af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FFSetup230.exe
Size 36.9MB
Sample240612-mn9zaavepr
SHA256 af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30
MD5 6740a750d79cd3d1e6c6932a7a2a6c73
SHA1 621cdfbbace55bec19759f3418c2b1985fdb626d
SHA512 f8d41136c5fe03b3fe0bab5f4841541dcd5da8288aee9d11618633341c7ac5fb1443510745f04dbb557a64495debd7121e3a5682908dfa54e272d5381a60cbfc
SSDEEP 786432:kv/L52JTvcX/Fp0yvRYlcvhrXavf7AoiFehZ2T/0oBL8xBp2ez:kvTckPT3RKyhrqvfEoMevho9kprz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3572	FFInst.exe
972	askChecker.exe
1356	FormatFactory.exe
1772	QuickStores.exe
180	QuickStores.tmp

Loads dropped DLL 56 IoCs

pid	Process
4068	FFSetup230.exe
4068	FFSetup230.exe
4068	FFSetup230.exe
2704	regsvr32.exe
1484	regsvr32.exe
1916	regsvr32.exe
4472	regsvr32.exe
4864	regsvr32.exe
4196	regsvr32.exe
1076	regsvr32.exe
2492	regsvr32.exe
4296	regsvr32.exe
1444	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
1980	regsvr32.exe
3764	regsvr32.exe
3764	regsvr32.exe
3764	regsvr32.exe
3764	regsvr32.exe
3764	regsvr32.exe
2224	regsvr32.exe
2224	regsvr32.exe
2224	regsvr32.exe
2296	regsvr32.exe
1612	regsvr32.exe
1612	regsvr32.exe
1612	regsvr32.exe
1672	regsvr32.exe
1672	regsvr32.exe
1672	regsvr32.exe
1672	regsvr32.exe
1672	regsvr32.exe
3928	regsvr32.exe
3928	regsvr32.exe
3928	regsvr32.exe
2976	regsvr32.exe
2976	regsvr32.exe
2976	regsvr32.exe
2976	regsvr32.exe
2976	regsvr32.exe
4068	FFSetup230.exe
4068	FFSetup230.exe
1356	FormatFactory.exe
1356	FormatFactory.exe
1356	FormatFactory.exe
1356	FormatFactory.exe
1356	FormatFactory.exe
1356	FormatFactory.exe
180	QuickStores.tmp
180	QuickStores.tmp
180	QuickStores.tmp
180	QuickStores.tmp
180	QuickStores.tmp
180	QuickStores.tmp
180	QuickStores.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	QuickStores.tmp
File opened for modification	C:\Windows\assembly\Desktop.ini	QuickStores.tmp

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}	QuickStores.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}\NoExplorer = "1"	QuickStores.tmp

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pncrt.dll	FFInst.exe
File opened for modification	C:\Windows\SysWOW64\pncrt.dll	FFInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\rnaudiocodec.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\avi.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\pthreadGC2.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Help\FFHelpPT.chm	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\PicConvert.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\decodecs\raac.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\plugins\smplfsys.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\BCGPStyle2007Luna110.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Microsoft.VC80.CRT.manifest	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\libiconv.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Kurdish.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\decodecs\sipr.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\audiolosslesscodec.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\RealMediaSplitter.ax	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\splitter.ax	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Azerbaijani.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Catalan.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Farsi.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Arabic.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\audiolimiter.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\audiofmtconverter.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.ax	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\postproc-51.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\rmmerge.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\codecs\wmspdmod.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Indonesian.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ff_wmv9.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Spanish.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\libcharset.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\avformat-52.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\decodecs\drv1.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\logmessages.xml	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\mkx.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Sinhala-SriLanka.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\pncrt.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\audioresampler.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\rmwriter.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MpegSplitter.ax	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\libavcodec.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Japanese.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Romanian.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\drvc.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\videoresizer.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\AviSplitter.ax	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MatroskaSplitter.ax	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\BCGPStyle2007Aqua110.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\decodecs\ddnt3260.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\eventpack.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\Slovak.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\Install.bat	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.reg	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\xvidcore.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\Lang\German.txt	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\audiodelaycomp.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.ax.manifest	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\dsreader.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\log.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\cue2xml.js	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\ogm.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\ffmpeg.exe	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\audiometer.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\tools\capture.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\RMCodecs\decodecs\14_43260.dll	FFSetup230.exe
File created	C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\mplayer\subfont.ttf	FFSetup230.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\assembly\tmp\ZJ7UBF2L\Interop.SHDocVw.dll	QuickStores.tmp
File created	C:\Windows\assembly\GACLock.dat	QuickStores.tmp
File created	C:\Windows\assembly\tmp\5ZY4HSUI\QuickStoresToolbar.dll	QuickStores.tmp
File opened for modification	C:\Windows\assembly	QuickStores.tmp
File created	C:\Windows\assembly\Desktop.ini	QuickStores.tmp
File opened for modification	C:\Windows\assembly\Desktop.ini	QuickStores.tmp
File created	C:\Windows\assembly\ngenlock.dat	QuickStores.tmp
File created	C:\Windows\assembly\tmp\30ROE94Y\Update.exe	QuickStores.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	QuickStores.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} = "QuickStores-Toolbar"	QuickStores.tmp
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	QuickStores.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	QuickStores.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53D9DE0B-FC61-4650-9773-74D13CC7E582}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}	FFInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CEA8DEFF-0AF7-4DB9-9A38-FB3C3AEFC0DE}\ = "MPC - Avi Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{008BAC12-FBAF-497B-9670-BC6F6FBAE2C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60765CF5-01C2-4EE7-A44B-C791CF25FEA0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{545A00C2-FCCC-40B3-9310-2C36AE64B0DD}\ = "ffdshow raw video filter conf"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51A00247-40A8-4845-9F17-7DBFCC9A8783}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8F43B7D9-9D6B-4F48-BE18-4D787C795EEA}\CLSID = "{8F43B7D9-9D6B-4F48-BE18-4D787C795EEA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.ts	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E792CF-0BBE-4F7A-859C-194B0768650A}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\FLVSplitter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC257063-045F-4BE2-BD5B-E12279C464F0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F40E1E5-4F79-4988-B1A9-CC98794E6B55}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\ffdshow\\ffdshow.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49590BC9-6DD5-4E44-AD4C-E8FCB7131EC4}\ = "ffdshow Audio Decoder ffproc"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB02CC0B-C3BF-4c10-859C-70F42AFCD6B6}\ = "Haali Avisynth DS Reader"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Preferences\DT_Codecs	FFInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{149D2E01-C32E-4939-80F6-C07B81015A7A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9852A670-F845-491B-9BE6-EBD841B8A613}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FE9017-F873-410E-871E-AB91661A4EF7}\ = "ffdshow Video Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53D9DE0B-FC61-4650-9773-74D13CC7E582}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\FilterData = 02000000000060000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\ = "RealMedia Splitter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{C9ECE7B3-1D8E-41F5-9F24-B255DF16C087}\FilterData = 02000000000060000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\0 = "4,4,,66747970"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\2 = "4,4,,6d646174"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FilterData = 020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000500000006000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE77C59C-CFD2-429F-868C-8B04D23F94CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05F983EC-637F-4133-B489-5E03914929D7}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\ffdshow\\ffdshow.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A36C253D-CEE4-4BCA-9CC2-E03CF6BBB054}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{49952F4C-3EDC-4A9B-8906-1DE02A3D4BC2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B63A013-DC2C-462E-9292-CAF8C867100F}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\Haali\\splitter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8643B615-6A76-4060-8A29-C2C6BDF5D70F}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\ac3filter.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\RealMediaSplitter.ax"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FilterData = 02000000000060000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5711D95F-0984-4A22-8FF8-90A954958D0C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05F983EC-637F-4133-B489-5E03914929D7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90C7D10E-CE9A-479B-A238-1A0F2396DE43}\ = "Haali Memory Allocator"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{008BAC12-FBAF-497B-9670-BC6F6FBAE2C4}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\MPCVideoDec.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007FC171-01AA-4B3A-B2DB-062DEE815A1E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B841F346-4835-4de8-AA5E-2E7CD2D4C435}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A28F324B-DDC5-4999-AA25-D3A7E25EF7A8}\ = "Haali Matroska Muxer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6D6B700-124D-11D4-86F3-DB80AFD98778}\ = "AviSynth"	FFInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5AA0389-D274-48E1-BF50-ACB05A56DDE0}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB43B405-43AA-4f01-82D8-D84D47E6019C}\ = "Haali OGM Parser"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB02CC0B-C3BF-4c10-859C-70F42AFCD6B6}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55DA30FC-F16B-49FC-BAA5-AE59FC65F82D}\FilterData = 02000000010080000100000000000000307069330c00000000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B801B1-A239-473B-B6B4-6AE3DB3ABBD3}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\ac3filter.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9736D831-9D6C-4E72-B6E7-560EF9181001}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\RealMediaSplitter.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}\InprocServer32\ = "mscoree.dll"	QuickStores.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{F2FAC0F1-3852-4670-AAC0-9051D400AC54}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A68C3B5-9164-4A54-AFAF-995B2FF0E0D4}\ = "MPC - Matroska Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC257063-045F-4BE2-BD5B-E12279C464F0}\InprocServer32\ = "C:\\Program Files (x86)\\FreeTime\\FormatFactory\\FFModules\\Filters\\MpegSplitter.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1365BE7A-C86A-473C-9A41-C0A6E82C9FA3}\FriendlyName = "MPC - Mpeg Source (Gabest)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47E792CF-0BBE-4F7A-859C-194B0768650A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}	regsvr32.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4956	regedit.exe
5000	regedit.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
180	QuickStores.tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1444	regsvr32.exe
1356	FormatFactory.exe
1356	FormatFactory.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3572	4068	FFSetup230.exe	99
PID 4068 wrote to memory of 3572	4068	FFSetup230.exe	99
PID 4068 wrote to memory of 3572	4068	FFSetup230.exe	99
PID 3572 wrote to memory of 2704	3572	FFInst.exe	100
PID 3572 wrote to memory of 2704	3572	FFInst.exe	100
PID 3572 wrote to memory of 2704	3572	FFInst.exe	100
PID 3572 wrote to memory of 1484	3572	FFInst.exe	101
PID 3572 wrote to memory of 1484	3572	FFInst.exe	101
PID 3572 wrote to memory of 1484	3572	FFInst.exe	101
PID 3572 wrote to memory of 1916	3572	FFInst.exe	102
PID 3572 wrote to memory of 1916	3572	FFInst.exe	102
PID 3572 wrote to memory of 1916	3572	FFInst.exe	102
PID 3572 wrote to memory of 4472	3572	FFInst.exe	103
PID 3572 wrote to memory of 4472	3572	FFInst.exe	103
PID 3572 wrote to memory of 4472	3572	FFInst.exe	103
PID 3572 wrote to memory of 4864	3572	FFInst.exe	104
PID 3572 wrote to memory of 4864	3572	FFInst.exe	104
PID 3572 wrote to memory of 4864	3572	FFInst.exe	104
PID 3572 wrote to memory of 4196	3572	FFInst.exe	105
PID 3572 wrote to memory of 4196	3572	FFInst.exe	105
PID 3572 wrote to memory of 4196	3572	FFInst.exe	105
PID 3572 wrote to memory of 1076	3572	FFInst.exe	107
PID 3572 wrote to memory of 1076	3572	FFInst.exe	107
PID 3572 wrote to memory of 1076	3572	FFInst.exe	107
PID 3572 wrote to memory of 2492	3572	FFInst.exe	108
PID 3572 wrote to memory of 2492	3572	FFInst.exe	108
PID 3572 wrote to memory of 2492	3572	FFInst.exe	108
PID 3572 wrote to memory of 4296	3572	FFInst.exe	109
PID 3572 wrote to memory of 4296	3572	FFInst.exe	109
PID 3572 wrote to memory of 4296	3572	FFInst.exe	109
PID 3572 wrote to memory of 4956	3572	FFInst.exe	110
PID 3572 wrote to memory of 4956	3572	FFInst.exe	110
PID 3572 wrote to memory of 4956	3572	FFInst.exe	110
PID 3572 wrote to memory of 1444	3572	FFInst.exe	111
PID 3572 wrote to memory of 1444	3572	FFInst.exe	111
PID 3572 wrote to memory of 1444	3572	FFInst.exe	111
PID 3572 wrote to memory of 1012	3572	FFInst.exe	112
PID 3572 wrote to memory of 1012	3572	FFInst.exe	112
PID 3572 wrote to memory of 1012	3572	FFInst.exe	112
PID 1012 wrote to memory of 1980	1012	cmd.exe	114
PID 1012 wrote to memory of 1980	1012	cmd.exe	114
PID 1012 wrote to memory of 1980	1012	cmd.exe	114
PID 1012 wrote to memory of 3764	1012	cmd.exe	115
PID 1012 wrote to memory of 3764	1012	cmd.exe	115
PID 1012 wrote to memory of 3764	1012	cmd.exe	115
PID 1012 wrote to memory of 2224	1012	cmd.exe	116
PID 1012 wrote to memory of 2224	1012	cmd.exe	116
PID 1012 wrote to memory of 2224	1012	cmd.exe	116
PID 1012 wrote to memory of 2296	1012	cmd.exe	117
PID 1012 wrote to memory of 2296	1012	cmd.exe	117
PID 1012 wrote to memory of 2296	1012	cmd.exe	117
PID 1012 wrote to memory of 1612	1012	cmd.exe	118
PID 1012 wrote to memory of 1612	1012	cmd.exe	118
PID 1012 wrote to memory of 1612	1012	cmd.exe	118
PID 1012 wrote to memory of 1672	1012	cmd.exe	119
PID 1012 wrote to memory of 1672	1012	cmd.exe	119
PID 1012 wrote to memory of 1672	1012	cmd.exe	119
PID 1012 wrote to memory of 3928	1012	cmd.exe	120
PID 1012 wrote to memory of 3928	1012	cmd.exe	120
PID 1012 wrote to memory of 3928	1012	cmd.exe	120
PID 1012 wrote to memory of 2976	1012	cmd.exe	121
PID 1012 wrote to memory of 2976	1012	cmd.exe	121
PID 1012 wrote to memory of 2976	1012	cmd.exe	121
PID 1012 wrote to memory of 5000	1012	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\FFSetup230.exe
"C:\Users\Admin\AppData\Local\Temp\FFSetup230.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\FreeTime\FormatFactory\FFInst.exe
  "C:\Program Files (x86)\FreeTime\FormatFactory\FFInst.exe" /install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ac3filter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2704
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\AviSplitter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1484
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\FLVSplitter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1916
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MatroskaSplitter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4472
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MP4Splitter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4864
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MPCVideoDec.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4196
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MpegSplitter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1076
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\RealMediaSplitter.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2492
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\AviSynthPlugins\VSFilter.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4296
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.reg"
    3⤵
    - Runs .reg file with regedit
    PID:4956
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\Install.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s avi.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1980
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s mp4.dll
      4⤵
      Loads dropped DLL
      PID:3764
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s ogm.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2224
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s dxr.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2296
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s ts.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1612
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s mkx.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1672
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s avs.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3928
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s splitter.ax
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2976
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s Haali.reg
      4⤵
      Modifies registry class
      Runs .reg file with regedit
      PID:5000
- C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\askChecker.exe
  "C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\askChecker.exe" FF
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe
  "C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\QuickStores.exe
  C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\QuickStores.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\is-DPB7C.tmp\QuickStores.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DPB7C.tmp\QuickStores.tmp" /SL5="$E002E,151742,54272,C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\QuickStores.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Installs/modifies Browser Helper Object
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4112,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FFInst.exe

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFInst.exe
Size 64KB
SHA256 da964451e7da5c3c84d344913a32594c8f9b73597708476c0c10059589cc1ec6
MD5 1481773382ba81107e7ceef879c816e0
SHA1 887d491fbb74fc2b7ced5dc43dbd01e3105b71b6
SHA512 13ff6abbb8e2c6131c11d803e636f28680e1d8e70d42c6265c16ab040f8a97265110234d09d3f44767e2eea430eb9b4fe517e3f2038fbae2b913ba36093d5db0
SSDEEP 768:dCV7YJ9TQRla+08Muj2YdRdOw0/u4/eXwUPKDtZ29nour0Sl:n8a+08Muj2YZOJu4/eXwBZkvvl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSFilter.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\AviSynthPlugins\VSFilter.dll
Size 980KB
SHA256 4900df9612b2d2df1f4a4888e112ed28a75b2914220483a4fe43bdf6aa88f093
MD5 64ba2e5b9678bc574ef17af88be5df9c
SHA1 d2c3bd89d6a50370c856848876ffde8c5d45e365
SHA512 fca277c92a9dd8ac46cba0ac6ee63ec009a3b88e9d562d912678369e52b5c885fc2902137527bee5c6e08e1ba1a1de894c9093e9c0f6e4595f7edaf0a26171c2
SSDEEP 12288:NEhdLKTnPFBHd6eByHd6P5KXY9EZUsOJoDm1j8ebnZywTrmG6K2xAvJOJsV:NE/LKTdxdrBQm5KXCroi1zFnmGpTJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AviSplitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\AviSplitter.ax
Size 362KB
SHA256 b6436d454af49c0545db0b6d330749cc07131ad6ddd6baf35e294466302a4179
MD5 1eefbe31c7a4fd8cbd29db9b6f4681af
SHA1 297dcc29944615fb807a0ad6074975d1f99c501c
SHA512 d621005fa50e3f4ae837a5711a06a939601dc37af176bee3c3ab659d9d8a27a6515f13861c91fd28d4a33c871a0a8a071686ebaef1ee83601d713a8b9fa5becd
SSDEEP 6144:H6pjO+PcGr6S451u0IaC1KXCKsAqqMNug2tR22p+1WcA0zAU76SfR+WUTw:H6pS4cGuSIC1BT/qMNug2tR2B1ZQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

FLVSplitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\FLVSplitter.ax
Size 338KB
SHA256 64bd6a50c9aefd636e14ecf94b2df98ca7417894eb1a5608d2904f8b1e60dc48
MD5 3fef1aa2fdde866fb4527730c66aeabe
SHA1 bb547a06c4b3cd06a62bb730fc4e37f242bee741
SHA512 8315bdbc338eb5152fff15630baac7eada36362a780c60f641d013cf3498633213375f9abf6461df10b612bec1e018737a58f462f3c604cf073d38e588c44281
SSDEEP 6144:pPTbB8GeZTmwws7OfhUlJozvPkcAon+hXVcqXXkDyDA+gDLJ:pPXB8GeZiAlyzvPkcAo+hdXPux
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.bat

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\Install.bat
Size 193B
SHA256 8d36760dfe5eef3ad3bc010fc5aa490f59eae4c73bd63ff2515e155d6b1cec37
MD5 ed699e5351e521dc8c891c7250947525
SHA1 81e0593a3e5a35f84244607c4622a1c0585c653a
SHA512 461eb7ff9c4d02b80df9580c45d832427e0f5c34260cabd4312cfe1e1a1fb2ce111c384d8a8503d6dcc690a6bdc120b86ee80607d184bb775ce45767a9cb758c
MD5 SHA1 SHA512

Submit Download

avi.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\avi.dll
Size 105KB
SHA256 645338afe29c37519e993b1f2061a1a7b2c68b9c817989639e17bbc335603fba
MD5 99c6577248ea73079ca526b9cd455332
SHA1 c86c142ea370f65c5b30f8f7761c0762cb2e4308
SHA512 1046205fe9f6d5b344016b523cb1edc67984b94133a1a948c7a8a9ff412da29d32d8446ec525356efd2f5d3e448d5de3ae5d5442f0fe195c39bca98a6f494a03
SSDEEP 1536:zliMFPgLas2Ip3QuN1IItfHQdV0dWzr4p5htTikaWqotoVUSbtRIoDT:zhdavp3QuzICQfmO4pXtUotouutRI
MD5 SHA1 SHA512 SSDEEP

Submit Download

avs.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\avs.dll
Size 95KB
SHA256 d5bc8cbfd43d0e09e80f224c96b972e5ed7b36670dee38bf1a5569b3ad2d07be
MD5 dd1d15c0ea5a093d6f3af433f8ddb414
SHA1 eae24f935868611558f317d0bda875c6f16b364f
SHA512 d232d20b3919a63d9e085fbb1f36d13e8fd5fa44ad2b36630002c65f1a732c0fc39027a1655b667789a3151c5d0dcfe78388a156a51a3fd44c98fb5883eb80ce
SSDEEP 1536:535u5tokJcGZhNe02Z9lHkdqwjRj7dtjk6r:WskJNZh3OxK7dtjBr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxr.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\dxr.dll
Size 241KB
SHA256 d222614600ff0467c8fe339df3538539dc98d248e6c96721017ce9f55337c710
MD5 656a5c612e0f259cf0b06b67465646cd
SHA1 7338fba1ed3dd90c7d71353778acaa27a236478f
SHA512 f5565f14364531fd17ed9d34e9ff6807a5e1561bced12ed19b733e1ec99c622cbf61a12cbca7c37d2f31b71f044e12b5f42f9108ebe5a636e8b2e6b82f7d915b
SSDEEP 3072:NBJUEfBxed7gmC4a69/aXf7JflYHA8fLiQcylHMI6ftt1px:NPUEfBxW0mCx0/ml8F1lP6D1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkunicode.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\mkunicode.dll
Size 23KB
SHA256 364da76d61452390e93c1f16a47f8f2fb394bccc3ce9a3f06696de3a47bb786f
MD5 4a93524b0dfeea362de46b441c7667dc
SHA1 a82fdf2420865433cf1507a3f2ae92d85c90af42
SHA512 0d5bd83bffeee2d7eaad607632b346c841b42ee6a0c30f48951d7a7d3d36238c1ab4399dc3fa25fc483a0ca8511f40aae8984b49b3666a62a12ea20d11d6d42b
SSDEEP 384:u9wVJc5nTawOsIoy3qtiB9DRPnoDtaYCV6YxJde9UnV+gn3Jj:yX5TaKy3qYnmaYrKV+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkx.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\mkx.dll
Size 145KB
SHA256 7157191e4f784c25b4febfe5b39ebb89bf23e1cd3a16cbe7976d39af3b4e97da
MD5 2e7e0761c302c9a05be7bf8395a430a8
SHA1 94080bea8f1b64113087ca71c3647530119d880d
SHA512 034e2e532e97f1384cf064e69a07c49667ca973009cbb0e7d95d67f91dc52f6466bdd337d478dc2ff19510cca7cf0e839b3058146fc6e8962034ac80f7352aa6
SSDEEP 3072:cl86fc597px8ZU7gr+5feYDcnMT4FNGQ5tT:IUcS9BDcMspX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkzlib.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\mkzlib.dll
Size 77KB
SHA256 ad2cfc410bce0f310af565fa62ee46492e312b35f4bf9d8eea350b766e91f3ab
MD5 a5ee4284dff89d897aa08898afc0dec8
SHA1 f4158fef2fdfbe116e92df1c6f993a6789475f66
SHA512 ceb6a8ef50d67fd87cc619f53f3a5d3cb39915239b3ff2b1239fddc4ee7083d166c465cdcd2d5e7485e8793b86b926bbeea48cc26738c998fb03bbd49d06d36a
SSDEEP 1536:RFq9UqvI4fenYnvbsscOtC91eeALIIODnToIfQSt1Qw:LQdb9nvbsytleALOTTBfLt15
MD5 SHA1 SHA512 SSDEEP

Submit Download

mp4.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\mp4.dll
Size 138KB
SHA256 0757e15a00dc6144b957ba5b4ac621a1956ca7cb2a464cc8d730a84c0893b95a
MD5 54ca2551e1ab62154c118c7864116a4a
SHA1 04302cd7b671e699f49ef52ab0960e85bff88221
SHA512 7329e853643ea5429f5ddd610debb0e5bad1719ab50cd30da27a33e5e5ef8224ccb7513c8e1c46597b69a33ad76781d029902805c61622c045c6b81b4c7a38e6
SSDEEP 3072:g4UpnkTp3olpY5UASoYZEmHqK2tBDa8H:PUipkpyU/nByD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ogm.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\ogm.dll
Size 118KB
SHA256 c95048f3f3ad2b7a7a85575646fcc8dd0145741323e61a0c1819edc7153f0e1a
MD5 0e911d30e2154c498c9fb775661a15fd
SHA1 df528a490386519f1ecb02cc8c6036394bc4494f
SHA512 7e4a4b08cfab307db51ce9d456661dd670207eef59631b7db4a921d968b1608dee30e5bbe99a34b2585e022d74f90b9754ce793d724d2ee1f40824954cfb764c
SSDEEP 1536:uyNui7iH3QNZLPjTh22zzV36qXrsSdwHoLi+TkTYICJGIHIyeXvfT48iSAoS3tgL:f23CjU2t3N46LHkzAoStgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

splitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\splitter.ax
Size 524KB
SHA256 b7ab7be5ea978617f2f6b5019092256a1bccd1d74d1e888a0207892c89b464d3
MD5 674fb3d19ec45abdb40f03659c781f7c
SHA1 9a9e00cb31673f2d7363136df11e89836ca042a3
SHA512 97fcfd94dfbb24cd65fcfc321b75f86f078065c8c960fba2d722061de758fbcb182904fe466ad84d609f1a88738c78cad94fa56c9da7a796f22ea9db70a0d33f
SSDEEP 6144:4AVTMd3NsZbkor83g226is/i+onX4xVepS2glBZTc0zuKXjOOSWOrVB3QhoUEtTi:4qYgbkor8Q2HiZ4xwg2SwJOSprVB3Nl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ts.dll

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\Haali\ts.dll
Size 160KB
SHA256 d0b7a79b1650cc80f4e5e3ca872e3af251fe67e8fa7bd4c5de4abba7cb977650
MD5 2fb2ef4d4e8868f9df665a78a4268abe
SHA1 cd36bb732d5ecf122749d3b2cacf04e34d9211cf
SHA512 397da65bf3dfa1710b6ac9012f9772ba9d09dc8538d890a609f16474e6995054148b1f9c7601fdc018353c2c38db2ec67bc17877131ea62f6a6d253244b05548
SSDEEP 3072:8qk7R8D+cHE89VsiSly4fXVH4kFvTzKSbw9t1c:RBdbZmLFYk7Elc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MP4Splitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MP4Splitter.ax
Size 502KB
SHA256 d10be76e3f3a1f62ada23b0b708bc29a2413dc09a00d8367add330957201af04
MD5 c34757c536c925f6cde49034306234a6
SHA1 fb58dc5af16476414b2397e50cb8d9ab1ebe2249
SHA512 84dc75dfc3442a58add6b73d8ca1eeee3d9c51179b43f3cb50b89822440e02756c7939419b52bff3a8be1516523f2bdc329ed07a4c3782e2512970340a9e7e7e
SSDEEP 12288:W1tnw7awYfTjHZGRC+jdWVD+hJonnJ9q7BTqWUK2uQ:Ytnw7awYfHnAJonnfCTqWUK2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

MPCVideoDec.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MPCVideoDec.ax
Size 2.3MB
SHA256 3040061859f35d5a7f48a8980accf42eb71f2c75588ef87e42c99d8ffb4241a9
MD5 0fe62e6b03232340995d3c609d76addf
SHA1 2eeeb2163cf6d3f224f8f339a8143e1520fe1610
SHA512 337fff01fe231b95b68f7d57b695cb0df4cbed34c8fdedfccf4f15221374c950d50b328d52069f34f033d1b4152e724a3b28ae68f447ff929c12804f32687294
SSDEEP 49152:D+KGcPRVHsAt97nrs0Y678e1yH94HYQua2urCPF1iGTXe:DucPRVHsAt97nw0Y678e1yH94HYQuv6V
MD5 SHA1 SHA512 SSDEEP

Submit Download

MatroskaSplitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MatroskaSplitter.ax
Size 445KB
SHA256 6f51a4715bd7912026d75f921f006874012ae2784e7d6908a8b95cd8a045be68
MD5 9929cd1af867e6ec66633587c5f0712d
SHA1 89bde0c6c84148dde27268568c85a9762c092dfc
SHA512 1fe5b04ae9f0a80766e31782b899ffd42a311dd8170fcb423720df0e35fc25d4841d73c8e7747474dcaa16cb975cde425a4b0627e9430d828a6b3e1f0b3e2c4b
SSDEEP 12288:B94nV+d6GBwyIGGK4oPt7xCFnjaGo9TOcs5:LwykFnjab9TOx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

MpegSplitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\MpegSplitter.ax
Size 384KB
SHA256 f90b2953e43fa1130554bfb4b8bb6aafbbc75fd5a3e5dd4b7cf3d5044c31dd8e
MD5 c4feea9b39d4026bc63f1d1c148ece5d
SHA1 8c79127a6800bc182f687e0f1b7ec63a6f59c6df
SHA512 ff5a22611adbdbfcaed50d7e1328ebe181b41f92e06407ce6a9b241c81bd46bcbdfc1dd34b22bbe981fd44227c76c9e4ed691baf86058ae699caf030754b50ae
SSDEEP 12288:/SCdGniF0g3IC9stGWVJ6/8jtiDngMf8:XGniVIC9sjungMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

RealMediaSplitter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\RealMediaSplitter.ax
Size 424KB
SHA256 2e29e053b0b84a8b2fa20317a4bb9f99c42003a33b0b43b0acafd32a4b0168e5
MD5 ba19c06d668edc455cc579907a1b923a
SHA1 12f717deab3338fc5ab9a8f0f6a76e3e7fa3d844
SHA512 82a476d4652b2b900d68c652870dd78271505ad632247e574783adcaddaf53ded39ff370c8d681e901d1bff35d583263681506e1fd2415e74ff27477473970fa
SSDEEP 6144:qqvuDpeM2iSfoGGZHDFTPSzZNd9SHUYgu1Sw0G8u7d8DZMJIo78X:hvWLvSfoGGZHDqSHUYxSw0G7Io7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac3filter.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ac3filter.ax
Size 778KB
SHA256 73b931b7e229ab515bc3b2ae6c6e32b07be744bca85b362a3c9af5b1b559936d
MD5 841e8d8623b1683eb8249b676ca0ad26
SHA1 8f8606f76318dd328b5dd978467832f2de381c58
SHA512 63d9be02f3ccb5716cfa93cb0e3f40339458ca7065aed2cf2e95a43015f268dad94168bc17e121b02f5d7e3080aae65125e85b9ca55f6bd7e2af3a11616923bf
SSDEEP 24576:Jb225iho5OgbkdMy7yjTbXajJ0YT/X9sgS0BxpwCPAX5J4kmsVFpY6m00vPiIM4Z:QcGsNpqEzlGKvF6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffdshow.ax

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.ax
Size 3.4MB
SHA256 6e2cd0cbcadf1268de728c1d7dfa0bb3131bf3cf5a6d03bcdbb611b4b255144b
MD5 9cc8ac6ba3e9e0393478e86bc62d06ef
SHA1 fb3626e58b86f0e20a0d4708f875074aaec8d97b
SHA512 9b997b4b162c6046d45524990f85ec8cd5b0e16483875277d8767faa22a312006d95a1df4563beba6eacd4582de46432986fc20072e60194f7e06e4d02a57f7f
SSDEEP 49152:IFIEkkZ+sBcJnxlzgD22sZHPfyveoA3Kbqbuz9HBCa9W0bxl:LkZ+rxeXsZ0VA3KbqbuzvD9W0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffdshow.reg

Path C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.reg
Size 6KB
SHA256 b9044ed1412c49e832c1f2fb13febd85132fff271082c3009235f53f5a8ba7c5
MD5 8a86637bd7857a65f3aa6e16da662dc1
SHA1 f7715e8cbf7c4123966d40474e1fb6e2b293ab94
SHA512 07e428cd4d5b83443a10886319e802f93bd05e2b6f24d5f95f180b4cbe22ec9aa1f6d3aec7012de33e6ca77c5f6e2ac311909e4642a9fe91ca26f05cfa89c4a9
SSDEEP 96:YW0iQemQlsEsJGF61wiQ4wscsr1uj3Ys2enzO:X0N3QFn948j3cenzO
MD5 SHA1 SHA512 SSDEEP

Submit Download

FormatFactory.exe

Path C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe
Size 2.3MB
SHA256 b54f24659a44f4ceeb0c0a7790798a4ef56dfda4c11ffec8d31f3dd067c34c5a
MD5 8b94639c43f8514b93043e8bebada32d
SHA1 eeacbd9d4a296cf3cf582ae1729bc76a87f9847a
SHA512 4a9c9bb4fe447b5e2e2522953d9e7f37e9fb74db4696e1faa5009db493b2f669aae8f45e56f0b0db510687cd9526bdd67d08383fd97a9052157f3419cb77fb02
SSDEEP 49152:x/9T6ZIQ4CdX1XOYPsYw7Zk//kGyfMMMMMMMMLMMMMMMMMMMm1iGdJd:AtEMMMMMMMMLMMMMMMMMMMmJrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdvSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\AdvSplash.dll
Size 6KB
SHA256 0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6
MD5 a1bba35c752b36f575350cb7ddf238e4
SHA1 9603b691ae71d4fbc7a14dbb837bd97cecac8aab
SHA512 eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967
SSDEEP 96:6ONSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpiwoS:sXIpzTSd1BSk/kJtWpi
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\System.dll
Size 11KB
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg2EFC.tmp\nsDialogs.dll
Size 9KB
SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
MD5 ab73c0c2a23f913eabdc4cb24b75cbad
SHA1 6569d2863d54c88dcf57c843fc310f6d9571a41e
SHA512 99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
SSDEEP 96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update.exe

Path C:\Windows\assembly\tmp\30ROE94Y\Update.exe
Size 44KB
SHA256 0e7bcd39f8255eaa3c9dc017586fc52f6912c0c34fabea3143beef7b211ec4a6
MD5 723130df7bbca7fc4bfb1f829abd13b3
SHA1 b0b2c0a3e9915ef419d5fa4f7d8c662445d78c99
SHA512 037ecae3012c8e7ce6ced6f9faf10c2ebd46a517b0be4f59696f1758502741b43e7600a675c9260efee29210ab9e47b58e663ac54a434ce271c5082bed77d77c
SSDEEP 768:OTZg15t5WTX5UvAUNT5xWSpJjvx+NfCIxKMRwKMRSyBLOR:0g15t2GnT5sSp/+KMRbMRSKqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuickStoresToolbar.dll

Path C:\Windows\assembly\tmp\5ZY4HSUI\QuickStoresToolbar.dll
Size 36KB
SHA256 617b1f1dd8765f9483c9671b3d3ebce9f359f708b88ab7494f53399ffba84076
MD5 e8c8af2e5aaafb43b348194dbac7dbd0
SHA1 45bf87bb136674afe36787691d7990cd0c492dbc
SHA512 2ff96bbca268fb731916694120c5e57e6542c9e7cd7d284154dc2a945058289ba7c30ab7f5037033fc6bb02e4233454e83a32e7e554d2a8904fc936b52ead84e
SSDEEP 384:rTFsER9+NpsfUb9HjOQsjJVfwgu4BG5hTzW8FX4VZBlK0lK0vPG6YgHokl7ZokTH:rpfR9+pj2weIfTa84kmu8r/+be6BL4Fl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Interop.SHDocVw.dll

Path C:\Windows\assembly\tmp\ZJ7UBF2L\Interop.SHDocVw.dll
Size 124KB
SHA256 d84e2fcb321bb969eebca48d44787fffc8016f70660c4a58e46589dd22906bda
MD5 2613734670b491be45410d496cef7fa8
SHA1 5b9ae74a23e76863c025fdede54c4ee3316074fb
SHA512 69dc8ad210361bce4c28b15ad31cfccb916557fd60d366642a90a37e046ba4b023c1d41833a15534ab9413f046a5af350403e44c7e80fc40eba58724c3d14c04
SSDEEP 3072:pzAJhn6qY7SVU3OBwTatsP25zsdGPQx6z0FeXY5S7cN2fgBqjk1OnoJCrM9cg55b:pzAJhntY7SVU3OBwTatsP25zsdGPQx6D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/180-429-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1356-351-0x0000000000B10000-0x0000000000FD2000-memory.dmp

Download

memory/1672-326-0x0000000001230000-0x0000000001246000-memory.dmp

Download

memory/1772-352-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1772-430-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2976-337-0x0000000000D00000-0x0000000000D16000-memory.dmp

Download

memory/3764-308-0x00000000015C0000-0x00000000015D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads