3314851b0925f24ccf7b4bc12d1ef3fa7c308b9a5136727118f1b58474bd134c

Analysis

max time kernel
133s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
Size

906KB
MD5

36e910c6e230456c98672821d88d3f9f
SHA1

6f4ed920ed618ce9df5e84823c7547ff0bb30e9f
SHA256

3314851b0925f24ccf7b4bc12d1ef3fa7c308b9a5136727118f1b58474bd134c
SHA512

824507b1f98103101372bc12ce37d66d7ed8918e76b286905bbcd673a17b3d2fb21a9ad250661406996bbc5acae4d9ff5b3f17e0f4f5076c1d779787658ab7f1
SSDEEP

12288:QUHzKufgk0IpzpXxsPsM+80/9OCOaVLR7g1xGkgBaFSkYu8DU0OYhLu0O49gY4B:THVfSIpzpBsGACO0LRs1kk6i6uKVOu4B

Score

8^/10

adware bootkit discovery persistence privilege_escalation stealer

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

Processes:

minidownload.exeDownLoadDlg.exeExternalApp.exeUpdateService.exeXLDownloadCom.exeUpdateService.exeMiniTPFw.exeThunderFW.exeXLDownloadCom.exeMiniThunderPlatform.exe

pid	process
2960	minidownload.exe
2588	DownLoadDlg.exe
1912	ExternalApp.exe
1356	UpdateService.exe
1992	XLDownloadCom.exe
912	UpdateService.exe
1020	MiniTPFw.exe
2044	ThunderFW.exe
528	XLDownloadCom.exe
1704	MiniThunderPlatform.exe

Loads dropped DLL 48 IoCs

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exeminidownload.exeDownLoadDlg.exeExternalApp.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeUpdateService.exeXLDownloadCom.exeregsvr32.exeUpdateService.exeMiniTPFw.exeXLDownloadCom.exeMiniThunderPlatform.exe

pid	process
2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
2960	minidownload.exe
2960	minidownload.exe
2960	minidownload.exe
2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
2588	DownLoadDlg.exe
1912	ExternalApp.exe
1912	ExternalApp.exe
1912	ExternalApp.exe
2220	regsvr32.exe
1316	regsvr32.exe
1912	ExternalApp.exe
2288	regsvr32.exe
704	regsvr32.exe
1752	regsvr32.exe
996	regsvr32.exe
1912	ExternalApp.exe
1912	ExternalApp.exe
1356	UpdateService.exe
1356	UpdateService.exe
1356	UpdateService.exe
1992	XLDownloadCom.exe
1992	XLDownloadCom.exe
1996	regsvr32.exe
2588	DownLoadDlg.exe
2588	DownLoadDlg.exe
2588	DownLoadDlg.exe
2588	DownLoadDlg.exe
912	UpdateService.exe
912	UpdateService.exe
912	UpdateService.exe
1020	MiniTPFw.exe
528	XLDownloadCom.exe
2588	DownLoadDlg.exe
528	XLDownloadCom.exe
528	XLDownloadCom.exe
528	XLDownloadCom.exe
528	XLDownloadCom.exe
528	XLDownloadCom.exe
1704	MiniThunderPlatform.exe
1704	MiniThunderPlatform.exe
1704	MiniThunderPlatform.exe
1704	MiniThunderPlatform.exe
1704	MiniThunderPlatform.exe
1704	MiniThunderPlatform.exe
1704	MiniThunderPlatform.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}	regsvr32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exeDownLoadDlg.exeMiniThunderPlatform.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
File opened for modification	\??\PhysicalDrive0	DownLoadDlg.exe
File opened for modification	\??\PhysicalDrive0	MiniThunderPlatform.exe

Drops file in System32 directory 4 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	regsvr32.exe
File opened for modification	C:\Windows\System32\GroupPolicy	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	regsvr32.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	regsvr32.exe

