Edit tour

Windows Analysis Report
https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?

Overview

General Information

Sample URL:	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?
Analysis ID:	1538471
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found dropped PE file which has not been started or loaded

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,18086677487560941788,16590809308708294037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5528 --field-trial-handle=1948,i,18086677487560941788,16590809308708294037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 6648 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

ImgBurn_822881.exe (PID: 7272 cmdline: "C:\Users\user\Downloads\ImgBurn_822881.exe" MD5: B0122909933A4243C6055AF589ABCF51)

MPC-HC.1.9.19.x86.exe (PID: 7836 cmdline: "C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" MD5: 987F955A9CC69937A6BF6C1B5C8DA647)

MPC-HC.1.9.19.x86.tmp (PID: 7856 cmdline: "C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp" /SL5="$902A0,16070317,185856,C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" MD5: 97E8309859A8F2E96633F3ABAD8727F0)

MPC-HC.1.9.19.x86.exe (PID: 7948 cmdline: "C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" /SPAWNWND=$90294 /NOTIFYWND=$902A0 MD5: 987F955A9CC69937A6BF6C1B5C8DA647)

MPC-HC.1.9.19.x86.tmp (PID: 7972 cmdline: "C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp" /SL5="$D0188,16070317,185856,C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" /SPAWNWND=$90294 /NOTIFYWND=$902A0 MD5: 97E8309859A8F2E96633F3ABAD8727F0)

mpc-hc.exe (PID: 1284 cmdline: "C:\Program Files (x86)\MPC-HC\mpc-hc.exe" MD5: 4A7D6D2643C29D1769DF5BA1D548185C)

chrome.exe (PID: 7380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/clsid2/mpc-hc/releases MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=772 --field-trial-handle=1588,i,684023181700708914,18408882208510045909,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Downloads\ImgBurn_822881.exe (copy)

ReversingLabs: Detection: 37%

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.9:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: z:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: x:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: v:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: t:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: r:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: p:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: n:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: l:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: j:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: h:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: f:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: d:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: b:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: y:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: w:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: u:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: s:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: q:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: o:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: m:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: k:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: i:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: g:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: e:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: c:
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	File opened: a:

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: s3.us-east-2.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: contentworldinc.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.9:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@37/131@11/116

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp

File created: C:\Program Files (x86)\MPC-HC

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\f49b3257-f62a-478f-b4f0-8489b6810a44.tmp

Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Mutant created: \Sessions\1\BaseNamedObjects\MediaPlayerClassicW
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Mutant created: \Sessions\1\BaseNamedObjects\'mpchc_setup_mutex'

Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe

File created: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp

Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,18086677487560941788,16590809308708294037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5528 --field-trial-handle=1948,i,18086677487560941788,16590809308708294037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,18086677487560941788,16590809308708294037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5528 --field-trial-handle=1948,i,18086677487560941788,16590809308708294037,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\Downloads\ImgBurn_822881.exe "C:\Users\user\Downloads\ImgBurn_822881.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe "C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe"
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp "C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp" /SL5="$902A0,16070317,185856,C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process created: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe "C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" /SPAWNWND=$90294 /NOTIFYWND=$902A0
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp "C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp" /SL5="$D0188,16070317,185856,C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" /SPAWNWND=$90294 /NOTIFYWND=$902A0
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp "C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp" /SL5="$902A0,16070317,185856,C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe"
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp "C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp" /SL5="$D0188,16070317,185856,C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe" /SPAWNWND=$90294 /NOTIFYWND=$902A0
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process created: C:\Program Files (x86)\MPC-HC\mpc-hc.exe "C:\Program Files (x86)\MPC-HC\mpc-hc.exe"
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/clsid2/mpc-hc/releases
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=772 --field-trial-handle=1588,i,684023181700708914,18408882208510045909,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process created: C:\Program Files (x86)\MPC-HC\mpc-hc.exe "C:\Program Files (x86)\MPC-HC\mpc-hc.exe"
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/clsid2/mpc-hc/releases
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=772 --field-trial-handle=1588,i,684023181700708914,18408882208510045909,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: secur32.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: schannel.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Section loaded: netutils.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: aclayers.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: sfc.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: acgenral.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: d3d9.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: avrt.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: explorerframe.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: ieframe.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: mlang.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Section loaded: onecorecommonproxystub.dll

Source: C:\Users\user\Downloads\ImgBurn_822881.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp

Window found: window name: TSelectLanguageForm

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-G1JA9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-E1CCJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-HRP5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-H1HG0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\is-VGCFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-E5DT3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-JOOLQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-LRKKH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-I8O7B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\is-I5VSF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\is-Q271V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-GB9QV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-GGN6G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-4J1PM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-S9DSV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CSEKA.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-NI1KP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-JLURM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-SG7J4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-KAM7D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-MNOND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-8I2S7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\CrashReporter\is-VLCLE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-5G7SG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-VJ7MT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\CrashReporter\is-0SBI0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\is-EHUPO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-A4ORV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-9U2V9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-8S77H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-GBT2L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-O5PQ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-HM83S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-A27KQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\CrashReporter\is-COO4M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-F602M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-FA2AP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-PF32S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-E6IKC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	File created: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-M8EL4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-2SST0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-276B0.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 271687.crdownload	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-F3958.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-MR3Q5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-RT0HS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-JNJ28.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-9F7JP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-6EMAN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-S4643.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-49CFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-0VBGR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-KGDJ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\is-E50CV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-4IFSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-N3ECJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-B3Q3D.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	File created: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-4LSBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-CIPNU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-A3VA9.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\f49b3257-f62a-478f-b4f0-8489b6810a44.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-Q09AS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-SMKID.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-NU37N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\LAVFilters\is-DCB43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\Lang\is-V0FJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\Program Files (x86)\MPC-HC\is-5RD0J.tmp	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC\MPC-HC.lnk
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC\Uninstall MPC-HC.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-G1JA9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-E1CCJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-HRP5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-H1HG0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\is-VGCFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-E5DT3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-LRKKH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-JOOLQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-I8O7B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\is-I5VSF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\is-Q271V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-GB9QV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-GGN6G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-4J1PM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-S9DSV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CSEKA.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-NI1KP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-JLURM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-SG7J4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-KAM7D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-8I2S7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-MNOND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\CrashReporter\is-VLCLE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-5G7SG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-VJ7MT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-A4ORV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\is-EHUPO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\CrashReporter\is-0SBI0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-9U2V9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-GBT2L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-8S77H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-HM83S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-O5PQ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-A27KQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-F602M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\CrashReporter\is-COO4M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-E6IKC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-FA2AP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-PF32S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-M8EL4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-276B0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-2SST0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-F3958.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-MR3Q5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-RT0HS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-JNJ28.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-6EMAN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-9F7JP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-S4643.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-49CFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-0VBGR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-KGDJ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\is-E50CV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-4IFSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-N3ECJ.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\ImgBurn_822881.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-B3Q3D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-4LSBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-CIPNU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-A3VA9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-Q09AS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-SMKID.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-NU37N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\LAVFilters\is-DCB43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\MPC-HC\Lang\is-V0FJK.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-0GQ2H.tmp\MPC-HC.1.9.19.x86.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Users\user\Downloads\ImgBurn_822881.exe

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\MPC-HC\mpc-hc.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://github.com/clsid2/mpc-hc/releases

Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	Queries volume information: C:\ VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	2 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Rundll32	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label
C:\Users\user\Downloads\ImgBurn_822881.exe (copy)	38%	ReversingLabs	Win32.Adware.Snackarcin
C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.19.x86.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CSEKA.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\CrashReporter\crashrpt.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\CrashReporter\dbghelp.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\CrashReporter\is-VLCLE.tmp	2%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\IntelQuickSyncDecoder.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\LAVAudio.ax (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\LAVSplitter.ax (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\LAVVideo.ax (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\avcodec-lav-59.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\avfilter-lav-8.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\avformat-lav-59.dll (copy)	4%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\avutil-lav-57.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\is-FA2AP.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\is-MNOND.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\LAVFilters\is-Q09AS.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-0VBGR.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-276B0.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-2SST0.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-49CFF.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-4IFSU.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-4J1PM.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-4LSBI.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-5G7SG.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-6EMAN.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-9F7JP.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-9U2V9.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-A27KQ.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-A3VA9.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-B3Q3D.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-CIPNU.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-E1CCJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-E5DT3.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-E6IKC.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-F3958.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-F602M.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-G1JA9.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-GB9QV.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-GBT2L.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-GGN6G.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-H1HG0.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-HM83S.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-HRP5E.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-I8O7B.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-JLURM.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-JNJ28.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-JOOLQ.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-KAM7D.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-KGDJ9.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-MR3Q5.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-N3ECJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-O5PQ3.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-PF32S.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-RT0HS.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-S4643.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-S9DSV.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-SG7J4.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-SMKID.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-V0FJK.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\Lang\is-VJ7MT.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\d3dcompiler_47.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\d3dx9_43.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\MPC-HC\is-5RD0J.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\is-EHUPO.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\is-I5VSF.tmp	0%	ReversingLabs
C:\Program Files (x86)\MPC-HC\is-Q271V.tmp	2%	ReversingLabs

Source	Detection	Scanner	Label	Link
s3.us-east-2.amazonaws.com	0%	Virustotal		Browse
www.google.com	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3.us-east-2.amazonaws.com	3.5.132.70	true	false	0%, Virustotal, Browse	unknown
contentworldinc.com	104.26.5.9	true	false		unknown
github.com	140.82.121.3	true	false		unknown
raw.githubusercontent.com	185.199.108.133	true	false		unknown
www.google.com	142.250.185.164	true	false	0%, Virustotal, Browse	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
3.5.132.70	s3.us-east-2.amazonaws.com	United States	16509	AMAZON-02US	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
104.26.5.9	contentworldinc.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538471
Start date and time:	2024-10-21 11:24:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@37/131@11/116

Process:	C:\Users\user\AppData\Local\Temp\is-0EOK8.tmp\MPC-HC.1.9.19.x86.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	A06D04466F4C4337402B04D8DD04166E
SHA1:	EB4D7B76778158614011641AC5E24DB1C0E50414
SHA-256:	6AE163B528231FE0AA35A03A6800F3228ACF75EC5CAD8C52183C3E2419079353
SHA-512:	8BC0E3B3D17CA080621E26B6D519797E3A16AB5E3B8B5520E63C870E897BCCED970376B4B84487E29147F94FBFCBA16FBB6C8E3D613202EBDB0ADD62FFCCC2B7
Malicious:	false
Reputation:	unknown
Preview:	Active..-----------------------..clsid2 https://github.com/clsid2/mpc-hc Code, Project manager..adipose https://github.com/adipose/mpc-hc Code, Transifex..nevcairiel https://github.com/Nevcairiel/LAVFilters LAVFilters author......Inactive..--------.._xxl <drevil_xxl@users.sourceforge.net> FFmpeg..Alexander Wild <alexwild@users.sourceforge.net> Code, German..alexmarsev <alexmarsev@users.sourceforge.net> Code..Armada <armada651@users.sourceforge.net> Code..Arto Jarvinen <ar-jar@users.sourceforge.net> Code..Attila T. Afra <attila.afra@gmail.com> Code..Beliyaal <beliyaal@users.sourceforge.net> Code..bobdynlan <bobdynlan@users.sourceforge.net> Code..Casimir666 <casimir666@users.sourceforge.net> Project founder, Code, French..demi_alucard

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:24:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.981947741488531
Encrypted:	false
SSDEEP:
MD5:	828EF788B4FD5376C6926CD825B4DF57
SHA1:	0A2FC45ECB3FB62AA16605E6DDD84B83642670F5
SHA-256:	AB6EFF14787876C3936E3DEF4E00764749E6E008C73628F8033A4C4D986FFA41
SHA-512:	97C00FF16780748AC392BF0836DE2E213635BDEA0CBD4C6764FDB49C90C30DC08C043BC362E8147FEE6FE7ACE9BB626D18C098C0569FE5685CEAFE5317AD0A66
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....${...#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUY.K....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.K....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.K....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.K..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY.K...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........B@.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Program Files (x86)\MPC-HC\Authors.txt (copy)

C:\Program Files (x86)\MPC-HC\COPYING.txt (copy)

C:\Program Files (x86)\MPC-HC\CrashReporter\CrashReporter_LICENSE.txt (copy)

C:\Program Files (x86)\MPC-HC\CrashReporter\crashrpt.dll (copy)

C:\Program Files (x86)\MPC-HC\CrashReporter\dbghelp.dll (copy)

C:\Program Files (x86)\MPC-HC\CrashReporter\is-0SBI0.tmp

C:\Program Files (x86)\MPC-HC\CrashReporter\is-COO4M.tmp

C:\Program Files (x86)\MPC-HC\CrashReporter\is-G979D.tmp

C:\Program Files (x86)\MPC-HC\CrashReporter\is-VLCLE.tmp

C:\Program Files (x86)\MPC-HC\CrashReporter\sendrpt.exe (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\IntelQuickSyncDecoder.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\LAVAudio.ax (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\LAVFilters.Dependencies.manifest (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\LAVSplitter.ax (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\LAVVideo.ax (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\avcodec-lav-59.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\avfilter-lav-8.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\avformat-lav-59.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\avutil-lav-57.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\is-8I2S7.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-8S77H.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-A4ORV.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-DCB43.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-FA2AP.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-KOOLH.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-LRKKH.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-M8EL4.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-MNOND.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-NI1KP.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-NU37N.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\is-Q09AS.tmp

C:\Program Files (x86)\MPC-HC\LAVFilters\libbluray.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\swresample-lav-4.dll (copy)

C:\Program Files (x86)\MPC-HC\LAVFilters\swscale-lav-6.dll (copy)

Windows Analysis Report
https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre