Analysis
- max time kernel
149s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 12:44
Behavioral task
behavioral1
Sample
K-Lite_Codec_Pack_1990_Standard.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
K-Lite_Codec_Pack_1990_Standard.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target K-Lite_Codec_Pack_1990_Standard.exe
- Size 39.1MB
- Sample260814-py1jpsbp4x
- SHA256 a253e9d4e641cb271f5553d8955e02e3c2810979cfe8f2bea5d0a0e960c3d1ab
- MD5 10ded18030734b37dbe5b893b74f0679
- SHA1 ad8633195b1ed69ec681d8c2e51ece9c42a35977
- SHA512 19882e51a606ac56a8e596281cd0918adc232acf466729a96d31c2cc1e9b6b85d2eeeb351aa4cafa798fb7cefe6ce3d208a6d15581f430337872d24325f64dab
- SSDEEP 786432:/T7ql1nF32usbElMcv1ypDcJdFzYcV1rmsFbe26glKpkBfSn938XG5Q4MEzExgBg:XqLF32xIGctypoz6we8KpkBfI9sXQExf
- TLSH T1FD97335DE70598B3C66939F4AAE0E73C227F3E0065E304092EDB2AEBF1677211476749
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\International\Geo\Nation K-Lite_Codec_Pack_1990_Standard.tmp - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
pid Process 4616 K-Lite_Codec_Pack_1990_Standard.tmp 1968 CodecTweakTool.exe - Loads dropped DLL 27 IoCs
pid Process 4616 K-Lite_Codec_Pack_1990_Standard.tmp 4616 K-Lite_Codec_Pack_1990_Standard.tmp 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 4556 regsvr32.exe 2524 regsvr32.exe 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 6008 Process not Found 6008 Process not Found 6008 Process not Found 6008 Process not Found 6008 Process not Found 6008 Process not Found 6008 Process not Found - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\is-FKIB6.tmp K-Lite_Codec_Pack_1990_Standard.tmp - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Am-LQ Filled\is-4UTJI.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\Localize\is-O2VG6.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\LAVFilters64\is-G80KD.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Info\is-3G6T4.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-F30VI.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-TP54C.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-VFS8U.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\LAVFilters64\is-AB6S0.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\LAVFilters64\is-RGOQA.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\is-BVLEO.tmp K-Lite_Codec_Pack_1990_Standard.tmp File opened for modification C:\Program Files (x86)\K-Lite Codec Pack\unins000.dat K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Tools\is-JJAFC.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-FCEJO.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-PK93L.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Oxygen White (old)\is-TTFC9.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\LAVFilters64\is-K36PR.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-M7I1I.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-UPGPH.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-5SCBV.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-74LJ0.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\is-RNGNI.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-OITM8.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-J01R9.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\is-ETPBL.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-FNRQ8.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-388CS.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-GBJOM.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\RRR Classic\is-19B3O.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\LAVFilters64\is-OINH9.tmp K-Lite_Codec_Pack_1990_Standard.tmp File opened for modification C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-434E4.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-1CGKC.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Oxygen White (old)\is-ULJVL.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\Localize\is-77M0U.tmp K-Lite_Codec_Pack_1990_Standard.tmp File opened for modification C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe K-Lite_Codec_Pack_1990_Standard.tmp File opened for modification C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\mpc-hc64_nvo.exe K-Lite_Codec_Pack_1990_Standard.tmp File opened for modification C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC\mpc-hc_nvo.exe K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\Localize\is-6L001.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-LE632.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-N01J5.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Am-LQ Outline\is-ECRMB.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\is-V05TO.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-5NJOI.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-89BD5.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Am-LQ Outline\is-S4FUS.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Oxygen White (old)\is-KFFOF.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\Localize\is-CMOCG.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icons\is-F13K7.