Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\chrome.exe

"C:\Users\user\Desktop\chrome.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5172
Target ID:	0
Parent PID:	4004
Name:	chrome.exe
Path:	C:\Users\user\Desktop\chrome.exe
Commandline:	"C:\Users\user\Desktop\chrome.exe"
Size:	151040
MD5:	8A0DA8925B19D58DB5A209DEED075A5A
Time:	03:12:42
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x540000
Modulesize:	172032
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected SugarDump	Stealing of Sensitive Information, Remote Access Functionality
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Roaming\svchost.exe

"C:\Users\user\AppData\Roaming\svchost.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7328
Target ID:	5
Parent PID:	4004
Name:	svchost.exe
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Size:	151040
MD5:	8A0DA8925B19D58DB5A209DEED075A5A
Time:	03:12:58
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xe40000
Modulesize:	172032
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Drops PE files with benign system names	Persistence and Installation Behavior	Masquerading
Sample uses string decryption to hide its real strings	AV Detection
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates files inside the user directory	System Summary	Masquerading
Drops files with a known system name (to hide its detection)
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\svchost.exe

"C:\Users\user\AppData\Roaming\svchost.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7664
Target ID:	9
Parent PID:	4004
Name:	svchost.exe
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Size:	151040
MD5:	8A0DA8925B19D58DB5A209DEED075A5A
Time:	03:13:07
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xa20000
Modulesize:	172032
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Drops PE files with benign system names	Persistence and Installation Behavior	Masquerading
Sample uses string decryption to hide its real strings	AV Detection
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates files inside the user directory	System Summary	Masquerading
Drops files with a known system name (to hide its detection)
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

158.247.200.45

Details

Name:	158.247.200.45
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\chrome.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

https://www.nuget.org/packages/Newtonsoft.Json.Bson

unknown

Details

Name:	https://www.nuget.org/packages/Newtonsoft.Json.Bson
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\chrome.exe
Source:	chrome.exe, 00000000.00000002.4607705887.000000001C400000.00000004.08000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\chrome.exe
Source:	chrome.exe, 00000000.00000002.4600408690.0000000002811000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://james.newtonking.com/projects/json

unknown

Details

Name:	http://james.newtonking.com/projects/json
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\chrome.exe
Source:	chrome.exe, 00000000.00000002.4607705887.000000001C400000.00000004.08000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://www.newtonsoft.com/jsonschema

unknown

Details

Name:	https://www.newtonsoft.com/jsonschema
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\chrome.exe
Source:	chrome.exe, 00000000.00000002.4607705887.000000001C400000.00000004.08000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

158.247.200.45

unknown

United States

Details

IP:	158.247.200.45
TargetID:	0
Current Path:	C:\Users\user\Desktop\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	26133
ASN name:	FEWPBUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

svchost

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	svchost
Value data:	C:\Users\user\AppData\Roaming\svchost.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\E830DA85A0C79A6314FD

