gh0strat | 092ff5eeddfd265d8f37c5a9afbf7c3018ba65fcd0dd59c0237f7e04d1915060

Analysis

max time kernel
466s
max time network
479s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12-11-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2345pic_x64.msi
Size

79.4MB
MD5

fe984489b63aa7cd7aee6c48fe69e08d
SHA1

b5cac8c66311b7601e0ef2a1d134bf06a8079497
SHA256

092ff5eeddfd265d8f37c5a9afbf7c3018ba65fcd0dd59c0237f7e04d1915060
SHA512

806872b46c843727d4a980e46fef0a662115a6429868e74c8889d9363323008797c5b11ad54bb524709cb26087a8bec42b0051f701af4766ee7227068a7a0e92
SSDEEP

1572864:NmsJ8LVVmCjLbWQVZq/5u3dOdYMBWkAhIo/qQXAbJqWOm9uUQerttNG2MZ7dE:ojyCjLLZq/5ukpBVMWchl5erttNXMZ7S

Score

10^/10

gh0strat purplefox discovery execution persistence privilege_escalation rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/4616-110-0x000000002BFC0000-0x000000002C17D000-memory.dmp	purplefox_rootkit
behavioral1/memory/4616-112-0x000000002BFC0000-0x000000002C17D000-memory.dmp	purplefox_rootkit
behavioral1/memory/4616-113-0x000000002BFC0000-0x000000002C17D000-memory.dmp	purplefox_rootkit
behavioral1/memory/4616-114-0x000000002BFC0000-0x000000002C17D000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/4616-110-0x000000002BFC0000-0x000000002C17D000-memory.dmp	family_gh0strat
behavioral1/memory/4616-112-0x000000002BFC0000-0x000000002C17D000-memory.dmp	family_gh0strat
behavioral1/memory/4616-113-0x000000002BFC0000-0x000000002C17D000-memory.dmp	family_gh0strat
behavioral1/memory/4616-114-0x000000002BFC0000-0x000000002C17D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	2345pic_x64.exe
File opened (read-only)	\??\R:	aAvapbvtIRjv.exe
File opened (read-only)	\??\M:	aAvapbvtIRjv.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	aAvapbvtIRjv.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	aAvapbvtIRjv.exe
File opened (read-only)	\??\V:	aAvapbvtIRjv.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	aAvapbvtIRjv.exe
File opened (read-only)	\??\S:	aAvapbvtIRjv.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	aAvapbvtIRjv.exe
File opened (read-only)	\??\E:	aAvapbvtIRjv.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	aAvapbvtIRjv.exe
File opened (read-only)	\??\J:	aAvapbvtIRjv.exe
File opened (read-only)	\??\Q:	aAvapbvtIRjv.exe
File opened (read-only)	\??\T:	aAvapbvtIRjv.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	aAvapbvtIRjv.exe
File opened (read-only)	\??\L:	aAvapbvtIRjv.exe
File opened (read-only)	\??\Y:	aAvapbvtIRjv.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	aAvapbvtIRjv.exe
File opened (read-only)	\??\U:	aAvapbvtIRjv.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	2345pic_x64.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	aAvapbvtIRjv.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	aAvapbvtIRjv.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	aAvapbvtIRjv.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jnSNQNClfnFm.exe.log	jnSNQNClfnFm.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2928-6663-0x0000000071280000-0x00000000718E5000-memory.dmp	upx
behavioral1/memory/2928-6675-0x0000000071280000-0x00000000718E5000-memory.dmp	upx
behavioral1/memory/2928-6685-0x0000000071280000-0x00000000718E5000-memory.dmp	upx
behavioral1/memory/2928-6705-0x0000000071280000-0x00000000718E5000-memory.dmp	upx
behavioral1/memory/2928-6712-0x0000000071280000-0x00000000718E5000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.vbs	aAvapbvtIRjv.exe
File created	C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg	msiexec.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv	wBtkOfXYmrXB.exe
File created	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml	wBtkOfXYmrXB.exe
File created	C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe	wBtkOfXYmrXB.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe	wBtkOfXYmrXB.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe	wBtkOfXYmrXB.exe
File created	C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv	wBtkOfXYmrXB.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.wrapper.log	jnSNQNClfnFm.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.wrapper.log	jnSNQNClfnFm.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer	aAvapbvtIRjv.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.wrapper.log	jnSNQNClfnFm.exe
File created	C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe	msiexec.exe
File created	C:\Program Files\EnableMagneticOverseer\valibclang2d.dll	msiexec.exe
File created	C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe	msiexec.exe
File opened for modification	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml	wBtkOfXYmrXB.exe
File created	C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe	wBtkOfXYmrXB.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7A92C46CF58C3908.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{944047DE-2AC8-485B-B376-DA72238E3394}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF77FA8CEDA43CDB30.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f388.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3142831431B41B6B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF57C.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f38a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC477F98A5F506DB.TMP	msiexec.exe
File created	C:\Windows\Installer\e57f388.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 28 IoCs

pid	Process
4924	wBtkOfXYmrXB.exe
1856	aAvapbvtIRjv.exe
2232	2345pic_x64.exe
2768	jnSNQNClfnFm.exe
4236	jnSNQNClfnFm.exe
4200	jnSNQNClfnFm.exe
2024	aAvapbvtIRjv.exe
4616	aAvapbvtIRjv.exe
2800	2345PicLoader.exe
2480	2345PicLoader.exe
2392	2345PicLoader.exe
428	2345PicTool.exe
4508	PicServiceManager.exe
2928	PicService.exe
3676	2345PicLoader.exe
2180	2345PicLoader.exe
4700	2345PicLoader.exe
2320	2345PicLoader.exe
656	2345PicLoader.exe
4992	2345PicUpdate.exe
3452	2345PicHelper.exe
3792	2345PicUpdate.exe
4400	2345PicWorker.exe
952	2345PicHome.exe
1504	2345Login.exe
2820	2345PicUpdate.exe
4628	2345PicTool.exe
3192	2345PicLoader.exe

Loads dropped DLL 44 IoCs

pid	Process
2232	2345pic_x64.exe
2232	2345pic_x64.exe
2232	2345pic_x64.exe
2232	2345pic_x64.exe
2232	2345pic_x64.exe
4336	regsvr32.exe
2960	regsvr32.exe
428	2345PicTool.exe
2928	PicService.exe
1036	Process not Found
1036	Process not Found
1036	Process not Found
1036	Process not Found
4508	PicServiceManager.exe
2180	2345PicLoader.exe
2320	2345PicLoader.exe
4700	2345PicLoader.exe
2928	PicService.exe
1804	Process not Found
1804	Process not Found
1804	Process not Found
1804	Process not Found
1804	Process not Found
1804	Process not Found
1804	Process not Found
2392	2345PicLoader.exe
4992	2345PicUpdate.exe
2928	PicService.exe
3184	Process not Found
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
952	2345PicHome.exe
4628	2345PicTool.exe
2820	2345PicUpdate.exe