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-I9NEI.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-AGQTR.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-TF8AS.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-9V3CE.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\is-1EVBU.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-9NSHN.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-1B9BP.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-EO40G.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-97SP1.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders11\is-FHTT9.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\RRR ThinLine\is-7GUB3.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Lang\is-VA740.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-FPQG9.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-3DROF.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Shaders\is-57VHI.tmp K-Lite_Codec_Pack_1990_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\Toolbars\Am-LQ Filled\is-C3OC7.tmp K-Lite_Codec_Pack_1990_Standard.tmp - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4560 sc.exe 4952 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K-Lite_Codec_Pack_1990_Standard.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K-Lite_Codec_Pack_1990_Standard.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CodecTweakTool.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 616 msedge.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/6064-0-0x0000000000400000-0x000000000047B000-memory.dmp innosetup behavioral2/memory/6064-20-0x0000000000400000-0x000000000047B000-memory.dmp innosetup behavioral2/memory/6064-478-0x0000000000400000-0x000000000047B000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 K-Lite_Codec_Pack_1990_Standard.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz K-Lite_Codec_Pack_1990_Standard.tmp - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_GIF = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_RTSP = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_VTS = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_NELLY = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_WMALL = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel\av1 = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVAudio\SampleConvertDither = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\FrameThresh = "8" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Settings K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_MMS = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_FLAC = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter\NetworkAnalysisDuration = "2100" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel\HWAccel = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-BE Filters\MPC Video Renderer\SwapEffect = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311852114283012" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_FLAC = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_AVI = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_HTTP = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_MPA = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_UDP = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_RA = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter\prefSubLangs = "eng" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel\h264 = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Settings\UseSeekPreview = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_MPEG = "1" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel\vc1 = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_AC3 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_DIVX = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_DTS = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_MPEG2 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\TrayIcon = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel\mpeg2 = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-BE Filters\MPC Video Renderer\UseD3D11 = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_MATROSKA = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_MPEGTS = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_V210_V410 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_WMV = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter\TrayIcon = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter\QueueMaxPackets = "350" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter\prefAudioLangs = "eng" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVAudio\Bitstreaming_ac3 = "0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\UseCoverArt = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Settings\KeepHistory = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_ASF = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_XVID = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_AC3 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_FLV = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_VC1 