7a670e163d640b5fa60ef6709270ff1e08325e63a5c33a87e40228aa3d0089f5

Analysis

max time kernel
44s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RegCureProSetup.exe
Size 7.2MB
Sample260629-pgsgrsc14x
SHA256 7a670e163d640b5fa60ef6709270ff1e08325e63a5c33a87e40228aa3d0089f5
MD5 97c0bfaa3f7612057779f3cea32660fe
SHA1 39159359b73530fe48995f2b34f550518d20fb55
SHA512 83fd860c5da4ccce3bce309100ccd08c1fd75606f225a5f09355fe33084e4709e5af3e07e69e9142d989efbb2c4e2b9bbb884a63c8486c98929bec2aaa704573
SSDEEP 196608:AmoqECBPeZi5O6GvhBmSQg9mIrmTLMEgKJPeR:5dJeZ3VJgDIKToEgPR
TLSH
T12B76338427BF0545FFB187F86A138345AA75A1724BEB83069548BFF7BC9E3910A83513
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c00000001c67f-92.dat	acprotect

Executes dropped EXE 7 IoCs

pid	Process
2200	RegCurePro.exe
4120	Pareto_Update3.exe
1860	RegCurePro.exe
2656	RegCurePro.exe
6180	RegCurePro.exe
3688	RegCurePro.exe
1680	Splash.exe

Loads dropped DLL 53 IoCs

pid	Process
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
2200	RegCurePro.exe
2200	RegCurePro.exe
2200	RegCurePro.exe
2200	RegCurePro.exe
1860	RegCurePro.exe
1860	RegCurePro.exe
1860	RegCurePro.exe
1860	RegCurePro.exe
2656	RegCurePro.exe
2656	RegCurePro.exe
2656	RegCurePro.exe
2656	RegCurePro.exe
6180	RegCurePro.exe
6180	RegCurePro.exe
6180	RegCurePro.exe
6180	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c67f-92.dat	upx
behavioral2/memory/6048-96-0x0000000006660000-0x000000000667D000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\buttons\start_over.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\priv_fs.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\drivers\power.png	RegCureProSetup.exe
File opened for modification	C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Buttons\start.png	RegCureProSetup.exe
File opened for modification	C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Scan\damage6.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\UNS.xml	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Frame\top_logo.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\011.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\buttons\button_file.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\animation\09.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\dup_doc.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\priv_multi.png	RegCureProSetup.exe
File opened for modification	C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Frame\renew.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\LiteUnzip.dll	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\rating_mh_scan.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\animation\01.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\priv_email.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\headers\header_settings.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\privacy.db	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\MyResources.dll	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\error_large.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\buttons\register_over.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\defrag\c_unknown.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\driver_animation\ani_21.png	RegCureProSetup.exe
File opened for modification	C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Buttons\register.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\html\2_days.htm	RegCureProSetup.exe
File created	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe	RegCureProSetup.exe
File created	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Images\close_mo.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\html\images\10x10tile.gif	RegCureProSetup.exe
File created	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Images\progress_glow.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\License_Time.rdat	RegCurePro.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegHookSpecialist.pxt	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Frame\register_over.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Icons\cleaned.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\rating_h.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\driver_animation\ani_15.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\buttons\button_ignore.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\priv_browser.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\recommendations\rec_system16.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\recommendations\rec_system32.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\html\images\error_internet.jpg	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Utility.pxt	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Frame\min.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\rating_m.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\headers\header_tools.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\headers\settings_registry.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\recommendations\rec_unknown16.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\Fix_over.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\driver_animation\ani_5.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\ig_proc.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\recommendations\rec_userapp32.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\error.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\defrag\c_frag.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\priv_office.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\headers\header_restore.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\drivers\outdated.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\recommendations\rec_system24.png	RegCureProSetup.exe
File opened for modification	C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Frame\register_over.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Images\topbar_gradient.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\group\startup.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\list\drivers\disk.png	RegCureProSetup.exe
File opened for modification	C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Scan\rating_m.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Images\min_md.png	RegCureProSetup.exe
File created	C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\Scan\animation\05.png	RegCureProSetup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job	Pareto_Update3.exe
File created	C:\Windows\Tasks\RegCure Pro Startup.job	RegCurePro.exe
File created	C:\Windows\Tasks\ParetoLogic Registration3.job	RegCurePro.exe
File opened for modification	C:\Windows\Tasks\ParetoLogic Registration3.job	RegCurePro.exe
File opened for modification	C:\Windows\Tasks\RegCure Pro.job	RegCurePro.exe
File opened for modification	C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job	Pareto_Update3.exe
File opened for modification	C:\Windows\Tasks\RegCure Pro Startup.job	RegCurePro.exe
File created	C:\Windows\Tasks\RegCure Pro.job	RegCurePro.exe
File created	C:\Windows\Tasks\ParetoLogic Update Version3.job	Pareto_Update3.exe
File opened for modification	C:\Windows\Tasks\ParetoLogic Update Version3.job	Pareto_Update3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pareto_Update3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCurePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCurePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Splash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCureProSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCurePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCurePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCurePro.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegCurePro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegCurePro.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	RegCurePro.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RegCurePro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RegCurePro.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Control Panel\Colors	RegCurePro.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uus3url-pl	RegCureProSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uus3url-pl\URL Protocol	RegCureProSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uus3url-pl\shell\open\command	RegCureProSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	RegCurePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	RegCurePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uus3url-pl\shell	RegCureProSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\uus3url-pl\shell\open	RegCureProSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\uus3url-pl\shell\open\command\ = "\"C:\\Program Files (x86)\\Common Files\\ParetoLogic\\UUS3\\Pareto_Update3.exe\" %1"	RegCureProSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	RegCurePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	RegCurePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	RegCurePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	RegCurePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RegCurePro.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe
6048	RegCureProSetup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	RegCurePro.exe
Token: SeShutdownPrivilege	3688	RegCurePro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3688	RegCurePro.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3688	RegCurePro.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2200	RegCurePro.exe
4120	Pareto_Update3.exe
1860	RegCurePro.exe
2656	RegCurePro.exe
6180	RegCurePro.exe
3688	RegCurePro.exe
1680	Splash.exe
1680	Splash.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe
3688	RegCurePro.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 2200	6048	RegCureProSetup.exe	92
PID 6048 wrote to memory of 4120	6048	RegCureProSetup.exe	93
PID 6048 wrote to memory of 1860	6048	RegCureProSetup.exe	94
PID 6048 wrote to memory of 2656	6048	RegCureProSetup.exe	95
PID 6048 wrote to memory of 6180	6048	RegCureProSetup.exe	97
PID 6048 wrote to memory of 3688	6048	RegCureProSetup.exe	99
PID 3688 wrote to memory of 1680	3688	RegCurePro.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\RegCureProSetup.exe
"C:\Users\Admin\AppData\Local\Temp\RegCureProSetup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
  "C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe" -addtask
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2200
- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
  "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe" -AddTask
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4120
- C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
  "C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe" -launchonlogon
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1860
- C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
  "C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe" -install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2656
- C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
  "C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe" -report
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6180
- C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
  "C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe" -scan
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Program Files (x86)\ParetoLogic\RegCure Pro\Splash.exe
    "C:\Program Files (x86)\ParetoLogic\RegCure Pro\Splash.exe" /Time:5000 /Image:Images\splash.bmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D8
1⤵
PID:6156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pareto_Update3.exe

Path C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
Size 1.9MB
SHA256 5a6f0e2fd369c09b22d29d7e6cacf247d7696a0ea3b78b88d58f5898457c3d70
MD5 ebf9ebe8ed0cafdbfbb422bb2eac33a0
SHA1 a65dacede17b6c9855a91ab159a821a1ee91bcde
SHA512 bcc6c6d033a250c3280e746c0c2a0747dc24ae5f1ced8d37bba06a31b7a6745fa82817b7a466d5a3ea3c2d5bf1ac52d23f8a56d469128f21f0e3efd11099e898
SSDEEP 49152:sYTDBxsF2Lci2he3z3/ucVlbDYXJEH7iHbT5Sc7Fxsdt7+B0XE+ehEcP7DK:bz7Lci2hez/LlbMXJEH7iHbTSdIB0XEK
TLSH
T123958D3136E18076C772363086DDA7B9A6B9AA705B74428B25A02F3D2E704D3953C77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.xml

Path C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\settings.xml
Size 1KB
SHA256 f2cfbc6b9aecd94141c18b4bb1ed188cf1e390a3909e3d88416577921eaaacb1
MD5 687cd6f46c1c1abbcbd1139001babf51
SHA1 b6b78947f27926d0fbf5548140452cab9b017d1b
SHA512 b77de87148b9811db93e4346bddf50d7842bbd078d654c477bf34c0f211d14f57c29c9ea55eca42053d6bb825fc8c1aa81950224d3b1f3c9d7cf3e3d2883e3ee
TLSH
T160316E1737F86209B577BA8D8FFDD1E98735B4E286A5D65F0071120BC2E2C1648A233B
MD5 SHA1 SHA512 TLSH

Submit Download

7ZipDLL.dll

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\7ZipDLL.dll
Size 541KB
SHA256 56c8ce7d1130a47db66b6371d8a73842cbae7b4f23c2531efaa18b513749cf4c
MD5 d619f1d4576dfb1c098ad75d39e803f8
SHA1 bbc31087a48c9044f69e94b0ad6ae4e9f66d1d82
SHA512 9350fc67b05a66231693b1574432df7cef7df4c203cce94a9b85f73708ab1ea8cfc8e5e4caf2ce75b3c2d0e3217fa731dd08e0da1676cdeeee7ff9e765932f31
SSDEEP 6144:PxZKMZcL5HryEO+VpnvvdEBptqi5Bn7LNOLkmVKapZG9OOhX8xmyEtrVUjSSdQbZ:pUxdHl3dm37LNO7VVpU4+WYtrVUjqbIU
TLSH
T10BC44A3367E2D176D15F1230EA06F3E914AAE3768420954B7ED80F2E2FF06E5D509E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash.bmp

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\Images\splash.bmp
Size 410KB
SHA256 4edf0bab5323fe66ccddb33d084e13506a53fc21e1151ac069d1f9b4b7b798d9
MD5 959c1d8648a28875f6da0ff99fb9de4d
SHA1 012994fb05ac3671008808aae23f008c1e9a3a0c
SHA512 f9f534e4d39e530868be134b2aa80f221b904a7e93baf6a4f68da8d8a802bf4d94a67dfed8469d0fecff75cb6b426e0b0eec82552659d6cd6171e5f85f9f4ac3
SSDEEP 3072:+tjSmSS5QBSS9SJ+rUSspFn5t4fQygDURlqSzO49xAB5/P5DSEJgWJBDT+NBY55w:FwyUPUubB3IakF14MtLEX2
TLSH
T12694A675DD542A47A28171F228B73CE9640AA1E054538B9FBD0328185FEEF7AC7207DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiteZip.dll

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\LiteZip.dll
Size 44KB
SHA256 cf1f238449738ec2da2a93e23b1b30f6449639ddc7d283cfcbe36c103b947cc0
MD5 96488b5b095566a69e4159552af83c22
SHA1 15ea99c76e5ef12911db5e9c0781d6a8df5446a1
SHA512 41b8bd0ec95d784358b4614e19af1ee7254dce8c6ae8bf6cd0f2e561995f48153629c90f183b37d1e4ba0ae15140142cff9e23312654053a945f487f57373727
SSDEEP 768:qy41BN8y3eMQ7kaXYeluJGa2vhZUBgAf9rY1Ve8R0jr5J2uwof7:qy4vqWThel+Gh63f2Ve1RjD
TLSH
T135236C43AB9981B3D4D68B3804EB2B33AC376A9257F989C7C385187D5D627D0B13835E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MyResources.dll

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\MyResources.dll
Size 492KB
SHA256 00d24b7d2a05ae0038f8378ae90f503914e6389251d7309520d1d027465f24ee
MD5 927b0a5a7cad78eba75c433b8ddae0c2
SHA1 6e59c9891ca3f8481b885bcda4b62cd9e157d783
SHA512 0898f5e72c581b297b7aafea8ef33327410648e14c7de16a75f6dd2efa3cc7cd124b5bec9eac931c4f043e7698b590af0bced2c03bc62f6a7a78221a05506f68
SSDEEP 12288:7XFLM8Gh2/liKmhVRlZKmhVRlmKIBbscZOG:9MEiROl2zG
TLSH
T182B47B42A3F94528F2FB3F356D764A640A36BC86AD35C24E1650688FADB5B42DD30732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RB.rdat

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\RB.rdat
Size 48B
SHA256 967a130dd206f6008f77a7f0fbec1b9350fcd0de90342dbe5c4ae76f63ed04a6
MD5 5ee61af78ef3cf7de7812c8edce0a9d8
SHA1 b97cc11f0ecad6f148e8985fd4f1af8fc98ee519
SHA512 5725ff72ad3565851204d8166a70908a4fa47b38d66eaacc94b27c58f321a3423d37a84c3e16c776d49122ee30fc866606d5bee7c3f928b7728d36549051490b
MD5 SHA1 SHA512