Modifies system executable filetype association 2 TTPs 7 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\PicExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\PicExt\ = "{FA60785B-B582-410F-B6B1-B8BDA43D8E56}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\PicExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\PicExt\ = "{FA60785B-B582-410F-B6B1-B8BDA43D8E56}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\PicExt	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\PicExt	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1408	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345pic_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aAvapbvtIRjv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PicService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicWorker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aAvapbvtIRjv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PicServiceManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wBtkOfXYmrXB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aAvapbvtIRjv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345PicUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000485242783223abf50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000485242780000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090048524278000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d48524278000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004852427800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aAvapbvtIRjv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	aAvapbvtIRjv.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.pnm\Shell\图片编辑（裁剪/抠图/水印）\Icon = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicEdit.exe,0"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.iff\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe\" \"%1\""	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.sr2\ = "看图王 SR2 图片文件"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rdc\UserChoice	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.tif\Shell\图片打印\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicPrinter.exe\" \"%1\" \"--rightmenu=\" --product 2345PicViewer"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PicServiceManager.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cap	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.x3f\UserChoice\ProgId = "2345Pic.x3f"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.jpg\Shell\图片打印\command	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.xbm\Shell\图片打印	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.cap\ = "2345Pic.cap"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.webp\shell	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.dcr\Shell\图片打印\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicPrinter.exe\" \"%1\" \"--rightmenu=\" --product 2345PicViewer"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.pcd\Shell\使用看图王打开\Icon = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PicService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.orf\Shell\使用看图王打开\Icon = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.k25\ = "2345Pic.k25"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.nrw\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.pfm\Shell\图片编辑（裁剪/抠图/水印）\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicEdit.exe\" \"%1\" --rightmenu=0 --pagetype=5 --subtype=3"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.fff\Shell\使用看图王打开	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.kdc\Shell\使用看图王打开\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe\" \"%1\" \"--rightmenu=\" "	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.tif\2345PicBackup = "TIFImage.Document"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.ppm\shell\open	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.wmf\Shell\使用看图王打开\Icon = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.sti\Shell\使用看图王打开\command	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.ppm	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\.pic	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.pbm\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\.wdp	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice\Hash = "ru9qT1rzRZM="	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice\Hash = "dky4zKRGLus="	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.crw\Shell\使用看图王打开	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\.ico\ = "2345Pic.ico"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.cr3\shell	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\.drf	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psb\UserChoice\ProgId = "2345Pic.psb"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice\Hash = "iGHnQoICHTs="	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.pic\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.rw2\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe\" \"%1\""	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exr\UserChoice\ProgId = "2345Pic.exr"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.mdc\Shell\使用看图王打开\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe\" \"%1\" \"--rightmenu=\" "	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.ai\Shell	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.mef\Shell\图片打印\command	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice\ProgId = "2345Pic.nrw"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.jpg\Shell\图片打印\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicPrinter.exe\" \"%1\" \"--rightmenu=\" --product 2345PicViewer"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.cs1\Shell\图片打印	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.dng	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.ia\Shell\图片打印\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicPrinter.exe\" \"%1\" \"--rightmenu=\" --product 2345PicViewer"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.jp2\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.pfm\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.heic\Shell\图片打印	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\2345Pic.fff\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mdc\UserChoice\Hash = "xAKXVkc8/ww="	2345PicLoader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.targa\Shell\图片编辑（裁剪/抠图/水印）	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.wdp\Shell\图片打印\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicPrinter.exe\" \"%1\" \"--rightmenu=\" --product 2345PicViewer"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.pxn\Shell\使用看图王打开\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe\" \"%1\" \"--rightmenu=\" "	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\SystemFileAssociations\.pxn\Shell\图片打印\Icon = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicPrinter.exe,0"	2345PicLoader.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.ofd\shell\open\command	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\.bmp\2345PicBackup = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.cur\shell	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.rwz\shell\open	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.mdc	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.rw2\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.pnm\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.pgm\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.dcr	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.rwz\shell\open\command	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{F260009D-313F-4977-AEEA-1E362358C22C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.raf\shell	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.ras\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.pic\DefaultIcon	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.hdr\ = "看图王 HDR 图片文件"	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.ofd\DefaultIcon	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.mef\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.pct\shell	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.raw\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.exr\shell\open	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\.j2c	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9292671-476C-41C7-B4CF-F637370C26E8}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arw\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.wbm\shell\open	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.ia\DefaultIcon	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.bay\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.orf\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.jfif\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.iff\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.wmf\shell\open	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.ai\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.pcx	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.wap\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.tiff	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.sr2\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.nrw	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.xbm\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.pbm\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cr3\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.ptx\ = "看图王 PTX 图片文件"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.drf\shell\open	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.rdc\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.webp\DefaultIcon	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.arw\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.emf\shell\open	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0FECBFA-0EB9-42A1-8E1A-F7B305A36208}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\2345Pic.mng\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.iiq\shell\open\command	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.dds\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe\" \"%1\""	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.rw2\shell\open\command	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.sgi	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.pic\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\2345PicViewer.exe,0"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.ofd\shell\open\command	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.psd\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\psd.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2345Pic.rwz\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\2345Pic\\icon\\common.ico"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\.jpg\ = "2345Pic.jpg"	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\.targa\ = "2345Pic.targa"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.pcx\shell	2345PicLoader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.cut\ = "看图王 CUT 图片文件"	2345PicLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\2345Pic.sgi\DefaultIcon	2345PicLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\TypeLib	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5084	msiexec.exe
5084	msiexec.exe
4276	powershell.exe
4276	powershell.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe
1856	aAvapbvtIRjv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1408	msiexec.exe
Token: SeSecurityPrivilege	5084	msiexec.exe
Token: SeCreateTokenPrivilege	1408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1408	msiexec.exe
Token: SeLockMemoryPrivilege	1408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1408	msiexec.exe
Token: SeMachineAccountPrivilege	1408	msiexec.exe
Token: SeTcbPrivilege	1408	msiexec.exe
Token: SeSecurityPrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeLoadDriverPrivilege	1408	msiexec.exe
Token: SeSystemProfilePrivilege	1408	msiexec.exe
Token: SeSystemtimePrivilege	1408	msiexec.exe
Token: SeProfSingleProcessPrivilege	1408	msiexec.exe
Token: SeIncBasePriorityPrivilege	1408	msiexec.exe
Token: SeCreatePagefilePrivilege	1408	msiexec.exe
Token: SeCreatePermanentPrivilege	1408	msiexec.exe
Token: SeBackupPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeShutdownPrivilege	1408	msiexec.exe
Token: SeDebugPrivilege	1408	msiexec.exe
Token: SeAuditPrivilege	1408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1408	msiexec.exe
Token: SeChangeNotifyPrivilege	1408	msiexec.exe
Token: SeRemoteShutdownPrivilege	1408	msiexec.exe
Token: SeUndockPrivilege	1408	msiexec.exe
Token: SeSyncAgentPrivilege	1408	msiexec.exe
Token: SeEnableDelegationPrivilege	1408	msiexec.exe
Token: SeManageVolumePrivilege	1408	msiexec.exe
Token: SeImpersonatePrivilege	1408	msiexec.exe
Token: SeCreateGlobalPrivilege	1408	msiexec.exe
Token: SeBackupPrivilege	4988	vssvc.exe
Token: SeRestorePrivilege	4988	vssvc.exe
Token: SeAuditPrivilege	4988	vssvc.exe
Token: SeBackupPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeRestorePrivilege	4924	wBtkOfXYmrXB.exe
Token: 35	4924	wBtkOfXYmrXB.exe
Token: SeSecurityPrivilege	4924	wBtkOfXYmrXB.exe
Token: SeSecurityPrivilege	4924	wBtkOfXYmrXB.exe
Token: SeBackupPrivilege	2200	srtasks.exe
Token: SeRestorePrivilege	2200	srtasks.exe
Token: SeSecurityPrivilege	2200	srtasks.exe
Token: SeTakeOwnershipPrivilege	2200	srtasks.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1408	msiexec.exe
1408	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2200	5084	msiexec.exe	87
PID 5084 wrote to memory of 2200	5084	msiexec.exe	87
PID 5084 wrote to memory of 4668	5084	msiexec.exe	89
PID 5084 wrote to memory of 4668	5084	msiexec.exe	89
PID 4668 wrote to memory of 4276	4668	MsiExec.exe	91
PID 4668 wrote to memory of 4276	4668	MsiExec.exe	91
PID 4668 wrote to memory of 2928	4668	MsiExec.exe	93
PID 4668 wrote to memory of 2928	4668	MsiExec.exe	93
PID 2928 wrote to memory of 4924	2928	cmd.exe	95
PID 2928 wrote to memory of 4924	2928	cmd.exe	95
PID 2928 wrote to memory of 4924	2928	cmd.exe	95
PID 4668 wrote to memory of 1856	4668	MsiExec.exe	97
PID 4668 wrote to memory of 1856	4668	MsiExec.exe	97
PID 4668 wrote to memory of 1856	4668	MsiExec.exe	97
PID 4668 wrote to memory of 2232	4668	MsiExec.exe	98
PID 4668 wrote to memory of 2232	4668	MsiExec.exe	98
PID 4668 wrote to memory of 2232	4668	MsiExec.exe	98
PID 4200 wrote to memory of 2024	4200	jnSNQNClfnFm.exe	105
PID 4200 wrote to memory of 2024	4200	jnSNQNClfnFm.exe	105
PID 4200 wrote to memory of 2024	4200	jnSNQNClfnFm.exe	105
PID 2024 wrote to memory of 4616	2024	aAvapbvtIRjv.exe	106
PID 2024 wrote to memory of 4616	2024	aAvapbvtIRjv.exe	106
PID 2024 wrote to memory of 4616	2024	aAvapbvtIRjv.exe	106
PID 2232 wrote to memory of 4336	2232	2345pic_x64.exe	108
PID 2232 wrote to memory of 4336	2232	2345pic_x64.exe	108
PID 2232 wrote to memory of 2960	2232	2345pic_x64.exe	109
PID 2232 wrote to memory of 2960	2232	2345pic_x64.exe	109
PID 2232 wrote to memory of 2800	2232	2345pic_x64.exe	110
PID 2232 wrote to memory of 2800	2232	2345pic_x64.exe	110
PID 2232 wrote to memory of 2800	2232	2345pic_x64.exe	110
PID 2232 wrote to memory of 2480	2232	2345pic_x64.exe	111
PID 2232 wrote to memory of 2480	2232	2345pic_x64.exe	111
PID 2232 wrote to memory of 2480	2232	2345pic_x64.exe	111
PID 2232 wrote to memory of 2392	2232	2345pic_x64.exe	112
PID 2232 wrote to memory of 2392	2232	2345pic_x64.exe	112
PID 2232 wrote to memory of 2392	2232	2345pic_x64.exe	112
PID 2392 wrote to memory of 4508	2392	2345PicLoader.exe	113
PID 2392 wrote to memory of 4508	2392	2345PicLoader.exe	113
PID 2392 wrote to memory of 4508	2392	2345PicLoader.exe	113
PID 2392 wrote to memory of 428	2392	2345PicLoader.exe	114
PID 2392 wrote to memory of 428	2392	2345PicLoader.exe	114
PID 2392 wrote to memory of 428	2392	2345PicLoader.exe	114
PID 428 wrote to memory of 3676	428	2345PicTool.exe	116
PID 428 wrote to memory of 3676	428	2345PicTool.exe	116
PID 428 wrote to memory of 3676	428	2345PicTool.exe	116
PID 428 wrote to memory of 2180	428	2345PicTool.exe	117
PID 428 wrote to memory of 2180	428	2345PicTool.exe	117
PID 428 wrote to memory of 2180	428	2345PicTool.exe	117
PID 428 wrote to memory of 4700	428	2345PicTool.exe	118
PID 428 wrote to memory of 4700	428	2345PicTool.exe	118
PID 428 wrote to memory of 4700	428	2345PicTool.exe	118
PID 428 wrote to memory of 2320	428	2345PicTool.exe	119
PID 428 wrote to memory of 2320	428	2345PicTool.exe	119
PID 428 wrote to memory of 2320	428	2345PicTool.exe	119
PID 2392 wrote to memory of 2480	2392	2345PicLoader.exe	122
PID 2392 wrote to memory of 2480	2392	2345PicLoader.exe	122
PID 2392 wrote to memory of 2480	2392	2345PicLoader.exe	122
PID 2232 wrote to memory of 656	2232	2345pic_x64.exe	124
PID 2232 wrote to memory of 656	2232	2345pic_x64.exe	124
PID 2232 wrote to memory of 656	2232	2345pic_x64.exe	124
PID 2232 wrote to memory of 4992	2232	2345pic_x64.exe	125
PID 2232 wrote to memory of 4992	2232	2345pic_x64.exe	125
PID 2232 wrote to memory of 4992	2232	2345pic_x64.exe	125
PID 2232 wrote to memory of 3452	2232	2345pic_x64.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2345pic_x64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 382838555EA7C4782EE971DF9C2CECC4 E Global\MSI0000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\EnableMagneticOverseer'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start "" "C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe" x "C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg" -o"C:\Program Files\EnableMagneticOverseer\" -phZJcWScQuNgsiGBeBDtN -y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe
      "C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe" x "C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg" -o"C:\Program Files\EnableMagneticOverseer\" -phZJcWScQuNgsiGBeBDtN -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4924
- - C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe
    "C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe" -number 182 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1856
- - C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe
    "C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe"
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\Desktop\2345Pic\2345ImageThumb64.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4336
  - - C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\2345Pic\PicExt\2345PicExt64.dll"
      4⤵
      Loads dropped DLL
      Modifies system executable filetype association
      PID:2960
  - - C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe" --fixdir
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2800
  - - C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe" -recorderRealtimeStat aq_01#2;aq_02#0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2480
  - - C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe" -install 71 -invoke-platform-x64
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Users\Admin\Desktop\2345Pic\protect\PicServiceManager.exe
        