Drops file in Program Files directory 54 IoCs

Processes:

minidownload.exeExternalApp.exeDownLoadDlg.exe

description	ioc	process
File created	C:\Program Files (x86)\SogouDownLoad\html\download.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\error2.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_spr.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\rocket2.swf	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\uninst.exe	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\error.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_close.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\zlib1.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_set.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\ThunderFW.exe	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\down.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_t.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\npdownload.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\config.ini	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\id.dat	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\IEHint.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\settings.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\IEHint64.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe	DownLoadDlg.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\errorbg2.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\CommonState.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\download_engine.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\btns.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\DlgHandler.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\XLDownloadComPS.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_min.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\warning.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\dl_peer_id.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\repair.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\atl71.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\msvcr71.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\check.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\jquery-1.11.2.min.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\xldl.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\bg_line.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\btn_spr.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\rocket1.swf	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\MiniThunderPlatform.exe	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\download\msvcp71.dll	ExternalApp.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\attention.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\errorbg1.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\actions.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\npdownload64.dll	ExternalApp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\minidownload.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\minidownload.exe	nsis_installer_2
\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe	nsis_installer_1
\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

DownLoadDlg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\Policy = "3"	DownLoadDlg.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	DownLoadDlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}	DownLoadDlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\AppName = "DownLoadDlg.exe"	DownLoadDlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A79E46E-5A01-4abb-BCC1-F96D06AEE085}\AppPath = "C:\\Program Files (x86)\\SogouDownLoad"	DownLoadDlg.exe

Modifies data under HKEY_USERS 38 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeXLDownloadCom.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35489C47-0C7C-48D8-8000-0FB159BAF406}	XLDownloadCom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35489C47-0C7C-48D8-8000-0FB159BAF406}\Version	XLDownloadCom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ProxyStubClsid32	XLDownloadCom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\TypeLib\Version = "1.0"	XLDownloadCom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\TypeLib\ = "{2D85F656-2970-437F-BA8A-C6F95B86EE0D}"	XLDownloadCom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\SOFTWARE\Microsoft\Windows	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\ = "IEHintBHO Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35489C47-0C7C-48D8-8000-0FB159BAF406}\TypeLib\ = "{2D85F656-2970-437F-BA8A-C6F95B86EE0D}"	XLDownloadCom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D85F656-2970-437F-BA8A-C6F95B86EE0D}\1.0\HELPDIR	XLDownloadCom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\TypeLib\Version = "1.0"	XLDownloadCom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\NumMethods\ = "14"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D85F656-2970-437F-BA8A-C6F95B86EE0D}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouDownLoad\\XLDownloadCom.exe"	XLDownloadCom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ = "PSFactoryBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SogouDownLoad"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D85F656-2970-437F-BA8A-C6F95B86EE0D}\1.0\0	XLDownloadCom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\ = "IEHintLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouDownLoad\\IEHint.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ = "IDownLoadBHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\SOFTWARE	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ = "IXLDownloadInterface"	XLDownloadCom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\*	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548F20C0-F980-4912-9190-1127D22D883D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\InprocServer32\ = "C:\\Program Files (x86)\\SogouDownLoad\\IEHint64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{459CB386-4301-448D-A1DA-8751857E980B}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouDownLoad\\IEHint64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\ = "DownLoadBHO Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{548F20C0-F980-4912-9190-1127D22D883D}\TypeLib\ = "{459CB386-4301-448D-A1DA-8751857E980B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouDownLoad\\npdownload64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D5DD5D-0742-4CC1-A0AB-7251C40DB020}\TypeLib\ = "{459CB386-4301-448D-A1DA-8751857E980B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B411DAF2-77C4-4478-8477-5826A4147AE9}\ProxyStubClsid32\ = "{B411DAF2-77C4-4478-8477-5826A4147AE9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DownLoadDlg.exe

pid process

2588 DownLoadDlg.exe
2588 DownLoadDlg.exe

pid	process
2588	DownLoadDlg.exe
2588	DownLoadDlg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exeDownLoadDlg.exeExternalApp.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2960	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 2904 wrote to memory of 2588	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 2904 wrote to memory of 2588	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 2904 wrote to memory of 2588	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 2904 wrote to memory of 2588	2904	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 2588 wrote to memory of 1912	2588	DownLoadDlg.exe	ExternalApp.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2220	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1316	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 2288	1912	ExternalApp.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 704	2288	regsvr32.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1912 wrote to memory of 1752	1912	ExternalApp.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1752 wrote to memory of 996	1752	regsvr32.exe	regsvr32.exe
PID 1912 wrote to memory of 1356	1912	ExternalApp.exe	UpdateService.exe
PID 1912 wrote to memory of 1356	1912	ExternalApp.exe	UpdateService.exe
PID 1912 wrote to memory of 1356	1912	ExternalApp.exe	UpdateService.exe
PID 1912 wrote to memory of 1356	1912	ExternalApp.exe	UpdateService.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\minidownload.exe
C:\Users\Admin\AppData\Local\Temp\\minidownload.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2960

C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe
"C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe" /Install?status=true&softurl=http%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3DYRyEVuHeM45mBjjEUSPVUEJm8GF_McJfVdEjKPrgnocp6RPTnPFSKls2-N19zn1VVyIyQ0EaAFzVunBLAWIXs1gXJ8-dW6ZyJd2HMCZpOTvLIGNafI07QZpggfaFdLzRilLVZzhV53fF-ago-P3fECJIPRI-Fuc_AxfASetSfW-faQ80d0IKxv44fPBspu-9gJ23-t3zxt4Y4-C8cvpfCNZHher5qyyKJrSsN3LkAxu_IhNtWMXWFw..%26pcid%3D-9085129097648098765%26w%3D1950%26filename%3Ddjyx_134_1389168322_djyx_134_2014-1-8_VIPDL_signed.exe%26extra%3D5_tencent%26downloadtype%3Dsoftware%26stamp%3D20160414&iconurl=http%3A%2F%2Fimg02.sogoucdn.com%2Fv2%2Fthumb%2Fretype%2Fext%2Fjpg%2Fcls%2Fimagick%3Fappid%3D200504%26url%3Dhttp%3A%2F%2Fpc3.gtimg.com%2Fsoftmgr%2Flogo%2F48%2F11245_48_1390193625.png&softname=%E5%8D%A1%E7%89%87%E5%8F%AC%E5%94%A4%E5%B8%88&softsize=2.8+MB
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588

C:\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe
"C:\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe" /Update
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\npdownload.dll"
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2220

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\IEHint.dll"
4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1316

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\npdownload64.dll"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\SogouDownLoad\npdownload64.dll"
5⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
PID:704

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\IEHint64.dll"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\SogouDownLoad\IEHint64.dll"
5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:996

C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe
"C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe" /Install
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356

C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe
"C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe" /Regserver
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1992

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SogouDownLoad\XLDownloadComPS.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:1996

C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe
"C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020

C:\Program Files (x86)\SogouDownLoad\download\ThunderFW.exe
"C:\Program Files (x86)\SogouDownLoad\download\ThunderFW.exe" MiniThunderPlatform2024-07-0507:50:19 "C:\Program Files (x86)\SogouDownLoad\download\MiniThunderPlatform.exe"
4⤵
- Executes dropped EXE
PID:2044

C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe
"C:\Program Files (x86)\SogouDownLoad\update\UpdateService.exe" /Service
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912

C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe
"C:\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528

C:\Program Files (x86)\SogouDownLoad\download\MiniThunderPlatform.exe
"C:\Program Files (x86)\SogouDownLoad\download\MiniThunderPlatform.exe" -StartTP
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SogouDownLoad\DlgHandler.dll
Filesize
191KB

MD5
87d4aa3496919af493c9365619c3fd53

SHA1
a883a0be2940811ef9232592c811b854f684f4b7

SHA256
d4a4eb61a6ffba806c3f34fa6bb5fca32489f53138dbaf324a8b2d210afa0771

SHA512
064637554b7e7e1c5699f4e4ced73dd4ca7bf87172009b121bedeb864f8e3d03a1352b6f6b9515b9a4020137e07b9981476a664eadbd27bd32acdd8a53003372

Download Submit
C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe
Filesize
795KB

MD5
1a21e9b1435c06e562a1c6a2e92a82d6

SHA1
60457394473cb75fca7d3fe5069231e82c84a4e6

SHA256
35e9bfc9e668511572a1e41f9421b5bd931e1b66a0562789453690f306a9af8e

SHA512
d4336ddc4969c19078c0b06ae799a9062c571de12f471cdc6fcc8f9d27e3f8aebe75a0de47eaf7f719c3a58f69d40f7c28a964ab88cd9ef2b566c73e0e9f3eff

Download Submit
C:\Program Files (x86)\SogouDownLoad\IEHint.dll
Filesize
300KB

MD5
6cffe36e5e3d9364a18eaf4a44ebfc23

SHA1
8a3bb3fa5f76a7eac5dfc4bd201a5e5203c10bcf

SHA256
cd57765f8cea6a4f422862c0b8a3e1945f17292e4c14b31333ec1525e05c6025

SHA512
7e145a0a79bd3d8caa89bae2ddb1187ff4de481426bb820cdf8f0206c96819d38af0ade5aad6c9e89da4e11dad6d5ab692f3d8bb25b90da2596bf49619fe325b

Download Submit
C:\Program Files (x86)\SogouDownLoad\IEHint64.dll
Filesize
346KB

MD5
30e7e39b49c8590aec85aca2664ff3e7

SHA1
8273c46fb4666e44ce3865012529aebb6aa95f1c

SHA256
3d3f8c1a05c2b5b5362b9ee0ddc1ce653a22abf0b559acceebcc82b73dbaf79a

SHA512
8d967605e4be98929cf6b508dccc217e60186da44dcb594d16e286f29b66c846dc1c4e676fab235de7f2326bcb4aae30528a535136de72f6a978a48d8a424245

Download Submit
C:\Program Files (x86)\SogouDownLoad\XLDownloadComPS.dll
Filesize
42KB

MD5
ef217dde650c290e6f15bdbd7f55f26d

SHA1
87ef4ca0ac1f7dd6c50bdaa0aeeebc3d1e132dcf

SHA256
a445ea86ffb20f9540d53aa12dc8f3737a9c87573241b9c5686109533b92e890

SHA512
d2ae2574d2fa5455b590513066bdee9d3765bffd6b82450a5e619d01d4378013cbdcb4f0d9cec47ba7f03125098945c07cb0c6274a9a1ad0346bddd10fe022b5

Download Submit
C:\Program Files (x86)\SogouDownLoad\download\MiniTPFw.exe
Filesize
58KB

MD5
58bb62e88687791ad2ea5d8d6e3fe18b

SHA1
0ffb029064741d10c9cf3f629202aa97167883de

SHA256
f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100

SHA512
cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\config.ini
Filesize
116B

MD5
ffa1443199298e2c4ff1122f1ae14b05

SHA1
96175a64c1f8ba142aa057e8f76e13467ecefb82

SHA256
2d21ddb94831d5345bbfbe52ecd342067cf49c6eaf8c78057e1901b6c69c6574

SHA512
3955846ed694c43d2d9857168e1c3fee9714ecea70c0af04b1db6d7be5b4805b92730d74bc4a74ed5464c47e4af558b8d040d0efc8ec276fcb8c50c346fe61de

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css
Filesize
7KB

MD5
0079cdb145c388c3e4c5e2235ac97bce

SHA1
7a8fee29992183dd572c52a1f6ca24219f4d8cba

SHA256
f4890eb5df2bb1b2921c0e561388780b4e2871998ca5aa7f4ec8bbf6ea1a715c

SHA512
7387d097152a49f8c57db203d89f64f6d2f905b60f69fa90d26ee3ebcab6428865e745fca63600c724c296db85d299502b4133cacd4b7dbcd4653712a82caa46

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\download.html
Filesize
7KB

MD5
382c18d88309c186f501dc3d31876461

SHA1
1c602b521deec4e2826e9280fed7e586351282c4

SHA256
67293d69f293e3347dd6eaabf19b84d3bba0fbc00fcc19d79be354da3f105687

SHA512
f82ba3616734551eef1239203cc09531280f1c9118edc1f1218c18247c13dc3455e7d783f440a919a1df47922d33ed8526deabd979fe4d12e6cef2a5707c045d

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\attention.png
Filesize
567B

MD5
1688dc013a46d66800b0c0683ad7bb43

SHA1
83a57258c3197dc1fd69f7dc893555e7c502441b

SHA256
e541cb9296ccf86493b878da480908dea3dcbf6437da2c3683d737d0c93cce98

SHA512
8552fe4ead1c34fdfcea0fa7dde294c1fce1e88e856d99c36f30f672d1ebb9eb198eae8a69f38e14121e000c73b6e2ae79b846fcd5c2d04ec01253ab653ad5fd

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\btns.png
Filesize
931B

MD5
f719268e754a88159b72ee7f9d3bb1f3

SHA1
8c5c129749792a001e654f1c61185d2467282070

SHA256
7530e65071e469580ecb2be7fef7215b0dc857a74c8fff834ad8c1c0f0b38477

SHA512
6960026f90fb1257cd1840f3c0914669e6f3081c441da9d2085a312a2b8fb1877c5474936d7be65bdc23689be91a1e8d63dd910a5dd424a6fa90d33e0650233d

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\check.png
Filesize
295B

MD5
7d5cd717db00796e2860dcd497f51070

SHA1
58c1a013d5ccdbeb876bc97d935f8d3c20e55a9a

SHA256
b754d70605198fcf95b7a47da63eeb1b62055c26d112849752d73ff27f6866e3

SHA512
8b96628120bead20312a3224416ecaf83daa5e020f4aff2fbc41064381b8cde547881b93a88b921a48ac4dffde168a25e3b471f1e9fd054ec69c5aea0f8ee046

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png
Filesize
25KB

MD5
b6b31a4d23c2664b87dc8bf1fcf8ff22

SHA1
17f27a514ef7119080be4ae9dc691010acdc43fa

SHA256
5ece2e217e6a50b2ecc6564601c1da92441c73a1a34a3c6c5d207d6726df8756

SHA512
5506ed1fba0e3fa471c83240266ff329fbb23ae862955a5bac358ae506c90d4c03227a710fc548ca5510eb711b95ecce75c63323c30766e3dd081c081b5829cd

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png
Filesize
646B

MD5
a71d60c90ab3baeccb1e5212f47a236c

SHA1
1edc658717eb5eae7ceca3f75e81c971dcb83bb2

SHA256
ecf2dbdf42e4d543f304857ed5bc58e91228ffcc41538a8ec3fb9c7fcefd63fd

SHA512
851a0c793a21f9cb4e03687ac3e41bd1c042c276b858c81a8eba9e5abef4ebba9449a0806f2ff043077ef04ed2f5f03ffa8c301d3d07e1a8a939a9537f4112a1

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\error2.png
Filesize
738B

MD5
074527951050744fd058ec84b7ea6a49

SHA1
64ce9939dcf20a04033e2ff0b3d7789a1b1b123d

SHA256
1ee798ab18501b2234f146de4898167500ce55c3d07e041ed847d0d1e89db84f

SHA512
1c6eec31f0e7f68090d608394fa8325b572d960337e58dd11e2531374e4d5abb452d3104a41f8f900d49ec6abf4ac66834613339971f026d8e2bb0cb1beb9fb2

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif
Filesize
657B

MD5
0e0ac8352cd69f396f271fa32f3ab554

SHA1
ed6d306a5033707f45477df3318a53d15b47cf43

SHA256
c2c34d6bf4e17b756954e409dc9b5663169d68997abd722ce1e86473b769f10c

SHA512
5d2528489c21600f16f04559500be3ebe9db5a1dc7bf9abc9c1312187b4b8b7bc5966f9eb2a38e26bff26c854a6d964fa156641fed9501cf0e7befedb60fd7e0

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png
Filesize
285B

MD5
7db33b5890d916426f77d585ab3c4fa9

SHA1
99a794c3a88803ae289c7ea6f0d733e22a3b799b

SHA256
5585318ea9be125540f00f04b05b29da3816ef97ce837a22a2eaee2d5d462d9b

SHA512
9800273f1e605b946dd553cbae650270c5bf2af7909a4836aa81907f9e30ca348a3552a1887e3357472ca1b93fa8361a17bee3fb742fb5a2d0c1b47a5a47c773

