509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648

Analysis

max time kernel
146s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Size 12.8MB
Sample261109-tykkps11ew
SHA256 509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648
MD5 c8d7aba0e9f7f6a62929c74204ad6a60
SHA1 2a30eac6a0e704d1ea4faa663ed432d50700a9ed
SHA512 b250ea7263977cc22848c1e402aec750413ccdc9b28a8ca706b9db14918ade61aeee4057b5c9b16cabd3d5f2943adb5e505ef9fc12ff2a3b69801757be7855e7
SSDEEP 393216:7VH2gSxzKH8/mjhmHkz5wha6Gy63x+CaNH:pHOuHyWCL6B+CaNH
TLSH
T179D6010373F88485F2BA5BF5D0B5C6206A76BCB97D75C24EED8214D93D30BA468A2353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution exploit persistence privilege_escalation spyware

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
1440	icacls.exe
1268	icacls.exe
4416	icacls.exe
1280	takeown.exe
4004	takeown.exe
1608	icacls.exe
1828	icacls.exe
4616	icacls.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2588	Flash_Player_v34.0.0.330_ActiveX.exe

Loads dropped DLL 8 IoCs

pid	Process
5392	regsvr32.exe
5096	regsvr32.exe
5380	regsvr32.exe
428	regsvr32.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1280	takeown.exe
1608	icacls.exe
1828	icacls.exe
4616	icacls.exe
1440	icacls.exe
1268	icacls.exe
4416	icacls.exe
4004	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\mms.cfg	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
File created	C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash	xcopy.exe
File created	C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx	regsvr32.exe
File created	C:\Windows\SysWOW64\FlashPlayerApp.exe	xcopy.exe
File opened for modification	C:\Windows\System32\Macromed\Flash	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx	xcopy.exe
File opened for modification	C:\Windows\System32\Macromed\Flash\Cleaner_Flash_Player_AX.bat	cmd.exe
File created	C:\Windows\SysWOW64\Macromed\Flash\mms.cfg	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
File opened for modification	C:\Windows\System32\Macromed\Flash\Flash.ocx	xcopy.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\FlashPlayerApp.exe	xcopy.exe
File created	C:\Windows\System32\Macromed\Flash\Flash.ocx	xcopy.exe
File opened for modification	C:\Windows\System32\Macromed\Flash\Flash.ocx	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx	regsvr32.exe
File created	C:\Windows\System32\Macromed\Flash\Cleaner_Flash_Player_AX.bat	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	xcopy.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1512	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flash_Player_v34.0.0.330_ActiveX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1120	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3736	taskkill.exe
3860	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\NAVIGATORPLUGINSLIST\SHOCKWAVE FLASH	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "11001"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Compatibility Flags = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "11001"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "1"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\NAVIGATORPLUGINSLIST\SHOCKWAVE FLASH	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe = "0"	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.21\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\Flash.ocx, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17\ = "Shockwave Flash Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.19\ = "Shockwave Flash Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.34\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.23\ = "Shockwave Flash Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.mfp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\ = "Shockwave Flash Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.32\ = "Shockwave Flash Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sor\Content Type = "text/plain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory\CLSID\ = "{D27CDB70-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID\ = "ShockwaveFlash.ShockwaveFlash.34"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}\ = "ISimpleTextSelection"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\ = "Shockwave Flash Object"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/futuresplash\Extension = ".spl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.20	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.28\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.mfp	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.mfp	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9\ = "Shockwave Flash Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.34	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.29\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\Content Type = "application/x-shockwave-flash"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.22\ = "Shockwave Flash Object"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.30\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.30\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.29\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{31CAF6E4-D6AA-4090-A050-A5AC8972E9EF}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\Content Type = "application/futuresplash"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: 33	3672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3672	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5392	regsvr32.exe
5096	regsvr32.exe
5380	regsvr32.exe
428	regsvr32.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 2588	704	509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe	90
PID 2588 wrote to memory of 5856	2588	Flash_Player_v34.0.0.330_ActiveX.exe	91
PID 5856 wrote to memory of 5068	5856	cmd.exe	93
PID 5856 wrote to memory of 1512	5856	cmd.exe	94
PID 5856 wrote to memory of 3736	5856	cmd.exe	95
PID 5856 wrote to memory of 3860	5856	cmd.exe	96
PID 5856 wrote to memory of 3688	5856	cmd.exe	97
PID 5856 wrote to memory of 6044	5856	cmd.exe	98
PID 5856 wrote to memory of 716	5856	cmd.exe	99
PID 5856 wrote to memory of 6028	5856	cmd.exe	100
PID 5856 wrote to memory of 6056	5856	cmd.exe	101
PID 5856 wrote to memory of 4292	5856	cmd.exe	102
PID 5856 wrote to memory of 3128	5856	cmd.exe	103
PID 5856 wrote to memory of 5488	5856	cmd.exe	104
PID 5856 wrote to memory of 2320	5856	cmd.exe	105
PID 5856 wrote to memory of 4152	5856	cmd.exe	106
PID 5856 wrote to memory of 5268	5856	cmd.exe	107
PID 5856 wrote to memory of 2920	5856	cmd.exe	108
PID 5856 wrote to memory of 4004	5856	cmd.exe	109
PID 5856 wrote to memory of 1280	5856	cmd.exe	110
PID 5856 wrote to memory of 1388	5856	cmd.exe	111
PID 5856 wrote to memory of 1608	5856	cmd.exe	112
PID 5856 wrote to memory of 5628	5856	cmd.exe	113
PID 5856 wrote to memory of 1828	5856	cmd.exe	114
PID 5856 wrote to memory of 4828	5856	cmd.exe	115
PID 5856 wrote to memory of 4616	5856	cmd.exe	116
PID 5856 wrote to memory of 4740	5856	cmd.exe	117
PID 5856 wrote to memory of 1440	5856	cmd.exe	118
PID 5856 wrote to memory of 5164	5856	cmd.exe	119
PID 5856 wrote to memory of 1268	5856	cmd.exe	120
PID 5856 wrote to memory of 2888	5856	cmd.exe	121
PID 5856 wrote to memory of 4416	5856	cmd.exe	122
PID 5856 wrote to memory of 4352	5856	cmd.exe	123
PID 5856 wrote to memory of 432	5856	cmd.exe	124
PID 5856 wrote to memory of 1088	5856	cmd.exe	125
PID 5856 wrote to memory of 4788	5856	cmd.exe	126
PID 5856 wrote to memory of 2076	5856	cmd.exe	127
PID 5856 wrote to memory of 2744	5856	cmd.exe	128
PID 5856 wrote to memory of 6136	5856	cmd.exe	129
PID 5856 wrote to memory of 3144	5856	cmd.exe	130
PID 5856 wrote to memory of 5748	5856	cmd.exe	131
PID 5856 wrote to memory of 1496	5856	cmd.exe	132
PID 5856 wrote to memory of 1216	5856	cmd.exe	133
PID 5856 wrote to memory of 2368	5856	cmd.exe	134
PID 5856 wrote to memory of 1308	5856	cmd.exe	135
PID 5856 wrote to memory of 5952	5856	cmd.exe	136
PID 5856 wrote to memory of 6100	5856	cmd.exe	137
PID 5856 wrote to memory of 2568	5856	cmd.exe	138
PID 5856 wrote to memory of 820	5856	cmd.exe	139
PID 5856 wrote to memory of 5272	5856	cmd.exe	140
PID 5856 wrote to memory of 4324	5856	cmd.exe	141
PID 5856 wrote to memory of 4188	5856	cmd.exe	142
PID 5856 wrote to memory of 2504	5856	cmd.exe	143
PID 5856 wrote to memory of 4692	5856	cmd.exe	144
PID 5856 wrote to memory of 4208	5856	cmd.exe	145
PID 5856 wrote to memory of 2500	5856	cmd.exe	146
PID 5856 wrote to memory of 5284	5856	cmd.exe	147
PID 5856 wrote to memory of 1860	5856	cmd.exe	148
PID 5856 wrote to memory of 468	5856	cmd.exe	149
PID 5856 wrote to memory of 5360	5856	cmd.exe	150
PID 5856 wrote to memory of 5392	5856	cmd.exe	151
PID 5856 wrote to memory of 3000	5856	cmd.exe	152
PID 3000 wrote to memory of 5096	3000	regsvr32.exe	153
PID 5856 wrote to memory of 2064	5856	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe
"C:\Users\Admin\AppData\Local\Temp\509d0edf228eeaa5671fb34f5f45e9b4acab46b43d4234c3fd7abee854d45648.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\XiaoYouXiHallPack\Flash_Player_v34.0.0.330_ActiveX.exe
  "C:\Users\Admin\AppData\Local\Temp\XiaoYouXiHallPack\Flash_Player_v34.0.0.330_ActiveX.exe" /ai /gm2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @pushd "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000" >nul 2>&1 & CALL "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\!)Install_Flash_Player_AX.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKU\S-1-5-19"
      4⤵
      PID:5068
  - - C:\Windows\system32\sc.exe
      sc stop "Flash Helper Service"
      4⤵
      Launches sc.exe
      PID:1512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FlashHelperService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FlashPlayerUpdateService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3860
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Adobe Flash Player Updater" /f
      4⤵
      PID:3688
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "FlashHelper TaskMachineCore" /f
      4⤵
      PID:6044
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Macromedia\FlashHelper" /f
      4⤵
      PID:716
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashHelper" /f
      4⤵
      PID:6028
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\services\Flash Helper Service" /f
      4⤵
      PID:6056
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\services\AdobeFlashPlayerUpdateSvc" /f
      4⤵
      PID:4292
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashHelperService.exe" /f
      4⤵
      PID:3128
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerUpdateService.exe" /f
      4⤵
      PID:5488
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION" /f /v "FlashHelperService.exe"
      4⤵
      PID:2320
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION" /f /v "FlashHelperService.exe"
      4⤵
      PID:4152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:5268
  - - C:\Windows\system32\findstr.exe
      findstr "\<6\.[0-9]\.[0-9][0-9]*\> \<10\.[0-9]\.[0-9][0-9]*\>"
      4⤵
      PID:2920
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Macromed\Flash\*" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4004
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\SysWOW64\Macromed\Flash\*" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:1388
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Macromed\*" /t /c /grant "Everyone:f"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:5628
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\SysWOW64\Macromed\*" /t /c /grant "Everyone:f"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\FlashPlayerApp.exe" /c /grant "Everyone:f"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4740
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\FlashPlayerCPLApp.cpl" /c /grant "Everyone:f"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:5164
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\SysWOW64\FlashPlayerApp.exe" /c /grant "Everyone:f"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:2888
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl" /c /grant "Everyone:f"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4416
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Macromedia\FlashPlayer" /f
      4⤵
      PID:4352
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f
      4⤵
      PID:432
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveXReleaseType" /f
      4⤵
      PID:1088
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer" /f
      4⤵
      PID:4788
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f
      4⤵
      PID:2076
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveXReleaseType" /f
      4⤵
      PID:2744
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerApp.exe" /f
      4⤵
      PID:6136
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil32_ActiveX.exe" /f
      4⤵
      PID:3144
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil64_ActiveX.exe" /f
      4⤵
      PID:5748
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerUpdateService.exe" /f
      4⤵
      PID:1496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1216
  - - C:\Windows\system32\xcopy.exe
      xcopy /c/i/r/y "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\app\*" "C:\Windows\SysWOW64\"
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:1308
  - - C:\Windows\system32\xcopy.exe
      xcopy /c/i/r/y "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x64files\Flash.ocx" "C:\Windows\System32\Macromed\Flash\"
      4⤵
      Drops file in System32 directory
      PID:5952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:6100
  - - C:\Windows\system32\xcopy.exe
      xcopy /c/i/r/y "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x32files\Flash.ocx" "C:\Windows\SysWOW64\Macromed\Flash\"
      4⤵
      Drops file in System32 directory
      PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:820
  - - C:\Windows\system32\find.exe
      find "5."
      4⤵
      PID:5272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:4324
  - - C:\Windows\system32\find.exe
      find "5."
      4⤵
      PID:4188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:2504
  - - C:\Windows\system32\find.exe
      find "6.0."
      4⤵
      PID:4692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:4208
  - - C:\Windows\system32\find.exe
      find "6.0."
      4⤵
      PID:2500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:5284
  - - C:\Windows\system32\find.exe
      find "6.1."
      4⤵
      PID:1860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:468
  - - C:\Windows\system32\find.exe
      find "6.1."
      4⤵
      PID:5360
  - - C:\Windows\system32\regsvr32.exe
      regsvr32 /s "C:\Windows\System32\Macromed\Flash\Flash.ocx"
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5392
  - - C:\Windows\system32\regsvr32.exe
      regsvr32 /s "C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /s "C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo f"
      4⤵
      PID:2064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" copy /y "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cleaner_Flash_Player_AX.bat" "C:\Windows\System32\Macromed\Flash\" 1>NUL 2>NUL"
      4⤵
      Drops file in System32 directory
      PID:5796
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f /v "Version" /d "34.0.0.330"
      4⤵
      PID:3620
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f /v "Version" /d "34.0.0.330"
      4⤵
      PID:2972
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" /f /v "PlayerPath" /d "C:\Windows\System32\Macromed\Flash\Flash.ocx"
      4⤵
      PID:3956
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Wow6432Node\Macromedia\FlashPlayerActiveX" /f /v "PlayerPath" /d "C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx"
      4⤵
      PID:4768
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /t 2
      4⤵
      Delays execution with timeout.exe
      PID:1120
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayName" /d "Adobe Flash Player 34 ActiveX"
    3⤵
    PID:3576
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayVersion" /d "34.0.0.330"
    3⤵
    PID:3984
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "DisplayIcon" /d "C:\Windows\System32\Macromed\Flash\Flash.ocx"
    3⤵
    PID:5640
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" /f /v "UninstallString" /d "C:\Windows\System32\Macromed\Flash\Cleaner_Flash_Player_AX.bat"
    3⤵
    PID:3244
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWOW64\Macromed\Flash\Flash.ocx"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5380
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Macromed\Flash\Flash.ocx"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:428
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /delete /tn "Adobe Flash Player Updater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x0000000000000424
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

!)Install_Flash_Player_AX.bat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\!)Install_Flash_Player_AX.bat
Size 8KB
SHA256 2199fddeba1fbd7b09361be2c19498c572144a82f9bcfd674c62182574b255a3
MD5 f9beb5ef461751fec3d3c88974b81360
SHA1 5f9d644dd6e376344bc3261d7b642c6072ecee30
SHA512 0fca32431d29107f237edc498f9605eb42269634231579ca1d84f2b59284c48a7febd802964a4cec073f314cb1087d99a4e4ddce2fc718da1c2b4ff8496136f8
SSDEEP 96:nB6UHaKtPtLlV2rNMCiEV/HbyDND4tstwtzth90ZmQ2PvPk2TFgQlLOj:MU61NMCiEV/8RXZm5fk2TFg2LOj
TLSH
T1EA026C96BB4507D1A4131E1DF3C7A821EFEAA58ED19BBB022507F176D95F7080324EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cleaner_Flash_Player_AX.bat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cleaner_Flash_Player_AX.bat
Size 9KB
SHA256 74a55a5bb88016c90fcbf9ca81c9e93a8b88d9d4c3416ced182db427d503b38b
MD5 82d6efca60c1463e7d77749e163ea29a
SHA1 9daf294c6224854400954ddda0bc760f9df8c2e7
SHA512 74258ce36ee99c0b8023090728534c2e93677408920919d2a4cfca32dfdd84e167f918739d16551e45e61d24b087ca792e599c6dc50e984a17028502bb688d06
SSDEEP 96:nYaKtPtLlv2rNMCiEVIS/Hb3DND4NLt4KJYHDNQ9DHctGtstCN1cUWcUoXhpcUaV:zvNMCiEyS/nREJYJekKM
TLSH
T19122A893671602919D23190AF3C69826FFEEA24DE1D77A012653F232D92B75D1334FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlashPlayerApp.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\app\FlashPlayerApp.exe
Size 829KB
SHA256 c77da8acfea2d689ba6dc015f828c2d4944558707405902a4167f6ac1dc21010
MD5 7db46e68bf9daa7b5047b2a6f99fc384
SHA1 e4c4de045eec1ff1e26d47fb88fa7207e15653a6
SHA512 da3b1ae39e30c85f4bad0d4d0148aaa8a424820d91982c1a00d01ac3a95eb2bf2f019f6e13b8082a5a8b5cf9b70187e8f934991073ac5206ec009fe863c7e586
SSDEEP 12288:IOltT6Tksd/224Yg/a6jd1BtOkodxduog/TXJa/x82IErOJsXV/Qti:bcbvLuog/TXJmxOkIk
TLSH
T1A1059F6BA1D4402DD0D0017AAE71F7187DFDAC34DF21E1D3914DDA2E28E12D58A3EAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlashPlayerCPLApp.cpl