        "C:\Users\Admin\Desktop\2345Pic\protect\PicServiceManager.exe" install "C:\Users\Admin\Desktop\2345Pic\protect\PicService.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:4508
    - - C:\Users\Admin\Desktop\2345Pic\2345PicTool.exe
        
        "C:\Users\Admin\Desktop\2345Pic\2345PicTool.exe" -update-force-config -invoke-platform-x64
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe
        
        "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe" -check-thumbnail -invoke-platform-x64
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3676
      - C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe
        
        "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe" -check-update-pdfconverter -invoke-platform-x64
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        
        PID:2180
      - C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe
        
        "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe" -check-update-ocrconverter -invoke-platform-x64
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe
        
        "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe" -check-update-picdesigner -invoke-platform-x64
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\2345Pic\PdfEditor\Application\1.4.0.683\ngen-install.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
  - - C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe" -skinselected 0 -invoke-platform-x64
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:656
  - - C:\Users\Admin\Desktop\2345Pic\2345PicUpdate.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicUpdate.exe" -install -update-platform-x64
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4992
  - - C:\Users\Admin\Desktop\2345Pic\2345PicHelper.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicHelper.exe" -repairAssoc
      4⤵
      Executes dropped EXE
      PID:3452
  - - C:\Users\Admin\Desktop\2345Pic\2345PicUpdate.exe
      "C:\Users\Admin\Desktop\2345Pic\2345PicUpdate.exe" -SendUIStatNow
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.vbs"
1⤵
PID:3516

C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe
"C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe" install
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
PID:2768

C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe
"C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe" start
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4236

C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe
"C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe
  "C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe" -number 250 -file file3 -mode mode3 -flag flag3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe
    "C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe" -number 132 -file file3 -mode mode3 -flag flag3
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4616

C:\Users\Admin\Desktop\2345Pic\protect\PicService.exe
C:\Users\Admin\Desktop\2345Pic\protect\PicService.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2532

C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicWorker.exe
"C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicWorker.exe" -from_shell
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4400

C:\Users\Admin\Desktop\2345Pic\2345PicHome.exe
"C:\Users\Admin\Desktop\2345Pic\2345PicHome.exe" --desktop
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952
- C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345Login.exe
  "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345Login.exe" -pro 2345Pic -t update
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicUpdate.exe
  "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicUpdate.exe" -update -update-platform-x64
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicTool.exe
  "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicTool.exe" -update-cloud-config -invoke-platform-x64
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4628
- C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe
  "C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\2345PicLoader.exe" -repairAssocPDFAndImageAndSafeCenterProtect
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f389.rbs