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\actions.js
Filesize
8KB

MD5
3b4a5f925a08bd18b636880b8d557077

SHA1
73ed8c3697681e7999bae4fdcc62867b263182ce

SHA256
48b8718ba8de855d6c937b23eb7ccc4f5482e6619de9261324c12a48ae6769dc

SHA512
aa5ffd3040a6eb964ed7c70d138e3201989f78551610e22585077fa86bff58740500d6309c339a2dded56481d04f7416ca97b22548fde4661f7da39c9600644b

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\jquery-1.11.2.min.js
Filesize
93KB

MD5
5790ead7ad3ba27397aedfa3d263b867

SHA1
8130544c215fe5d1ec081d83461bf4a711e74882

SHA256
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

SHA512
781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js
Filesize
10KB

MD5
631f38cfac458788af482eba736e5ac3

SHA1
b1d09def39ec74eff2c9e0aafe0a7c12e7650150

SHA256
13e6cf03cdd65a8174cce7b0cb40c9821d2aff04a79c3374e8664fb0abb5694d

SHA512
3ae47c895cd586b1dca8bdf65c58bc896b27837881cc42bb7b3d55c9a71ea9e857939a69c5146b445b64714996393d1ec9c0d95b18d18fd5cb48f02bb8a53f42

Download Submit
C:\Program Files (x86)\SogouDownLoad\npdownload.dll
Filesize
263KB

MD5
09c16c79a0093b38ef756c58c32d75e2

SHA1
d6721cc14a1dd1879a923b38fd046d6e8b0f40df

SHA256
a93cce637743104e4d418eca05f238405b3e97672163d8abd1ad429045f843b6

SHA512
eabb9237b5121e9755a01d4e9522513fbf5ea4594779d336fe373708933006b94d10a23a749efc623177296b1270337a63aab46d4990a0ee1f73df7ee8622f87

Download Submit
C:\Program Files (x86)\SogouDownLoad\npdownload64.dll
Filesize
302KB

MD5
8523eee6d4c49b110e6c19ecfd7e5620

SHA1
434ddf9f77f904812ef4c3c2329ce057b30dfdfc

SHA256
a4917bf56e25576632e808c5199c3c43eb21c866e4e6eb6747c79168f6044c57

SHA512
bb916842beac0a605675dda9bf240b2f75437a61bbdd3d89fd464694167db7addb9fd6dd2fce482b9670c9c0e46eb9b3952cf538fb555ade10a9787f4081934a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C
Filesize
471B

MD5
a685fbaedb32dcd704a5ca174dfc98ff

SHA1
56ba32d7eb642d3d1371c4bb95eb2f0b783f05c8

SHA256
8912a5419a7bea9c4311d61d515a06ceafa534aad5c016ef03418cbf305118d4

SHA512
4c94a9bbb75dc2af075b6e4a132e662f4427c86fb4469427a1de03ac33adbdb1887c8e57a65c6cf1f981ebb3ab9242f45dc47e458677f52097bffc7ae00e6c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_905D9FF52A32147C74DA1002ECE93FF3
Filesize
471B

MD5
3426abae74014209c360f104363b937b

SHA1
0889d4823541272a857bb636b1a25ef26daffbb0

SHA256
8aa7f99fdfd94cf44ab3ba8cfb94f3ff606d07aeac5e7412fb007b3ceddfc1d3

SHA512
ddf1c7777669189ee8649827e8f2893e750f6536591d1d2f4f5e08715756c9b56f925f07495de675b74a84d7b482b2806206f553cc501ddf9524a5ac16c1975f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C
Filesize
398B

MD5
f582d6dae430dbc5f3b26bd04652534b

SHA1
aee49d76a6844a671ac69480a81626e8b5327984

SHA256
a0ceca25cfc10e62a7cda5f121ad7794b88f95437a34efd1db8a1ed9597abbdc

SHA512
4614ac7e30e2fd7ae1d678c73a2167c77a6d4ce02642957bab1eb80c44d5bbfff8411599ee0d42061a45cf7c4a42a59b58e8a34815db9279d20671dfe87b7dcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7bf79f1ed58f560bbfd89071df1b49e9

SHA1
aed6dc7ccc6d51a99d0a6cb62ee429503dfe0637

SHA256
e0f2f7e63ea089538e9abe56c9a3233d8b5b859ff9bdf6569915ee43dd82f205

SHA512
4151265fa7389070d6411374935817a4ca47279c60588f4d26522f950720cccddf45b1d7380187edbdf126553aca7082b528202092ad476cc56314fb223c0d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_905D9FF52A32147C74DA1002ECE93FF3
Filesize
398B

MD5
db874c9795f86b4f540f991c3c99a0f9

SHA1
a3aca9d27754049da2a43a2a2aa027625390e46c

SHA256
b9580ecb2c2b182e2440174bcb74350582ad7315cde9f09632a1192f2d69174c

SHA512
a625bee43e8718021df471b650639e807ca9e5c8f1aaf42aa5493dfc12b26e574b0e127a147e4c2f46730a7bd1b7cdb0a4ed77b303536daf776e164701b36d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4386.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\63M9DL2H.txt
Filesize
96B

MD5
6f9c01fb41915600a79bd4e2b41abf8d

SHA1
1f5deffb444f78e32a1821b79da563d3de71a03e

SHA256
a370f30aa6425a97b32043feee6e57a62021d37ab22d91546d9ceb13d55aee3c

SHA512
e016148252db0654d3f72450a3bedaaab7307b988dec10f3105ab03b933aa100a5334f8042db4ae337ccc27402fd8dcd00d2ada218b9c624de3c640e612001c4

Download Submit
\Program Files (x86)\SogouDownLoad\XLDownloadCom.exe
Filesize
133KB

MD5
004dcd89684f7fc42d3c77edf80dfc92

SHA1
8a086552df8c17ad146518757689f9237e27b87d

SHA256
67510f7dd0476f12e07901ac0344d92186dd761a52398ee1e835421382094f1b

SHA512
3a60493e77a7e59147d2b75bed788062d7482d922062d63a40ba3a050013736ce28e1f6319ba3eb7faecc44de9332ff571c028ea8582270d614d9659bf2769ac

Download Submit
\Program Files (x86)\SogouDownLoad\tmp\ExternalApp.exe
Filesize
2.4MB

MD5
b58d945d3d2b83eb5199d60fc27d0e6a

SHA1
3b70e368422bab5ff123d1ef6c5779adb540ef5a

SHA256
905de1f8ab574888fa9dbe7bb5a060ca1c09f710fed2c98e3c2699e595343b79

SHA512
027b6ab2197451dae5224c6f3417120d3b7e1ca5cb1801e4a952cac4b832deeacd16955bb3cb3c13553317685609eac6a2202ce8d2ab85837963a5a1478eacdd

Download Submit
\Program Files (x86)\SogouDownLoad\update\UpdateService.exe
Filesize
154KB

MD5
44f5df9407679e7385a0a3a925fbc39b

SHA1
95681735e2b3e8d0296b39fb505a6e6644e2330b

SHA256
a1779be9ef6a3ec798578c0b79a279d34316872d8509eb37f62c98b2fe6af23f

SHA512
bf02965127b81da708e13b519b822903de9999b797bbd0ed6697a39e95279511c9e9044d793ef69d9a11f3d518fce1ba85250bbe58c6255f660a09bced35c63f

Download Submit
\Users\Admin\AppData\Local\Temp\minidownload.exe
Filesize
499KB

MD5
92611a7ef872df59c53eab1e76855a9d

SHA1
41351edd9c7a5587a2ba7793131205a8bc3896e8

SHA256
b655815e0b129134ccebd00f44eb87f85e72eb37a1879509e90f539dda4600cc

SHA512
1b07e6ef576751ee20e4d2c43031aa4d668b8dd3f58dd403db56fb9cce39c4c8646cb2c0268596c3df67f7fbbddefc017e5205f8f27612fb269caffa52536f0b

Download Submit
\Users\Admin\AppData\Local\Temp\nso4ECD.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/528-180-0x00000000002C0000-0x0000000000316000-memory.dmp

Filesize
344KB

Download
memory/1704-181-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-199-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1704-205-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2588-63-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2588-198-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download