-only)	\??\W:	InternetSecurityGuard.exe
File opened (read-only)	\??\L:	InternetSecurityGuard.exe
File opened (read-only)	\??\N:	InternetSecurityGuard.exe
File opened (read-only)	\??\T:	InternetSecurityGuard.exe
File opened (read-only)	\??\X:	InternetSecurityGuard.exe
File opened (read-only)	\??\I:	InternetSecurityGuard.exe
File opened (read-only)	\??\M:	InternetSecurityGuard.exe
File opened (read-only)	\??\S:	InternetSecurityGuard.exe
File opened (read-only)	\??\Y:	InternetSecurityGuard.exe
File opened (read-only)	\??\G:	InternetSecurityGuard.exe
File opened (read-only)	\??\H:	InternetSecurityGuard.exe
File opened (read-only)	\??\K:	InternetSecurityGuard.exe
File opened (read-only)	\??\P:	InternetSecurityGuard.exe
File opened (read-only)	\??\Q:	InternetSecurityGuard.exe
File opened (read-only)	\??\V:	InternetSecurityGuard.exe
File opened (read-only)	\??\Z:	InternetSecurityGuard.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	InternetSecurityGuard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\ltHI = "0"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\IIL = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\ltTST = "1214"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	InternetSecurityGuard.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\Clsid	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "InternetSecurityGuard.DocHostUIHandler"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Software	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\InternetSecurityGuard.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler\ = "Implements DocHostUIHandler"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Software\Microsoft\Internet Explorer	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Software\Microsoft	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetSecurityGuard.DocHostUIHandler	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	InternetSecurityGuard.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2712	mofcomp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4532	InternetSecurityGuard.exe
4532	InternetSecurityGuard.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2712	4532	InternetSecurityGuard.exe	88
PID 4532 wrote to memory of 2712	4532	InternetSecurityGuard.exe	88
PID 4532 wrote to memory of 2712	4532	InternetSecurityGuard.exe	88
PID 4532 wrote to memory of 4396	4532	InternetSecurityGuard.exe	89
PID 4532 wrote to memory of 4396	4532	InternetSecurityGuard.exe	89
PID 4532 wrote to memory of 4396	4532	InternetSecurityGuard.exe	89
PID 4532 wrote to memory of 1912	4532	InternetSecurityGuard.exe	92
PID 4532 wrote to memory of 1912	4532	InternetSecurityGuard.exe	92
PID 4532 wrote to memory of 1912	4532	InternetSecurityGuard.exe	92
PID 4532 wrote to memory of 4504	4532	InternetSecurityGuard.exe	95
PID 4532 wrote to memory of 4504	4532	InternetSecurityGuard.exe	95
PID 4532 wrote to memory of 4504	4532	InternetSecurityGuard.exe	95
PID 4532 wrote to memory of 2804	4532	InternetSecurityGuard.exe	97
PID 4532 wrote to memory of 2804	4532	InternetSecurityGuard.exe	97
PID 4532 wrote to memory of 2804	4532	InternetSecurityGuard.exe	97
PID 4532 wrote to memory of 1456	4532	InternetSecurityGuard.exe	99
PID 4532 wrote to memory of 1456	4532	InternetSecurityGuard.exe	99
PID 4532 wrote to memory of 1456	4532	InternetSecurityGuard.exe	99
PID 4532 wrote to memory of 1716	4532	InternetSecurityGuard.exe	105
PID 4532 wrote to memory of 1716	4532	InternetSecurityGuard.exe	105
PID 4532 wrote to memory of 1716	4532	InternetSecurityGuard.exe	105
PID 4532 wrote to memory of 4516	4532	InternetSecurityGuard.exe	107
PID 4532 wrote to memory of 4516	4532	InternetSecurityGuard.exe	107
PID 4532 wrote to memory of 4516	4532	InternetSecurityGuard.exe	107
PID 4532 wrote to memory of 4320	4532	InternetSecurityGuard.exe	109
PID 4532 wrote to memory of 4320	4532	InternetSecurityGuard.exe	109
PID 4532 wrote to memory of 4320	4532	InternetSecurityGuard.exe	109
PID 4532 wrote to memory of 992	4532	InternetSecurityGuard.exe	111
PID 4532 wrote to memory of 992	4532	InternetSecurityGuard.exe	111
PID 4532 wrote to memory of 992	4532	InternetSecurityGuard.exe	111
PID 4532 wrote to memory of 5096	4532	InternetSecurityGuard.exe	113
PID 4532 wrote to memory of 5096	4532	InternetSecurityGuard.exe	113
PID 4532 wrote to memory of 5096	4532	InternetSecurityGuard.exe	113
PID 4532 wrote to memory of 4376	4532	InternetSecurityGuard.exe	115
PID 4532 wrote to memory of 4376	4532	InternetSecurityGuard.exe	115
PID 4532 wrote to memory of 4376	4532	InternetSecurityGuard.exe	115
PID 4532 wrote to memory of 2592	4532	InternetSecurityGuard.exe	117
PID 4532 wrote to memory of 2592	4532	InternetSecurityGuard.exe	117
PID 4532 wrote to memory of 2592	4532	InternetSecurityGuard.exe	117
PID 4532 wrote to memory of 4808	4532	InternetSecurityGuard.exe	119
PID 4532 wrote to memory of 4808	4532	InternetSecurityGuard.exe	119
PID 4532 wrote to memory of 4808	4532	InternetSecurityGuard.exe	119
PID 4532 wrote to memory of 1508	4532	InternetSecurityGuard.exe	121
PID 4532 wrote to memory of 1508	4532	InternetSecurityGuard.exe	121
PID 4532 wrote to memory of 1508	4532	InternetSecurityGuard.exe	121
PID 4532 wrote to memory of 2076	4532	InternetSecurityGuard.exe	124
PID 4532 wrote to memory of 2076	4532	InternetSecurityGuard.exe	124
PID 4532 wrote to memory of 2076	4532	InternetSecurityGuard.exe	124
PID 4532 wrote to memory of 5088	4532	InternetSecurityGuard.exe	126
PID 4532 wrote to memory of 5088	4532	InternetSecurityGuard.exe	126
PID 4532 wrote to memory of 5088	4532	InternetSecurityGuard.exe	126
PID 4532 wrote to memory of 1072	4532	InternetSecurityGuard.exe	128
PID 4532 wrote to memory of 1072	4532	InternetSecurityGuard.exe	128
PID 4532 wrote to memory of 1072	4532	InternetSecurityGuard.exe	128
PID 4532 wrote to memory of 4480	4532	InternetSecurityGuard.exe	130
PID 4532 wrote to memory of 4480	4532	InternetSecurityGuard.exe	130
PID 4532 wrote to memory of 4480	4532	InternetSecurityGuard.exe	130
PID 4532 wrote to memory of 912	4532	InternetSecurityGuard.exe	132
PID 4532 wrote to memory of 912	4532	InternetSecurityGuard.exe	132
PID 4532 wrote to memory of 912	4532	InternetSecurityGuard.exe	132
PID 4532 wrote to memory of 4632	4532	InternetSecurityGuard.exe	134
PID 4532 wrote to memory of 4632	4532	InternetSecurityGuard.exe	134
PID 4532 wrote to memory of 4632	4532	InternetSecurityGuard.exe	134
PID 4532 wrote to memory of 4612	4532	InternetSecurityGuard.exe	136