Filesize
7KB

MD5
dc4b8094707ea00f505db03451e227e0

SHA1
e5e0c2ca1e1ed1972d21244f812330d5ba5d8eba

SHA256
ee3e2359213e1ab67beaaa2562387e9bae667e3ed078b2b5d743fdfa3eb1a20b

SHA512
e9ad544e0f24e43dfebb2b342b22fcabbd7149761ad31b8f14da502ab5c0111e733a4c9e3a180c6f5ab7961a6f9e4ec922e4811bd96f78040e146ecf241f7c27

Download Submit
C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe

Filesize
3.2MB

MD5
90a521d21169049fdf1a244fc2989377

SHA1
e9b0db47e89683444ba886fa8091167e160f6b30

SHA256
7dd65fb863051edda07d0f84c65c36cd7388aa28464eb3f6c541f73c9f195f41

SHA512
e20e25cf49489861dcb00cb4b38f9c96b26b016b55a9b92ab082ef422db98dad3936b6918b65f1874ba4fe1a0208e8bae701aaf3d7e3bdcca3f046eb0826f8dc

Download Submit
C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.vbs

Filesize
2KB

MD5
1e0499cb02d625084bc87bdc378c766f

SHA1
4a28d0d6b3f69ab3254a08be8a102bf5690d661f

SHA256
0a3a48ab6d2e8cb621cef3949557ee289d566f788e99d1091fb1a4fa838273b7

SHA512
37b147378920a187bb9d18ef930d9e86d12b238657e794398f32065b77211c165a6c680421d44742508d3bdbd0143431b0c37cc05056e9ce5ad1fc54727ff370

Download Submit
C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.wrapper.log

Filesize
266B

MD5
4bc0ec63457e59d2f2081c240f7f2d86

SHA1
27a13b85b0115cb81eff242af8d8c4cbcce5e9a5

SHA256
aa5cf2312a255ca8d40ec0179123efe18c883ae54b17d84728447529e6e06da8

SHA512
e80f1ec6aa0c85474dea395d92fab2e68663a5c17ee7461299691965d6944d28bc30c9b4a27e3ffb0f76e1657686fe92b93b907970d1e40e6c7451b77388daa5

Download Submit
C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.wrapper.log

Filesize
486B

MD5
51d90bf12ed277e4e82ae13b75cb198a

SHA1
d7391f08a9c2ec5df7625179f8d0afc0f747393b

SHA256
2fc931e94df8c21935db6f9e26f38d8f1b37b8f95ede8ef69388894856de860b

SHA512
3c16aaddca2341a43674e8a7863c03d03b96b5fc291ade1ddb737abf3da7880bc6c4308babfedc9aac03a0a63554ce2209cc85c88667a7a433e393d850d7e609

Download Submit
C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.wrapper.log

Filesize
588B

MD5
14faa2c671c723ff434ea0f177a0ec08

SHA1
7ecaad0e90c463dd82520101e80a7c8e8dcde92b

SHA256
72e8778675c5b119ce34313103c09d8febbfa52fbcd9ca607778666829723345

SHA512
3e46c6940b5316fe19248f52ea9a2b8f67168453c0428643f41dd3d6d553aacf2ef2eb2250569763bc1edd7796f9f711c901fc1ceab1981972b744cea3e64add

Download Submit
C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml

Filesize
437B

MD5
5bb0d373e349c5b338e75bb61087c8a7

SHA1
7f1ef7fdfd8be7d238dbda9a8742abd0e584e788

SHA256
82c7224a57ffe8384766daf2c00acb148d9ca79db5cb2bc222ec9f385bcd966c

SHA512
f887e41966eda84cafb7e003f946116be2d9dcc8fe1578050f296771ff8735fee06730de5cd1c7408148d91b61f5c87515c1b53440191e5a31f08317c6758a49

Download Submit
C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg

Filesize
2.4MB

MD5
5ac34b87f21ae7fedf4dc629181decf0

SHA1
3890201e28d44a46b6e810b5bc5eddfec78d92b9

SHA256
ffc5b747ee4183aa7b298e7e296981d19321c208ae40b0052f1965033da5ebb4

SHA512
fbfee20bf2795f2e67ef24a1add342d61c131226ab74638447c5be70f4acd0ad9e51db1f58e69e4785446e2af71208a729636c0a79db1415712e67ebad8c2eda

Download Submit
C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xldykt3s.cbv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq2102.tmp\FileInfo.dll

Filesize
624KB

MD5
cc7eab4f83339cca63f763114ca04c6c

SHA1
4da526e8b270dc16865813801dc5bcda8162c09d

SHA256
a1c9c3b3bc8e75aa91f639da10835210e81aeb7fb5db79ac0703e1594e516b5b

SHA512
d1df9bdb61dcc95e579adf4891c000feee83f9f4a3f82debca617fb62afff16707707681c2f2655aa02756873d5251db74d5b843ec56c3e12ab1120355360ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq2102.tmp\RCWidgetPlugin.dll

Filesize
2.4MB

MD5
2f2ae26fd88c512ac0feb39fa42ee894

SHA1
ac50a5fd61933bdd2a54e6503e39438f05af3304

SHA256
9117cafe403e445a291141ee898845799a165c383d3dfcf76c1870f66782e6b1

SHA512
b919244cd08118a2258cb062e5ce3a4626d82ed0ca3600a018bdb97962b9f96d57d1a08d338fd41fbae4af72debf7840707f67d442e53ec8a15cb8002ee725e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq2102.tmp\System.dll

Filesize
27KB

MD5
a568feaa357f44dd50c5e447fa8ee1b2

SHA1
5c765fad342b756d5ea522087c6f7567b5f3ed57

SHA256
57947a15ad3215185c7e15a5f0da393570845a13ab7b184a07fcefbf97537e48

SHA512
7c8c36c0123de839e677beeba65c1af56c5e85d8f1ff2c94950aed33e026dff3fbda8c49859012862110117977c928b814c0d91c477583a2b8f83d73f3cdf174

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq2102.tmp\libcurl_x86.dll

Filesize
2.1MB

MD5
a26e75c0407c87786eea42febdb32532

SHA1
27e52fdca023cb8f031cd55ac37965d93f7f7da7

SHA256
635f988beb849c6510f54f681387bf810c2266bd27834c5a9c160cbfe6df44d4

SHA512
fdd9760442579ad2a3df4f31464f9e66bc19a4390fa1c81afb516cce817097b5324024f712d9c1bf1a11ad30324f5a8aa83c72a732e1197e8804ab806d3859e6

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\dlg\popup_tips_blue.png

Filesize
1KB

MD5
95e1828b8f6503f437b596c5128bd645

SHA1
d94592e1b45b137348eb43693c94887e2a96fdc8

SHA256
3cca0deae3d9d75263adecd15eddf063e95ab9981c277e442a648e7e0c33f04b

SHA512
984cb7765eee2dc63df8fa4b5cec171a67b4d1572d34cf0a3ade5f7791ddea01e5d238a0b1abaf7fd1c8536ba50fb593696e860e5513fc475b2539d99c2f4eea

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\dlg\[email protected]

Filesize
1KB

MD5
8abc07202d7186d709d51cdd1175aca1

SHA1
e6efd7190782d8e5763144e5b8222e156ae81ab2

SHA256
4f2602c973b3ff4dfb94f5e4b5758b2dab5c241970984a658cd9e194e383f9b9

SHA512
808907df2c23989619ecc7dd13a170d1e2dbbe22e2e93252252d980ecf5a39c21b4822bf779fdd370d1fe98e7a658f5f2d27c8f86bfac1a3870438a78ee5d4d0

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\popup_RB_Selected.png

Filesize
443B

MD5
bc12d407d5d5b0508e2871ad344e306d

SHA1
043e0b3c443e969e378e42ff2ee800e51c841c0a

SHA256
3c4f0492de96f4f4e7f94295777fe36425fef91adac06a28fa0c6044ceee0177

SHA512
151c8e60a2e42dd47157e967577bcc74411d78b93562c1690fd20c42a5b4b7261638ee7063222a1ea0a9511e324e21ad56cc30bcfb4c64344115c56dca816e6b

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\[email protected]

Filesize
551B

MD5
a0251caa028d68f77297cab1bec64c25

SHA1
eb79b330b8dc262bb44a2cf15fb0a47dccffd3c5

SHA256
214261af5b93a1694bf5ae6eef7fc96a98aff0a4bd7a5be53b3a84a5d75a3ae3

SHA512
9a542bab759bac9d0d0407b0669f26dbc2b4ac7695664ac593fd25ac4edcc5520bcf95b2c6d20745cc9068ec08ca3e598cfdf4899651a4596b64b5812a569e66

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\popup_RB_Unselected.png

Filesize
245B

MD5
b787be7275da89fef81d93960460d3d9

SHA1
6940feede36ff5bbefa528d759a764666ff067d1

SHA256
5c6c8d6b07b8468c07d996f209e590505967017e67f56f1723dbeb8f34e64be3

SHA512
b474322fa82d73b6c78e5c794686fed4d652b70895cd5f7daca5dfe293ff743e6042b9f47cf6a1a7632ac0b15b7f4154746e41eb207c07215236c94461ab68bb

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\[email protected]

Filesize
305B

MD5
c6c627bd294aef92f18caff40904cdd8

SHA1
012727b9f71b5c74e17f04994c78e3aad82abd63

SHA256
8d92f3245f2e6e673128270d95c47ab692ce327cf8acf2ec6504c457c148bcd8

SHA512
c84641abaea4a33f4768722fdc914f15c1d032fcc463c36799a9adc13057f23eda0b44f0b0f26a925666bafe3928fe10345b0570604cdd3f7a5a5d85a8c3d5a9

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\popup_RB_Unselected_hover.png

Filesize
248B

MD5
e994b04b8c3203b50bef4bca73338891

SHA1
24d98ce399e531fac13dfc89e3ce2d431d54417f

SHA256
c32156bf89b569c1c5d964e9a932aec6a0dbc91014be03d531692f3c1ec5fd31

SHA512
12a226c4b8767ab9bb6a989720a067e3a78f8331c01be7e1f741c4f2a12cd78895cb0c8afcc4d3cb44d865002bf87367bcecae327bdf7fe8027eaacb8fba7d09

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\[email protected]

Filesize
305B

MD5
a7d3c5bd3ef1e023e10ffa89fcda4d04

SHA1
437daa8dedb2558d4474f2e27926a27bc240ef3f

SHA256
4cea5c669c26dd2294983a8c4582067f762cf08eee6b1f52c7ef02b48c1d7a0b

SHA512
6df3bcb62127ab4de61c972bfdf6eeedfe5c5938d744e8a3c45b24b2385a2ac05718cf2e7aee4f21a39869b78affd0262326f47e55da1afbeb863f0ba7005061

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\popup_RB_Unselected_pressed.png

Filesize
257B

MD5
d3018eefcf78291bb4173c3b2016d39b

SHA1
4e1eb656d738da192f974f3b9a3a0079072e3be3

SHA256
92164f437b40e363cb902d5351ec3fdca6f0d458c02daf3d8e5ccef2ecf22b58

SHA512
4cbec39ebd22b9910e2e7de778651daf9d4b1f7c62ecbcca36c764c05be90509a907ee3e39e37a3d22b4adbf20553f92aac21fae5f79dba1e5bd928ba38c77d7

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\[email protected]

Filesize
312B

MD5
c588379bc0ed655a76f14828a0057c35

SHA1
f8a8171ddcb4da40cd7e6061813485241265d80a

SHA256
516250ac3563a60b8fcdd34d133b34ebdf9edc74cd290952a564c37244354fa3

SHA512
eca4e8ff8309fe489283b283cd84cbf08f6110b62f2035d6bf605133781186872233596abd0fa550c8e44c4bb600101896638816cee0f5b6f6b19bc360e0e96e

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\popup_RB_hover.png

Filesize
511B

MD5
0e9787ae505bd3ba671bd64938205f84

SHA1
20104239f93f165207e97964d5faf9b1eca1f099

SHA256
837b8eda575ea4a55410adca6c95b73026afd0cff4ae3d73a10397a4c3863e52

SHA512
4f96a67359766edc50e7355263b29e8d05d240862e4dfb313d6ff617da8914af6e65f6dcafc3ca06fdea1595dd8a5b554483321216729a161e5c302aa41b1648

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\[email protected]

Filesize
653B

MD5
f637da10227d0bb78080248a368e9b8b

SHA1
0343ab440bae66241efea8a8502df0582eb3e1af

SHA256
b07aad097b0b957199aa75735e61eb814d182abb3ba012fba28fcc343327a760

SHA512
7423d6872c3ce2ce320bf38b2595967c105d86990dcb4f0e8a34b7227a35c608e7a9ad4e5d821ae3201ce6516a80cde1dc3566c7988092e5454d4c73c2f7212c

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\popup_RB_pressed.png

Filesize
506B

MD5
491039a46fc5de6cd8dd4cbaa10311e8

SHA1
69507b16d633be0e1922f416ff66b3537e4b3dfc

SHA256
b3d0dc0d43dc5b3bfdf8e574c453689ad0fabce111c307ce0ee557996e95d26c

SHA512
00d99feab888917c24e3c82a8513450a3e8d2c77d82a07204ac8d73fce5356d3f0dc3f318b4549910e92cce7d61d8739d730d2a563ec9e70a60cd1dc964ffe88

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\default\[email protected]

Filesize
652B

MD5
6b36a6e40211ac514566742ecdc54575

SHA1
f412732021ed52ba24c02b8f81437354504c5b5b

SHA256
7504ad14efad0aa7419372a6014531eac60a35881b87736eec1dfccaf9d89381

SHA512
2d0152da33131669f4de1981056f9d2397e5a933682358f74328c867b5afc002272f51134d2f90c3c03bcd82cb08da0baa5e8751691656c120cd340f1a8cf5e6

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\system\close_normal.png

Filesize
263B

MD5
6a6ce6d7d17218ee8328f5c9bf9ff743

SHA1
e8e78bbac2ce8569ce4480e7732c43d02e7ffe2b

SHA256
79869641ac9916c5e389955c07ea2ae1ecacbf5d05f4021a3bfeed0d3634ad7f

SHA512
e6a5112e10b394442ef1d7402f1dea921261601754da0fdefa542ba88536e3859899543fa9c9dd04d604ed447d81ddda0a7ba8dff988b4eacacdd33f1d601246

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\system\[email protected]

Filesize
464B

MD5
1de8efd42937972f919cae377fed6e24

SHA1
b5b3eeb548dc786dcee183303563d7ba84b215e1

SHA256
7412d125dee1686c7a7444653e0e6b3238a5ddc1e96510b162bcfde81c31fc8a

SHA512
b9a0ca2405dda1ec941eaabf36b2e8ea12facef0abbdbdf2e0e5cbd5f4999966c8bcf774bdd6ef5a5a96201996a3320868bb29d44e8f1f7e91f4e7c9127e38e2

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\usercenter\unvip\headoutline.png

Filesize
1KB

MD5
e00bcfcc23aa4c703c22e8d2e68eff7d

SHA1
af2e12c0218add3b5166d6f5d4b4d913bcff2f48

SHA256
27b8e9ea7b3b0e7b67769815bb324648823ab8de41020032566c01d77b36feb6

SHA512
ecaddbc706a28b0579fd688bbbe83ded319b5997e6645ae26fcd1e7a7f0fef06a9c1c1b0c8500a1c1aba0cf01fa7b0901d6f29a4a6014ad7e80bac3c7b02486d