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVAudio\TrayIcon = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\SRC_APE = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Settings\AutoloadSubtitles = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_VP356 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Settings\DefaultToolbarSize = "28" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\ExePath = "C:\\Program Files (x86)\\K-Lite Codec Pack\\MPC-HC64\\mpc-hc64.exe" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_LPCM = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\TRA_VP9 = "1" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVSplitter\subtitleMode = "3" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Internal Filters\LAVVideo\HWAccel\HWResFlags = "3" K-Lite_Codec_Pack_1990_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\MPC-HC\MPC-HC\Settings\AutoDownloadSubtitles = "0" K-Lite_Codec_Pack_1990_Standard.tmp - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\mpc-hc64.exe\SupportedTypes\.dsv K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\mpc-hc64.exe\SupportedTypes\.pls K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mov\shell\open\command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.aac\shell\open K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.ape\shell\open K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3gp\Shell\MediaInfo\NeverDefault K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3gpp\Shell\MediaInfo\Icon = "C:\\Program Files (x86)\\K-Lite Codec Pack\\Tools\\MediaInfo.exe" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.clpi\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\MediaInfo K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.y4m\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.trp K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.webm\InfoTip = "prop:System.ItemType;System.Size;System.Media.Duration;System.OfflineAvailability" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mp3\shell\open\command\ = "\"C:\\Program Files (x86)\\K-Lite Codec Pack\\MPC-HC64\\mpc-hc64.exe\" \"%1\"" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.flac\Shell\MediaInfo\Command\ = "\"C:\\Program Files (x86)\\K-Lite Codec Pack\\Tools\\MediaInfo.exe\" \"%1\"" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpm\Shell\MediaInfo\Command\ = "\"C:\\Program Files (x86)\\K-Lite Codec Pack\\Tools\\MediaInfo.exe\" \"%1\"" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wv\Shell\MediaInfo K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.ogm\shell\open K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.evo\ = "EVO Video File" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.3gp2\shell\open\ = "&Play with MPC-HC" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.3gpp\shell\open\command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mpls\shell K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mkv\Shell\MediaInfo K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpg\Shell\MediaInfo\NeverDefault K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ofr\Shell\MediaInfo K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mk3d\shell\open\command\ = "\"C:\\Program Files (x86)\\K-Lite Codec Pack\\MPC-HC64\\mpc-hc64.exe\" \"%1\"" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mp2v\shell\enqueue\Icon = "C:\\Program Files (x86)\\K-Lite Codec Pack\\MPC-HC64\\mpc-hc64.exe,0" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.3gp2\shell\enqueue\MultiSelectModel = "Player" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.dff\shell\open K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.m3u\shell K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mov\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.flv\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.m4b\Shell K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mp4v K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.ts\shell\enqueue\ = "Add to MPC-HC playlist" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ogg\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{c5aec3ec-e812-4677-a9a7-4fee1f9aa000}" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fli\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mac\Shell\MediaInfo\Command\ = "\"C:\\Program Files (x86)\\K-Lite Codec Pack\\Tools\\MediaInfo.exe\" \"%1\"" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpv2\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\mpc-hc64.exe\SupportedTypes\.f4v K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayBlurayMovie\command K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.m4v\shell\enqueue\MultiSelectModel = "Player" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mts\shell\open\ = "&Play with MPC-HC" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.ssif\shell\open\ = "&Play with MPC-HC" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rec\Shell\MediaInfo\Icon = "C:\\Program Files (x86)\\K-Lite Codec Pack\\Tools\\MediaInfo.exe" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.f4v\ExtendedTileInfo = "prop:System.ItemType;System.Size;System.Media.Duration;System.OfflineAvailability" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.264\ShellEx K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\Software\Classes\.webp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.m2p K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\mpc-hc64.exe\SupportedTypes\.mpv4 K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.rm\shell\open\command K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.avs\shell\open\ = "&Play with MPC-HC" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tp\Shell\MediaInfo\Command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tta\Shell\MediaInfo K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wv regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.tp\shell\enqueue\ = "Add to MPC-HC playlist" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mpc\shell\enqueue\command K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.mid\shell\enqueue K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.amv\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{c5aec3ec-e812-4677-a9a7-4fee1f9aa000}" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.opus\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{c5aec3ec-e812-4677-a9a7-4fee1f9aa000}" K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.amr\Shell\MediaInfo\NeverDefault K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ogg\Shell\MediaInfo\Command\ = "\"C:\\Program Files (x86)\\K-Lite Codec Pack\\Tools\\MediaInfo.exe\" \"%1\"" K-Lite_Codec_Pack_1990_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.opus\Shell K-Lite_Codec_Pack_1990_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ogg\PreviewDetails = "prop:System.Music.Artist;System.Music.AlbumTitle;System.Music.Genre;*System.Media.Duration;*Icaros.AudioTracks;System.Rating;System.Media.Year;*System.Size;System.Music.TrackNumber;*System.Music.AlbumArtist;System.Title;*System.Audio.ChannelCount;*Icaros.BitDepth;*System.Audio.EncodingBitrate;*System.Audio.SampleRate;*System.DateModified;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mplayerc64.avi K-Lite_Codec_Pack_1990_Standard.tmp - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2648 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4616 K-Lite_Codec_Pack_1990_Standard.tmp 4616 K-Lite_Codec_Pack_1990_Standard.tmp - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4556 regsvr32.exe Token: SeRestorePrivilege 4556 regsvr32.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4616 K-Lite_Codec_Pack_1990_Standard.tmp 3344 msedge.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 6064 wrote to memory of 4616 6064 K-Lite_Codec_Pack_1990_Standard.exe 89 PID 4616 wrote to memory of 2396 4616 K-Lite_Codec_Pack_1990_Standard.tmp 91 PID 4616 wrote to memory of 4556 4616 K-Lite_Codec_Pack_1990_Standard.tmp 92 PID 4616 wrote to memory of 2524 4616 K-Lite_Codec_Pack_1990_Standard.tmp 94 PID 4616 wrote to memory of 2648 4616 K-Lite_Codec_Pack_1990_Standard.tmp 95 PID 4616 wrote to memory of 4560 4616 K-Lite_Codec_Pack_1990_Standard.tmp 97 PID 4616 wrote to memory of 4952 4616 K-Lite_Codec_Pack_1990_Standard.tmp 99 PID 4616 wrote to memory of 3344 4616 K-Lite_Codec_Pack_1990_Standard.tmp 103 PID 3344 wrote to memory of 4612 3344 msedge.exe 106 PID 3344 wrote to memory of 2988 3344 msedge.exe 107 PID 3344 wrote to memory of 616 3344 msedge.exe 108 PID 3344 wrote to memory of 2988 3344 msedge.exe 107 PID 3344 wrote to memory of 2988 3344 msedge.exe 107 PID 3344 wrote to memory of 2888 3344 msedge.exe 109 PID 3344 wrote to memory of 2888 3344 msedge.exe 109 PID 3344 wrote to memory of 4268 3344 msedge.exe 121 PID 3344 wrote to memory of 4268 3344 msedge.exe 121 PID 3344 wrote to memory of 4268 3344 msedge.exe 121 PID 3344 wrote to memory of 5508 3344 msedge.exe 112 PID 3344 wrote to memory of 5508 3344 msedge.exe 112 PID 3344 wrote to memory of 5508 3344 msedge.exe 112 PID 3344 wrote to memory of 1380 3344 msedge.exe 113 PID 3344 wrote to memory of 4380 3344 msedge.exe 114 PID 3344 wrote to memory of 1380 3344 msedge.exe 113 PID 3344 wrote to memory of 1380 3344 msedge.exe 113 PID 3344 wrote to memory of 4380 3344 msedge.exe 114 PID 3344 wrote to memory of 4380 3344 msedge.exe 114 PID 3344 wrote to memory of 3040 3344 msedge.exe 115 PID 3344 wrote to memory of 3040 3344 msedge.exe 115 PID 3344 wrote to memory of 3040 3344 msedge.exe 115 PID 3344 wrote to memory of 4584 3344 msedge.exe 116 PID 3344 wrote to memory of 4584 3344 msedge.exe 116 PID 3344 wrote to memory of 4264 3344 msedge.exe 118 PID 3344 wrote to memory of 4840 3344 msedge.exe 119 PID 3344 wrote to memory of 4264 3344 msedge.exe 118 PID 3344 wrote to memory of 4840 3344 msedge.exe 119 PID 3344 wrote to memory of 4620 3344 msedge.exe 122 PID 3344 wrote to memory of 1360 3344 msedge.exe 123 PID 3344 wrote to memory of 1360 3344 msedge.exe 123 PID 3344 wrote to memory of 3600 3344 msedge.exe 126 PID 3344 wrote to memory of 3600 3344 msedge.exe 126 PID 3344 wrote to memory of 252 3344 msedge.exe 127 PID 3344 wrote to memory of 1192 3344 msedge.exe 128 PID 3344 wrote to memory of 2440 3344 msedge.exe 129 PID 3344 wrote to memory of 4932 3344 msedge.exe 130 PID 3344 wrote to memory of 4932 3344 msedge.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\K-Lite_Codec_Pack_1990_Standard.exe"C:\Users\Admin\AppData\Local\Temp\K-Lite_Codec_Pack_1990_Standard.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\is-JEK8D.tmp\K-Lite_Codec_Pack_1990_Standard.tmp"C:\Users\Admin\AppData\Local\Temp\is-JEK8D.tmp\K-Lite_Codec_Pack_1990_Standard.tmp" /SL5="$40182,39937292,446464,C:\Users\Admin\AppData\Local\Temp\K-Lite_Codec_Pack_1990_Standard.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosThumbnailProvider.dll"3⤵
- Loads dropped DLL
PID:2396
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosPropertyHandler.dll"3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\MPCVR\MpcVideoRenderer64.ax"3⤵
- Loads dropped DLL
PID:2524
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN "klcp_update" /XML "C:\Program Files (x86)\K-Lite Codec Pack\Tools\klcp_update_task.xml" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2648
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" query AudioSrv3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4560
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" query AudioEndpointBuilder3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.codecguide.com/configuration_tips.htm?version=19903⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x388,0x7ff86ee1c188,0x7ff86ee1c194,0x7ff86ee1c1a04⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,1097734725646699455,11952962650596873927,262144 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:24⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,70651902973397693,4978714351781400510,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
PID:616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11416150056774859005,16664346584684572498,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:134⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,14434953381084145047,3537184248076571870,2097152 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,5640479907110251442,9438933742322999064,2097152 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵PID:5508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,3204363541224417154,1841562798565385169,2097152 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15633170971262397050,5295676738884875717,2097152 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:94⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3728,i,11645690937622069956,14719318383096939621,2097152 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,4661277017038537008,8316560964986106885,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:144⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,10820114866576991596,3358689065804527310,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:144⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,29356644169254588,6178327853867096225,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:144⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16043954402670103358,5663203807406226083,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:144⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16043954402670103358,5663203807406226083,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:144⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,17970376607564718748,5027441254872868162,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:144⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,629152974910491872,2647594782203494766,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:144⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,16708706754669701146,10929882256319434250,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:144⤵PID:252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,10072255632276953999,12037568501287100400,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:144⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,1628907689108020671,16142075361401421886,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,13360508886761723795,4237803555759493652,524288 --field-trial-handle=2332,i,16558910017480796044,1133621591848852178,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:144⤵PID:4932
-
-
-
-
C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe"C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:2452
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosCache.dll
- Size 352KB
- SHA256 c736d79ac24f9adaa5e8350e772b258fd841354ec96f56e25eba2e2e839e84b7
- MD5 c15d6da7fd944036a702e71936c9ffb3
- SHA1 0bf3031ce77df6c2e8e9fb5759ea33ea299f0f89
- SHA512 f647db730e3a9573236e4710daa2a6cfdc5b0242c734758aa2cdc906d1553b0bdc1bb342cf68a3e16aa89ad165ce5643415ee2c776f660cfdbfa5fb4fd43ff97
- SSDEEP 6144:HUZJNtXhKENWgsyJm8ZnQXjANCHS4xOgmrqaeh7m:Hkh9NoQ344gud
- TLSH T1F7747E15FAA415B5E167C138CE734906E7727C9A07A0ABCF23A44A562F33FD09A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosPropertyHandler.dll
- Size 866KB
- SHA256 7a93d1c28d1bfb276cb77b9ab37d507305240c2a9ef7fae70728276fbe8a5453
- MD5 da1ad8a8a27da031912267da4bb9f24b
- SHA1 012d6d0dd9202492c4e91fdf9c41024d69cc0dbf
- SHA512 8930d85865d1999610e22dcd130b7ff8c1f410820f4e681988991af8171b5be29747dd44ec444ef65f12b6bd7ea9224a79c1d26256ab5c5cdf8c870568cfc33c
- SSDEEP 12288:qKnYnnpZ6ZqfqDkeqcaeJoCKZbNHdiCvlWbq0DgT:q67keqcae6dbfno5D2
- TLSH T191157E1EBAA801B9E1BBC274CB639516D7B2B4460761A7DF03D015AA3F377D04A3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosThumbnailProvider.dll
- Size 405KB
- SHA256 7a8a3e54d320c0db40554c0f77d64547961c42dcdf08930786c8db850a877ae3
- MD5 f2dc183a023654f2a0ec8c6061fee66f
- SHA1 9ffb8b5fd80915482f7b8a1ffa1c14ce1b26a160
- SHA512 a02f9229b15f43483140e22f03abc40adf3ff15dae1582989b5296071a29db374632ded8ea4d6fb3dd5512919eac2857680630abf2fbb6a9d02f60af1d6ba6a9
- SSDEEP 6144:bVthEgGy3jiCW1HZoZWznf5ld33pEtaofivjf+dv1/O/Q3m2Jug2w:BHiFnpESG7G/Q
- TLSH T1DE947D15F7A411B9D177D138C9738902EB727C8A17A0ABEF13A446AA1F33BD05A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\avcodec-ics-62.dll
- Size 11.5MB
- SHA256 4948b0bb55ca6a0f8a587ad901d99a565b7ef79c2140a6160bd792a0e8deca33
- MD5 68b61c129aeb4277942fd8d9ff4d7946
- SHA1 543e438e63577d416828a08c192415999fd5d926
- SHA512 84578a7793c055933c8231912e04a3de257f7cdadd9d815beba54c699d67adc4aebd595afe83128126e807a6f8cd4796665ac9efd3c79218553328daaa680a4d
- SSDEEP 98304:J59htUkkssVJB4oapeMZHd18UNFe5lTnfSQFpywekNSb3aFHh+Wf+lS2+clyQ1cm:JXUkAVgpN7ISQgISb3aF2S2h91cveVN
- TLSH T151C68E4AF29351ECC66B8470476BEB73FA3434FC40247D769B84D7702A62F906A5AF18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\avformat-ics-62.dll
- Size 1.4MB
- SHA256 dc9a1578798a2f542a21057539f64df327bc9713be5fae4368f970f85235f07b
- MD5 6ec1396b9fe70c318753e61c7dd1ee8f
- SHA1 2ee883fb21a0ef3892599578653036f2c4ce3883
- SHA512 c8c5ad1d4581679728e8a53d5f3cd0a5d61d4b592e6144d3bff3b517c84f53c4a465954852170de47d726b1ff741d13c7dd8da267564a28b889cdcbc7b1db1b4
- SSDEEP 24576:E7WDnigij6mNSzHGl9r32Ajz9qv3QpsfDIXIT95jwZNnpy19PBSZF:E7WDLm6mwzK3Vx83msfDIZZNpyt
- TLSH T157656C43E1A325ECC62BC170539B9B72F631B8650530BDBF5690CB312E16FA0572EB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\avutil-ics-60.dll
- Size 1.0MB
- SHA256 8ab7dd6469373b630a08bbbcde1930736403e12ae4f35c74d6f99cc02c7122cb
- MD5 ce4520cf8f2b054bd05c3b899ec0f3f5
- SHA1 96dc9c915d8cd13b083ae885b1526f4a5149cc31
- SHA512 c67611a65c5502bbd248227cd874718ca662916a91fdfe9655bb66c6b3137664250d98a6c6eef04875ba2931919d7fda687e33514b974c5589e0e630a55fea40
- SSDEEP 12288:EF+pTOIhZKRT2VfF5LPLITArUd3tR+CEPO0mrwR1OO:O+pTOIhQTqzDLUlOBPNmrwF
- TLSH T1C9356C01A5E318BDC56B813056AB7677B62134528A647E3F27A1CE343F34F911D8FA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\libunarr-ics.dll
- Size 400KB
- SHA256 b330e5f0a6799c740724969618e0d0a36a96549e4e1c40421ce2e63eb4688d02
- MD5 dc03a9c5931e562574dd7886284f49b7
- SHA1 45c89acfd73cf0b8adf56b4e5a3b311ae4fd5d70
- SHA512 84703b99da727f6a12fd6cbcdcf7b35990bf2bbed1f0a96c9db18268c60f56f2910006272ba8367a47c00c4090cf9969a7997d46a1f676705058d1a74a4390c5
- SSDEEP 6144:kDHCdIjuU94ckQooKrfm233xNMivPo0CkM3wlBEfRypPA5w+28x54/JdJ80O8:KmUyckQirfx3IQA0CX3wAfg+28fsJ8B
- TLSH T170945B1AE1E325FCC653827087B79F72F931789D06246DFB81D4DB302D22EA05A19E79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\swscale-ics-9.dll
- Size 1.1MB
- SHA256 a17d17960689df4b2223be2a24099e3697bf4610cb8fb51a457e83202b6fd987
- MD5 4fd133431ec24b9c9bf509d64fd5814c
- SHA1 0f8d8fedfa5e0d6ba13f2ff29d6f73309f95091c
- SHA512 aa17b5c14dcf7db2ba627e70e2fcbc9187a614fbd4159d3f455b7cbdff2ca68f064a28946f5d9aa642c5ca7d37322b2cffe9b8a98ebc50059aa90e8c5ef94f53
- SSDEEP 12288:THtZfXIITvfzEUdnRQutlBDpUrsLPitsOG4Ime+TzcOG6w+97Q6gPv:xZfvzEUdRQsliKqSme+TzcOG3d6gP
- TLSH T1A4355C96E3A3A1EDD72B843082A79F73B660B45501156E3BA7C0C7352D27F805B0BF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\IcarosDescriptions.propdesc
- Size 3KB
- SHA256 c17028630d11d9dd82b65233978415d273aa5b32d4143c978c13fdf0a7f7c39e
- MD5 e24a7c6b3288aa8d4b0fa24eeca579bd
- SHA1 af8affa918d0078fd17d23ac2fa31bde0db53de4
- SHA512 ee308deca4b1af4f4cfc3855d2cca85efd222d2346df3640e74a8ba2f164d9dbfa27bb800df1c3ad9e326f33a0fb38f9218b9113a6a144526965498047d6279c
- TLSH T153718820FC58BD2441BD81003E70965CEE3443C3C9789563FBAC86BB7F66699A8E3356
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\MPCVR\MpcVideoRenderer64.ax
- Size 986KB
- SHA256 38c17bc54c062423b1ed828754e81a13b75d20e6fc3c8c3a58627e1a598e5091
- MD5 fe75ddfe3a76fecf53e068193c95c436
- SHA1 cfeba494c1635256e1fbacbf0d320b66a3c12b55
- SHA512 41ed990adc9083e6792ff198c6de529884c90affa2347ba26d154879c8155a0cd6b39fd4612f4f62529aa53a529eeec3603c4a71d4b96bdef51b3e27e0c0eabd
- SSDEEP 24576:CshVpshSMXlz4iISh11y2kIKhwfQCVAxWC:VFl211yQl
- TLSH T172258D0773A406B9C5BED2788DD78F11F776B45507A08BCB2294462ABF637E05E7A320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
- Size 13.1MB
- SHA256 9d0ca47bf7ea6c2b6e33e92e271001f007806e2d1967ec2829b3fd5ab6b6bf96
- MD5 61ce6fe7320e5d9289ba24ef55bf5db8
- SHA1 48d7f89360d5b69effd9f220c78f8774f75ac77f
- SHA512 e9ecc598fb846ae211747db9cb86099ef1b369291fd8b31774e1bec9632e80bdabf1c3c420677556acd2cb3f5cee9020d0ab6490e082d0b801bce71f5c90f63a
- SSDEEP 196608:nPo26ExhBZu1rxa2xf+ky0Qx8D4pV3ZkM:n36ExLMx9xfseD4HKM
- TLSH T183D6AD4772FA80D4D6B6C0388656470BE6727C4547B0C7EB35A8762E2F33AE12D7A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool-0.bin
- Size 160KB
- SHA256 542ec3bb70339af36ca8b6a46016581b24021b6eff467393c6ed4d9a48cd2b3a
- MD5 11d87fa055f1f23ace75f29736ea3167
- SHA1 2831cc982fa9957571a10058990c55eac32669cf
- SHA512 0c71aa25f470f3fc77811722e2eeca43bb08e29b471c27c092b80bf8c3aca85fa2f1e46528b86cc32f67ba1372aa34243e58378b2c4c3f4531286471d0318552
- SSDEEP 3072:q7KcGFYQMQBqIHusx+3Pk/sfghHWUB4mqcUbVRGB6wX2Mf:q7KcGpB5Hlxmk/sfghH/2e0VRNwXrf
- TLSH T17FF323A7C7702086E6EFFFD12196A864E51E53D41E26260E70FC9B2DDFA621181E0176
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe
- Size 2.3MB
- SHA256 015f202c68e4d168d139f4a9b52c01845ab0cd344f4b57d3ce618dcf9be53c8f
- MD5 863fec3552e0a7470b28f13bde6d107e
- SHA1 3c2ede2911d3ed283d299c36ef6cdc9a6c29be50
- SHA512 c885cfc97ee75d157d7d3ce103b7079c319ac8288991f2f145caf68fbeeb673e2c847fdbdfdf709a4d88dea6d5a22dbfbc54c3446b06c26c22baf1e7b7b3bd29
- SSDEEP 49152:KV7OXY3hbzs2HyhgFuwbieQ2QLPoTd+h333zj:KZ/HBowbieQ2WH333v
- TLSH T113B57DAAE3854237D0522A395D66D3845C3FFE702E24BC4B7AEC7D4C8E3565C3A28356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Tools\klcp_update_task.xml
- Size 3KB
- SHA256 4ec076459bef4bfb7c0d5d60969f6c69161f6c32f00519953e80e0fefca51437
- MD5 4847d2c2a624418bf441ac21473a0819
- SHA1 7c1068c9bb86e62cfa28efffde499c12a548c797
- SHA512 96a3e33f226338455a1def5fa5386b1adea0904c9ff9c6f69de0b43bf8ee0bd26e8687cd17229d3a9dd96ac662dcc3da039aa134a26c7f24c6884ff5a5feb3d3
- TLSH T182616A4357EE1109F1F36B6CAEB354624E63BD525938C86D00AC250DCBF7E628560BBB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\K-Lite Codec Pack\Tools\mediainfo.exe
- Size 1024KB
- SHA256 e28bcf9b230c537525e074fc82c84cf1df56f27dc3a05fc62615b9ddaceddd6e
- MD5 ad937f57725167e2d5d7be534feed706
- SHA1 18668605af8ec081eb9cdac5b0a6aced6a2b600f
- SHA512 cc417d4b486616014a9e44207f3c71168623023337fc82305854f053d4a3b9ab1bc4f5027802dd3307f3f609b79602e6e1944a2ddeeaf1ce19abda3f155f1069
- SSDEEP 12288:LitwUz3r/ezh2BJIwDHmWf42j28N+lMMaeIf+u2rHbRW7rrPssTM8e:Li+oQhk04ljNPNsMrrPss5
- TLSH T1A0254BDEE2F140B2C476193C4C3B556657B27E001D2AC88AE6A77DE8DFF56433C1A289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
- MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
- SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
- SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
- TLSH T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
- MD5 8af1f60999c332d8cf9a392cd968a81c
- SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
- SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
- TLSH T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 552B
- SHA256 fda5bb6366fe5152f44c32800994f13d50c648a237b0fb63cfc58f65ba90a8c6
- MD5 572ad0d45dc0337a5bba61084be40fba
- SHA1 d187dcbdd6d4734f36dcb059916dcfa4c56f626a
- SHA512 687e080e5bec0c4a03e45ad332a7404817b65f741c3a4c5ec7e1a18384f859c1516b0d544942d4766d5ed58f6c0463fed4c8bb6b448446902df830c4c56539dd
- TLSH T1B9F08C9453E14145DF783C31988AC16633F69E6AB2834AD6A5C95CF489D2FB003E1DD7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8d9b.TMP
- Size 360B
- SHA256 e3988a12116956ab3a6bcf6297f29fa8638a79536d0c226b459da2c32058e939
- MD5 f0f0019d45b8480869b918dde4eea809
- SHA1 944fcd309fc6945be1ae925bfc38dbb7bd60b19e
- SHA512 f3b4fc02dd40381a3add8c7b06577d252b7a4a08979af54633d73f454dce76461ab63bd616ef4265f05f467ee9f45b0c8b8403714127ba358d243a1787824f72
- TLSH T145E02E0587220244EF5A0CB0ADE9C2AA33F0CEFE72930B69A0D86C344E41FB153C041B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 42b5cd959652b688d9b6d1e0b0c01ebe997de9df1e27e7bb73a873eed8a41ffa
- MD5 2df44c4eb263cf93c70f4ea0d37a9a67
- SHA1 53c5b7230078b0eb6fb2becf58fadca2559a71aa
- SHA512 d68bb9002dc7a98df6f0584b3a394b505aba9cf0a6337406153e450a5842c69b35c4b4fa904be25c2222941a57477c0f84d5e4afbfcb323fcee6ac5c732eeb92
- SSDEEP 192:sxRcROyM/jK1Ml8wCQ/fPsMvdLZQc0zzoD8pdY/g6+WNYg+/SNQtMb3D2hPGk5Il:sxRcM8Q/fPsYdlLyG/52/uyO
- TLSH T15162D716AA345D7BCCDBD20DF951BF63D6F81563A1901E44AEFC8A1C00E6AED220781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 b20c1c55ab43c6e16b539431d632d0ab8d8c11b3afb78d55a7e6298a26938f81
- MD5 10b671cf06cf63cb27f9f8ef7af0f5f1
- SHA1 1c59f3a9faf7f71a4c5ffe62d2ba4dd8046a13a9
- SHA512 3392b35a1782c71ed5517bb1ac1c875cdec612820ac55cb467bd8853347f6a6a424111542703f00300858348f6b226f0ee243a03d5ea272b863355b572746f87
- SSDEEP 192:sxRPROyM/jK1Ml8wCQ/fPsgvdLZQc0zzoD8pdY/g6+WNYg+/SNQtMb3D2hPGk5IH:sxRPM8Q/fPsMdlLyG/52/uyW
- TLSH T16262D816AA345D7BCCDBD21DF951BF63D6F81563A1901E44AEFC8A1C00E6AED220781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 b1189ca4fe40f9199b04c7554d5918c13104f1988d061de8a2a7b9aaf6419b75
- MD5 a26179c20ef1ecf6f334d5ced5552486
- SHA1 8e08df729a6a51681ad766590e97b25ea7497c6c
- SHA512 973ad381473fdc6a0184a943bc38215c62ed77435bfd9c4bcc9a9a5e05d5074be89524d7e2b2645106d5112657d050ae13283d2648a2664264e8e513d3338cf1
- SSDEEP 768:Giqbxo7pLuL7hkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVS1oMW6QroejTie:GiqbxUE7hkWg0CfDsu1jat1oF67eKe
- TLSH T189E2FC3B680CCB7E4F804A9CEC29BE9B6DA801CB96D8CD5447EA841C03C67FB55165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 068254f148549f4b43af5ac1122c8cea7e0117118afea172b347e114a1ee7047
- MD5 c598a90df6260fb800374e4a5e8cbe23
- SHA1 4f6e7b335e3776d94f0096d3c367bcb2a882dc43
- SHA512 4a986e0aa2c4a9778708baab25ff980063a5dedf26c1d2627ed420e7d3ed32d36af942c477aed165ebf41bcfcdd2bcb09273bfb9c23b81fb4ad80a5016e40053
- SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHEFw0Oy2UWS/fg8UK4Rg2Uc00/uUJHk0kT:C1i7PF/DWrwfX9mgpct1o7zsHEFw0Oy3
- TLSH T1E2C15595713B0344397DAA0C91BDD82EC3C375A3311CA86B3BA941A65F66E038DFD4D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b1b45.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 44KB
- SHA256 4932c4564a764c1da7eb2f52003cd470f636ce6612959f11e3b06777e95b7396
- MD5 1cfb2d15f00c3c7724e81c6a757103e3
- SHA1 868cfb475ccf816ff1cb72884d5467276dc06a07
- SHA512 bb7bce02e9130ae0db42c00f5ea8c408b5a89d46ae1d1882247e759d60a95e0d3b465152fc69c032064a0fafb8b63461623a3a08805416dc5d03b12fdc494bd4
- SSDEEP 768:FFEA3N8wgnVgtfZOsfcR66Igfcl665vShCQRpPi9PRW:YA3pf7f16Igf565vStPb
- TLSH T1B61329F1D8E79A76D9EE5787573D6E02AEBDC163B1885984BB884D0CCC821BFC306815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 5ba58f72e94619927dfbc83ef108a2316230553be621c6b9a0fd0a9a5ae8c72d
- MD5 0363a30965642c7edebf228d5b6cf0f7
- SHA1 70f5ee336f239edd06c037dc7228fb7221f8bf97
- SHA512 b4e91c6d3dfdd823ade32bbd31dfbb3d97f5d06040e937f3621626ccaa8686b428e0b6fd32457cf933605bae489da9df29c73caccdc37e35ab584f33ae189fad
- SSDEEP 768:3y3N61c+wfZOsfcR66Igfcl66evShCQRpPi9PRW:3y3Mwf7f16Igf56evStPb
- TLSH T115F2BFB1E8746AB39DE69B8567063B13BFF95163D1C80A48DADC4B0C05C36AF171B836
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 50ee9b6bdb9cb223e4ae7951d28966ba42d1f378ecddbe6d68fb07d201ae83be
- MD5 4c6bd6a200a566165a475851dc9604e4
- SHA1 a1dd504176f96d7c286586fdd5c16c0839d08301
- SHA512 c91fb574326100285eed1982b1d9838e0d58fec5c682e59e08537b908bceea6fab1740a154b635eb8df5396521188f80170b17f79a2e9dad3c3e8ca87f1f2f5b
- SSDEEP 768:Rrv+4UNbd43S1kc+wfZOsfcR66I/vShCQth2bwWV:RbsbO3Sswf7f16I/vSF0wO
- TLSH T18103C032E86899339DE792487646BB637EB96173C8C54744DADD4B0D028369F370BC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 4531728aaa1b2532daab8577c67a6f601d898fecddb4e7fab79a33303c72479b
- MD5 40c7b2e114f76fd742ff98fc7f8c9529
- SHA1 69cd85eb17815b122afa190bbdfdd021a4f4dfa3
- SHA512 f91030949cad6ee940d3b66f5a1e126a35555804c728092e15d3ffaccc6913d365fc19d864c737860d1579870b81f4f015b15cdf3d2168fb14985bd648b0eb7f
- SSDEEP 768:by3N11c+wfZOsfcR66Igfcl66gvShCQRpPi9PRW:by3bwf7f16Igf56gvStPb
- TLSH T123F2BFB1E8746AB39DE69B8567062B13BFF95123D1C80A48DADC4B0C05C36AF171BC36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 cda74cad11c303d9775a261eea55654c6b863b6229ef9b094afa15d8dcb2f591
- MD5 04286c17e9aa9f62247522d0c5f769d8
- SHA1 51c7e40e9a1677f1686450a8b1e7296d5de8007d
- SHA512 6b0d619f232337dd3a2269e8737743eef41935f0893195636d9de4dab9c56e4b4c2d93f9e8d41b9fb8b8265ef4de7e5f2d0da191fab574e3783cb0f32d518319
- SSDEEP 768:1rv+4UNbd43OYbc+wfZOsfcR66Igfcl66EvShCQsp2bwWV:1bsbO3fwf7f16Igf56EvS60wO
- TLSH T1C303CF72E8786A739EE39644760ABB13BFB55263C4C54684DEDD0B0D028769F331BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\is-5PR99.tmp\detect_speakerconfig.dll
- Size 67KB
- SHA256 b8644e445548d7af65f4619e3acbed248f94e65c69fe88262837f49e77e00960
- MD5 10f0c13b1b75b21bda380be20086f932
- SHA1 3ca015e0ca59ccf916eee142e18427ee0ede014e
- SHA512 5cbc60d51f7e879fccee0a125c81c38704aaf74eaca84a91433a1c8ff370380e96c4b745703b5ab0c73e36f5d7e8975bd62ad46130a9511e8c5b21f270f2fca6
- SSDEEP 1536:wzYdGiJBGyIKfl236FbgRCo3sWicdaG5N8Io:wzYdzHFt237HFaG8Io
- TLSH T141635A10B6E1C4B1E1BE2A394870C6A55E7D7C104FE59DAF2B99022E0F741D2A735E3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-5PR99.tmp\klcp_gpu_info.dll
- Size 75KB
- SHA256 96cbabac80d34411ae2efcadea9ce858454bbd6b5a02c211a195cb23dbd8cebd
- MD5 4b0f30a967a9b2ea7065e5f5bd949c4c
- SHA1 d6975e9bb5e1ecedbe596f86bf5ba0fd4d80f293
- SHA512 8c91ae448557d44c0ccd706e0e22b89d8049a152b9e3256c25ce6dd878bb48e74d8c1bdaad65c526ab1985a12a4848e254da3f9ca2a268e68fccc9f70f594655
- SSDEEP 1536:dimaHUIBaUuW1+0+sw5ezCnw4sWvTcdbNSC1Dphp:dimaza9wXzwwPbNSC1Dphp
- TLSH T1C0736C01B6D1C871E57E1E381875C6A46B3EB9111EE49DAF3B89026E0F742D0EE35E36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-JEK8D.tmp\K-Lite_Codec_Pack_1990_Standard.tmp
- Size 2.4MB
- SHA256 f0e6cb7f49afb1e899957346a7310ed1ce1fc5940dccd6d461ddfd093cf2f842
- MD5 f90fabdc11c18ccd6ac4705449022233
- SHA1 e6ca98de2a587b877b7b42ed78967435d573da5e
- SHA512 b3d86a1bb86e584c1fd7a13efb7bd218c5cc2639eb17a335d3e9a96eb9849091a89453f71067ec5af515a6ccc88cc9525fbe7ad2d737ec584fdcad63bc0abc8a
- SSDEEP 49152:rV7OXY3hbzs2HyhgFuwbieQ2QLPoTd+Q3336j:rZ/HBowbieQ2WO333A
- TLSH T1D2C58EAAE3854637D0522A395C67D3945C3FFEB01E24AC0B7AEC7D4C8E3565C3A28356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3344_173859715\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH