IOC Report
AUCHKVG4Ic.exe

loading gif

Files

File Path
Type
Category
Malicious
AUCHKVG4Ic.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\TableKnight\TableKnight.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\TableKnight\sqlite3.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\LTDIS13n.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\bjpeg23.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\darelvideostudio32.exe
PE32 executable (GUI) Intel 80386, for MS Windows
modified
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-2EFRQ.tmp
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-C09GP.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-EF30Q.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-KJ819.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\ltkrn13n.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\sqlite3.dll (copy)
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\uninstall\is-PKSRV.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\uninstall\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-1LPNT.tmp\AUCHKVG4Ic.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-MI0D5.tmp\_isetup\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-MI0D5.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\ProgramData\de121it56.dat
ISO-8859 text, with no line terminators
dropped
C:\ProgramData\de121rc56.dat
data
dropped
C:\ProgramData\de121resa.dat
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\darel.chm (copy)
MS Windows HtmlHelp Data
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\gdiplus.dll (copy)
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-6H2NB.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-G610Q.tmp
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-KUG1G.tmp
data
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-LHKR7.tmp
MS Windows HtmlHelp Data
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\is-MRTMC.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\msvcp71.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\msvcr71.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\uninstall\unins000.dat
InnoSetup Log Darel VideoStudio, version 0x30, 4966 bytes, 878411\user, "C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7"
dropped
C:\Users\user\AppData\Local\Temp\is-MI0D5.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
There are 21 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\AUCHKVG4Ic.exe
"C:\Users\user\Desktop\AUCHKVG4Ic.exe"
 malicious
C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\darelvideostudio32.exe
"C:\Users\user\AppData\Local\Darel VideoStudio 1.0.7.7\darelvideostudio32.exe" -i
 malicious
C:\Users\user\AppData\Local\Temp\is-1LPNT.tmp\AUCHKVG4Ic.tmp
"C:\Users\user\AppData\Local\Temp\is-1LPNT.tmp\AUCHKVG4Ic.tmp" /SL5="$20450,3407737,54272,C:\Users\user\Desktop\AUCHKVG4Ic.exe"
C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" pause darel_video_studio_1215
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 pause darel_video_studio_1215

URLs

Name
IP
Malicious
http://www.innosetup.com/
unknown
https://188.119.66.185/ai/?key=8f3f2b3ab14e166f251de6a5231e72eee7c4db7e40b82a8dcd6c946851e3008888325
unknown
https://188.119.66.185/1
unknown
http://www.remobjects.com/psU
unknown
https://188.119.66.185/p
unknown
https://188.119.66.185/priseCertificates
unknown
https://188.119.66.185//
unknown
https://188.119.66.185/n
unknown
https://188.119.66.185/mCertificates
unknown
https://188.119.66.185/8
unknown
https://188.119.66.185/rosoft
unknown
https://188.119.66.185/
unknown
https://188.119.66.185/ai/?key=8f3f2b3ab14e166f251de6a5231e72eee7c4db7e40b82a8dcd6c946851e30088883250aa15d105633775b0e650f2ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021ddd322619d4308a
188.119.66.185
http://www.zldo.narod.ru/plugins.html
unknown
https://188.119.66.185/6
unknown
https://188.119.66.185/en-GB
unknown
https://188.119.66.185/C
unknown
http://www.remobjects.com/ps
unknown
https://188.119.66.185/?
unknown
https://www.easycutstudio.com/support.html
unknown
https://188.119.66.185/allowedCert_OS_1
unknown
https://188.119.66.185/icies
unknown
https://188.119.66.185/g
unknown
There are 13 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
188.119.66.185
unknown
Russian Federation

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
Inno Setup: Setup Version
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
Inno Setup: App Path
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
InstallLocation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
Inno Setup: Icon Group
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
Inno Setup: User
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
Inno Setup: Language
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
DisplayName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
UninstallString
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
QuietUninstallString
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
NoModify
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
NoRepair
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
InstallDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Darel VideoStudio_is1
EstimatedSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\DTour
g_table_knight_i56_2
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2E01000
direct allocation
page execute and read and write
 malicious
2D56000
heap
page read and write
 malicious
568000
unkown
page readonly
2D4F000
stack
page read and write
534000
heap
page read and write
534000
heap
page read and write
60980000
unkown
page readonly
499000
unkown
page read and write
29B8000
heap
page read and write
400000
unkown
page readonly
60900000
unkown
page readonly
534000
heap
page read and write
2001000
direct allocation
page read and write
534000
heap
page read and write
4AB000
unkown
page readonly
840000
heap
page read and write
5BE000
unkown
page readonly
4AB000
unkown
page readonly
534000
heap
page read and write
316E000
stack
page read and write
270E000
heap
page read and write
34DF000
heap
page read and write
18F000
stack
page read and write
401000
unkown
page execute read
534000
heap
page read and write
535000
heap
page read and write
7CF000
heap
page read and write
2E70000
heap
page read and write
400000
unkown
page readonly
534000
heap
page read and write
1FE8000
direct allocation
page read and write
71E000
heap
page read and write
21D0000
heap
page read and write
6096F000
unkown
page readonly
348E000
stack
page read and write
96000
stack
page read and write
1FD7000
direct allocation
page read and write
312F000
stack
page read and write
535000
heap
page read and write
60901000
unkown
page execute read
55B000
unkown
page readonly
3497000
heap
page read and write
2330000
direct allocation
page read and write
799000
unkown
page execute and write copy
2FB8000
heap
page read and write
76D000
heap
page read and write
5F20000
direct allocation
page read and write
346A000
heap
page read and write
534000
heap
page read and write
2BFF000
stack
page read and write
278E000
stack
page read and write
3476000
heap
page read and write
6097D000
unkown
page read and write
49D000
unkown
page write copy
5CD7000
direct allocation
page read and write
40B000
unkown
page read and write
2E50000
heap
page read and write
23E1000
heap
page read and write
56B0000
trusted library allocation
page read and write
302E000
stack
page read and write
8E0000
heap
page read and write
326F000
stack
page read and write
2740000
trusted library allocation
page read and write
2003000
direct allocation
page read and write
3497000
heap
page read and write
201D000
direct allocation
page read and write
534000
heap
page read and write
3425000
heap
page read and write
6096E000
unkown
page write copy
2354000
heap
page read and write
411000
unkown
page readonly
343A000
heap
page read and write
2C80000
heap
page read and write
24D0000
direct allocation
page read and write
7CF000
heap
page read and write
4D2000
unkown
page write copy
400000
unkown
page execute and read and write
2330000
direct allocation
page read and write
3171000
heap
page read and write
534000
heap
page read and write
3461000
heap
page read and write
3476000
heap
page read and write
400000
unkown
page readonly
7D0000
heap
page read and write
534000
heap
page read and write
530000
heap
page read and write
3530000
remote allocation
page read and write
B4E000
stack
page read and write
30E0000
direct allocation
page read and write
2C7F000
stack
page read and write
2E40000
heap
page read and write
4D7000
unkown
page readonly
19D000
stack
page read and write
2910000
heap
page read and write
4D0000
heap
page read and write
D9E000
stack
page read and write
2F8D000
stack
page read and write
880000
direct allocation
page read and write
346A000
heap
page read and write
75F000
heap
page read and write
534000
heap
page read and write
401000
unkown
page execute read
882000
direct allocation
page read and write
2E55000
heap
page read and write
3530000
remote allocation
page read and write
400000
unkown
page readonly
28BD000
stack
page read and write
1E0000
heap
page read and write
71A000
heap
page read and write
401000
unkown
page execute read
534000
heap
page read and write
78F000
unkown
page execute and write copy
2570000
heap
page read and write
860000
heap
page read and write
2350000
heap
page read and write
31AF000
heap
page read and write
2144000
direct allocation
page read and write
5F1E000
direct allocation
page read and write
20F5000
heap
page read and write
334E000
stack
page read and write
1FF4000
direct allocation
page read and write
534000
heap
page read and write
2C4E000
stack
page read and write
534000
heap
page read and write
534000
heap
page read and write
510000
heap
page read and write
52D000
unkown
page readonly
535000
heap
page read and write
270C000
heap
page read and write
534000
heap
page read and write
358F000
stack
page read and write
DB0000
heap
page read and write
534000
heap
page read and write
534000
heap
page read and write
299E000
stack
page read and write
3230000
heap
page read and write
366F000
stack
page read and write
3235000
heap
page read and write
411000
unkown
page readonly
534000
heap
page read and write
870000
direct allocation
page read and write
430000
heap
page read and write
900000
heap
page read and write
31F0000
heap
page read and write
534000
heap
page read and write
5D12000
direct allocation
page read and write
78F000
heap
page read and write
10000000
unkown
page readonly
5D05000
direct allocation
page read and write
269C000
heap
page read and write
3530000
remote allocation
page read and write
29A0000
heap
page read and write
27C0000
heap
page read and write
2900000
heap
page read and write
534000
heap
page read and write
401000
unkown
page execute read
5E0000
heap
page read and write
2EEC000
stack
page read and write
7CF000
heap
page read and write
2BF0000
heap
page read and write
ACD000
stack
page read and write
534000
heap
page read and write
7C8000
heap
page read and write
534000
heap
page read and write
5BB0000
direct allocation
page read and write
499000
unkown
page write copy
3171000
heap
page read and write
5EE000
heap
page read and write
3499000
heap
page read and write
78D000
unkown
page execute and write copy
820000
heap
page read and write
534000
heap
page read and write
400000
unkown
page readonly
20F9000
heap
page read and write
9C1000
heap
page read and write
401000
unkown
page execute read
5E9000
heap
page read and write
534000
heap
page read and write
5D9000
unkown
page execute and write copy
312F000
stack
page read and write
4C0000
heap
page read and write
32BD000
stack
page read and write
21E0000
heap
page read and write
30F0000
direct allocation
page read and write
6097B000
unkown
page readonly
534000
heap
page read and write
2E50000
heap
page read and write
40B000
unkown
page write copy
797000
unkown
page execute and write copy
295E000
stack
page read and write
3497000
heap
page read and write
31F1000
heap
page read and write
2098000
direct allocation
page read and write
9E3000
heap
page read and write
1FD8000
direct allocation
page read and write
3171000
heap
page read and write
78B000
unkown
page execute and write copy
534000
heap
page read and write
40B000
unkown
page execute and read and write
3171000
heap
page read and write
75B000
heap
page read and write
534000
heap
page read and write
34DE000
heap
page read and write
9B000
stack
page read and write
40D000
unkown
page write copy
908000
heap
page read and write
344F000
stack
page read and write
30F0000
heap
page read and write
2080000
direct allocation
page read and write
29B0000
heap
page read and write
270A000
heap
page read and write
20F0000
heap
page read and write
534000
heap
page read and write
30E0000
direct allocation
page read and write
5F22000
direct allocation
page read and write
1FE8000
direct allocation
page read and write
3412000
heap
page read and write
2E39000
direct allocation
page execute and read and write
7CF000
heap
page read and write
31AF000
stack
page read and write
2370000
heap
page read and write
5C80000
direct allocation
page read and write
710000
heap
page read and write
30F0000
direct allocation
page read and write
2091000
direct allocation
page read and write
356E000
stack
page read and write
534000
heap
page read and write
788000
heap
page read and write
3463000
heap
page read and write
20E0000
direct allocation
page execute and read and write
9F6000
heap
page read and write
2360000
heap
page read and write
3497000
heap
page read and write
9C000
stack
page read and write
3171000
heap
page read and write
49B000
unkown
page read and write
2091000
direct allocation
page read and write
4CD000
unkown
page readonly
2FEB000
stack
page read and write
5F24000
direct allocation
page read and write
781000
unkown
page execute and write copy
341F000
heap
page read and write
1FD0000
direct allocation
page read and write
33BD000
stack
page read and write
77A000
heap
page read and write
10001000
unkown
page execute read
2E3D000
stack
page read and write
32F0000
direct allocation
page read and write
797000
heap
page read and write
283D000
stack
page read and write
534000
heap
page read and write
10002000
unkown
page readonly
3476000
heap
page read and write
49A000
unkown
page write copy
4D0000
unkown
page write copy
2710000
heap
page read and write
7CF000
heap
page read and write
789000
unkown
page execute and write copy
19C000
stack
page read and write
2FB0000
heap
page read and write
There are 250 hidden memdumps, click here to show them.