ctblocker | 7ab79b9896e8bf6e039e227eb304504c4065db31941587af00f847ed10dd49f5

Analysis

max time kernel
208s
max time network
204s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
Size

924KB
MD5

12bcae9fbba46e40fc81eda65b27c73b
SHA1

413dce848d94d03213c7ea7ac2c57a1c9a081070
SHA256

542f2d5acbe45b037e7a20ac58ccad039f566ed066d59d7401f2ea936a88aaa8
SHA512

d74a634127371432094b5440e78e8950be1e1ea92ec1496912cfea1741616ccae2320a74c633f7351df00fd9603775c8a11a8e128b99068ad5e16e3a29dd12eb
SSDEEP

24576:+FHH+HHHHHWHVHCUXGHnHHhHraHIeXObvpPMHH+NZZ4EA0OGYrOuGO/GS:+FHH+HHHHHWHVHCUXGHnHHhHraHIeeNK

Score

10^/10

ctblocker defense_evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\qhnocie.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://tmc2ybfqzgkaeilm.onion.cab or http://tmc2ybfqzgkaeilm.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://tmc2ybfqzgkaeilm.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://tmc2ybfqzgkaeilm.onion.cab

http://tmc2ybfqzgkaeilm.tor2web.org

http://tmc2ybfqzgkaeilm.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

yudvlmn.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation yudvlmn.exe
Executes dropped EXE 4 IoCs

Processes:

yudvlmn.exeyudvlmn.exeyudvlmn.exeyudvlmn.exe

pid process

1524 yudvlmn.exe
1964 yudvlmn.exe
2120 yudvlmn.exe
928 yudvlmn.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	yudvlmn.exe

pid	process
1524	yudvlmn.exe
1964	yudvlmn.exe
2120	yudvlmn.exe
928	yudvlmn.exe

Loads dropped DLL 13 IoCs

Processes:

542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exeyudvlmn.exeyudvlmn.exeExplorer.EXE

pid	process
928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
1524	yudvlmn.exe
1524	yudvlmn.exe
2120	yudvlmn.exe
2120	yudvlmn.exe
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

File opened (read-only) \??\F: svchost.exe

description	ioc	process
File opened (read-only)	\??\F:	svchost.exe

Drops file in System32 directory 1 IoCs

Processes:

yudvlmn.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	yudvlmn.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-koicsgj.bmp"	Explorer.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exeyudvlmn.exeyudvlmn.exe

description	pid	process	target process
PID 928 set thread context of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 1524 set thread context of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 2120 set thread context of 928	2120	yudvlmn.exe	yudvlmn.exe

Drops file in Program Files directory 7 IoCs

Processes:

yudvlmn.exesvchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG	yudvlmn.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG	yudvlmn.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.JPG	yudvlmn.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.JS	yudvlmn.exe
File created	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	yudvlmn.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-koicsgj.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-koicsgj.bmp	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe	nsis_installer_2

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2412 vssadmin.exe

pid	process
2412	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

yudvlmn.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	yudvlmn.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	yudvlmn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	yudvlmn.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE

Modifies data under HKEY_USERS 22 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b9263cc4-28a0-11ef-8413-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00620039003200360033006300630034002d0032003800610030002d0031003100650066002d0038003400310033002d003800300036006500360066003600650036003900360033007d00000030002c007b00390062003500640063003400380031002d0032003800360062002d0031003100650066002d0039006200310035002d003500650034006400620035003300300061003200310035007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b9263cc4-28a0-11ef-8413-806e6f6e6963}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b9263cc4-28a0-11ef-8413-806e6f6e6963}\MaxCapacity = "14116"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9b5dc481-286b-11ef-9b15-5e4db530a215}\MaxCapacity = "2047"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9b5dc481-286b-11ef-9b15-5e4db530a215}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9b5dc481-286b-11ef-9b15-5e4db530a215}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe

Modifies registry class 64 IoCs

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000cc5811161100557365727300600008000400efbeee3a851acc5811162a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "96"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5a00310000000000d45841aa10203336313537357e310000420008000400efbecc58521ed45841aa2a000000192101000000090000000000000000000000000000003300360031003500370035003200320035003300000018000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000cc581116122041707044617461003c0008000400efbecc581116cc5811162a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000d45848aa102054656d700000360008000400efbecc581116d45848aa2a00000001020000000002000000000000000000000000000000540065006d007000000014000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000cc58f71810204c6f63616c00380008000400efbecc581116cc58f7182a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "3"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exe542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exeyudvlmn.exe

pid	process
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2660	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
1964	yudvlmn.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
1964	yudvlmn.exe
1964	yudvlmn.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
1964	yudvlmn.exe
2604	taskmgr.exe
2604	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

taskmgr.exeExplorer.EXE

pid process

2604 taskmgr.exe
1284 Explorer.EXE

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

taskmgr.exeyudvlmn.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2604	taskmgr.exe
Token: SeDebugPrivilege	1964	yudvlmn.exe
Token: SeDebugPrivilege	1964	yudvlmn.exe
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe
2604	taskmgr.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

yudvlmn.exeExplorer.EXE

pid	process
928	yudvlmn.exe
928	yudvlmn.exe
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exetaskeng.exeyudvlmn.exeyudvlmn.exesvchost.exeyudvlmn.exeExplorer.EXE

description	pid	process	target process
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 928 wrote to memory of 2660	928	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe	542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
PID 2716 wrote to memory of 1524	2716	taskeng.exe	yudvlmn.exe
PID 2716 wrote to memory of 1524	2716	taskeng.exe	yudvlmn.exe
PID 2716 wrote to memory of 1524	2716	taskeng.exe	yudvlmn.exe
PID 2716 wrote to memory of 1524	2716	taskeng.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1524 wrote to memory of 1964	1524	yudvlmn.exe	yudvlmn.exe
PID 1964 wrote to memory of 596	1964	yudvlmn.exe	svchost.exe
PID 596 wrote to memory of 432	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 432	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 432	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2432	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2432	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2432	596	svchost.exe	DllHost.exe
PID 1964 wrote to memory of 1284	1964	yudvlmn.exe	Explorer.EXE
PID 1964 wrote to memory of 2412	1964	yudvlmn.exe	vssadmin.exe
PID 1964 wrote to memory of 2412	1964	yudvlmn.exe	vssadmin.exe
PID 1964 wrote to memory of 2412	1964	yudvlmn.exe	vssadmin.exe
PID 1964 wrote to memory of 2412	1964	yudvlmn.exe	vssadmin.exe
PID 1964 wrote to memory of 2120	1964	yudvlmn.exe	yudvlmn.exe
PID 1964 wrote to memory of 2120	1964	yudvlmn.exe	yudvlmn.exe
PID 1964 wrote to memory of 2120	1964	yudvlmn.exe	yudvlmn.exe
PID 1964 wrote to memory of 2120	1964	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 2120 wrote to memory of 928	2120	yudvlmn.exe	yudvlmn.exe
PID 596 wrote to memory of 2476	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2476	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2476	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2468	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2468	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2468	596	svchost.exe	DllHost.exe
PID 1284 wrote to memory of 1324	1284	Explorer.EXE	verclsid.exe
PID 1284 wrote to memory of 1324	1284	Explorer.EXE	verclsid.exe
PID 1284 wrote to memory of 1324	1284	Explorer.EXE	verclsid.exe
PID 596 wrote to memory of 2204	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2204	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2204	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2164	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2164	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2164	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2928	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2928	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 2928	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 1096	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 1096	596	svchost.exe	DllHost.exe
PID 596 wrote to memory of 1096	596	svchost.exe	DllHost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:432

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2432

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2476

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:2468

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2204

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2164

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2928

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
2⤵
PID:1096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
"C:\Users\Admin\AppData\Local\Temp\542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:928

C:\Users\Admin\AppData\Local\Temp\542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe
"C:\Users\Admin\AppData\Local\Temp\542F2D5ACBE45B037E7A20AC58CCAD039F566ED066D59D7401F2EA936A88AAA8.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2604

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
2⤵
PID:1324

C:\Windows\system32\taskeng.exe
taskeng.exe {D5CCDAE9-EFF6-4EBB-8EC8-E78EC8BC9F47} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe
C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe
"C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows all
4⤵
- Interacts with shadow copies
PID:2412

C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe
"C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe" -u
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120

C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe
"C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Direct Volume Access

T1006

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\History.TXT.koicsgj
Filesize
17KB

MD5
3661dd263bc9733166f75768867f41fd

SHA1
0f520d8d16b2db8a01807ac106a3cd3673aafe50

SHA256
f86d6fbb1e0dfbd5b0476978d391620a44bc08c0099b367efbf327beba99cf9a

SHA512
4a455398538adff33f5e9d169e11735cead10eab2edd3ff9f4ca2801c040449989e50c3f9cc01284bdbb8dccd2effb2d7f0a55f170dfbf8c79b85ae8caaf981c

Download Submit
C:\Program Files\7-Zip\Lang\af.TXT.koicsgj
Filesize
2KB

MD5
f39f91aceb9dd7a1a7f87afe6899c1ca

SHA1
7a5f22f9430e426ebe1bf77ed1de63459eb0e42e

SHA256
8f3298f87a761322d05980b8dea72a54f6063e86f95b1c3459b78bd5e7652c06

SHA512
83f9b7bc80ac60f59a9d2da1f8563667e7cb6f554aeadc638b77ecee4dd4eafccd03652e976159f4a07f60654b45ed076c8354dd6520956fd232e62a9487716b

Download Submit
C:\Program Files\7-Zip\Lang\an.TXT.koicsgj
Filesize
3KB

MD5
0a71e3b71535a1789d6ba0a42815c128

SHA1
29bad8ee7c7786aae03a0b58c865d3826cf0d7ed

SHA256
bcfd247f16e2a27f29e8c622b23c7dd4407fb7e0c7fddf1c592eccaf6b160399

SHA512
9d428fd95be99f8d76fdc156d691f73b28456de17d0649163eeef14a7ce8dc8980b952edad5c0c7feed1ad95ab6cc41dd0db22164d5430a8d7e5b5ee8b4f5ea3

Download Submit
C:\Program Files\7-Zip\Lang\ar.TXT.koicsgj
Filesize
4KB

MD5
8f6499a3bfa684e47471e06568226991

SHA1
d8936a831073569ff5ab117bcd9204504ecb62cf

SHA256
79c2a962e5b28d006543afdf3ffa597e0cc5b576504bde2c64f01868830ae6d0

SHA512
bc6f6f549477ec8cb253b0410d7a078428467c4c15390016f664c80d12cc71ddb2f3b3e35e053133b094bedf2530cefb80a665f8fb07dc843072b5c485449691

Download Submit
C:\Program Files\7-Zip\Lang\ast.TXT.koicsgj
Filesize
2KB

MD5
5709775152587101d8fd39bf8f146588

SHA1
79847c5d52eba38c3cf4a90be8e83cff80f6e366

SHA256
cd6288eeb3d3cd4f7db3cffd960c15ec67ed17f6b9a3db93c3c6f8e2c63078f2

SHA512
ff4a06fd73b422963b4d4b5272b42784b6ad70950fd1b3cba824a528b17f2e7e090df5bd1e60627fa09f3bd739665337df0da7ddc06a17197793e6b926e0cc13

Download Submit
C:\Program Files\7-Zip\Lang\az.TXT.koicsgj
Filesize
3KB

MD5
b2b8e79733bec97b7a495f36473f0691

SHA1
d6538cdbe05e8cf9c6454d76357f6e9585544c39

SHA256
8029e7852e763ec71201b6800e07f1e63c6fd721f9e7ea3bbed15e0c47b94bbc

SHA512
a966e87b0f4004b2a4c6ae06b50805dc4baa38193fd1a162623816621042b1f54f64eeb701cb1af84703401037f512c72d7e677d718bb7e89df6f0431757e64e

Download Submit
C:\Program Files\7-Zip\Lang\ba.TXT.koicsgj
Filesize
3KB

MD5
c099aa2a30649eff10bc60b7d654d392

SHA1
88f8653a18159380bc2a7bb48165eec25a5e990c

SHA256
b54e3eb81eba40866369213ca446438b6f5b11f74007e3efc460dddbb203e84f

SHA512
e1982163c8f119c79c8b2ed94830fbe3416fb1b4f5731d91a1e5a5dc1c3902e6d134d53a62fc8e835ab8639407630f97fe2db58403b6bb480bc222d3617dd8db

Download Submit
C:\Program Files\7-Zip\Lang\be.TXT.koicsgj
Filesize
3KB

MD5
75950b60b63f27aa31b8b317ef29f93b

SHA1
5cd35c35500ef6a6082da2fae6f5cd2e7a95e9b1

SHA256
71768b02da5416c94493fe1680dc09ae359017020e8acf99143440942e83cc36

SHA512
b941670b7bb2c26ec4b2f9cfda4794892bf46ad5d2d8b45323811c6a25f5a1b49737b053e6310ea23ca3938cd8c6d5fbd6aca67807ac8883cd09f45696570de1

Download Submit
C:\Program Files\7-Zip\Lang\bg.TXT.koicsgj
Filesize
3KB

MD5
1e488fad82add543174f5d29eeb56495

SHA1
dc95d58cf6920ff59ecb476587639bdb99f6b3bf

SHA256
6fd272b9ee4f4772f02d35b3f297cecddfbcf01f526313e16f478fa2551eb3fc

SHA512
0a9b67540c2edf3e0ea8547dd917028e8c4d52b441363fb6c6ec5c5bc7cd35ae3f5ddc85af4bd2f5073c1b45e61013e9893456705d6d85178d1d77c8b9ebae0b

Download Submit
C:\Program Files\7-Zip\Lang\bn.TXT.koicsgj
Filesize
3KB

MD5
a0360b58313ee3c75f52ed400d4168ba

SHA1
18cbeafd14ca7776e427103483a3fd9b59e7468d

SHA256
45b18c37f4e71a87e5d68410a2b0f43b661a725255b3999d060f418ecc6c462b

SHA512
8980bb5c435f97af34ab2a48845dadbd9747b655e9c4f01e4698ce41f159217dbd9fda3628388382c8621a631b032f578d991e246d8bdd1c36f4ce4825b3eba0

Download Submit
C:\Program Files\7-Zip\Lang\br.TXT.koicsgj
Filesize
2KB

MD5
7ff331434d6257657ed9b52823f444e7

SHA1
6e530901ac0021dad86e00b0ce630887e7e20b80

SHA256
5c46aaddf30dccbbed48a9710f1d37d945c9faa631e9d65baa4bb8eb4e58edf8

SHA512
15d4a83b5d2b76d23f55c8e4c961872e22f445752c301fa78a8b8f1ad54b7f92825c4903c714a125d1324dcb553b14128fbeb60737685ca4a068263a91ee3645

Download Submit
C:\Program Files\7-Zip\Lang\ca.TXT.koicsgj
Filesize
3KB

MD5
99475bebfea929f29c15bcc556cb2a49

SHA1
2cd4165bd2d87925438988afb976fa4b9ec0d54e

SHA256
ac9d5382fd47d9a56d5b745f1ff38691bb8038e28121488396778fdd0b358fe8

SHA512
85f44bf987d98f0601c1ac795b39f8f68487d1f3dcdb97847b7bc9d5f3b74098d59e3625806c735c78d5b3f1820075c933d4b8afbfe5741b206299046b9cfaff

Download Submit
C:\Program Files\7-Zip\Lang\co.TXT.koicsgj
Filesize
4KB

MD5
28f039a9efff6cc37fe2678344bfcf23

SHA1
a774d7fe6da4e1d8f5f68433a65e6e3cff8727e7

SHA256
178e270ec48a3cbb9940ef893aa98751ade4d6966a99ca10f493d05830baa08d

SHA512
0f23b2818dda021c1a8c3b8e3bfa33915cf9dffbb24e549f4f89fb5f64a74ccdb95910eb3002d35476933b366b57e3bbc2f4d24a29a8bef61fd4105d1bd7e139

Download Submit
C:\Program Files\7-Zip\Lang\cs.TXT.koicsgj
Filesize
3KB

MD5
5b3742d0d569dcf1d855d1080a228834

SHA1
9cead36f39654b02530db87c9c614c0e5eaaeabd

SHA256
497c72e5ae456e8abf60feda3d7387cb999334821aa0fed020da765a1f0b1344

SHA512
e41a037ecd85ecb220f0dca7ba50501535a7a30b8146f96cde61219bb3c59176bbae38a30bd0af0afecb2226a2979cbfbb3161d7179cc86b1ffc494d4e6d334d

Download Submit
C:\Program Files\7-Zip\Lang\cy.TXT.koicsgj
Filesize
2KB

MD5
d6fe0ecc80fd405aa174efd325fdfbe5

SHA1
2b69fc83967dc8fb86bd6b41816dbe9550c487da

SHA256
9d21a45837ae3e381c609323777dea1f1aacef6b536d5d0e4684c430f42b2423

SHA512
480495a870da86640c92bc0d8adbc9c73cb73975f544008001ae998592a9e7781e939a627de8bfa55874df8913f5377e65bf2f2c05346ce01f7c5caf464fcdde

Download Submit
C:\Program Files\7-Zip\Lang\da.TXT.koicsgj
Filesize
3KB

MD5
535cb5df4dc4a29c546ea71ea4fb7b6e

SHA1
9e306be0ff3853b25ed5e8b27ab6278393e480ee

SHA256
e90f8b2d912ed9ccfe8e676df39ceada6306fabc671f2dc4ff8be49dd5c1ef3e

SHA512
0174e90edf041c575740a5d93795e657c8cae450bbf6842a3cabe3490b0459d01f2703f7ecd5f084e25fa6dc5869d404d6897a8896892a3eaf8e99bb24303f87

Download Submit
C:\Program Files\7-Zip\Lang\de.TXT.koicsgj
Filesize
3KB

MD5
3b9371ef3e9000826005cf232e6eed0c

SHA1
74d705d43078b345c76beb455c2199aea53df499

SHA256
d281162db62899996abdb482893cc9353c869344b3b5cb1570cb5386a32ca07b

SHA512
4e0aae70d98497812f6ff6bffbd7920fa64cc74853b036ce7205b98af6d0b5d145fc36eb887f9947faf3631feebd1718c66384b27a576a5f036331cdff464506

Download Submit
C:\Program Files\7-Zip\Lang\el.TXT.koicsgj
Filesize
4KB

MD5
4fbced7510b96904680094834213c948

SHA1
2d4400dd91c9cb314395e4b30c7b495503ff4810

SHA256
fcb0f8b535ff1d874f94c84790ed633c12ec350e5089d5583460080821405259

SHA512
ec3cdcffc0369cdb0620cf641963227066d6cb76e979bdb309e2f4c771a24b4f1b4fd553c2bc0408fe40320729f8963c118d688391f4499c61c030b35fd47bdd

Download Submit
C:\Program Files\7-Zip\Lang\eo.TXT.koicsgj
Filesize
2KB

MD5
d6cd45e5b0b6f162d9392a6ddc8138b3

SHA1
f4c4b82d6c5b50387ad4b732fcfb2a806499de1a

SHA256
b992849bf70c46fef3219bae3038be4ba3ad1bbad406926452fbb53f0f27775a

SHA512
c5e15d8fc49031ed65391a1921476356954ac84e3c17b5065435fc15fa0d1e598efdc0ce0024ad0c4a9aeeebd33f9d931a1c87bdca6234c49b1d6ba04565f0a4

Download Submit
C:\Program Files\7-Zip\Lang\es.TXT.koicsgj
Filesize
4KB

MD5
c50de13c8183bfca05639467cfe352ef

SHA1
afb39a83da992ac6d2fefe6a6cd042cd53c65db8

SHA256
ef0fe2a9e9bb59c0f714785a30575f672f6af5e4d791acb65c60e299a53816b1

SHA512
8fc43fd8ad6cf05364d6de732ab49c9cdf72aeef21e180ddc2fc09e8c3e516d9b9499fc8333261e7f7c91f97b556fc2d502838c9fc1f1659410cd09a40a8eaf0

Download Submit
C:\Program Files\7-Zip\Lang\et.TXT.koicsgj
Filesize
3KB

MD5
251696796fa1b3ed045d771757fc1933

SHA1
979ff3cb40c0390a8893662cd4df973e5140298d

SHA256
8b462bebaafb3a3baaf9f8fd1bd8edd79845f5b01bfc5942d1e54eedd7f0757e

SHA512
f8546407c9d0c2e227282dfa198e2acf0bb5fb68eccd7aee6b80a319c5f165c6f87793f32e94b390dd02f4f0719f32c225ae85e6920276f5740586e65ea07c05

Download Submit
C:\Program Files\7-Zip\Lang\eu.TXT.koicsgj
Filesize
3KB

MD5
69d6b3c5dc4e654e8fd3d134c9cab700

SHA1
78f5cb3a1f812535869412ee5a8aff5cce5dc4f3

SHA256
0453a8a48c43584cc8b4e225354d30c49c3f3fa6fb6bbbc3b03d2cc9c98a0448

SHA512
52d20f0b842f187c50c47e3a96a192b2e4d346c011f4c051eec1e3882502f5c4bba2fe2fbadba6b2bffa86fb13fd67110c5cc4cf27dea39e3880f749d54495aa

Download Submit
C:\Program Files\7-Zip\Lang\ext.TXT.koicsgj
Filesize
3KB

MD5
f568bbc9e788c7250244f33f078045f4

SHA1
e384fd9a162b8d37c90bcc90ebe89043629e35c2

SHA256
bc159a88bd9e2ac6e952e1b9b56bb0ce5e96291e567c449a599d1b98a31c2e0f

SHA512
412b018f9c2bf20ac8f4016855ce1219d513a4e7c825e4614d214967207af9a615749e5ed7be9040e78781444aa5a56aef8d5ac163f78c97ba9705daa6bb427f

Download Submit
C:\Program Files\7-Zip\Lang\fa.TXT.koicsgj
Filesize
4KB

MD5
ab46c8c3fdb962303304880aed204090

SHA1
de32ea48fd39db0899759d8cf79c4337d718e1a0

SHA256
5ec99c1b79188c63ef5879188556b28ae60e8a7d016331d4f18a6e26ed2d6e49

SHA512
8bb6cf57c1b7f69c01ddab86377eb884ce08f8d7ff702e599aeee97c82cbb314fb27be7ad6222c09f3e620909d3cc31323f43307bb7a4651f80af74a0497e4b9

Download Submit
C:\Program Files\7-Zip\Lang\fi.TXT.koicsgj
Filesize
3KB

MD5
551b2fbf13d5537c444bb094ab7d85d8

SHA1
acc4454b44d1a1ead24e45267eac9b428652382f

SHA256
8e58e61ce70045eca4a45b7ec64741e62cac5eb7c6fbca25e59c3c8511d91e03

SHA512
b135357ac96f1d6a6dbf90cbd8bbee430ab2a4d167728d3bdd4396afc8eeea580614bba7372aafb39ac7a8afb9cb06a319afe063e877888680aaf7b0879e7da5

Download Submit
C:\Program Files\7-Zip\Lang\fr.TXT.koicsgj
Filesize
3KB

MD5
e058661c6070cfb7a1d042f534bb69a3

SHA1
6006ad8d8c9484cb98f029d7f0fd654a1c75acb3

SHA256
2bf69456198704c22b38c938e3ef932212f2cd4b0c2824c0f69f19e1f5d5d45e

SHA512
13d9c5c87c5634a62ec3a71422056c8530ef18d32e549b12a9d2dc25fd431b9425b8b694d3b30efff040599a88d6ee197e77c705cf372463c60da967e6edca73

Download Submit
C:\Program Files\7-Zip\Lang\fur.TXT.koicsgj
Filesize
3KB

MD5
33fea829797d4d52950c5281ef90fb9e

SHA1
82bf17659f16d8ac92f0355110ac99febb11b791

SHA256
585387231d70d1d410cb3067639a8402ad5c0bef56f7240f7caca3854f032699

SHA512
ebe274a86a0980d0b5f7b71de3d0e469d8ac64e2071b711b107f915c82f718fdb1662161041271e8e8f80b29e98fc36e71650a9f2a72dd5bfa7dc63d4137edf9

Download Submit
C:\Program Files\7-Zip\Lang\fy.TXT.koicsgj
Filesize
2KB

MD5
75cd7861d9e699ca3c49b20518bb34b6

SHA1
48904d9862cec702f089d9739769a4f2c06f4f1c

SHA256
f92943cab987d706781cef075efd5ff009018c81f692fc50bbe2500324f09465

SHA512
a1aa3f49bbe14e6f928ca2a8dfe440957f2c5293fe794feee9a774fca114793c52227cef71aae4744716013838d7fcd0dd647e8167ddc602a3356a0279051908

Download Submit
C:\Program Files\7-Zip\Lang\ga.TXT.koicsgj
Filesize
3KB

MD5
18b9e3f5a6eb8e83d76e631618f05019

SHA1
80e643d666d4e6086efdfec93b2a4598046e9169

SHA256
95c27ed55360c405bdfded4375d07226f2b5bf732e30a333a4668302bad8f769

SHA512
a746c85b6f34a319416ca2f5f7523be89fe8b785172a6f01db45c4ea9604e48dc4e13b7aaf9a4ad413734dc280494295d561cbe6c234ddf52ef4d9e9303964b6

Download Submit
C:\Program Files\7-Zip\Lang\gl.TXT.koicsgj
Filesize
3KB

MD5
56c82ab2fb2e4da3f1ab9b2121304d20

SHA1
a353e147568d8d147a456d8baf5e81bf83d3d28f

SHA256
cd4b667e7e98b82e7862fcc56496ba42e745d1f0781be1230658c9784e1d71a6

SHA512
e9d9e010588035617bebc547662e9ee7b9811039da6dd7a546aaba4e9d94475ae24b13a472aa2159b0730c6e4eb2f6abb42f5bd4ff475dc72f5260577cc2d630

Download Submit
C:\Program Files\7-Zip\Lang\gu.TXT.koicsgj
Filesize
4KB

MD5
8c36d7e9101c3c3bc5a63126813a8bc5

SHA1
b53f79d159e1e97cf579f14517c311473ccf37b4

SHA256
4324c7be60e745119036e8ade4322a36d298f408539c7671ca3961827a6ef047

SHA512
787d6f64717004e32fb4faccf1dfabb01115584060e161651045e1ab3b0005e9fba0bda5e54aeb788442df41f8e2969c399d9fc0495774683d63d3b91e2e266d

Download Submit
C:\Program Files\7-Zip\Lang\he.TXT.koicsgj
Filesize
3KB

MD5
82632d74f6f7d3868c831cbe8f073efa

SHA1
9eef08f1754759e70a216a60d994be16dbcbf811

SHA256
b063d3c93e6e817d6483acc2cfcc87a51849be72df7976f4ba9ece0f4134b4e6

SHA512
3c25c6dcd6de1d7ca0973a8026703110d9eb884b1759427898e1c569a24ff2052a2840ec67d6e44b7d772f9dd94448db176831c420f57f8784a18c0e6ff84a90

Download Submit
C:\Program Files\7-Zip\Lang\hi.TXT.koicsgj
Filesize
4KB

MD5
ac9b5e7b746924f18d53e999248f1c09

SHA1
03b5a39de11e9aebe540319e2071d8f33ae75576

SHA256
557583ce5d8f2c98cbd017c0c907fe9910bba2a12dc5de39b7cfd4cbf2f49d4c

SHA512
8fa845d2a8f5cb34b805c12ef640836d00f30c3c776e12891ce0029b5ca71cab59eb50847028b6507a3d274d10f2822b17c482df8cfe53ca426dfd86b35cd06c

Download Submit
C:\Program Files\7-Zip\Lang\hr.TXT.koicsgj
Filesize
3KB

MD5
1a1307d497d3e941ab1a986b437ba09c

SHA1
a7bed1f4e8fcd68845affdfce3668d052b24b142

SHA256
3b529a432c7f017ef57f0a469b6421a532f99302e076c287ebf5ed60150f2075

SHA512
fa7a95ee352e9f7e654199a5486400871062360bcdfde403e92ae610b1c41ac28e319054162edf454cc578ea50156460b6951d7132ada0b7a84ad112ec4e1c61

Download Submit
C:\Program Files\7-Zip\Lang\hu.TXT.koicsgj
Filesize
4KB

MD5
ec6690c093ce2d89d734c62f1dc97da3

SHA1
244614fca960326ec796b3d688d87787a4091cef

SHA256
84c2ecb07d6035ea4624e03ee645619d186a5f7951dd953b1c7d142e8e6dc523

SHA512
c1f72b38a7b55de716c21de51569a61609651c35189f491e820fa4eca00f1736c18507aecd0f68e02b28fde43aac86c296a59d9cd47a7d9fba93d47040449e0b

Download Submit
C:\Program Files\7-Zip\Lang\hy.TXT.koicsgj
Filesize
4KB

MD5
28956958d728f2613eb5bc76a0277822

SHA1
1c2837249826303d7a34ef3fcc689ed0383768e3

SHA256
87e90b9e08055210b282de509fbb05b4880f3eb04d64e4ed23f1e5c9885ebcac

SHA512
1706fd1a17ecc3d7dfd5cafd09cb6376ccb5d2e2a3df7ffc0110ad1256b983db8a847424e79805e45194fb91b269fa1d776d5e8ceb688a5ceff4c567378d28aa

Download Submit
C:\Program Files\7-Zip\Lang\id.TXT.koicsgj
Filesize
3KB

MD5
c79a20608d3a40e641e0e7e8d16bcc47

SHA1
e0c4ab143e4ae80bec5aad04570f919d48c0c451

SHA256
28b9422e6cceee313936464754186f91f3e8e35144e1456eb569d266b30d4240

SHA512
3f055d5f0f5703b0faf0100d4ea016529c4ffa3573d9873d3aed08dd6cbd11c99a5361f430d9cc215a7af465ce465ade590f85b982d3b81495663533b6202093

Download Submit
C:\ProgramData\Microsoft\gyjaxkb
Filesize
654B

MD5
16fc8322c09dcea497a3f58381efbf2f

SHA1
577478db138b5274eb51b961ec7df8ea36e1c015

SHA256
5467fe94a122ce7d994b60e30e103717a670e7b190045857dd2f21c611ddf378

SHA512
636651e5f300d9529e14abc2d0d5efc916e494de8b93f093671235034c7acc3e0b4c0b7ce860a93d3cea4d005e94968d3968b3b5d27642f454ca7eed5ea98097

Download Submit
C:\ProgramData\Microsoft\gyjaxkb
Filesize
654B

MD5
5d6a4c94e3c455d0f48eb9701489ab12

SHA1
d3272d31f359e75a9c6b66b4e3a443db8b670d41

SHA256
f1566ff7a333882cf89910528691d8895bf0af3a753f8f07e3a9c8e8ffc9ee14

SHA512
19e4f23aeac80043768e4e202027d99c22688da4936b6057313371749536ef4e3143b11842b1485bbd89173aee4795c690acbb88507632da21b5683f4301e12a

Download Submit
C:\ProgramData\qhnocie.html
Filesize
62KB

MD5
6fb564a545b468631aadc6673bc3a822

SHA1
2a4a51ff34d7bf54dddfc7845215120225f05dc7

SHA256
cd1525533dcd25b107be7d651796cba5c63731af4d3ba13c17bd6d23c2745d65

SHA512
74eb9f3c8010ea2950a8194461530b7eb50502c6691a439391dd9adba8c4539b6b78383f917fe6d632783ab91e6bbaa33f850ab84d234093da165946dd661b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\3615752253\zmstage.exe - Copy.orig
Filesize
3.7MB

MD5
b76cdc1b0bedb3d580509a2419a8821b

SHA1
66aa0ea32b71dbe2c0a1bc61eb9f5105c20c66a7

SHA256
592b28435c59961bb97b8496a8794391f5ed29cc6d48e81f5b7a0fe846db1ccc

SHA512
7fbd8900be5c4a630bcf6aa56861ec53b4a359dbb8888b15b3c491f56808877265d96887e862c7a3dad38c50348b625ffd5783d1caaa3d7279b033dfa0b971ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\yudvlmn.exe
Filesize
924KB

MD5
12bcae9fbba46e40fc81eda65b27c73b

SHA1
413dce848d94d03213c7ea7ac2c57a1c9a081070

SHA256
542f2d5acbe45b037e7a20ac58ccad039f566ed066d59d7401f2ea936a88aaa8

SHA512
d74a634127371432094b5440e78e8950be1e1ea92ec1496912cfea1741616ccae2320a74c633f7351df00fd9603775c8a11a8e128b99068ad5e16e3a29dd12eb

Download Submit
C:\Users\Admin\Desktop\ApproveWatch.RTF.koicsgj
Filesize
404KB

MD5
4c01e66f7359c80188a0309069653d29

SHA1
ba4c55a53c21264bab26bd8dcac0db1ff6da9898

SHA256
1206d7a4738b75ca5131506ff67e6cb6219301cf6e3550610914f93461058989

SHA512
15795eb8ccc0a183b8411c4703a8e7efeec5ae8e66bff39029fab746891f29025b2cb524883983cedefea535161679b6d7cc62f55d2ddefa6c98f57e9adfddc8

Download Submit
C:\Users\Admin\Desktop\DisableFormat.PPT.koicsgj
Filesize
849KB

MD5
bfb201f494d40aa99058e2ea24a195f5

SHA1
b008f4f1efa6c8329bc380bc86ec77bf8839fcdb

SHA256
aa2d87b422106168665dca5e5361c71a7551f322a9b8bf1af44d2856ebf8800c

SHA512
9b6a0f22b862209778f9e6346177f728e9f0fc73c9b28b9f60b2dfe18d74fc4f8ad9af19a03f2007be54a45fb1af8860fca7206c7180454767ed20c83741b0ef

Download Submit
C:\Users\Admin\Desktop\DismountDisconnect.RAW.koicsgj
Filesize
376KB

MD5
36b970a6bc5f5774e2483d8c81f6adfd

SHA1
7e95141c827fef62055d24f8f5abab9d86bbc142

SHA256
02c192e7adc85af47db83a376241b6d1b6bf66071267794b5118d9e3db5bbb3b

SHA512
63250c7b585d7dadc9cef4eb0e7d22a9755a2cc890b6c765d768adecae994b119901f9d24508731dde7e075bd92f697fd47b9f25364a0637f89e90f138785546

Download Submit
C:\Users\Admin\Desktop\EditSelect.DOC.koicsgj
Filesize
543KB

MD5
d20aa5c8b7210dbe51001ce78ff7f724

SHA1
f450d46a0e103a4490c2dea07576a6785b136b14

SHA256
81d7493fe509d73632a5e045b4f5ad76c46d2a93ded56c711625771c0d87aa4e

SHA512
ece683f5620f72fb0dd42df92fae5f54833af4eda5894d4318077e4fd11cda0a0564317765b73f557360146fe949c6125a0dce169ab1a2bcdd2440b2031882c0

Download Submit
C:\Windows\TEMP\fi.gif
Filesize
1004B

MD5
0aae04dbd30720f6bd155ce7840910e3

SHA1
b533f683a4b685f55fb1bce194d9145c602f2e9a

SHA256
a7c5d01580067d324a13a972fa18a9180eac9a11246bebec9a2f01cc637f1cb7

SHA512
ab7a50407f279e3a58f397ef75c25edfeb3bf8221b37fb01caaab751664cf95602a35936e5958452717cfca51a22b1e258c63dd63dc9fbfd5ca1cf4d7e141038

Download Submit
C:\Windows\TEMP\hauwvhbjaw871uiaajytwa
Filesize
453B

MD5
26285d1377373ceac812055acb452fb9

SHA1
f3e218e8462a1460afb152c398f4357ab88dcff5

SHA256
131913b9c692467e775cca508e3ac6ed4416677c58e1f9c36d07bf97a9e06b24

SHA512
6db15c446ae0a7bfab6052773db2fc20f399da0ae41f8cd9e8fcb11146840155766dc96f4d9a7b44b5fbbd97db0e0200515039ca7b966cad145ee0667885bdef

Download Submit
C:\Windows\Temp\default(5).jpg
Filesize
3KB

MD5
14b4d9ba36a8670eece654e1a4fdc2f2

SHA1
2462df322e59a44b9187788f64eedab3d1a535e3

SHA256
980cad5d94f8a820920a167d9f4869c0b391906b5d2c27e4d390abe3f8173d97

SHA512
3864f8a182e50352162441e467b5bcb9d683c4ce3895408ad056250cd5293434eb38cea7e99c112982055e5ee8ea04dcf5ab97c0aaeb03d555757c4cf10134c3

Download Submit
C:\Windows\Temp\fi.gif
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Temp\sk.gif
Filesize
1006B

MD5
01d603424483cf66ca867ba0f1c9fec4

SHA1
851a4e2fad80d91460e80b9d8ba1a24286372850

SHA256
3f5faa0cf6fbc76de5b6033000c72a54b77485ea7804e3f9735260d42ac71fae

SHA512
d33154eac5a61a593c21ebb6a0b58de51680d60cc56fb503860cb96a6f86f2307196c8f15159f33351f6f6d5f8631b553b40d44e1974e07a4d4683e4a0f44696

Download Submit
F:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
\Users\Admin\AppData\Local\Temp\indult.dll
Filesize
52KB

MD5
2af5aca231901b467c24034a9f19418d

SHA1
7895e41cb146c3323cafe1344828a7f94be91ccb

SHA256
6073b252332794c7d1fa4c3161cd1a8b7d29639677bf0e0c1a135ea2d61dfe20

SHA512
0e92b177646f305dc99a8da36b427cba6ccda866e25d947003d6bd827784ff270ea001ae38d749028ad0f9c02958523533833fff26eeaea4f82feafc797a2bae

Download Submit
\Users\Admin\AppData\Local\Temp\nst6F87.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
memory/596-78-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-1294-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-310-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-85-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-89-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-87-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-82-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-81-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/596-79-0x00000000003A0000-0x0000000000417000-memory.dmp

Filesize
476KB

Download
memory/928-18-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/928-1365-0x00000000008C0000-0x0000000000B0B000-memory.dmp

Filesize
2.3MB

Download
memory/1964-74-0x0000000000C10000-0x0000000000E5B000-memory.dmp

Filesize
2.3MB

Download
memory/1964-1306-0x0000000000C10000-0x0000000000E5B000-memory.dmp

Filesize
2.3MB

Download
memory/1964-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2120-1345-0x0000000000360000-0x000000000036E000-memory.dmp

Filesize
56KB

Download
memory/2604-1444-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-67-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1483-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1358-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-28-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-27-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1435-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1434-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1429-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1428-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2604-1357-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2660-34-0x0000000000740000-0x000000000095A000-memory.dmp

Filesize
2.1MB

Download
memory/2660-21-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2660-26-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2660-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-22-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2660-33-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2660-35-0x0000000000400000-0x00000000004A4400-memory.dmp

Filesize
657KB

Download
memory/2660-36-0x0000000000960000-0x0000000000BAB000-memory.dmp

Filesize
2.3MB

Download