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\app\FlashPlayerCPLApp.cpl
Size 173KB
SHA256 3e6ae5dbbb964a803269b2d81377338f0d7ecb1a5dcb644958c59543cc18d946
MD5 7091407975ef126ad828774d44901e92
SHA1 dcd75fda44ff351eb8753f1dd155c1d796d6fca8
SHA512 e13701828060a6975163d9f76d46a7dd6c428d0fb5ded1e05ae8e92272f4c6f57980930e8b1d6e36848ecbf556ffa65b6f5d539e42c5e8595fdff5ec89afdf47
SSDEEP 3072:K7SiMivya+a3GJqP5XPZF/eHlRNO35eOfsXSHCFgeDSU5TgDK/ICPP2K:EO8B7PV/QN6MSFC+K
TLSH
T13704494363E1C831F0FB793C9875C5A01929BC529AE0C95B2664161E2E72E83ED3DF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Flash.ocx

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x32files\Flash.ocx
Size 11.3MB
SHA256 23f8a9af9f5f59bf8446c68c6f0e339460f9d25ac3e525a2fed910cc5d36d461
MD5 f8d812219f05c2a47e9be84c350e74d0
SHA1 f3618863834a94c081ecc14d17281dc87c581e72
SHA512 4a34ddf2e3c6266e3615faddea164428d79bec8cc5def3ecf2555aa611c794c610fd04d1aa8649d15cfd2129ef779f657965f4c23103e1338f1249aad9f7faad
SSDEEP 196608:cM9tPNJMw2qnE3WT6DwRgxUphp9AnpQr/wC2PI8e3lSHEry:cMzPNJMw2Qd6UPbA1pPe3EHR
TLSH
T133C68D33A4514871E4EB107D8FEDEA798C6C9520532814C70AE0645A697EEF33A3D7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Flash.ocx

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x64files\Flash.ocx
Size 13.2MB
SHA256 d5d42e413fde79eb58d50070e33f81dcf5c694bdd2f7ca5840d9fde475bd5343
MD5 f30cf3d8001ea0e92bdc27419e754373
SHA1 92f19830784a7aa98384d9f89e82ed147abc65de
SHA512 c09319901ac250aa27643ae153388a3518b9751ebdc23a9cb9e8d194ff25c25cf7f899702ca829a77e70f884925e60ad3bafbca4e4056e2b06b1547db769dd81
SSDEEP 196608:FaqwDFV3fkDlFmm8pt9lcp6b2F3hPrMVMHI:F7wDFVCF+pt9lgrF3Vr0
TLSH
T197D66B4BE2A510A4F27BE07CCA13D507D7F2B81A03A197CF017446561F63BE26A7E369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpF301.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF301.tmp
Size 2KB
SHA256 389c2091b8a8ecc7ce487ba3e762a512d48c8bfbdf44c782ae3c10ae440628d4
MD5 05decaad639edfe0204833ce497ed751
SHA1 026a522790828d70d1f52aac6b1660bdd2c3292c
SHA512 581662744df2fe1f8a4a39ad2bf309fd870f689d239aafc8ac4e52da8ef3ad1c101dc29dc8170393444000785f68572859ca62a36cce768ea9ea19a4ee0d3a67
TLSH
T127512B109C78113178E9DEA990DFE702DC9CD79A6B24154DE27A19CC4F2ED3B080E2DB
MD5 SHA1 SHA512 TLSH

Submit Download

Flash_Player_v34.0.0.330_ActiveX.exe

Path C:\Users\Admin\AppData\Local\Temp\XiaoYouXiHallPack\Flash_Player_v34.0.0.330_ActiveX.exe
Size 10.3MB
SHA256 29a639c3830827764055a1e328e2997159edec62aa90e70b337179312a8ef666
MD5 1a6b2dc5056c44221041c9431a816468
SHA1 465b8b07916d0ea87e3dff2aecac790327795e5c
SHA512 9f19a1ee9166c3bc269115662b63e5b72e8dd5239ca65c19667f9e713a78219dc5277a2acd2e6d0c9df9121ae541f3e70b08e66d861597072d7fc342192e1878
SSDEEP 196608:XgO3xzKbA685J0ZDG0hNv4D5MGkcGnvP62O3UsIkP7+6Gy63IsaHR4a2:XgSxzKH8/mjhmHkz5wha6Gy63x+Ca2
TLSH
T1B9B63341B6E9BAF9DF0D3175067B9185997CEC244B7161C3BB8A29DBCFB41CAD4B8080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

official.swf

Path C:\Users\Admin\AppData\Local\Temp\mods\zm1\official.swf
Size 2.0MB
SHA256 a5e9650ca4c3b779d62fb7987a0b7e7d5af5983b3197fa2f2e846a91b3f9ccce
MD5 82fff265ee07ca6559c54988dab0d211
SHA1 ece9947edeb259a7b0a62c6ca026c27083d7237c
SHA512 3dc2faffc6e40eaabacf7689f77cfcd88e0860d7013a2b14b75b215a72d9be7cb4d1ef6e77271195e1e1afa9ea0b1c3cf030af1c7052481a31b0179056429093
SSDEEP 49152:tTM5YSbujYHZouDy/0838qtOixWF9sqlfPn:65/pW/0838q1UHn
TLSH
T189A533A886754BB612F211E46D7D873A451E30A1B3ADBCD27C940F0277E24187D7E4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

official.url.txt

Path C:\Users\Admin\AppData\Local\Temp\mods\zm1\official.url.txt
Size 76B
SHA256 cf66875a2e8a178796c0d73f62a99258f57b46396d2592aa0bad4206982e558b
MD5 bce760e6277ec2e99de2f1ee73f36a3c
SHA1 c7e2a82f76db54ee34e38a7f4e017d1ca71688d0
SHA512 8f46c548694996a62641930a15a4e91141eee645d30b7e39fb9dfa93fcb0befb5a402005529feaca7b3589454a3c796a8346c413a4b82401689388b003437010
TLSH
T1E1A011C8280A82B02A8080022BE3A88082A0B8A0220888808A0C08838028BE2202A380
MD5 SHA1 SHA512 TLSH

Submit Download

patched.swf

Path C:\Users\Admin\AppData\Local\Temp\mods\zm1\patched.swf
Size 2.2MB
SHA256 c7ece41b80ebdd91718cceea080261bbab41f210bc6a6b98199a227cca5acc23
MD5 600d60a709bd7ec5d72a02531f8fc42f
SHA1 ec5ada5557bbae61ed5506f00e71477ffdbe3a2c
SHA512 a70da628a5e8389e293ac62103021f700ef2b21af2d33978bfb618691b3d9d1e7be60293616645453011338d39b7272b1aba9266c8f60202092a970602f1b187
SSDEEP 49152:ZFkJe9AzIVY3f8ubCrM+3oCNCc/ApLgmgp:ZD9mFmrM+3oC7o1c
TLSH
T14FB523E5351A0F41DA37FDF708AE8A3A366A7488E2C7B8C2B7514F315BC11C86D11B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.sol

Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
Size 510B
SHA256 44aed3b392bac353ce4bff90a00b693dffb103de2689166a246bfef20347ab33
MD5 619e7420449567f4fb5208ba1d1b8c16
SHA1 bf8bfa61d167bb6b3bfee6b12e4686f35dfc110e
SHA512 d06b28c0ab73c52f58e7d5897f8af2380ca474a89809b34b5320c8b6f2217f1ad0a9cd4684fb9ed6b150c04422e02ebc04b47c5ef04596059f83bbac5b1798e5
TLSH
T189F0DC862130C5B9D96E4E3D104022392A219B4F71863802439C50A0AE8FCF38C0F384
MD5 SHA1 SHA512 TLSH

Submit Download

settings.sxx

Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
Size 550B
SHA256 c990a8f0006913020f3d132356a0be8cd23e5fa484c51c8030c6a441faf85750
MD5 0f04cb355564ee70380782610cc84527
SHA1 912d9dcee8f8875b399526b6796ecf8e1953f5b1
SHA512 0f3f7f666cba5e80f35c3a5b9f416b10192e8dc5954e952ffacdaffa352dc092c22165bbb3a3c6274d5a74da099219c617ff37083cdbd9b8f97a9b81f4cca7b0
TLSH
T1D9F09E866130C569D9AE5E3D215022392B31AB0F71967811429D5091EE8FDF39D0F785
MD5 SHA1 SHA512 TLSH

Submit Download

settings.sxx

Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
Size 567B
SHA256 756dbd7f33e1ad8d415252a2614a6c1bac25d769f6e08a0e25ad993cdfc66b23
MD5 1010ef2d83d95cb4eb57f63eda01f343
SHA1 22c175599d5905545d3795a8572ac86a2e18565d
SHA512 4f88a309baac17b466218a5568462c58b3992918845c38f20f8e9a2fb295d7b46f0df897de0f89b6f690eab66262464f468fa0890df58d06eedff6d35db5ec56
TLSH
T131F0C0857120C469D9AE4A3D214022392A30EB0E71967851029D4051AE8FDF35D0F785
MD5 SHA1 SHA512 TLSH

Submit Download

mms.cfg

Path C:\Windows\SysWOW64\Macromed\Flash\mms.cfg
Size 281B
SHA256 6f19ace68c8880f0ce9d23c578bc892dfab42a80f1106451bb417df4b7a2b375
MD5 5929d477f524898ecca7e94d6664c0b7
SHA1 63f1524d7780ed020e521dda4b44a2b3b48386d2
SHA512 fc47053ffbe8aa49d555845247c7ebfab91969e52b4b30adff50e57ddf5fc20cb3ed122615917eaa224a3944fa716bbabeee06fa6d7bea613ca0923b9d9d5d88
TLSH
T164D0C2609706F4EE508BC2BCA8BA533117E24916849055604A891A4E6C6A080392FD4B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-1037-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1083-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-52-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/704-56-0x000000000ACA0000-0x000000000ACC2000-memory.dmp

Download

memory/704-41-0x0000000074962000-0x0000000074963000-memory.dmp

Download

memory/704-63-0x0000000011C80000-0x0000000012426000-memory.dmp

Download

memory/704-16-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/704-11-0x000000000AC10000-0x000000000AC1A000-memory.dmp

Download

memory/704-5-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/704-4-0x0000000003C50000-0x0000000003CB6000-memory.dmp

Download

memory/704-3-0x0000000006130000-0x00000000061C2000-memory.dmp

Download

memory/704-2-0x00000000066F0000-0x0000000006CAA000-memory.dmp

Download

memory/704-1-0x00000000007F0000-0x00000000014C2000-memory.dmp

Download

memory/704-0-0x0000000074962000-0x0000000074963000-memory.dmp

Download

memory/704-1045-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1039-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1040-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1041-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1079-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1082-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1081-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-44-0x0000000074950000-0x000000007510C000-memory.dmp

Download

memory/704-1087-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1086-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1085-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1084-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1080-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1047-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1048-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1049-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1050-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1088-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1051-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1078-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1038-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1034-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1036-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1033-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1031-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1029-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1035-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download

memory/704-1030-0x000000000E8D0000-0x000000000EAD0000-memory.dmp

Download