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\usercenter\unvip\[email protected]

Filesize
2KB

MD5
f0c735923a4e739fe2ae134b06c19862

SHA1
c8d54ae1de3dd8a269b3d212b0935427ec4ab9ea

SHA256
38a06c63d9c61b93812e9ef167b34f31443b6fedcf43c8dde59ce93400db2adf

SHA512
707dd12b55519eac63ae07f072a8544895d9cdcfb0bc87b9b0ecc020d406e773ac867d5cec7a0256d945951d67da2d3c0c94408f41f2c66baa52defad5a8e99d

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\vip\[email protected]

Filesize
1KB

MD5
e41c215b662691a2e037d48711c98005

SHA1
2dd74834b7af9eddf91fa7674e88163ef362fd38

SHA256
0adc3959c48e5d7f94c115050e1ca503165cfcd22658dad79116838a46812291

SHA512
7149d7c8e721d4240d90e6a4ca60403364cd36d90a44edb919aab89e683ea2f833cef61f4df20d483abce628569111eac9b69d0eaf2a719003e884ec6d20f05a

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\pichome\viplogo\[email protected]

Filesize
1KB

MD5
addac39e4ef6b031d8b43bcbb6f94b00

SHA1
d79495a4cf7ca4625fa6035346d8fed059cb18ea

SHA256
2b3bef4135bde64c055fae99603f549eca5748e44cf984de54a1ad32e638b248

SHA512
34ffdce99fa19e870c92a8bec8aff1ff2483bbd706d9cbc7a1f4b050e48d75c85a9d1b95a74be82f93e7faf68a21f75a81970df07a02dd8ae4e5c361ad47540d

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\picprinter\scrollbar\vScrollBar_bk.png

Filesize
321B

MD5
95a8db8521d837c106994866f6a88499

SHA1
1988066430da693ae4ee8e52f4216bc55f368603

SHA256
aed94805a9d6baa6947852fd91a2d5147a2c81b8edca75bba8b5df329d0afe3b

SHA512
9774713d352a9f62f62736d3d6dcc2d3fb3292a9c2b972ab82f30f9d5ba3ced578d2591c1a657e0aee24d005d3e3dd77cd8b9edf5ac48a530b11acf1f060c014

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\picprinter\scrollbar\[email protected]

Filesize
388B

MD5
0ba2ee9d46d5f773b214662799ca7eb8

SHA1
3663f5ac237b4b258afb357e28317968bc355d06

SHA256
d7c2a07d24adc82f28a9c6b00d9b0bf23b0d35c584f37ae242b714d6934a5575

SHA512
c6cce8a67be786f2d70059bf10eef9e17bdced89779293f05e2d0fbcbd7169152692723dc2a6d00c1269df463ea39e418ca96dc0c7e6e8b696f83e71a4f9ee36

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\picprinter\scrollbar\vScrollBar_fore.png

Filesize
340B

MD5
cd43729b10c9691ac3dea006fd159018

SHA1
b9a5a6fa7fe6e9fb6a10b785601a6f329b263464

SHA256
320f801661e9fabeb08f744d3519b6d864e09e6455da66204c83b22d30e8bcf9

SHA512
3a9ed2a301c72217676693d35b21328e2e99181e72c69ce012dd74241655bc3d325413c5f1bfa4f2186f544296c03c533db80e5fc90f53b810efd599d92d0ef0

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\picprinter\scrollbar\[email protected]

Filesize
402B

MD5
d06985ee10e9bdf76bbea5c29a6d272c

SHA1
28f084a7ad793a01b65f600078087fce84b57e77

SHA256
4ac5488185c7385d973abbf4444eb8a621df5aab335efcf42fd393d9e438108e

SHA512
1aec10c2a12efc0dae20543ae6bb5ea0481a3ac84406e4918a7e4f5cd3f55404fb3acb96c8bbd6c04c85a6cbd87010f25c7f821a4ad9a62265b8604e8bffd6a3

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\skins\png\purchase\[email protected]

Filesize
412B

MD5
fa8ec3b81fa2fad456367e57ebdddba7

SHA1
3d906ac03891691f1439c5c27b6e357a1279b83a

SHA256
36a153c1811c4e20c9c9c72d448fd484ad901d731e449f281e806132c3ddbc03

SHA512
22639c229bef3ef19e860f096d2811886b3e74620a3485bb71af4e022aefe78dc1d1e1cb5242569b3612002a366b4c9574531dc54ab3e6deb5a87efffb2ef359

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\thumbnail_x64\2345ImageThumbCore64.dll

Filesize
3.3MB

MD5
20bef75123561323a869b2cca311e881

SHA1
3b67960ee258e44467c26aa09957a1c81084552f

SHA256
a184de789881966b138fafc00488473b55a4709cc9c0846c0507973e8b25a470

SHA512
6703b52bc37584e4e4358fb0d1757984fcabb984098eb6a59f4fe8d1a890cb04273e06c90dd60f0d9c4fdf0e1e328cf5ef5d0d1bf47ba2dbbed85138234cf3d7

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\thumbnail_x64\FreeImage.dll

Filesize
12.4MB

MD5
b8a2a1abc6be3364decabc1f4d0173ed

SHA1
3727bdc1c2ef9db833a7315fb96c394faf43c2d8

SHA256
c61a95677c03d49c44a4f7333979f5a726f379b0cdf78c0a92fc77ad2ef6ac3f

SHA512
44cadedf237f66822f537f87efb1263f4958d5fb00a9c487f49421e0040533ecf805b2b8824f938fc1e8f74b3b20ff9b362939c16f0abc667ad03370daf74891

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\Application\11.4.1.10796\thumbnail_x64\FreeImagePlus.dll

Filesize
183KB

MD5
9e424448d82a31b263f86f1c00981b12

SHA1
2398ecad23ab47a10024f5b2e5243aece8bf2f11

SHA256
da2d42179cf2592d2f8a4be9d132cc2568c64a0630605b305b40b42d6bad0222

SHA512
aa5e8203a410a2ba1ff3a72c6d48e6edde0086fedc81f4a03ce454ef1925b78c1904d727c9e317af177fa059258213257ce32ffea850d9e3d27018ed25374754

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\PicExt\2345PicExt64.dll

Filesize
616KB

MD5
c986eaed19d9b0e2789ba6f4e8c3f738

SHA1
53b313068249314511ba9a7ef106d7da4330ec74

SHA256
5be00e3cbb7930af3e4a155d32961c534cb1d3e80aab94b1e405d6a9622cbe32

SHA512
0676c42fcb1b6c33539c49f3ea01c3e545b94928f3259e486fabee9c2753fe394b0f79cde272d34a836c8a13ed68089a28fda98ffa4bcddb917c38e9446f7976

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\PicExt\libcurl_x64.dll

Filesize
3.1MB

MD5
60ef5f8ea368c088dfd053666a3a198a

SHA1
fac2a6f283073b363c8eb5b66b23e13e22c63b76

SHA256
a1970d754ddc181ccf4530b7b47f5d301624c20cf005f065e431a9520a5492d0

SHA512
6e25868dfe2140e87041739189b214830242bc018a5c05960640ea6ec8d4b842de0e732f1ec12dfb09bf55c1d26c30ac55dd0eb243110b483d1f8ac5d7d0ebc1

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\RCImage.hzc

Filesize
1KB

MD5
5e9f2f2b162ef247ab08568b05304e2d

SHA1
f32c2dc94eeb7b7fd9e6d4ac7eb2dac607cbc251

SHA256
d024355fe463c780eca26b64abf860389652643e948b8ca6e042c196cfb89823

SHA512
c72806aa2fcaca9e323660fca972b801d18b692d71210e8e1da3b13ca8d65df186e909063ae3eb67960d7867a61d16640b993e5495eea3c48595c2e66a0d2d4e

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\RCImage.hzc

Filesize
1KB

MD5
f8e9c68cb2d5ca78d3cc784ee85ac2db

SHA1
7eab73565a031fea4924ed5a30945c7fd58fa9be

SHA256
8370c6cd95fc668de75075375e428aded2c5afe9ed9a0d8006543d84571b0ad8

SHA512
7eea6859eda339bbe94ed99971614d95e0160f1f21b23a593363c9b52852bdee745d834a9c3f09cce8128665e250852be9c52cb0987f6fe0a746e230d695db9d

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\RCImage.hzc

Filesize
2KB

MD5
2754dfc6b75959b209481a3867fdd7ba

SHA1
f647eba4b4e593dbbb9e064b84065bd3a40f3642

SHA256
7449b447a3434adbeb564a1ee2058130e80de9799b853c442542d96896709f57

SHA512
42985ce511dfa6c496cfdc6cf0d7a8f75ff6e1c39bce62b7901b93b8881a974ef4e160f2cc2b4a948906e169e080c87d62fc31c9461e1999fdc9065a79634edd

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\RCImage.stat.lock

Filesize
4B

MD5
f1d3ff8443297732862df21dc4e57262

SHA1
9069ca78e7450a285173431b3e52c5c25299e473

SHA256
df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119

SHA512
ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\cloudconfig.dat

Filesize
29B

MD5
99fb8e84b8aa92889349054a60e1f359

SHA1
1b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5

SHA256
5313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4

SHA512
2a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac

Download Submit
C:\Users\Admin\AppData\Roaming\2345Pic\config.ini

Filesize
33B

MD5
24018ae232d58618567b45195c0d662f

SHA1
972dd91194ddc7019a30fe98ee7fda048727fca7

SHA256
a7a027a679d74c329d4ecafd9f5e6f7ac313feb1071d796f4a3740aa336b679d

SHA512
ae3179788b29c743a34d81065cf6533a85765674c7bcdbeb00e8878957007c78df3ebfdbac4877448294057adb754e94a5c0c9aefae4b4a764ab0fc906cddeb4

Download Submit
C:\Users\Admin\AppData\Roaming\InsLogicCfg\InsTmpCfgData.dat

Filesize
425B

MD5
6a345b5e466e3a35e443f529f886e453

SHA1
b40c1b503952e3cc91aa68a0e35c3cf225bdff23

SHA256
511d204e59c5c97cabc0309c1647aeafad1a2cc9f54c02f4f1564a5743f4f591

SHA512
90b7c2ebc1d9739ed9c6f935526106c15556ceacef767d1c262c56e49b9c4496afc1cf4724dc2008e1788583387afc665dbc25672c9120f0340c3a18cd78ac45

Download Submit
C:\Users\Admin\Desktop\2345Pic\2345ImageThumb64.dll

Filesize
245KB

MD5
147dbe4cdbeaf50462ec87e018563ec3

SHA1
2fab36a3ee67c0a7264b5152ad2a81942bac9c07

SHA256
fb904e6f1817a4f94fb8e516965bf4b8889d55376c6829626ec32dd1f88b4e91

SHA512
845d4bf13fb08a97aa40f41fa9ac3e7ed2d845dab80951c068673ee83560eb481e96112cf3371fd45c646ebdadf6f42bc38cc38f6e7abf7a4b4dddd1cb26ea7b

Download Submit
C:\Users\Admin\Desktop\2345Pic\2345Pic.exe

Filesize
609KB

MD5
6a0529c91ece1ef948a4e474fc62a254

SHA1
652852638fa9e8432ac8bd3a7fbf0227d1a56e18

SHA256
9a72b5712f457775be2ac7830fecd6dc82497c04e7131071368e8d914ebd4373

SHA512
74f3dc48b21d15557701a65adb8343fbf6711f5fbd3974d803a8ed37eefe8c6299a347a627287546cbd7a7f4eb6bca6a50aff0bab7997cefb1c62f23caee7fe6

Download Submit
C:\Users\Admin\Desktop\2345Pic\2345PicHome.exe

Filesize
296KB

MD5
8db3b11b64d7610763887636e341fb04

SHA1
7873919cf2abbc2e77aa27f34cd7c71bc1318ace

SHA256
de89cc95c35a9836ac8d237828166c30a3e66d627e20b517678331ea01b7041f

SHA512
4f0c6242457fb8078cdb6b6eaa070c24427b6bf8092f7daed0b9c83147876244fbb8cea9d4f88aa03a80770b091f1fe2a4806486697811999d2f9f0d05f10424

Download Submit
C:\Users\Admin\Desktop\2345Pic\2345PicLoader.exe

Filesize
1.7MB

MD5
1e424f10843ff21ec32008b5c5388ef5

SHA1
5fb2e8947ca3d2636fd30412fe3d8a275eb98392

SHA256
52a42f9307866ce8610624c7e4847442d4f9cf59fdf708ecd71e4e947aeb51ad

SHA512
9b655cf9c2d38bd277875294601a8bf812f78a35b26afec17e1ff5cf233febf9ae31bfe4433563abbd69cc7a2eb72f6f0f8f7151aa0635b5c720ceec89194d4b

Download Submit
C:\Users\Admin\Desktop\2345Pic\2345PicTool.exe

Filesize
907KB

MD5
adb378428126566718696e6831358579

SHA1
a3d23136ba220b44d0251637d832a2e0369d70aa

SHA256
e963dbebc5658425d10fbccc1767ac5c9a740a41f1be64573bd7856e11d345eb

SHA512
43c3ad7f53484d007ef4a437a7cab428ca64570ad2d7285d4b9464e49c65d903a278434a94966c7b98f2b36933229f973773e50b5e8032d6926a1f6c934de206

Download Submit
C:\Users\Admin\Desktop\2345Pic\2345PicViewer.exe

Filesize
413KB

MD5
e2b99ff57697bb21e0e4591674b0812c

SHA1
e5f4b021ddd612752d370cc6ca473f9437276dcd

SHA256
8d7a4abff6ac374cc46d062e3f7334e5dc6dc53657762ffe7dc325df98683270

SHA512
55015fc0e9d1fb51b6c49b324858b9cbf9209e432d2906e84485fb65bec4dfe57cd49afa4fd41cdef1d41265e8cceaa4ee5dcacaf6fa07ae490db8f7bcf21f40

Download Submit
C:\Users\Admin\Desktop\2345Pic\Protect\config.ini

Filesize
119B

MD5
95590330b0e29f19f3a28937ff921bf6

SHA1
db8d61c89913feb523e403bb8501785ac50cee99

SHA256
45d028d077b394f340c68386ed78f8abb6072a6e0c7f27ef6cccf620ecff095a

SHA512
17763fcb6baeca4688331acbbd46f54ad178221bbf330e4dd8685818d728410d97e22e893c6e9814eeb807706711cc008f5b452a08c7db8f66aa470d4b7f8588

Download Submit
C:\Users\Admin\Desktop\2345Pic\Protect\libcurl_x86.dll

Filesize
2.1MB

MD5
fe4400f13cbfae5eabefe7a1f33a1c9c

SHA1
008aa9220c9aa44fa0c5690c1e9152630ef9a408

SHA256
4f4f1ab627b62d0865f653339894273bfe88ebb0c9648f176633e29f1d3e1659

SHA512
f245d05733c815b326cd3f6f60b46ae51d2fc487cc58980ab4dc79c171d28aeb71059d6d8cb5d2e6c411bb9437c95c07a8ee41b6b9c98bdc39abcbfd58d4cbbc

Download Submit
C:\Users\Admin\Desktop\2345Pic\icon\PNG.ico

Filesize
14KB

MD5
b0960194ea65b6043252245e5773d6da

SHA1
e202402c6f9d34d13c28aabdbe8b5faf246f60c3

SHA256
ed4ffd5e25094680eb4efb2946fce9a3fc23318d1067521989ed318d7b7e2425

SHA512
5709512f11673b205f328e7c51f94ab4941af778d6b3ed162812cc5d9209d19995de53963ad2f0b144aa63a4ad76cf643392d80d740ca37fcfdb3163d5e9568e

Download Submit
C:\Users\Admin\Desktop\2345Pic\protect\PicService.dll

Filesize
1022KB

MD5
1ec3fe29f044977c234c9f740929a518

SHA1
98d5096db29bc216820030f3fb14251b1d010e7a

SHA256
3deb75e937e85cc4ff3af8ff815f57aff75605ea9100f6f446968c6a65edfe87

SHA512
6ffbc455b0cc52e23e74d8d84d194368428ffd958c7c22dd13b87b7d23cd84b607f1f55b11e26498ce29eb7d0b30718ffcb790050b31e1cfd097dbad645199ee

Download Submit
C:\Users\Admin\Desktop\2345Pic\protect\PicService.exe

Filesize
205KB

MD5
8448c7d8b500d0d1d2d789a7f09187a8

SHA1
5d19d7a10c55a5d9ae6103edb7e0ae4c49f4b408

SHA256
bad54a8db63843caf80b51dcab92d6f52f0a48a0312ef2bfd81892ae67884ba3

SHA512
a026ebf1f5ed1964bd8b84439c6c86e289e0dab954969c02e7a4b813eb4d4f07f089992beb7e19ca8b64110da2a82d4596f478a61f9c271357188fffbb274d91

Download Submit
C:\Users\Admin\Desktop\2345Pic\protect\PicServiceManager.exe

Filesize
529KB

MD5
0a699ec44fd157d2b44b7f61daf70497

SHA1
cd4ca26b0f342064b5990628c9397ab177d2f3b2

SHA256
9caaf3e736b9424579fa40e5c06299b203270165718551bbb6a98100c71613ea

SHA512
c447e83a71ed6a735158f4a6dbd8355f9e0425fb8b9e1b1ed52f4e3e873f0c24566676e84673d27f773a360538ccbc7c4ce63c7aeeb6a8c9980616c3600a4723

Download Submit
C:\Users\Admin\Desktop\2345Pic\skins\png\system\close_hot.png

Filesize
267B

MD5
aa5f66a3257858aab5114aa46720aa64

SHA1
c4e7be37ca39e3f2621718afd1e262015fbfd5a1

SHA256
451737913ab6c9bdb8509d274bb3bc7ba4465331ea171e0c76c0d2a15d35fc83

SHA512
c24083c93ea63fe5e77656293480dea3b5ca021e891c4ee14c80ac972fa10c96d0acea8fa5525f3cb8bd755834c41b8e9cfc086cc2e7cafa14758dc72df29d89

Download Submit
C:\Users\Admin\Desktop\2345Pic\skins\png\system\[email protected]

Filesize
460B

MD5
26eaa09bb5cb971b0af4185721993e23

SHA1
5bbf17667e8e51a5478feddc9aa5f7650f6afe77

SHA256
18548dbab6c5c5b60ae7b38a38a3c7ec7d040ad206f46179f2c37f12ad144301

SHA512
41ca5ed066918666bc627fe854a70593bbfb6c572e255d05fe6b2a034e12a834778d9465b8b0e60ba3001635d733ace2934b94aa40784e74ad3d58e9ff4b74e9

Download Submit
C:\Users\Admin\Desktop\2345Pic\skins\png\system\[email protected]

Filesize
324B

MD5
a2c506a54f59f12b85e891cf0a69c5cc

SHA1
7a97d854d14f1df8221d7f3f0a68f5a33d18da9b

SHA256
3943030efa978a53e99e322cc6762328b0c261bc398264eaa62a030656fc35f8

SHA512
ffbf6b8edf90307053a65b6120ec573cc3c2a73cc91b753d4a679b422995bddb3f469a4cd109f317c39a367ae2775d6d09c45a26cd5c9141943ff56d46813b35

Download Submit
C:\Users\Admin\Desktop\2345Pic\skins\png\system\close_pushed.png

Filesize
267B

MD5
c3fc388faf52a99b63f0952af83a642b

SHA1
65d5d8fcf0b4cc3a27eff91717df27596595f8e0

SHA256
6e6c425c1b79326119f034e274922eb59798c302eb576097d3eb98a4ea94a01b

SHA512
abb1496c6a01e1813ae85f701933dc0693356d297cb9e470bc39fc8cbc23c2b2d17f9c1fa596bd79798464c3ce4e1efad013172fb5a52106e12ec8e873febd38

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jnSNQNClfnFm.exe.log

Filesize
1KB

MD5
8005734c5c8a27f0225756ad8ab852df

SHA1
5a611231e25aa2a4dec287c01750da7fa743e981

SHA256
c7fe4d0b82bec7d44e817c76123b381269d494e2ff4a7f539ad53eb3ef5c4371

SHA512
d2c653d0c22503817c9176f93c5e330c9c0d4a244d2e254f9bc895955ef8630e5fd83b5c22459dee5f18a3e1e016a638918087106e54b2fd169b435030d7c60b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
a99b101177cefee43a28ec51c361804a

SHA1
01a67040197faa0c77361ac5043798d27b8dce95

SHA256
962f7c6b3ba4302995a9c3c288d71a43d61086806007e1602cbeb4c1077c4c8e

SHA512
3a66cc37646eaf9a8a1c4ce97f0852950b8120baaf022642634fc271822a27e617d35c11b91c2880b7932a990e67b7770012e8d647d276d9338d6ad28ba8b412

Download Submit
\??\Volume{78425248-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{97c3bd6b-5b01-48ad-91ed-4c2034ac2d67}_OnDiskSnapshotProp

Filesize
6KB

MD5
3826b504e335150457aacce5cc4075d1

SHA1
ff5c813a917cbbd890017bcef37995b8b4211f10

SHA256
b60422533460bd727f413adccb0601fcd6040400e422b8cdd29d53b8c531c87c

SHA512
754ca8a5ff09a900d405f41348fb34b37040ed463bd6e1bbf88d2854739707eea5919653723fe1843be80da8f6fe9e6a46665d93792baed6f18c4bbaf2f24021

Download Submit
memory/1856-40-0x000000002A540000-0x000000002A56F000-memory.dmp

Filesize
188KB

Download
memory/2768-81-0x00000000006F0000-0x00000000007C6000-memory.dmp

Filesize
856KB

Download
memory/2928-6705-0x0000000071280000-0x00000000718E5000-memory.dmp

Filesize
6.4MB

Download
memory/2928-6663-0x0000000071280000-0x00000000718E5000-memory.dmp

Filesize
6.4MB

Download
memory/2928-6675-0x0000000071280000-0x00000000718E5000-memory.dmp

Filesize
6.4MB

Download
memory/2928-6685-0x0000000071280000-0x00000000718E5000-memory.dmp

Filesize
6.4MB

Download
memory/2928-6712-0x0000000071280000-0x00000000718E5000-memory.dmp

Filesize
6.4MB

Download
memory/4276-21-0x00000208071C0000-0x00000208071E2000-memory.dmp

Filesize
136KB

Download
memory/4616-114-0x000000002BFC0000-0x000000002C17D000-memory.dmp

Filesize
1.7MB

Download
memory/4616-112-0x000000002BFC0000-0x000000002C17D000-memory.dmp

Filesize
1.7MB

Download
memory/4616-109-0x000000002A3C0000-0x000000002A40D000-memory.dmp

Filesize
308KB

Download
memory/4616-110-0x000000002BFC0000-0x000000002C17D000-memory.dmp

Filesize
1.7MB

Download
memory/4616-113-0x000000002BFC0000-0x000000002C17D000-memory.dmp

Filesize
1.7MB

Download