C:\Users\Admin\AppData\Local\Temp\InternetSecurityGuard.exe
"C:\Users\Admin\AppData\Local\Temp\InternetSecurityGuard.exe"
1⤵
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\AppData\Local\Temp\11.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\InternetSecurityGuard.exe" "Internet Security Guard" ENABLE
  2⤵
  PID:4396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.com 8.8.8.8
  2⤵
  PID:1912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.net 8.8.8.8
  2⤵
  PID:4504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.com 208.67.222.222
  2⤵
  PID:2804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.net 208.67.222.222
  2⤵
  PID:1456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.com 8.8.4.4
  2⤵
  PID:1716
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.net 8.8.4.4
  2⤵
  PID:4516
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.com 208.67.220.220
  2⤵
  PID:4320
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt iorzzdjlpw1376xg.net 208.67.220.220
  2⤵
  PID:992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.com 8.8.8.8
  2⤵
  PID:5096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.net 8.8.8.8
  2⤵
  PID:4376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.com 208.67.222.222
  2⤵
  PID:2592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.net 208.67.222.222
  2⤵
  PID:4808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.com 8.8.4.4
  2⤵
  PID:1508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.net 8.8.4.4
  2⤵
  PID:2076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.com 208.67.220.220
  2⤵
  PID:5088
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt imntwyzbfg1344nv.net 208.67.220.220
  2⤵
  PID:1072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.com 8.8.8.8
  2⤵
  PID:4480
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.net 8.8.8.8
  2⤵
  PID:912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.com 208.67.222.222
  2⤵
  PID:4632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.net 208.67.222.222
  2⤵
  PID:4612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.com 8.8.4.4
  2⤵
  PID:4256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.net 8.8.4.4
  2⤵
  PID:336
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.com 208.67.220.220
  2⤵
  PID:2804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt dgnua528bdeijpy.net 208.67.220.220
  2⤵
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
196B

MD5
6e86650ad96258b23f022605c5f202d5

SHA1
321290e91871cb653441e3c87ee8b20ab5f008a0

SHA256
8c39246796530ee7588fc16486335d00d5b7273ebb26efe5833e4cfc2bcfe223

SHA512
e8a7bdf4bd2fba233a1a6cdf977d57dcb37ae46bc52bf29b4d23c6294e769069e146bcb5f56c4edbc3f93d38a226a9349f604b54156696ccdef41106cc05060c

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
379B

MD5
5f3cf864d94872cbc6b433b4e9f46395

SHA1
4ea53c0a8b3efc633a30ce9d4a6b9567126caf7a

SHA256
1acc6a438f1132104d0aa8091a7da5baecad39cd42727448a1819a9056f78293

SHA512
ea28ccd290fb7f1e09a3bd7c5c8b5ab9be0759030100f233eefb5bf72d4ecbc51b1a2a153e315568dfe1bcaacb2ef7ab366bbc17bfd4bb9c8d0268f9a763bbbc

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
913B

MD5
a31468d0fdc78b8772a871d63d0875b9

SHA1
d28c0b7fe314624055c82a22d524cca00b2ee18d

SHA256
00978622ea15ab809078e249822d9b1017453d7a97c85e43900240021b6ac540

SHA512
a0eda9368909aba2bebf2ad09d08882ae105f9ba627986d09e157fcca4f9730cbd787265ef9d8773ad95c72f2c56a9ca4c59de5fb8e4783e8be76d601c507c70

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
1KB

MD5
0f98c3c3ab9bd51a257b54c1ed495174

SHA1
b94a1355b607011c37a60edd2a32dfa14443c0ca

SHA256
4ac92d33a92d5961474ce8ffa88ec835223cc3444ebd1606c038d04b3bc48444

SHA512
7eb0c90001b5844b1e1174aab8c20d7a60828b51428bdf480395f883ff4fd5768b03af9d8a50cdfd8682ef3e061647bad85525d1b043fa5ae059f0f9f77592a7

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
1KB

MD5
0e9df17a64eb0f673fea9eefa758b2eb

SHA1
0f9c0755f8ee3ab03ebdc50f79c721e08e1c69db

SHA256
572c1e4c73c5a517fca24477735b5cae15a461ef497b950ec3b236757bfb7304

SHA512
48187379a2aea1d3aa23f9daa9eb7b53b22b269d544636048e8bad029746b9c193e68a09037cdf21de341145acd46487b74cc921e371348ce3acee8b5e2f18df

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
2KB

MD5
44dd2849bbcf7624de3e6b88598876f7

SHA1
3d05b31e97117568ed46ddf41b706aebf9c5834f

SHA256
08681a8e04ce4400aeb9395ee48ecfb562d7a2ae2caf7212c5b24f56cc9a965d

SHA512
7f710377c056fb437aa0619f2902725a1802cbbdc737cb18d8c208ba5d7f6750be375ce3c18c7393b414760f03c0d95234db88f21f38136acd7881aa96c97e06

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
2KB

MD5
f66d8671d5ca87b5072620b571bbc55d

SHA1
9c489b30587652790c60d8fd853e373a6e54eea1

SHA256
43f0163dcf0884f8d65d884e1ea21bb642906cecc3b16d4e4b9cb377977c321d

SHA512
e2c95fb7e91611a0468980c8eb5005e043e2b9ce0045f2bd29832bf5921c6eeba643abf456298e2ecb9b777a45ccfb437f56e1e47adba0edd7195bcc75a0d558

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
3KB

MD5
3bec2d7a4348d19d179b1b61ccd2b388

SHA1
95abf782c216ad74d14f17d4025d2bfe39055f4a

SHA256
1d9e45a3373181ce09f24b7bca0f907068517ec55edfa4c2589de913e5a862dc

SHA512
7dd33193a6a96fc0d233621776e8ff7d3ba321c33acab9f23cc6b5fb0475be87b2b19d4bf61ffbe05144e5dc7a48c7b9d7a8f80e4e6fc7e23cbea98305ab5a58

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
4KB

MD5
b5f8863392d954027a4ecb5593dff95e

SHA1
390f4f878f2ee7004b84abcc8be62fdb678bb872

SHA256
6c2f5652887958eb952bb201b77bd4c938af6e5c43f31cd8bcad3e6c1389bade

SHA512
b587a6224cd83aed72b9168a9cfe5215a1a17352f5594de56b6554081b4040b33095a299c261400a87f1db28c24b106d4a7242cab906b1ea32ff2f3f09ab207d

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
6KB

MD5
bf54e30f32dd46411cc26196066e7afd

SHA1
94912481614dbd11e0a18a3216c9b4e56dac0035

SHA256
844f84bd352761f27ad3d895cea7953a0b23e8e7f38339f7108014ef987ae5dd

SHA512
4eca2c5363e069b920f220e025b99659344fedaba8c04b81106efa389ec84d49a49c92dc75329152fc0181c5f7e9a6af1341a8029d50115131c2436237c25a49

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
6KB

MD5
8fc203e1edc250fe9934bb356236508e

SHA1
423b97164bf533416525bc66ba21adfa8577388a

SHA256
285d8e50f7f4beccc05f5b8576b9d34533743c4986d02f5ac2c3b32d7262e7d4

SHA512
06061c62f3a7ce4da807910a40211bbfec5ba712dd9df4e64f5f593fcc72fbe4ab8e2f14ff99164da3446adcc79b9491cc1c537ca0288acdb2a271f9970e106e

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
7KB

MD5
98c18d487574b19661fa2017c2f90d99

SHA1
a557e59ce9ff0b6ab6495a541e116b1186552250

SHA256
287446e2cf0f10cb084b7e8746273b1232178ecdd770105c8c3576056af0521c

SHA512
2346ff8ac3471db4cfef0461c6966cac16a9e2c66d1d32037e65e7b345a4117756ad2592bd01dfc561ce54d033db91f74ac4eb621ed5ea67a0160c7f542ac311

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
7KB

MD5
318eeb9b827cdfee67c0b95e36d5692d

SHA1
940e07b984d24de1e364e1d773464c2abb14ecea

SHA256
1ac3c9401db6e870e89c3803c3067b09e1a574274ee6f1d8f697fbef92055014

SHA512
f02049e12f74e06b4baa2caa6764afdd8c47ec51c2f4156fbbd174ece7867e04f1e19d9f21010e181240ed1c76139dc0a0eebecfacc860de036461f8d043230b

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
8KB

MD5
fb0c0ae400b8cf755caf8e93aed9a9cd

SHA1
1cca1282f75410c05099514c00778240a4e4814a

SHA256
c386f7c4b131e1d3bb05bfc5eccba595a394c1b18a7c65988d0cd0ca34d93198

SHA512
dbd2b3708478c6d9ed25fae0b08dc90b71d203e7c0ee81ccf334ba27a2ac55bec95abd6209f38108e9d643777354dd43ab0c9667c3ccba61a54169637077d88f

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
9KB

MD5
02d061ff167a5c966f8de2277df0219c

SHA1
7e6c59851f51467771e5c25bfa68bc1a02e9dafa

SHA256
31c69182bb8adadee928a6342bf6a12d2fffb0a14a959bea4084580e41d7304b

SHA512
5d1f2edd279ce408dce3726c27012e171dbd96cd48ea5af3e1f8be6351ccf1c4d50e608479902162c12ee555ceffe94f13bea0ff723e329aa021155492e110b8

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
9KB

MD5
144dc658301772e69f2cc1fc55e092e2

SHA1
8e323e738fea4db285d340770a197a9f73363afe

SHA256
60ab78038194f684e19f6ef8d9570abf56bf10a2b1de61f7427b3ededdb74a90

SHA512
769d406328fa47313bced91f7e21df440c30a58467b6878b5d326285a9f86b766c226809826d4d53e4ef081f707c03f114769e15bda4971256f2ff6f3c930fcd

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
10KB

MD5
69615b164c57c23f8e59d4a60a5945d5

SHA1
24440bfed9242aeb1b81b6d1483bbf7900759ad1

SHA256
410d23ca9835184ba99a3af3c671a3a51d8986e0424eba4a7444494a15f12876

SHA512
91c693c2a6e40be8eee2529097d00682264b5ae013974f4a6eb8f42fe228ab2c8120f67cd413a2bfe424c816d754bdb8c3e870a2e9456bce6394ca2703b4202d

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
11KB

MD5
ed53ab2a20e9eee26c94b21241e8bcc7

SHA1
6dc314bd022198489e28b6b408cc3e9fa745c24a

SHA256
ae80efa9d2ed8537dfc62962a8f19db138ab4c2c04a3613d3cb4f873e0ca07cf

SHA512
20d18753f53ee0115b85a0a8386922ece0c4e7946c0d85a8799fee2afe0ee940b42100caff8a7049b356c04196e5f401cd0130419a244155af0fb28baaef715d

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
12KB

MD5
00bc2080d014b895764972dfac791730

SHA1
33b3317f93f9ca4131ae92c20205fd12739302dd

SHA256
d63b755168dad432da02cfb367d5fe7bb828b8d40c4d75f4d28f7db9208feb25

SHA512
7545e5c5af7a25e66f828ff1048306782552d84bdd893f7b02af99bd44097a749bb063865d8339c6e1b2f779ad9707516d7a4aaeb1a460585fc91c847cb6e7d5

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
13KB

MD5
d57676f0c22fe956bd01b40c4ce09e0d

SHA1
17e733b8a1f0dd68d99337d4339c77bf40bc2b31

SHA256
dc4777eb81689ee54737ee9fcc9e9cec2154057343e7895f292a80ea1d612d30

SHA512
2987de5d58a01cd1879bcdf52e3497a3a480350eae4f67505542464a677065f45f930d5853654d727bda08b9827faa413b3e6432f0eb48aeb6b6102a50de272e

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
14KB

MD5
ed41628cbaeac1f08dee0c040bee0315

SHA1
5a0e23964226dedc2990b6ba04b0c1a638824a35

SHA256
3a4497c3c253fe1464864c92716fc55b72798a15a2eaefde03b63fdf85d614e8

SHA512
8dfd406ac79f7342025424c1b14b0bdaaa1f468ff4c9c122bca3849e3eda82f21a234581b6be243cb2985bfb8362802859b60d86fbe9132102c2c493330af2f4

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
15KB

MD5
cbb5c958dbbfd0c0e1d15c4084c8255a

SHA1
4ce39b1803b478056fb712b011e4f065d4903124

SHA256
a68dbf9955d33cfd5abe6cb98fb3d659184a114484d4dadcccf136a8e20217f5

SHA512
65daec94768d1e63d1e6b3492b73ad1f3414792d7faf760bbce7db8881acd68212fe4731766f16bb3296d6eae433512c5f7fa12c7abe7c2742e813c713595e77

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
16KB

MD5
995527fe7c298cbd9ff58bfb78637710

SHA1
ef62f19cd87ce536cf709ec7d2b501e8a4de7676

SHA256
949bbd6312fa2ed96f996564741c26a2daf749e152955a30b64628881c1a202a

SHA512
563c91ce46e1c9b4f7fb663465d502f62ab64480ae720997dfac6408c18cd3b70bc55d0ffae28e7dc870d6099945a0d3931579254a91255912cf4702263a7e52

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
16KB

MD5
9b611f957bdd9d6ff7e94c9229edb92b

SHA1
db9adba132687e27c8f937df5f45d4b9ff8c5ac0

SHA256
afb2ba6071a14956eaacb9de85d1c9d97171271bf88491edc5119ccaa09de6b0

SHA512
9670a37a64c56f2ac8f0375d636dd61eb83c4a4210423ee5996659f2721aa33ce71f232f899f088a3a5765fb45dddd33aaabb1b2bc9516aa34bc8c1a8e926d2a

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
16KB

MD5
22655a9f9cd019412d29f7545188c439

SHA1
e28a542c95d5a0b8e74fedb6f6351a3673c5cdc6

SHA256
85ec4fd660cdb5d59a037f9a1b44900c85089f3d826d2b4363f30075a14b628a

SHA512
7a84f4dae441b189bd1bf01dc20b766fb03664200e73a3a6b26d42175c8b0f7716c36209ede3e1406c0c7dac3821deffcb13e3d1d7433409cd506b6f5232433a

Download Submit
C:\ProgramData\ISJQQIEESG\ISGOANPG.cfg

Filesize
185B

MD5
b8224e5293d4fad1927c751cc00c80e7

SHA1
270b8c752c7e93ec5485361fe6ef7b37f0b4513b

SHA256
c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61

SHA512
8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2

Download Submit
C:\ProgramData\e32a8\ISd0f.exe

Filesize
6.1MB

MD5
04155ed507699b4e37532e8371192c0b

SHA1
a14107131237dbb0df750e74281c462a2ea61016

SHA256
b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77

SHA512
6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.mof

Filesize
344B

MD5
3754f8f8abad5bad797085d0717a9766

SHA1
48d92f36cb721b390e216aa03b27b41f25c563fc

SHA256
3c77f5f888d417a7a31284cb8c5e3bdb4d926c4a274cecac8a8b2920659d5927

SHA512
c59f322ece53c757767e52fe9bfbc3526a13afe9ec7503e3d1cae683eeb55cbb808a1bce720fd58f97f286756d314124bcf797c2167275e08ed93ba759bf3985

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\prefs.js

Filesize
6KB

MD5
f351ce6c94317496997ceb54e7214212

SHA1
26267c426df12d30d7172800fda256c9503a491f

SHA256
87b226912676379b54db5d37bc615faf31a0b3706f48e5345cbf36ab198e63bc

SHA512
3ad072a9c30ef2c7365bd22d4ba70e9021e18bdf24a170e4f648c6b89377ed866bfa73dba0cbab5574770d3af29953e6673b636ce4961b6f917dfcb8d99478ea

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
008fba141529811128b8cd5f52300f6e

SHA1
1a350b35d82cb4bd7a924b6840c36a678105f793

SHA256
ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84

SHA512
80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc

Download Submit
memory/4532-545-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-621-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-444-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-0-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/4532-446-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-615-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-617-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-458-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-457-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/4532-624-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-625-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-626-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-627-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-628-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-629-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/4532-630-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download