Submit Download

RegCurePro.exe

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe
Size 4.5MB
SHA256 3b15089bce8ca976491c3e6cec4417cded1e7abc6072242deade7aabb2e2ba00
MD5 4b2d6c65f9085cd0e4c91ac75556fb98
SHA1 8faf4f05b1cda2c16983f1234e3e8ee998aa541d
SHA512 bb1dc03a2a968b14ab6b5f27c12c1b452bde8bfb5ca3e9344ec3cd288d3c844d6376429581f9304dcc9688de9882588a361b2c59c668d0314c6a340665e16476
SSDEEP 98304:/cjUgm1RhSLpn5+50A7b0q3nnG/bdwUXyUIetuP4/Co9GBofkSszEb:/cwgeSFQDGl0jw/Co9GBCkU
TLSH
T1E426BE217B85C179D262153B91AAB37E626DF7311B3591C366A00E3CAD310D3BA3D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Splash.exe

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\Splash.exe
Size 3.4MB
SHA256 c92559b6011054a0282eeb3fec4c4cafdc7c88c598c4ecfc773abbe61111ac57
MD5 4ac5b2a53802d0675e2565fb78e2708d
SHA1 5d9e7665e12695eda8bf7492c33fa8b5893d3480
SHA512 5a079a9d2ebf7fcf7f29a4041757e5de2153f09b50779a610331b44ccb0307aa16084db34e26ca58977ea6c609e5f2352ba08a0eee2b08dde9d91c3d125d834b
SSDEEP 98304:0AGvo/ouZen8eaZLRLWLZPq2IvKu9e4OiZrq1DfPHNADtV6v+4E2:BouYnISi2IvKus4O7NADtV6v+U
TLSH
T17DF5C032FD9D5429D4630232CEDDB37866BFBDB47A39121721903A2EBA717834929533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

colors.xml

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\colors.xml
Size 3KB
SHA256 e8c56d1fdfd9c7bdbe870123828b84c0f80100a3fa63ee4ff674c1ad1fcb7569
MD5 1d9a6f4abc0981d10b5b1b93a5f98efe
SHA1 7c3504b2d32208d08a152e43cdc23a14dc934316
SHA512 5dc1e35bd130941866217dfcad4082518565ad6849adfac431ec2b03b6fb1ee5a9386155946edff788f4198855a56a494202c0a5d97698799e81b41d42c17677
TLSH
T18361E921F2CD727B9B2683C38B31D16A662FECE4E2117D5664BBC47BBB870501FA5250
MD5 SHA1 SHA512 TLSH

Submit Download

tab_bg.png

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Frame\tab_bg.png
Size 4KB
SHA256 0d2bba386679ec88978ba477d889ec27178f878943b6865d5058a15243c8a212
MD5 cd1d0f6b87f41033caf2c6e710196ff3
SHA1 2196b0e987f69169231266d201b84130e06bca62
SHA512 fc49d99ac64c43ca05ad0395c274513b733f20186e65a392522dd9184f842b146515501a5a1b380f930380a498191e138e675c8a2d65b98b5912b0a75b2d2191
SSDEEP 96:1SDZ/I09Da01l+gmkyTt6Hk8nTtLPDm6D/5dzGlOVT5LpWN8:1SDS0tKg9E05TpDJT7zoqT5LpWm
TLSH
T1DE917E5AC534184F685E71A309CD5181F35A226DAA323674D2C516EE80D7D06BFAD4B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

title_bar.png

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\images\Frame\title_bar.png
Size 66KB
SHA256 26b8c52a90cfe8ee74712d230e18a7bebcb646cf6d1553f15587da664e5a6f7d
MD5 1e87116195255d62ee708060cf921249
SHA1 ccee72f142b25d38c83a13ede30dbd85da1eb958
SHA512 fd47f3f22ba9dca3ff5ac9c6948ab6ccf0a29d2a55373bde2d61a7138b75990fb6bf677222e551cf892e4b74f68860b7c0ad1de4519395d7db2aa96e4d856ee5
SSDEEP 1536:JPPrdE9RDQOryEZikesN14XTHzw8EkqWnwM3QANRNnt:hPrS9RsMXZiQ4X9EAd/RNt
TLSH
T1B96302A8A9C01705DC5B01F13EE49434D757A0FFE55C06927ADED0760B82A8DFD2B29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.xml

Path C:\Program Files (x86)\ParetoLogic\RegCure Pro\settings.xml
Size 769B
SHA256 970e5ce65bc2f57e31bc75fdbe4e12c012671730e13c8cc11fff5c9de02cdd25
MD5 081abecee1af3a6ff841377fadace879
SHA1 d3e83859248b12b3357929634794828551ffda75
SHA512 285cdd9d9182a1673675acb36e234c17b765cab3d308b4be8ddcb138104d65117ec1bd4ae5041aba928db61362774d8c2e20d91800fef9a7c97612fe9df17944
TLSH
T1A001BDAEF038A4B1E6276CE1DFB3772620158D6448B98150CE16B97798F14B873F4D98
MD5 SHA1 SHA512 TLSH

Submit Download

License_Time.rdat

Path C:\ProgramData\ParetoLogic\RegCure Pro\License_Time.rdat
Size 48B
SHA256 780b29c5efd743494515810206f46a80ee2bf371fffa462d707be97710294fa2
MD5 58eecd332b68bb36df1e8b1384a5ccfe
SHA1 f9b91460b631958e1ae1fe13524602f19a2450c7
SHA512 796c9b0bdeded929567f125bf295b4448e07634afb74ff44e93372c389b1518c2901204344f4b2bd7a7610c439b61094c33553b94b9bbefff6349b0a743d4ded
MD5 SHA1 SHA512

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 a096e0c406ea71f2de35e952a055a9d82f08d5591e1acfe32b1882b1fe7cbe72
MD5 d06a6215d25587171ddcdfdd892175d9
SHA1 7d16221e21ca301a37bcf386eb8d04b49e50c64f
SHA512 50677fad75a54d6cc9896b38ffe48f63e7a79f7e04bcf34ed3d8ad9624a456e9f79a0b3a600153c839c95a9521519485a1f48ff196073f365bf7ddca3c0b46c8
SSDEEP 96:tK+clE4m/Gn6Fk37KJPn23b1XRS2/QAycPrCsFEr7Og+4K7FE:tK+clEHokkLk/i5seTTCsFS7xAFE
TLSH
T163D28656F444EA06DD0A2C36EFEAD5EC23313E26CD9A032375C2B77F48B70C08928589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdvSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\AdvSplash.dll
Size 5KB
SHA256 0990902460ec38bcd605b518bffa081942c6f4c5fe1828a61ba3965bbf15d8bd
MD5 41be2441ee7c684eaa76a62d4223b4c7
SHA1 05de8220e296db1025f7bd4d9de1f44370018162
SHA512 fec074a2196141e497334b57563dc7863a0b949d348164aec8c4f21d1b3c4ed795e03fd6e5726a2e90da7015abfbb4e28102647c0e343e84a707e99271a1a938
SSDEEP 48:i/UYdq4ThVJttIETQ1lk+MfSvZcLLefNDpXq65wtBpuRNanZNA6zu6cv9n1MFM0C:qvTFfSc+0OeLLefNDE6OuXaZq6VG6MJ
TLSH
T146C1C43BB6C0A2B2E16F02B13C26334383E05571236291354D77ADDC6AE6EA6DD58783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GraphicalInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\GraphicalInstaller.dll
Size 38KB
SHA256 7a72a7a6c28b9127d38cbdf14672ed1feaec86b72c83c0302cbcdbd03341da91
MD5 5691d9412413d3cff6c19f9e4c07e0f3
SHA1 6679230811fe3ba8fdf145e9a93babff66de8e70
SHA512 28c44a956a6951ce11fd03dac7f9b1eccde24720c385077315547d6b36e6df55fe5d19175f53a6e44068c6688400a52be10c720c1e4db47d57e75a6c8925b80e
SSDEEP 768:FsHjNDKSDTlZMXAy4IIZmr+FLtYCsKQPvatRNPjZjrQQEHZ2U7ReFH7:FiD1nlZMXJ49S+FJaKQPC7N9vQ1Zl7w7
TLSH
T16303F14C3164287EFDF2077CAFA8C7A36854EC28361A536D3387580F1E7964A16247F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\KillProcDLL.dll
Size 36KB
SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
MD5 1cc87d2b5a79b18f133b4f944e2f2f74
SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
TLSH
T1DFF26C507C8144F7C28E4235A5A9AB179FBF692036E55983CF269EDA1C311F0E93B307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Math.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\Math.dll
Size 153KB
SHA256 4e540d1d8ca1c7564753232d18a884b0597fd7e5df88f8b5d370824d858954b7
MD5 7fc4a4937d364d42d4d06ff3554a464d
SHA1 ad7ddfa47d0abfa0f3e9546db4d6fd6d40a39b41
SHA512 da80c681fac9497d2002ceec33fee63f3d6ed0ef4a62213405f87343e3723b27ab0f51c98cf6f588a48d9edf10e68bbbe8856657e630bd6a15252ad96ede2da7
SSDEEP 3072:2REe7Z38wWD1faAg0Fugz//BNABN6X195j8e3:NwZMweZaAOg75yw+o
TLSH
T19FE39E25B4A3C4B3C5BA00B40465EF991F7B543503B988773FF81A6E4EB47E09AA3256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkinnedControls.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\SkinnedControls.dll
Size 77KB
SHA256 5f7998711ea856730139c4dac403f11b947ed94a464dc6d2d4b22f928c3a8536
MD5 364bb3c9218429dd1315ad1db47e152d
SHA1 3253c1a381161c268bce8c487e892c8e5dd29dc3
SHA512 d9084068a259acb9a1691d10da8610053d3abdf6dc78d7357d80d1ac794d940478d2b05c3050484680ddee4c832ae30d71a67b2c2978845e298aca48058e01f6
SSDEEP 768:Q0p2dJFs6nYFg0vxrF9jd+IpMCGC8BnmmfJmLVp1aB5tEEThyX7QirbTGgyhTFDK:Q0YsX7vxGjBvJgVTadaXBTeh55axv
TLSH
T188737D417288C9FADCDE083A0C2AEF2595BE591247D2C5C33B5E6D56BE323CD9674382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\UserInfo.dll
Size 4KB
SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
MD5 d16e06c5de8fb8213a0464568ed9852f
SHA1 d063690dc0d2c824f714acb5c4bcede3aa193f03
SHA512 60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a
TLSH
T10281577B23F44473D09A4BBB01E60CD752A2D9309316442F498B4D6E14C1AA7FD6EB17
MD5 SHA1 SHA512 TLSH

Submit Download

background.ole

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\background.ole
Size 1003KB
SHA256 0e5aa56dd09707789400982b8085e38e79ae1714619be5fe692e6485aaed2753
MD5 e8d6edb75d9183af2eb076d8a203d8b8
SHA1 f83970613da628bf09920a07b72341f96cb50585
SHA512 6fe8ec6e09da9ec4fa6da61fd7782c77da9c29c8b388777b45d5d897779f29247ee1f6b94451c5d90d42320d2afbd762bded8c64801d8c25ad7c263515a4ff41
SSDEEP 6144:jWo1b58ubQse4ST1a/MwtZDBldta57Q0HYN3x/3:vULaEwvDBhW73Y5F3
TLSH
T19625D758DB9FA4C1ECEA2EB6F4B02DCA01226EB3EE5C4A3D4D0E700236B175D15D99C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background_small.ole

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\background_small.ole
Size 400KB
SHA256 2af245e206d5ad274310833657c8d9ca2def5d8f81092fd1be1b09005f5ef4e4
MD5 1a5dbc7eaa413338b23748f72fc813e5
SHA1 496ec508bb8ed3c8f890627cd271a291894224c9
SHA512 c217574ca9dd6249dc9458b0d489f65fd2c04ef524a19db7296d74f1d836a5082bf0776faac378caf808d5c87e05220290cef029bbe4162b1eb7b00125c71750
SSDEEP 768:ufio1rWePlwXrlHvlYjDRsBG+r7rIsUf469Q+qsVEjBjq4nPQQ75KzSgbpzUDdOh:K
TLSH
T17D9470F5E161F2CE28196594E66424F4125B1CADF837C73BAC0AFD65B8BF642B076E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv609B.tmp\nsDialogs.dll
Size 9KB
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
TLSH
T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegCure Pro Startup.job

Path C:\Windows\Tasks\RegCure Pro Startup.job
Size 478B
SHA256 b16078f1302eae4272f9eec3aa21fb0ae2a59a5da91390dee0fee5121452430a
MD5 e4d19459cb94a0f70eeb300ab648dc18
SHA1 d35bf752b50d8870ccdebe09807ab0714d34570a
SHA512 7f39f05966d44d0d7212ad53d3333abe0c32219a2968a2ec4411b93e52ec2443b0c740d60859b45c71b626d2b20c5fbd0a2f0575381fe212f5674a02e607576b
TLSH
T1CDF0ED01AFF9451CFBF2A9B152F28A695273F872A732CA9F545001450C73B058925B5A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro Startup.job

Path C:\Windows\Tasks\RegCure Pro Startup.job
Size 478B
SHA256 50ef5cf48b92ecbedf498990f5c8a8c4db83ce1c9587ab8ef4d97e2987d82c20
MD5 c271ed142a4ed856d5d32bc9a136de67
SHA1 50c4d56c3767826ce27849bd39b366669ce2b640
SHA512 c5e7501ee29b483e38f338d7d4408391e6caec71d14d0289ce6b3293bbf4a5e89d7e9c6e4cc35eff5ceda6b705db3d7f162efbc831e34e71bff3886877459e72
TLSH
T150F0ED05ABF9461CF7F2AAB152F18A655277F872A732869F445005890C73A018925B5B
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro Startup.job

Path C:\Windows\Tasks\RegCure Pro Startup.job
Size 478B
SHA256 3cf519a61b97c2756463c2415bd977c560fbcf7dd9eebd52132e985357e45108
MD5 b80e5124b3b51db063c1aa24a0bab10e
SHA1 aa9a7c654e92baeddcfde5e05208b9ca37261d88
SHA512 977d268efb3f907f336247abc410de95e258c00304abe331f4ab401ff40546789066db9b2517dad30c9116edb4e127ea966461a1db9726aaff71900cf8f0c334
TLSH
T1E2F0ED01AFF9451CFBF2E9B142F58A6952B3F872A7318A9F445402450C73B058929B4A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro Startup.job

Path C:\Windows\Tasks\RegCure Pro Startup.job
Size 478B
SHA256 438328cb829beaa315871948fb5a5d5a558eebbf2618f81f6b9b4d247f8b1c01
MD5 4499ffe63a46cf3c82d68ca9986a4b71
SHA1 2f56ee9e0b8cd2609edcfeae5ff748b0c43d319e
SHA512 ffe7140a76af17cd952e8d58e7066e7b4ce2b9455bbe36408ec185a7d564531efed548bb983d5d4463a16c69ef2db2727c9e51d91af831440e928791908bfe7d
TLSH
T1B1F0ED01ABF9451CF7F2A9B186F18A655673F872A732C69F455005890C73B018919B5A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro Startup.job

Path C:\Windows\Tasks\RegCure Pro Startup.job
Size 478B
SHA256 37212d6a3df4d310ef99560c1873a596d13a79dc9e6e3025f85b5a9ceac0676c
MD5 3bf7d9ec068d42502de19a841cdfb6c9
SHA1 05115556125ce88d0ee0fe24de172f2f32fe5090
SHA512 a9685ee6011445d2842b36c4b8207113458a74ed4c48ed5b8577316e99e1883e869affed6712d2502ca88202de091028423b2d95c6c926e4bbceec2b59216f78
TLSH
T1F2F0ED01AFF9451CF7F2A9B142F58B695273F872A7328A9F445006850C73A01C925B4A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro.job

Path C:\Windows\Tasks\RegCure Pro.job
Size 428B
SHA256 c84cd61b6fec950d77463a8383bcbedbca771cbaf1d82c2b391746adcf02f67d
MD5 6ebcebf414725184b8983d5c11416e4e
SHA1 447e51e6e177b781a653d8716722264a049eaef8
SHA512 e2ff500b6f318bb1caf1206431066e75d4805f692877f7a5260ca0797799f07859a1443bb4fc6dafd99e3952d01b60a5f2d2d9658378cfcd0b674e66c46d642b
TLSH
T171E04F01ABF9450CFBF3A57142F28B666273FD3257318A5F896006451C73B11CA1979B
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_10F028CB-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_10F028CB-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 0ab7556fccfdade7f9c6f4cb6e1f55442edc207bed56a13fff8b55f4a35ee895
MD5 932393cde15c371cec4a59b8f24424f1
SHA1 5c5e40bfb7d365f7d24d154d52a4f21e121bdb79
SHA512 130f61d461283348b82b2c381e9ba683f4f85913b3b09ff73cdbcd0ee9b983219360620c29352fd6a751ae0851ca1c0cc770239ce7307fa7d22472202955cd45
TLSH
T19EE08C02ABF9040CFBF3A97043F1873662B7F87267318A5F846502844C73A158A58B8A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_10F028CC-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_10F028CC-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 81f54ab9c0f3af8b93ece553ee3f93d8730c949e2514c88b280ae8da89be10a4
MD5 1c42eb41951f34c025b850562df541b7
SHA1 cc101836dcfc5434f50ec457941f01393f28c76f
SHA512 fc87823cf8b3867d62eef88c52e112a401b334f2d926310ffb3efc48b2c6f99d1afa3a3e8154879f4e06c20ff0b78b569c8d98da567106576aa955f8fb65ea4a
TLSH
T1C8E08602AFF5041CFBF3A57083F147265277F9725731479E842402490CB3E018958797
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_19390AA6-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_19390AA6-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 5b1e418bc092673a0c7e8f74cb1e27d4c1c9e92b38519207c6835380788aa68c
MD5 8f7e574dd5ae50f9121be42a59ad1bc2
SHA1 78089509d0108d0edd6d82414ed0e70336b11cc6
SHA512 2a7781acb74300338073eeaab5badf4d278ada46aae3546794be5615e4a01e20a0a93d6bc041d89c2d1c02ceaab09fda79aa1b6c6037f369e2a66853d4e0cbd9
TLSH
T158E08C02ABF9080CFBF3E9B543F58B265277F872A331865F842402544C73A118E1879B
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_19390AA7-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_19390AA7-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 c9f7fae7885d7455bfb2a3ee84c0ce7c0439301441901117917d4527399ed8e7
MD5 159dac5565fe137c8c83e45f38ac4bd6
SHA1 ce568362e35f43d99558ccc91b41d9abf6624412
SHA512 b5ea2406d67212112980b6316e71a3339c6b5563382ab881a142cc28270f0d3487fc493954cc5519760451f608057405682f776d6f293a6f151b27eca7a89a79
TLSH
T1EFE08602ABF5450CFBF3A57083F547766277F8725731465E841402540C73E15CD1878A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_215F7821-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_215F7821-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 1984dc5143bfd68dd7b5869eebd939554f9af6e2af4c16f8131955f683ff742f
MD5 78744efbe19156ab0d09f4f23746b964
SHA1 8faeeef8e65502b7b4014f6a8e87b0e1a1b4f727
SHA512 5293180f641dfb978a627d701969d6d5a932126b46f69cf1f1259504f822aa5b25742490af0e9839636b3a6cf4682d7cc07b4e1830700f60625d9516ac51e449
TLSH
T19FE08C02AFF9441CFBF3A97043F687665277F83267318A5E882502550CB3E018A1978B
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_215F7822-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_215F7822-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 5d991689ed550d17e2ff64a37595c93dd5476d31f24bc5943b639386a561aca9
MD5 763d58d580ee470d3d8f34b510c344b2
SHA1 1289e09b01ee51671a2f14b41cffaf963154cabf
SHA512 6147ceddaceaf0b442d8c2df6c144313e991207d6739624b3a32f743cdeb8b0421f9abedc7998b5907a7511a0fa7b8baf9ce5837c1cd52ef7be06e9483c586f4
TLSH
T18FE08601ABF5041CFBF3A97043F147265277F83257318B5E845402454C73E01CD1578A
MD5 SHA1 SHA512 TLSH

Submit Download

RegCure Pro_sch_29781D1C-73B5-11F1-ABB2-4E96A7495953.job

Path C:\Windows\Tasks\RegCure Pro_sch_29781D1C-73B5-11F1-ABB2-4E96A7495953.job
Size 404B
SHA256 642a983f0a2811ce2359fdd0a4ba9207b3b9e1104902f246f3e34d6a60007e33
MD5 ca8d98cc19e228be969e06cd036d83bf
SHA1 4c9b21fddf0bcda2438c5e7ea84c8d961f4fd6d1
SHA512 5029a3c6ab27cfbe875b3bf5b42ab697e7bafd6ce2656e6e85ecbe42950dd3431ad9324c87df0eae3b937d971a5ce2e107e0462c53fdc3553bed45ca66d1deae
TLSH
T13BE08C42ABF9441CFBF3A97083F68B2A5273F8325731875E886402550C73E118A1879A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1860-500-0x0000000000D40000-0x0000000000DD0000-memory.dmp

Download

memory/2200-459-0x0000000001540000-0x00000000015D0000-memory.dmp

Download

memory/2656-517-0x00000000013E0000-0x0000000001470000-memory.dmp

Download

memory/3688-585-0x0000000006870000-0x0000000006897000-memory.dmp

Download

memory/3688-582-0x0000000006830000-0x000000000685A000-memory.dmp

Download

memory/3688-591-0x00000000084C0000-0x0000000008527000-memory.dmp

Download

memory/3688-579-0x00000000067C0000-0x00000000067D8000-memory.dmp

Download

memory/3688-588-0x00000000068F0000-0x0000000006901000-memory.dmp

Download

memory/3688-566-0x0000000000BE0000-0x0000000000C70000-memory.dmp

Download

memory/3688-580-0x00000000067F0000-0x000000000681A000-memory.dmp

Download

memory/3688-586-0x0000000006B00000-0x0000000006BE8000-memory.dmp

Download

memory/6048-54-0x0000000006120000-0x0000000006153000-memory.dmp

Download

memory/6048-47-0x00000000060D2000-0x00000000060D3000-memory.dmp

Download

memory/6048-423-0x0000000006690000-0x000000000669A000-memory.dmp

Download

memory/6048-32-0x0000000004510000-0x000000000451A000-memory.dmp

Download

memory/6048-96-0x0000000006660000-0x000000000667D000-memory.dmp

Download

memory/6048-42-0x00000000060D0000-0x00000000060E7000-memory.dmp

Download

memory/6048-48-0x00000000060D0000-0x00000000060E7000-memory.dmp

Download

memory/6180-528-0x0000000000F70000-0x0000000001000000-memory.dmp

Download