B6D8BCCDF123CEAC6B9642AD3500D4E0B3D30B9C9DD2D29499D38C02BD8F9982

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\E830DA85A0C79A6314FD
Value name:	B6D8BCCDF123CEAC6B9642AD3500D4E0B3D30B9C9DD2D29499D38C02BD8F9982
Value data:	00 80 00 00 1F 8B 08 00 00 00 00 00 04 00 ED 7D 7B 7C 5C 75 95 F8 B9 F7 CE DC 7B E7 99 DC 99 64 92 B4 49 33 6D 69 1D 9A 34 4D FA 4C CB AB 79 B5 0D 4D 9A D0 A4 85 42 31 9D 4C 6E D3 29 93 B9 C3 CC A4 6D 28 2D A9 A2 2B 02 D5 0A 22 20 08 14 5F B8 EA C2 8A 02 82 2B 2C AB 82 AE 8A AF 2E 56 EC 22 A8 8B CA E7 A7 2C BA C2 22 E5 77 CE F9 DE 79 64 92 02 15 7F 9F FD FD B1 93 CE B9 E7 F1 7D 9C EF F9 9E EF F9 9E EF BD 37 69 EF C5 1F 06 05 00 1C F8 7D E3 0D 80 07 41 7C D6 C2 5B 7F 26 F1 EB AF FF AA 1F EE 77 7D 77 EE 83 52 CF 77 E7 0E EE 8A 67 C2 A9 B4 35 9A 8E 8E 85 63 D1 64 D2 CA 86 87 CD 70 7A 3C 19 8E 27 C3 9D 7D 03 E1 31 6B C4 6C F2 F9 DC 67 D8 6D F4 77 01 F4 48 0A C8 EE DF 5F 93 6B F7 59 98 17 F6 48 FD 00 FB 90 50 05 EF D7 37 21 08 E3 F7 4E 26 CB 19 97 85 DE 00 85 2B 56 66 3E 7D 14 58 FB 3E 2A 4A FF 0A D7 FC 85 3F 37 62 BB 7D 20 DA DD A7 CC 30 C8 47 01 BC 78 D9 87 E5 6A DF 86 4D F2 1F D4 4F 2F 22 75 A4 37 14 D1 4D 59 73 5F 16 AF 7F D9 63 8F 6B 5F 41 EF A2 26 76 34 A5 33 E9 18 D8 BA A1 8E 3C D0 2B A6 96 5B 8B FF 9A D2 66 C2 8A 09 5D 49 67 6E EB E0 B4 72 ED A5 6A 3E 71 93 B8 6E E0 2A 4E 58 8B C6 98 5C 07 20 D9 F2 47 3F 5A F0 89 B7 F3 99 23 47 66 01 B8 17 2D 04 39 32 1B 11 58 F4 E9 0C DA CD 3D 89 0D 3A 32 75 84 D1 AC 65 E6 10 A6 10 56 4F 18 8E CA B1 28 D8 2C F1 DC 60 51 03 0E 52 05 0B 4D E0 76 37 80 9A 97 C9 2C A3 26 AC B9 A5 32 85 65 D4 A8 35 AF 54 E6 60 19 75 63 CD 2F C8 64 38 1B 65 4E 96 21 74 54 44 D0 2F DD 1E AD 71 6E 1A BB 4F 3D 85 3C 39 B2 00 59 D6 42 04 99 77 21 F0 EA 93 4E 6E 8E 2B E4 FB F0 00 BB 2A B6 A3 E6 D8 F3 40 9E 24 62 D1 D6 0C CE 8A 1A 89 60 ED 2C 32 E4 49 8D B8 68 A9 33 C9 52 00 B9 FA 1A D7 D7 72 F5 A7 F2 23 3E 6C 83 F9 58 71 11 9B 58 DE 8F 1E E6 68 80 45 F3 64 E5 00 A1 C4 72 15 58 2E 9B E5 2E B0 DC 36 CB 53 60 79 6C 65 B8 4D 98 DD EC 86 85 12 FB AE 01 F2 C1 4A 14 1E 0C 11 30 10 D0 8C AA 9E 80 7C B2 72 0D CE 92 AC 29 01 39 82 93 AB FA 02 4E 87 D3 EF 8C 0C 92 0D 0C 67 50 95 35 F2 02 B5 EA 78 D5 B1 EB CF C2 A2 41 2D 14 D4 75 BF C3 EF 38 1C 0F 38 0D CD D0 0E C7 2B 42 01 3D 14 41 93 AA 41 97 E1 0A 9D 54 82 6E C3 DD 58 95 46 4E CA 70 5D 87 13 23 45 1A C8 EA 8D 08 AE 00 43 2F B4 E6 28 69 CA 70 18 44 15 35 77 B0 06 D5 3D 29 05 3D 86 A7 D1 93 FE 14 36 99 6B 86 7B F2 1A 5E EC C9 27 CD D8 D3 89 72 08 A8 27 43 38 74 D9 AA 21 17 7E 46 27 1F 50 17 BA 22 8B 89 D4 42 91 B9 44 1A F6 34 81 54 4E 7E B9 06 BE FE AA 08 2D C1 66 27 AC C2 AB 8B 6D A8 1C 0C 90 E9 EA C8 74 B3 58 FF 05 21 6D D6 91 DB 16 54 69 B3 11 56 6B B5 08 6B B4 BA 23 B7 85 22 4D 39 D7 E4 36 F6 02 75 47 3E B1 84 BC 32 20 29 8E 50 04 57 84 EA D5 69 10 38 E8 C6 50 3A 83 83 D0 A7 8D 21 D2 8C 17 A7 D5 82 D0 A7 1D 0C A2 02 2E D7 E1 78 28 32 3F 5F DB 69 38 B1 F6 7F CD 58 5B CB E9 E0 82 0F A3 0E 1E 7B 1C E5 F9 71 68 42 55 AF 1E 59 4A 3D C8 B3 AE C7 C5 30 7B 41 E8 60 19 16 39 BA A0 AA 2A B2 0C F9 47 17 54 E3 B4 D8 68 8D E3 68 64 0E CD 8E 43 E1 E1 1C AC C0 A2 4E 97 2E E6 2E 44 0B 4F 25 A5 48 37 D5 50 71 7A 7E 23 E3 F4 38 A7 29 E7 B2 D7 9C 0A 69 E0 78 67 40 C8 A3 38 D0 9D A4 50 64 5E 89 75 06 94 19 C7 97 77 25 9F C2 86 99 5A 55 98 E6 E9 19 AB BA EC 39 A7 F9 F9 18 F6 EF B3 FB 0F 3A 42 41 67 C3 7C 1C 8D F3 56 D2 BF 02 9D 0F 7D B3 51 6E D0 41 33 D4 C3 F1 63 1E 5C 19 55 C7 A8 71 1A F0 49 47 50 37 F4 C5 DF 2F A8 E2 0D F9 94 A0 2B 14 74 37 2C 35 5C 86 FB 56 F2 5D 6A 85 7C 55 6E A8 02 C3 13 D2 5D 86 07 0D BA 9C DC 82 D1 63 3E 30 DC D8 28 AE 1C C3 C5 8D FA 0C DF E2 47 F5 42 FC 48 E4 F6 92 8D 9D ED BD 3C 15 93 34 47 E9 75 0E 48 4D D2 84 A6 77 10 46 AB 3B 3D 49 18 39 6B FA 36 C2 C8 6B D2 5F 21 8C A6 2A FD 3D C2 28 1E A4 8F 11 46 41 A1 6A B2 8A 61 35 C2 B0 7C 27 3C 3A 49 CB 6E D1 CE FA DA C8 0A EA 09 63 80 A3 7E 96 C0 67 4F 09 33 18 67 9C 70 21 86 6A 3F D9 2F B3 12 99 0B D2 E5 4E 48 1D A4 3A E9 39 88 45 56 51 DC 6D A5 B1 2E 48 F7 93 88 9A 48 6F 27 D1 EA 22 D1 8D F9 5A 47 4B 45 CF E6 45 AF 94 36 88 EE 63 8B 7A D4 92 5A 57 E6 45 87 4B 45 4F E5 45 2F 94 8A FC 5A 4E B4 48 2B 11 9D 9F 17 ED 2C 15 FD 63 5E F4 43 AD 44 C3 57 F2 22 87 5E 52 AB 59 CF 89 CE 2E 15 6D CF 8B B2 A5 A2 3B F3 A2 2F 96 8A 9E CA 8B 4E 94 8A CA 5D 39 D1 52 57 89 68 57 5E F4 91 52 D1 53 79 D1 89 52 11 02 5B 54 EE 2E 11 2D CF 8B 3A 4B 45 FB F2 A2 EB 4A 45 FF 94 17 7D AF 54 F4 9F EE 9C DB E8 9E 12 51 CA 93 AB 75 B0 54 F4 48 5E F4 ED 52 D1 7F E7 45 D5 DE 12 D1 1A 6F DE A3 4A 45 E9 BC E8 F0 54 91 27 B3 86 C2 A8 66 9D 45 61 B4 E1 CC 80 12 C1 80 E3 C6 0D 2E E0 88 9C 83 18 5E CE C5 4B FA 51 AA 87 61 48 B5 CE E3 3D 01 0B AE A5 82 18 4D 16 7F FB 44 59 40 39 19 C2 1D 7B 76 6E BF 12 EB 5F EC 4B 92 D2 D6 AE 94 51 0C 98 DD EC 80 5F E3 DE 5E C6 F1 3C D2 48 91 3C A7 40 1B 29 10 0A 3A 5A BF 84 05 5C 86 E3 56 6A 3A 82 E9 A2 3B 64 47 32 67 EB 11 4E 0A 0D 67 A6 99 62 B5 7A 22 BC 20 D2 41 4A E8 B8 39 5B 9D 88 45 BA A8 FB 08 A6 8F EE 9F 8F 50 61 43 75 58 D8 81 4A 6D E0 AE 8C 6D F4 52 72 A7 5A CB 38 3B 08 BA 43 41 4F 6B 8B 68 56 35 3C E9 EF E1 30 AD 95 D4 BA 97 E9 5F E6 69 1F D3 B2 2F 47 FB 0D 7F 45 64 BD AD 5E 99 51 D6 78 B9 E1 4F 87 49 8C 99 AC 7B 31 8A D3 91 1C D5 20 55 05 CB 8D F2 C6 B5 38 A2 6E B2 FD F9 04 36 92 C2 4D D4 96 61 18 14 68 03 46 A0 D1 F9 F3 DB 51 97 48 0F CA 0C 3F 6F 9F 86 41 BB 3E 76 08 0D 18 C1 FD 91 25 82 80 06 05 4E 64 0D 6F A4 97 BA AB 34 7C 02 F1 62 89 5E A1 55 83 14 0A 06 8D 60 E3 12 3D 83 06 57 17 18 5E AB 92 F2 A3 05 86 CF 32 04 E2 B7 82 8C 28 56 15 5D AD 4D 64 BE 13 75 B6 59 2B C0 A8 28 35 EB 09 34 94 07 03 3E EE 0D 86 FB DC 6F 9E C4 23 9B E1 40 1A 77 3B 11 FF 2B 8D CA 35 E7 20 DB 76 01 68 5B 2E E2 FF 6A B1 57 42 17 88 E3 46 83 9D E2 D3 FE EE 45 EC 36 FC D6 D9 FC 20 FA C9 07 80 CF 49 18 9B FB 28 36 CB E9 66 5F 2E 3E F5 B3 53 CB E9 8B A6 72 3C 72 E4 02 CE 09 1A 7B E4 C8 66 DB 9D 1A 96 E6 7C 29 9D A2 E9 18 A0 81 D1 F6 8E 2E E5 2C 6D A1 64 28 E8 74 8B 1F 03 3B 19 99 DD AC F1 39 C4 A0 7F F5 5E DE 31 3D 72 8D 16 AA F7 52 DA 89 95 E5 C3 F1 FA F2 FC 66 2A D7 97 E9 21 62 95 1D 17 F2 FA 72 B1 E1 EB 87 E3 D8 FC F1 E2 64 52 E7 9A AE 50 7D B9 28 AA 87 0C 47 C8 2E 27 38 99 6A CE 4E 22 5B C8 21 9C 8A 56 81 3A D2 5A 53 AD AD F6 80 DC 27 EA ED 69 D3 C0 D0 8A A6 AD C2 6D 4F 9C BA 48 E2 EC B0 12 DE F3 31 A8 27 3B CF C6 4D E8 8F C8 09 F0 7A 4C 4F E6 AC E1 09 89 31 68 F9 F5 47 19 89 56 E1 6E 7D 82 1A 48 DF 8A 05 E7 64 2E 44 99 16 B9 88 3A DA 46 D6 76 59 17 B3 2E 0D 2B 71 7D 5D 82 68 B6 89 33 6F D4 66 3B AF 52 43 6F AC 41 E2 52 24 AA AC 77 93 D5 87 A8 F2 0E 9A 34 5E 80 56 94 CA E1 3A 5D FC B5 13 55 86 3A 8E 67 1E A9 D1 67 23 B9 D0 72 38 5E 5B 64 BA D9 C2 52 B3 6D 3B E1 0C 56 84 22 C3 88 16 EC E1 C6 14 E5 14 F6 A8 A5 F8 D4 0E 7D 47 A0 4A 78 E9 37 C1 F7 A3 9C 6D 1C 70 11 E5 D2 6C 9B 46 8F 4C 87 5B B1 AC AA F0 7C E6 A8 70 37 60 60 E4 09 E1 D5 2A F3 62 B5 3B E7 59 71 E7 16 92 17 F4 37 9B 8F 1A 08 AF 86 3A E1 F7 2A 54 E0 3A A8 10 F1 91 32 15 90 EB DD 22 67 7F AA 89 B2 DF 11 E4 1D C0 EC DF A1 F0 DC B8 D5 D5 BF C2 26 AA 94 FA 70 55 4D 65 C4 A4 1A 55 91 9D 78 79 20 32 4A 33 59 15 90 2A 77 87 22 BB 58 70 FD A5 9C FC 57 7D 22 12 E7 A6 59 71 8D 15 3F 50 4B AD F3 40 F6 13 1A AA 2F B3 76 53 E0 FF 36 AD 9A CB 78 E8 0A 2E 2D 4F FA B7 C8 C8 60 56 87 B9 A8 28 5A BF FC 08 CA 7C 2E 94 35 FB 0B 32 B9 BE BC 3A 82 4D AB 7F 77 00 D7 BB 03 E9 D6 59 4C 1F A8 23 72 3F C1 CC 18 96 3D 98 24 DB 58 B6 A7 51 DA EC 92 AB 76 73 29 9C 9E FA 91 DD B4 5F D1 5D 98 45 14 17 D6 B1 07 A3 7D 1C 73 4E CA 0E AC B1 03 7B 76 86 76 BB 1B 5A 20 B4 DB E3 A8 3A EE D5 45 2E 5C A5 CD 19 16 1A 2A 86 F3 D8 91 E4 0E 4F 21 FF 6D 79 5E CB E7 D1 2A AC 47 9B 87 B8 CD AA 63 E5 F2 1C B1 B6 1D CA 71 CC 88 31 1F 97 F4 7A D7 49 79 07 EF 1F 3A 76 D4 3A 8B 02 97 5E 85 CA D2 81 B1 56 0B D9 BD 1C A9 BF 6A E8 FE DB F0 68 92 A2 99 69 7D 99 26 97 EA 8A 53 A0 52 85 A9 7A 55 D0 51 17 74 86 82 AA 8B D3 EA 50 AE 2E AA 7D E4 36 04 E5 72 55 10 87 AA 04 35 24 82 7A EB 0D B4 2E F0 E0 A9 9C A4 A1 52 72 DD D8 8B D9 BC A8 64 E8 47 30 60 1D AF 1B AA 1B 1A F9 61 F8 0D 2A EA A8 AF 1F 8A 0D E5 C4 D8 A8 E1 24 F1 F0 0F 77 DC 7F 9B 1D DC 54 84 2A 5A E2 78 D0 09 0D 4B 5C D4 2C 6E 56 8D 0B DE BA D9 FB 6F 43 5D 2A 8F F1 76 6B 68 42 23 DC F9 D6 5C F2 C6 1B 6F E4 46 9D CF FB FD E4 96 EC C7 FB F1 60 83 07 8E BC BD 1D 70 15 CA AA 49 56 E1 09 79 E5 FD F5 2C AF 3A EE 73 89 89 BB 44 B0 0C E7 87 70 C9 CB FB 37 70 D2 85 9E C5 DB 2D 07 EF A5 9A 5E 75 8C 23 E8 39 74 3C BA 9C 82 0D 1E 12 67 7B 34 7D 6A DD 6E 3A 0E 62 59 3A A5 15 26 FF 8E FC F9 52 81 CD BC 02 51 17 25 A7 28 0F CC 5E E2 AB C9 53 89 AD 7C 68 16 B5 B7 A9 50 02 17 03 95 A8 82 69 05 1C B7 E6 C7 AA 00 2E 58 98 45 ED 57 7A E4 FD 73 EC 91 7A 75 DE 9B 9A 04 07 37 28 0B 8F 92 6E 07 43 7B B1 89 98 8B DA 7A 1A BC 85 7D A9 E5 BB 5A 25 8A C8 06 D4 B9 17 4F C5 1A 1D 6F 54 FB 4C AA C0 38 E5 59 F6 78 6A 85 B6 32 A9 1A 72 37 0C 81 32 E7 98 47 F1 69 41 87 0B CD DC 69 38 73 45 AA 8E 9F 94 45 A3 58 AC D5 5E D7 86 F3 48 78 12 5B 1B 62 78 52 CA E7 61 86 D3 DD 10 2C B6 E7 57 B0 5D 7B C8 40 F7 B4 68 EE 6B 59 87 AA DD 43 55 BB 4F 4A 45 6B ED 79 9D F7 79 C3 EE 44 B9 FA 48 BD 0F 0B A8 AB DF AD A1 FD 14 8E 08 35 BB 33 19 8A 09 59 02 38 20 B7 08 24 22 5A EC 21 E6 5E 02 FB 78 AB B2 1D A8 C2 3E 72 AF CA F9 93 57 16 58 8E D6 8E D9 2E 43 8E 21 5C 06 BD 62 F6 01 92 42 43 05 C8 5A 91 5C 70 35 F4 48 5A AC AD 5F 52 F3 BA CD 29 D2 CD 50 AB 9F CE 4C CC A0 69 50 13 85 31 78 89 D2 22 BA 29 BC D2 D0 86 CA BF 05 69 B4 86 76 35 ED B7 6A 50 27 D4 E0 9B 19 6A D0 85 04 D7 36 74 6E DC A6 C4 98 B3 79 13 E4 BB 14 4D B8 C5 38 75 43 3D C6 AE 7F 9A 8D 18 6E EE FC C0 7A 9A 78 BB A6 FB 2D 6B 5E C1 F9 46 D1 38 0C 1D 15 29 1A 8B 67 F6 F5 3B 68 63 F3 86 82 F6 9D 02 1C AA 6E 6B 6C 78 0D 1F 52 76 D7 77 10 79 53 BD 6B 37 BA 22 E5 D3 17 CA CC 88 B4 52 59 CA 9E E7 11 2D 0A F9 76 1F 4F CC B7 6F 2C AC BD 24 B2 1F D5 78 E8 0E 68 98 0B 85 22 DE 19 8B 40 43 25 97 91 F7 D3 1E CA 25 1F 38 92 BC 03 0C 1F AA 86 1A FA 66 9D 94 C9 CF 31 23 5F D3 83 61 AD 78 9B DA 53 BC 4D 51 AE BE BE C4 E4 45 DB 67 CE 84 9E 12 47 36 BC A1 9B 1E E0 8D F5 00 85 35 68 FD 26 DD 52 2E 74 52 3D C5 5F 24 CE DF 3B 4B BB 69 3E ED 6E 1A 86 8B FA A8 29 E9 A3 C2 A8 68 6C 2F ED E3 CA D3 EE E3 94 A6 C2 13 41 E3 96 D3 32 15 35 3D AD B7 AA 5C 6F DD 6C B8 E7 DE DC 70 21 23 D4 B8 F9 B4 0C F7 36 3A 6D 48 BD 89 19 AB 8C AA C6 FE D3 32 E3 DB E8 F1 54 8B FA 94 AD 50 03 C5 54 F5 F4 1E 6A 6E 7A 80 83 D4 FB 0E 6C 2C 49 C4 A6 4C 5B B5 51 DD 78 D5 3B 98 B6 37 D3 84 94 98 A6 D7 AC DC C8 7B 78 82 57 4B 6F 3A C1 35 46 CD 74 F5 4E 63 82 DF A9 7A B7 4E F5 BF 52 6F 98 65 CC 6A BC E2 1D 78 C3 3B 54 CF CE F2 30 CF 3B B7 F3 55 3C A3 B7 5A 6C 4D 7B C7 9D 8D 0A CE 36 66 AF BE 58 FA 6B B6 DC 60 AD 51 1B AC 33 EA 82 73 42 C1 FA D6 C7 21 DF 06 C6 DC 22 25 EB 4F B1 37 FE 5D 30 3C E3 E6 28 05 E7 1A 73 71 FB 96 8D F0 AC 99 FA 96 F7 D3 31 42 34 79 00 EC CD C7 3E 1A 34 AC C1 B5 A1 18 E1 E4 BF 5D 7D DA 75 8D 7A 34 55 BD 51 6F CC 39 77 39 45 FC 19 F6 79 D6 FE B4 1B 16 CF 50 0E A0 8D E7 E4 F2 BF 5C A6 8B 47 14 CA 2B 1A EC 64 C5 50 0B D9 2A E7 80 CA D4 4C 50 64 5D AA A7 C1 57 34 B1 2D 8F 73 2A 48 A7 6A 2D E4 6E AD 92 D8 21 A9 39 4D B4 D6 93 4F 7E 8A 18 E9 9B 31 91 B6 0E 62 C3 55 C7 AC AB E8 72 FD 30 1F 0A EB 1B 6F B7 30 CF C3 63 3C 29 48 A9 14 3F 0B 68 A5 FB 33 2E C3 4D 0F 04 42 5C D4 3A 84 A5 8E 12 9D BE 2D D7 16 1D 70 42 B8 6F D3 99 C6 C8 95 36 3C D6 7B A8 28 D7 BF 35 7D 67 AE 70 EE 20 23 37 AC C5 59 13 19 B0 7B C6 74 FE C0 1C 1E 82 28 41 8D 1C 2D 3C 6C 38 77 94 27 AB 78 7C 14 CE AA 76 1F 17 73 92 7C FA AB 91 B3 72 89 31 E7 A5 1A AC C5 A4 AB 7E 5A EE E9 D1 56 1B EA E9 2E 04 92 E0 F1 50 E4 FE 15 F6 33 9B 55 B9 23 84 4F 16 58 8E D6 73 B9 E7 AC 7C EE E9 A3 F1 CD CB E5 9E 7A 91 5C 70 75 9E 02 35 14 D4 5A 47 9C 00 15 98 38 CD 90 80 6A A7 4A 40 5D A7 48 40 31 B1 C1 04 D4 85 09 A8 8B 12 50 D7 D5 B9 EC 11 51 3B 11 0B 7A 90 98 92 01 BA DE 4E 02 EA 15 83 75 19 DA 31 3E 0A 9D 66 23 86 57 24 A0 BD 34 D9 76 4D EF 5B D6 E4 04 D4 55 34 0E C3 8D 8A 14 8D C5 37 55 0B 6E A4 A8 FE 7B A9 BE 1F B3 BF DD C7 1F 08 06 42 C1 60 EB 1C BA 3F AC 1B 41 7B 42 AA F3 13 86 87 9A D9 B8 DA BC E4 80 B2 91 1B 34 15 FD 50 35 0F 37 3F 84 75 7C 88 B6 F9 FB 89 12 59 2D 26 5A AB AF A6 55 3A 55 28 32 5C CA 92 96 E7 05 25 D5 67 CA 77 0F 74 B1 F3 2C 83 53 55 9A 29 03 16 95 A0 E1 5D 85 5A 76 2A 3C A5 2E E6 C4 A2 A4 E1 C7 1C D9 7D 7C F7 B1 AA DD C7 D0 4E 68 15 4A 49 8D C0 B9 3F 3D 49 C9 F1 94 09 37 74 8A 1C 45 0B F9 00 1D 86 43 98 CC B3 80 72 F8 60 28 14 AC 6A 7D 9F CC 26 AE 2A B5 0F 66 1C AB 5F 91 C4 40 AA 4A EC 63 6F F9 AB 27 A6 66 05 53 53 16 DA 74 77 94 68 C5 27 72 A3 AA 38 73 B1 3D C2 57 B4 8E CA 4A 56 51 41 03 32 83 D8 59 8F 42 EB 2B 6F 9E 74 E2 9E DA 78 E9 29 FA 6F FE 1B F4 DF B0 FF

Signature Hits	Behavior Group	Mitre Attack
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

HKEY_CURRENT_USER\SOFTWARE\E830DA85A0C79A6314FD

CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\E830DA85A0C79A6314FD
Value name:	CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34
Value data:	00 4A 00 00 1F 8B 08 00 00 00 00 00 04 00 ED 7C 0B 78 5C 55 B5 FF 3A 67 66 CE 39 33 93 99 64 26 4D 9A B6 49 99 D2 87 D3 26 0D 4D 5F B4 D0 D2 E6 D1 47 A0 69 43 D3 D2 07 42 3A 99 39 4D A6 9D CC 49 CF 4C A0 A1 52 27 A2 57 2A 96 BF 28 78 2D E8 E5 75 F5 D2 7B D5 2B A2 50 54 04 44 D4 A2 A8 E8 5F E4 7A A1 82 A8 17 14 2F F8 FA FE 8A 5A EF 6F AD 73 E6 91 A6 28 F7 7E FF EF 7E FF EF FB DF 69 B3 CE 5E 6B ED BD F6 7A ED B5 F7 3E 99 B6 67 F7 FB C8 43 44 5E FC FC F9 CF 44 27 C8 F9 AC A5 BF FE 29 E0 27 7C CE E7 C2 F4 19 FF 93 B3 4E 28 9B 9E 9C B5 6D 28 9D 8B 8D D8 D6 A0 9D 18 8E 25 13 D9 AC 95 8F 0D 98 31 7B 34 1B 4B 67 63 5D 5B FA 62 C3 56 CA 6C 0D 85 02 73 5C 19 BD EB 88 36 29 1E FA BB 1F BE 64 16 E5 3E 4F E7 C6 82 4A 2F 51 07 10 CD A1 05 F6 00 C4 DC 49 89 6A A4 AD 3A 7A 13 95 9F F4 88 43 E7 8F 87 D6 BE 8B BB F2 DF F2 B3 F4 90 CF 89 7E A2 2D AE 31 1F F2 9C C5 C8 3B 88 AA DE 84 2F 26 7D A0 9F 51 81 1A C0 37 56 E0 AD 79 F3 60 9E 75 59 EB F4 15 5B D5 49 22 F6 B4 DA 39 3B 49 AE 6E D0 51 0C ED 9A D8 0F 22 D6 B6 DA 66 C6 4A BA BA DE E1 CA DA 38 A9 5F C7 99 6A BE D2 EF 3C 37 CA 10 1F 6D 5A 46 F4 99 F9 44 4A B1 43 7F 39 27 DE CC 67 A6 1A 9F 8A 68 2D 98 47 6A BC 01 0D 5A F0 B1 DC 34 3C 0B 10 E8 CD 4D E7 16 47 2D 37 83 5B 1E 6E 35 72 0B 56 79 17 D4 2E 52 24 36 E8 1A A1 C3 3C C0 6A 02 33 D0 4C 5A 89 A7 0A 8F 45 58 33 CF E4 79 84 C7 42 AD 73 CE E4 79 85 C7 D3 58 B1 32 4F A5 55 E0 F9 84 07 E8 9D 12 9F 05 66 50 6F 99 65 63 FA 91 6F 83 A6 C6 CF 05 C9 9A 0D 90 43 D2 06 AA 8C 82 4F C4 C9 80 D2 1C 41 92 54 85 1C AD 48 3E 97 D4 02 23 0B 2E CB 21 2A 5A 7C 2E 46 E7 41 50 0B 3A 53 E1 A9 79 EC 29 A2 E2 78 5D C6 EB C5 F1 13 E9 F1 10 64 08 FD FE 29 A7 B5 3A 20 B9 B7 B0 4E 71 76 9F C1 BA 9F D6 A6 4F A4 FA DD 69 E6 3B D3 D0 0C D8 BB 83 24 2F 23 AC 46 00 7C 4F 01 33 78 BD 05 48 F7 FA 0A D0 D3 1B F6 16 C2 78 1C 66 99 D6 02 0E E1 61 7F A9 79 6A C6 DC 78 33 BB 88 74 AB 05 CF F8 42 A6 C6 5B 01 4F 11 EB AC C8 E2 52 68 C5 4A 9A 01 9F 29 03 F5 85 6A 8C AE DF 57 88 70 B0 CF 63 BD 6A 59 2F D1 47 A7 8B E1 67 3F EB D3 30 B5 31 B7 88 B9 10 E0 AD 73 BA 4F 3D BA 1A 22 0A D1 09 23 0F 73 87 18 7D 8D C8 6A 13 ED CA F8 62 C6 1D C2 61 36 EE 30 DB 16 5F C2 F1 5B CA AC A9 A2 0B 35 C4 91 56 DA BC 53 21 31 A5 A4 7D 1C A9 1F B8 31 1D 88 2F E7 01 E7 73 AC A3 6A 7C 05 5B 7B 8E FF 28 16 8F 32 B7 DE 86 4D 23 77 CD 9D 7A 98 FD 75 D7 DC 06 2D BE 12 FC BB E6 4E 73 09 D3 A3 4A FC 02 F6 8B 43 9E E1 92 1B 41 BE B0 4C 6E 72 C9 33 0F B3 A7 EF 8A AF 62 56 03 27 90 A3 3B 1B 5C 2F F0 C6 74 3D E2 5A CF 71 85 2B 02 C2 B6 2E 42 6B DE A9 3A 27 12 21 8A 4F E3 91 45 2B E0 58 A5 91 63 B0 9F 02 A3 14 9A 2D CB E9 62 7A 79 89 52 C7 6D F6 F9 EF 15 F1 13 72 4D 42 73 5A 09 68 2D 9A 23 C5 F5 9E 6A AD 91 75 50 7F 5A AD 32 56 F2 DA 3D 1C 91 B0 9C 56 42 FE 95 0F 72 37 D1 F1 26 0C AE F5 46 BC 2B DF CB 24 8E 8E B5 96 6D 99 C3 F9 DE CE 11 E3 61 0E A3 83 27 AD 08 63 44 D2 02 E3 7D 11 5F CB 72 37 E2 6F DE FE E7 96 73 89 12 29 53 F7 FD E0 81 A9 4F 97 73 85 9A A7 38 CA B8 4A 5A 9D 62 2F AD F8 0C 15 D5 74 38 BA D5 25 19 24 FA AD 63 F9 2C 0E 2A 69 11 AD 65 F0 30 0A 99 B7 45 97 47 73 FD E1 7A 66 69 17 B1 2A EB D1 75 6E 81 E9 B9 0D 68 D6 EA 11 BD 6C BC B5 91 65 16 ED 39 9B E9 53 2B 55 3D D7 B1 A1 AC C3 0F 26 99 43 D4 EC 77 A3 7C AA F3 3F 91 21 F5 4E 86 D4 1A 13 52 44 E1 14 A1 F6 46 A7 5E 4F C1 CF 93 F0 E4 0B F8 81 10 72 72 44 25 14 10 AE 3D 5C 27 E2 8D 32 B3 BB F2 03 A4 9D 65 E5 2F 28 AE 7B 54 86 19 8E 0C 1F 7D 80 64 3F 82 0C C7 F8 80 1A 9F CD 89 81 0A A5 05 F5 1B D3 B2 1A 6C 08 1D 89 77 B3 44 66 56 69 46 BD 71 63 DA 09 8C A6 D7 EB C5 B6 18 56 37 D5 BA 98 4D 13 44 13 77 D7 6B E2 B5 07 EA AD 4B C4 E8 2A D2 5A 74 CD DA C4 63 9E 7D E3 45 C2 6B 44 45 E5 31 B3 C5 ED 5D A1 43 6F A3 BA A2 FD 5F 01 25 C4 BA 3B F5 CB 99 DE EA 29 69 62 6D AE 2C 87 67 77 8A 9B 58 5B CA 39 D6 F1 D7 6B 28 39 85 B7 B7 B2 67 15 19 67 ED E9 9F D4 33 44 FE B3 45 07 46 2D 25 D9 49 A6 C5 9C F8 10 76 BE 69 DB 8B ED 03 14 7E 7B B1 7D 1B 85 8F 97 63 78 12 A3 C2 EC 87 15 9F 47 2B B6 68 14 75 F2 D2 72 99 B5 B6 B2 F5 DA CA EB A8 18 E4 A0 7D 1E 07 B4 14 E8 2A E3 EC 81 0E E9 FE 7A 7F 31 B8 7A 45 D0 27 07 5A 77 02 AD 4F 08 74 BC 4F EC AE 22 BD 45 D7 DD 70 13 95 72 DE 7B 46 C4 69 6A AD 6F C5 EA 3F F3 11 D7 8D FD 02 B2 8E 15 63 1F A1 0F 1D A7 FA A2 CD DF C7 F1 A2 DA CD FD 38 DB C1 E5 4C 4A 76 5D 7D 7C 9B 13 EE FA 5B 83 7A 7C B1 D8 17 7B A1 ED A9 87 96 AD 31 62 F7 6E EF 3F BC 6C BA 11 AB 9E 7E 81 7A E1 77 79 D9 92 43 6C 3D B0 C2 54 F9 0C 58 F7 48 F8 93 17 FE C4 E5 F0 B0 0B 3F C8 75 69 A3 30 AB 4E 4E 7F 92 87 EF 5C FF D4 13 AD FB 9B 5D CA 85 77 70 8F 79 D2 E3 C4 27 BE F4 BF 5B AB 99 F3 C3 A7 7F F3 A7 D6 B6 15 D5 20 EB 36 76 96 91 FA F8 76 28 B6 F2 76 EE CC F5 5D B7 2F 2D 53 1F 66 EA 8B 42 4D 96 A9 3F 62 EA 93 42 3D 54 A6 3E C3 D4 07 84 7A 5D 99 FA 6B A6 DE 29 D4 1B CA 54 0D 84 15 37 08 F5 6F CB D4 18 53 47 85 7A 7B 99 7A 3E 53 FB B9 66 C7 CF E1 F0 FB 0F 5F C6 A9 B0 43 82 15 F1 B6 34 F8 63 75 E0 4E CD ED E4 2A 26 BC 99 BC 4B 63 D4 FC D2 28 DE 2B 2A C6 71 99 9E 16 F1 C9 C0 FA B3 0C 7C 8D 63 EB E4 C1 8A 1F 73 5B 9B 7A 6B 7C 17 7A 68 0D CE 33 B7 9B 91 69 2E 71 BA F3 E4 B5 83 01 F7 FD D5 01 F1 36 9E 67 C5 7B 8A 1D 97 B8 1D F9 99 BB 9C 3B BC 55 AA D8 34 87 54 5F 5F 3F 95 CF 97 1A 35 EF 26 EE 77 85 EC 1D 3C F2 4A 29 D3 11 A3 3E A2 2F F4 34 34 2B F5 87 FB 79 F8 B9 2C BF 79 21 D5 C7 F7 70 07 7F C4 6F DF 0B 8F F2 88 84 3B D7 00 F7 9B CB 49 9A E4 B9 90 FB A7 9A DC 25 10 A0 48 E0 AC C5 A0 58 FB D9 AD 0F 20 83 4E E0 A7 C9 AD FD B5 8B 3C 84 C5 C4 67 66 9C 39 53 BC A0 EB AB 50 84 43 46 AD D7 0F F7 7B 6B B5 E6 B7 E8 11 ED 56 0B D7 B5 80 EA 04 97 4F 01 D8 03 B1 10 C1 08 34 47 28 A2 4D 7D 9A A3 13 F1 B5 7D 77 4A E9 AC 1D 91 95 C6 72 F7 F2 58 6B 90 DC 83 38 F1 19 D8 E1 47 2B F8 43 15 FC 19 8B BC C4 17 C4 5A 67 5D E6 D2 AC D9 74 D9 24 AB 50 3D A6 5B FB B8 28 18 F5 F1 FD 52 05 F5 FA 5C 46 32 CB 3F F5 07 EE 5E CA CA 47 7C F5 7E 6B 98 7B 46 7C 81 53 D3 09 79 67 44 BC C5 EA 51 51 49 64 4E A7 4E B4 50 53 37 97 40 67 BF D8 BC C3 A9 19 AC CF 5B 9D FD 33 52 AC 7C 2A 2A 5D 96 CB B5 28 24 C5 8C F4 A9 A2 48 C8 AF D6 83 6D 59 4C F4 5B 23 6E ED F2 B7 E8 7E 77 46 A7 C8 05 26 16 34 6D 81 A3 C3 1C AA 5B E9 CC AB E2 F4 BE 7E 73 59 07 F8 90 EA 58 87 DC 01 56 21 67 CB 76 A1 1B 87 F9 28 2F 85 D6 CA 81 64 E5 A5 CC 36 58 A3 F2 B4 AE 62 9D 54 B8 27 E2 AD 8F E0 0C 61 5D 2D 93 CF 74 53 C7 47 11 DF 5F 3A DF 87 E8 82 0D D4 E4 D4 CB FF B2 0E 07 FF EF E9 80 33 2D C9 F9 25 E2 9C E2 D5 5B E5 FC 1E 24 9C BB C7 D0 C0 E3 1A 3C 62 81 D8 3C CA 1D 72 76 D4 F8 DB 24 2E 60 5D EB F4 38 2C 6B D4 B0 DE 8E A7 61 15 8A AB 3D 16 A3 6F 90 35 CE 3A 44 BD DF AE 2D DE 08 E3 EF 00 B8 16 87 76 6F D4 1B 5F E0 D6 A6 96 75 11 EF A1 69 7C C4 73 0F 91 4B FC 16 AA 68 00 54 5C 78 BD 87 10 4C 6F B1 DD E4 B4 A7 B3 8F 9A 79 A1 FB AD 77 4A CA F0 0D 2D 70 6A 61 65 72 38 17 95 89 C6 E4 DE C5 EE 72 DD 52 91 AF 8B E8 D6 27 8A FB 5A 98 BE F6 34 CD 2A C6 E9 4A AE AF EC 23 6F BC 85 2F 93 9A F5 37 EC AB F8 BB C5 DD D0 7E 2E 69 6A EE 7A 89 42 83 1B 05 0D 6B 39 7E A4 32 00 C5 6C 3F 8C BA 17 F0 EC CB DD C0 EE B4 3F CB 9B 7B 8C 0B FB D4 DC 7B DD 9A 6E 1D 65 8F 1A 77 B9 67 85 5A BD 1E 35 4E 8F 1A F1 1B 45 5E E9 9A 55 1B 88 06 E4 9E 55 EB 77 64 D7 06 B5 48 10 69 61 FD 2F EE 58 BE 7C 1D 9A 78 F9 8A 04 9D DB C6 3C 2E 7F EF A3 89 F7 30 FF D9 EF 61 FE 37 77 0F 3B 15 A6 48 10 B5 21 58 3C 48 86 23 06 50 3D 7E 93 84 E8 59 3A 55 E3 3A A8 AA 7C 7F 94 13 49 E9 AC 35 9D 82 73 A9 81 7D AF D2 DD F4 8E B9 8A 5B 43 DE 46 0F 2E 73 DA B0 86 9E 5E AF D4 38 F1 F1 10 8A 03 35 70 7C A2 CA E9 3A 24 B3 AA 22 D4 6B 39 35 F4 43 31 3E 07 1D C2 C6 E6 FD 41 95 7E 68 96 60 E7 30 16 32 A6 3E ED 9F FA B4 64 03 4E 3D 11 AF E4 35 87 53 32 AF 56 53 23 5A 03 DF C5 70 E1 85 51 3E 58 E1 73 8D 8A B8 EF 19 78 3D A9 B4 8E EA 76 3B 75 8E 73 65 18 B9 32 4D D6 F4 7F 31 D8 BE 7A 2C 00 5F 54 9B 14 6C 03 09 20 C1 D6 DD 60 FB E3 E7 71 00 DF CF CE 5F C4 0B 29 80 7D AB 22 33 83 88 C4 5B B0 97 39 A9 59 5B CE CD 2A 8A 54 9D 99 9B 91 40 C4 FF 26 32 C7 FF 17 32 47 3F 7B E6 E8 6F 3E 73 FC 70 B2 BF 9C 39 1A FB 7C 72 E6 84 CE C8 1C 59 C3 ED 29 27 33 AE 77 EE 1F 74 8B 93 13 E4 E4 11 11 B3 BF 85 9F 25 0A 91 9B 44 F2 AA 6F 35 9F 41 40 EB AC A0 F3 A7 8D C7 82 B6 4D 71 DE 7B 3A 7B 3C 57 09 CE 50 8A C4 1E FF 48 E3 78 40 6D 99 5B 1F 6C 9E A2 EA 16 EE 6C 01 2D 11 FB 80 42 CA EE 80 3E 75 67 50 57 AD 9B 41 3B 4F 6D 7E A1 B8 8F 47 39 47 38 37 54 4F FC 16 36 FC 83 E5 8D 9A DF 59 71 F1 69 14 7E FC 6F E9 8C F7 70 4D 4C FF 76 4D B1 8A 96 78 55 C5 BD 5F 8D 7F 88 2A DE CF F1 B9 64 A6 D0 DF EB C3 AC 53 4E 2B 41 BD C5 88 C3 9A E6 40 B3 8F 54 E9 38 8F 3C A7 EB 98 2D AF 1D E7 BB CB 50 CE 14 D8 0D E8 1C 19 7F E8 56 4E C1 DB 38 9B F5 F7 1A 8E AC 2A A3 65 4A 1C EE 6B 0E 3A 6C DD FA B0 53 82 75 91 BB B5 28 4D CD 7D 84 AB 3D 77 59 D0 9A 43 B0 B5 02 BF 0E 58 B0 D8 93 C7 1D 6C 06 BF F2 84 F1 1D 7D 17 77 28 EE 9B 53 B6 E7 AA A5 AD 8B 5A 97 2C 5A D2 B6 92 29 3E C2 41 80 4E C0 F4 D9 D8 69 E6 E0 D4 F0 0A 2E 19 B3 FB F2 76 3A 3B 98 E3 1E 35 58 D6 DF E0 18 6D EF A3 67 67 B9 F1 DA B0 BD 9B 5F F7 BE 02 FC 6B 3A F0 8E 8C 35 50 8E BB B2 A3 E9 AE 26 3F E4 D0 EB CA 12 DE 00 79 F6 7E 67 2F A4 59 9C 4F F8 61 1F 7C C4 3D EF 75 39 FE E0 77 9E FC DE 4D 8C F5 54 B4 15 97 C7 4F DD E5 39 AF A5 BF AE 3B 96 69 34 CD 97 AC D2 E8 6F 04 BE E6 39 16 AC A6 C7 F8 05 27 B5 79 57 FB 35 FA A3 C0 61 1F C3 95 02 B7 0A 3C 28 F4 26 6F 13 46 1D F3 30 FC B2 50 3E E0 1D D1 02 F4 05 CF ED B8 56 25 3D B7 EB 01 F2 7A 6F D7 C3 B4 D0 F3 EB 60 98 5E 0F 3C 10 D4 E8 E3 DE 63 68 6F F4 AE AA 0A D3 1E EF 46 45 A3 F3 C3 51 23 4C 5F 0A 70 9F 17 84 F2 3B 95 29 4D 34 0A 09 FF E0 39 66 68 F4 5D E8 A6 D1 61 0F EB F9 AE C0 75 80 EF F1 C7 FD 01 5A ED A9 C5 BC FB 95 35 9A 46 6F F5 47 8D 00 0D 85 3D 61 8D 7E A1 7F 07 39 38 5F FB BA 16 A5 4F A8 5F 07 F7 04 66 D1 E8 D5 F0 1A 50 0E F9 77 41 CF 1F E9 DF 00 C5 56 8E 54 6B F4 73 3F C3 76 E3 48 75 94 4E F8 79 D4 FB 82 0C BF 1A D8 05 F8 E9 D0 2E 48 F8 AE CA 12 DE 21 F0 1F AB 57 63 F6 8D 32 FB 1F 21 33 4C B3 94 55 55 01 7A 59 3B 16 0C D0 7D D5 9E 70 80 7E A5 32 7C 4E 65 7D 3E E5 63 8B 06 43 AB AA EA E9 FD 46 67 08 1E D3 58 CE 25 3A EB FC FB 2A EE F3 6B E8 1C A0 B5 D2 FF 2A 99 E5 43 C4 A3 6A 43 1B B1 C9 3C A1 30 FC 32 24 68 74 24 C8 5C A3 3A 6A 44 E9 E5 F0 D7 B5 7A 9A 17 64 99 D7 0B FD 71 58 BA 46 49 05 38 8E 0F A8 DF 01 EC D5 E6 C1 BA 53 01 9E 6B AE CA 56 B7 18 6C EF 34 81 CB 54 B6 BA 29 CC 96 EE 54 D9 6A F2 B3 C7 86 F5 A6 AA 28 D9 01 B6 BD 2B C8 1E BE 3B C4 FE 5F 88 59 38 7B D2 92 43 C5 55 F2 2B 23 53 DD 5D C2 7E 17 C8 54 F7 A0 CD 79 5D 43 17 85 33 D5 57 00 F3 48 32 FE 5D D5 CD 55 57 20 33 0D E1 C5 43 99 EA 77 21 3F 83 C2 FB 7E 35 F7 34 50 F7 B8 C6 DC 6F DC 6F 30 56 2D 52 17 84 18 C3 D9 49 78 03 61 C6 AA 71 8B 60 DE 77 AA 18 9B C2 B5 0C E8 03 01 07 6B 12 DE 93 7E 07 9B 2F 58 6F 35 63 75 D4 2A 3D 71 BE 25 C6 16 93 0F D8 4F 82 0E B6 44 B0 16 97 77 01 F9 B0 FC FE 5D B0 7A 5A 45 01 F0 BE CA 72 51 CD D7 08 76 9F 60 8D C0 78 8D 6D 90 9E 33 5D DE E2 30 F3 66 52 07 EA F7 C2 40 9D B7 8D BC 81 26 C0 86 C0 5C C0 F5 81 85 DE 08 6D 35 96 01 D6 79 56 02 FE 1F E5 22 6F 3D EA 79 07 E0 15 02 67 54 6F 00 AC 11 F8 33 62 F8 45 81 B7 09 7C 9F 72 31 E0 8F A9 07 70 B9 BE 15 F0 9A C0 76 C0 17 69 97 F7 D2 C2 ED 74 A5 77 16 2D AE 3E E5 59 4E 9F A2 04 E8 B8 7B 79 35 3A ED BB 12 30 14 62 38 37 F8 3D AC B9 B7 85 F6 A1 BD AF 9A 29 2F 09 3C 18 66 F8 7D 3F C3 EB A5 7D 81 71 A5 B7 37 26 95 A3 E1 7C AC 47 85 76 4E C0 06 04 8B 34 AC 0E 3E 0C EC BD 82 D5 1A 3F 0F 64 BD 0A DD E3 62 3F 32 72 C0 BE EC 62 5F 0C 1C 04 F6 BC 8B 7D 2F 78 2D B0 3F BA D8 78 E0 1D C0 BA 66 39 D8 9F D4 77 03 BB DC C5 FC 9E A3 C0 52 B3 CA F3 A9 74 CD AC B2 2E 2A BD 53 B0 7A E3 E3 E1 9B BD 2A 7D D8 1D 37 23 C4 D8 7D 13 C6 BD 30 61 DC 2B CE 38 DA EF 3F E6 9D C8 D3 69 CF B9 E5 71 FA 19 BC B7 9D EB 8C EB 0D 33 EF B5 D9 0E F6 92 EF 2E AF 4E 53 E6 39 58 42 39 EE 35 68 A7 8B 3D A2 7C 0E B5 7A CA 5B 1C EC C3 CA C3 C8 ED C6 B8 83 5D A0 31 56 39 43 80 6A E6 3B BC BD 90 E2 DC 2D 0A 54 1F FB 66 E8 9F BD C1 12 B6 4F FD 8C B7 AA 84 AD AA FE 82 B7 86 6A 5A 9C 71 1F F4 3F E2 AD 29 F1 9E 0B 7F D5 1B 71 B1 DA D8 53 E1 6F 23 37 86 DC 9E 37 E1 F2 30 9D AE 77 B1 E7 69 97 67 06 DD E3 62 BF 0B 3D E3 6D A4 15 0B 1D EC 55 60 4D F4 05 17 DB 17 7C C6 3B 93 D6 B6 3A D8 26 60 E7 4C B0 21 E6 CE 17 89 7D D4 FF 43 6F 19 7B CC F8 29 B2 F4 CB 32 2E 42 D7 1A FF EE 9D 4B 2F 9D E7 48 99 EB F9 AD 77 DE 04 29 F3 2B EC 3B ED 9D 4F D7 B7 39 3D FF D5 AF FA E6 D3 94 C5 0E B6 5D F5 FB 16 D0 6F 96 48 DC E9 0F 38 C0 B6 D0 22 39 CD 7F 45 5D 15 FA 84 67 21 F5 BA 58 8D AA 29 AD 34 24 D8 75 F4 33 B5 DE D7 4A EF

Signature Hits	Behavior Group	Mitre Attack
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

HKEY_CURRENT_USER\SOFTWARE\E830DA85A0C79A6314FD

018E06F57725563E4525700EDFFAFB1B062BF5D4B0E9FEE498507F0F8200FCDF

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\E830DA85A0C79A6314FD
Value name:	018E06F57725563E4525700EDFFAFB1B062BF5D4B0E9FEE498507F0F8200FCDF
Value data:	00 9A 34 00 1F 8B 08 00 00 00 00 00 04 00 CC BD 09 7C 54 45 12 30 FE E6 CD 64 66 32 93 04 86 84 99 1C 40 10 04 C6 70 07 84 24 9C DE 8A 88 20 37 8A DC 20 08 0C CE 80 22 21 11 50 50 50 50 54 50 F1 5C C1 0B 3C D6 7B BD AF 5D 77 75 3D 10 D7 5B BC 6F DD 5D D7 73 77 55 F8 77 55 75 57 F7 7B F3 26 89 BB FF 6F BF 8F 1F 99 D7 5D 7D 57 55 57 55 DF C7 4D B9 C8 F2 5B 96 15 10 7F FB F7 5B D6 EF 2C FA 37 DC 6A FE DF 2A F1 57 54 F9 60 91 75 4F FE F3 07 FC CE 37 F2 F9 03 C6 9D 32 3F D3 71 49 3A 35 2F 3D 63 51 C7 59 33 16 2F 4E 2D ED 38 73 4E C7 F4 B2 C5 1D E7 2F EE 78 F8 F1 63 3B 2E 4A CD 9E D3 AB B0 30 72 A0 CC 63 F4 11 96 35 D2 E7 B7 B6 BF FB D9 1C 95 EF 7B 96 DD 31 EA 0B 5B D6 C5 FD 2D 2B 48 B0 2F EE 14 EE 8E C2 F1 78 7F AA 1D B8 6D AA B7 65 E9 AF 65 1D 8C 70 F8 E7 B7 86 AF B5 AC D6 F8 5F 7F F9 83 FF AE 12 F9 8E B4 28 DF D9 7E 8F 46 BE D7 DF 2A 68 01 2E DC FF FE 29 F2 0D 9B 00 51 DF A3 0D 6F AF A5 73 96 2F 05 C7 C5 B2 5D F0 B5 9D 79 08 F0 F4 5E E9 4C 7A 96 70 63 DD A0 ED D0 D0 4B FB 3B E2 0D 17 FF 7B A5 E7 2C 4C 89 88 05 B2 CE 98 D7 E5 59 F1 0E 75 D7 13 EA 64 5B 79 D6 CF 95 E5 D6 35 9B CB 2D DF AF 6D A8 FC 57 D1 A7 95 95 2F CA 14 E9 63 56 5A FC 2E 89 94 6D 04 7F 97 78 23 90 29 7D 98 00 25 05 3C 72 7D 97 04 41 96 69 48 29 41 6E 61 48 D4 B2 42 05 F1 C2 9A 4B 85 2F 9C BF 1D 32 2A 0E 58 B1 40 52 B8 22 C5 79 B1 BC DA 65 50 D3 58 20 21 0B 49 FF 28 D2 5E 9F 48 09 34 45 2A 30 7E FA 27 01 49 B7 F2 59 4B 52 01 48 14 84 E4 79 E0 0A C5 8B C3 35 07 41 4D 43 B1 30 E5 9D 6F C5 F2 D3 65 10 57 F0 5B 44 B8 BB 2B F7 F4 E2 48 2C 52 FB 1D B4 51 80 87 08 70 30 19 12 70 AA 49 34 16 AD 7D 0D 11 60 23 20 BE CF 57 5C 10 2B A8 0D 21 44 30 40 A4 AB B5 37 2E 3C C5 85 56 AC 30 95 0F 09 23 E2 C7 B2 F6 62 22 AC 76 4C E6 88 D1 2B 64 83 6C 81 27 6A 54 97 D2 58 F0 FA 2E 65 D2 53 1E CB 4F 46 01 45 C9 02 4E D3 28 5A 1D 48 15 52 CD 75 15 DB B7 34 AB 2E 15 12 D2 2E 48 D9 26 52 45 58 49 D1 E6 70 62 52 71 38 16 8E 85 36 CD 1F F6 DC 3E 10 11 F9 89 49 85 F9 61 E1 9D 05 5E 6A 5D 91 15 2B CA 6A 5D 95 F8 3B 44 B2 E0 77 C4 CF 56 89 40 3B A4 C8 B3 88 D5 0E 17 7F B7 0B D7 37 06 BC 93 9D 6C 05 B9 40 FA 4D 95 E5 49 D1 5F 23 AB 44 78 A0 B2 1D B9 81 59 32 31 70 41 C3 AB 8A FB D8 D6 38 E4 63 C1 7B 32 7E 3A E3 93 BC 14 49 6F 07 67 1B E1 8C 86 36 09 02 15 84 91 3C C1 C2 9A 03 C4 27 14 DF 2E 70 E0 03 84 05 93 C5 90 F2 5E 88 5E 22 5C 85 35 50 C3 FC 2A 5F 00 F8 BB D8 BA C0 07 32 45 94 91 14 80 60 44 C4 97 24 8F 86 30 C7 78 C1 DE 53 7D 4C F7 20 32 5B 61 30 D9 16 18 25 60 E5 17 E7 C5 8B 83 35 C7 02 52 F3 62 41 E2 BB 90 E0 C1 8C 68 77 24 95 80 58 02 D1 A9 52 E1 A8 6C 2D F8 28 3F 96 5F 1B 47 2E 89 85 B1 3E 82 13 43 B1 48 32 48 42 31 16 14 94 09 C6 82 B1 BC 4D F3 AB 6F 13 CC 5D 1C 8D 17 17 D4 BC 00 41 D1 58 01 E5 0F 5C 97 29 83 B4 45 82 40 58 46 2B 3B D6 8A B2 6B 2D 40 E5 C2 D1 D1 12 DE 05 FB EC E2 58 2C 56 2B 2A 6D D5 9C 0D 99 B4 4A 3F 01 9D A0 42 C4 A8 6D 8D 00 AA 5B 6C 9F AF 06 68 17 2F 6E 13 6B 83 21 82 F8 B1 D6 A9 76 D0 EA 9A A3 29 E9 1F 20 69 7B 01 A9 EB 44 80 57 18 10 23 C0 A7 0A 80 99 25 8A 8B 63 C5 B5 11 47 5E 56 AC 40 34 51 74 A7 58 54 70 5B B7 FD FB F7 27 0A F6 0A 26 B3 BA 02 AA A1 DC 70 D5 21 ED 88 BF 00 FF 2B 44 46 AB C5 1F 44 29 82 D6 0B BE 10 22 05 44 66 CC F2 2B 62 45 82 48 2C 3F 51 C9 46 F2 44 49 DA F4 B0 5C D2 26 8A D2 C6 1F CB 23 84 05 63 01 D1 57 3B 20 87 AB 5E 50 FD 82 2D A5 8A 20 65 71 38 5E 9C 5F D3 07 FB 4D 4C 66 14 B1 04 CD 30 A3 A8 3F 16 A5 8C 0A 62 91 58 81 24 64 4C E4 04 B4 8E 41 66 7F 02 9E 27 7E 2B B1 9E A3 FE 20 F0 65 A7 2A 81 47 3A 02 3B EF BD 1F 31 90 FE 97 C0 5F 34 94 11 3C 1C 29 B0 C2 A9 4E 10 A1 33 72 ED 02 E0 DA 94 D0 B0 91 A5 6D 55 53 D2 33 6C 81 EE 2E 24 3D 85 EC 65 9F E0 A0 DA 8E C8 93 A9 AE C2 6F A7 BA 61 63 DA 84 92 49 E8 CE 07 29 02 C5 81 39 6B 8B 90 DA 41 8C 1A D9 DB 13 FB 47 4A D4 39 D2 73 D3 5E 08 CB 47 DC E6 A7 BA 03 8E DE 26 31 90 BE 44 14 16 C1 BE 14 AC F2 B5 83 7E DA DB 5A B9 CB 2A 22 CA F9 AC 36 C5 D6 AD 44 AF A8 F5 A8 45 48 91 A9 D2 5B C4 6F 87 4C 0F A0 91 EA D9 1F DB B2 67 A7 BB F8 AD 25 89 64 4F C2 40 61 BC 38 50 73 1A 94 1E 0B 10 E6 F3 44 A3 88 F9 45 23 53 BD A0 39 BD B1 71 A1 58 28 D5 47 F5 B7 BE E0 80 BE D6 8B E4 5D AA 1A 04 A0 52 2B 7D 45 11 D7 C7 51 AD 24 30 D7 64 3F 29 E5 84 00 00 FD 33 A9 38 10 0B E4 0B D2 9D 17 2C A6 46 C6 22 55 44 C3 E2 3E 05 96 D0 29 C0 9B 31 21 15 A0 EC E4 C5 43 44 C2 C6 03 0F B4 02 D4 D3 04 0D AC CA D6 BB 31 67 21 2A 23 BB 03 20 40 C0 95 3C 18 7E 06 80 94 83 E8 98 A6 7E A0 F0 A2 AB B1 33 67 D1 1B A8 93 3E 56 54 54 27 4E 6C EC 84 F5 8F 97 24 6B 50 59 D4 42 66 75 90 59 67 95 BA 7E 10 64 86 DE 4E AE CC E6 B5 34 B3 4E 2A 35 65 06 AE 60 6A 30 B0 22 FE 0C 81 88 80 B0 0A 20 58 77 E8 82 DD 4B E2 C9 E1 40 4E C4 55 48 F1 7B 71 9F 98 75 03 74 3F C4 55 65 2B 1D 3F A2 E8 7E A6 5F D2 3D 29 3A 78 30 73 66 B9 15 EC B8 0A C4 63 19 46 AE 2C 48 FA B9 8C 4C 46 84 46 33 FB 8B 45 C4 F9 65 56 B0 20 1C 0F A5 16 0B 87 15 0E 6E 9A 9F 5A 22 5C 1B 05 0F FB 0A C3 F9 E1 60 5C 80 F2 E3 A9 D3 05 30 75 86 F8 E9 9A 14 66 52 24 3F 75 18 94 BA 1D 4A 3D 1C 1A 73 04 CA 71 22 71 40 D5 DB D4 55 15 7D 06 58 9F D8 28 7F B4 1E DA A5 6A 1D 09 A6 9F 52 EE 68 30 FD A1 72 17 84 93 47 42 B7 CD AF 1D 81 1A 31 73 14 96 13 0B 84 53 47 A3 A4 11 DD 35 14 10 DD F5 18 A8 C4 08 EC C1 35 9F 50 8F 3D 16 FA 78 0F E0 F5 A0 A5 0C 87 74 DB 00 A8 F2 44 2C 98 EE 0C C9 46 42 B2 E3 50 CD 97 A6 7B 62 58 99 08 EB EB 0A 2B 4F 0F 82 30 54 FF C5 21 11 61 98 23 42 71 18 91 22 E0 C7 38 E0 48 5D C4 54 71 BE 9D 1E 2B C2 62 A1 F4 34 F1 41 0B 24 35 0A 65 6C 7A 16 C0 C3 D9 F0 33 01 9E 9F 0D BF 10 CA 18 45 3A 20 2F 75 3C 68 8D 22 21 FE F7 96 61 B3 97 C5 51 AE 0A B3 2C 8C DD 8D A5 4D 18 25 23 49 1D 2B 84 68 45 0B CD 44 AC 50 27 21 85 D8 02 37 62 0B 09 B1 85 06 62 8B B2 11 5B D4 04 62 8B 9A 46 6C 2B 11 C1 85 D8 D6 84 D8 A2 DC 88 8D 49 C4 B6 CA 81 D8 D6 39 10 1B 6B 1A B1 85 6E C4 16 B6 0C B1 76 71 1B EA 04 6D 04 D3 1F 32 9B 86 1A 27 8B BF 9F C5 DF 14 81 EA 32 4B FF 13 A2 C2 1A 2E 60 67 FA B0 6F A3 5E 86 F8 F7 FB 28 FE DD B6 33 FE C5 3E 8A BF C7 D6 F1 9D 7D AC AD F5 82 8F C8 67 65 46 43 BF B2 EC 68 A8 20 7C 44 90 B4 25 E6 D6 53 96 2C BA AC F5 25 88 35 30 DD 84 BD 26 68 10 EC 4A DA AB 70 EF 7A 82 95 98 30 1C 55 80 65 10 2C DC 3B 1F DD 31 74 4F 45 F7 18 E8 D0 CF 07 64 C7 85 3E 0A AA 3F D8 35 FD 25 C0 4E 10 B0 CC 8A C1 56 10 15 4F DB 05 A9 D3 84 5B B8 4A 53 D3 C9 D1 2E 35 8E 1C B1 40 6A B8 70 75 05 57 FA 47 95 5F 6A 27 86 06 12 C9 B1 D8 BE BD 68 74 E5 11 2D F2 24 2D CC 04 C9 71 F0 D3 0A 1A 31 1E 6B 0F 96 81 AC A5 2F 4F D5 52 E8 3E 70 04 2D 77 2D C1 60 E1 5A 86 54 2D 43 AA 96 42 06 C8 5A 82 34 70 D7 32 E8 AC 65 88 6A 19 52 B5 0C 36 51 4B B0 FF 4A 0A F7 82 AD 57 1C 06 17 5A 11 C0 4B 23 89 97 B6 89 3F D1 1D AD 8F 2C 3D 56 B7 25 1F 01 7C 83 CF 39 86 07 93 E3 21 01 7B 92 F8 02 C7 10 15 7D 22 D6 3C E1 8E 22 9F 4C 20 3E D9 34 3F 39 11 A5 6F 28 5E 9E 9A 04 91 83 89 CC 64 32 1F EC B8 08 26 60 38 35 85 9A 06 16 0A 0D 16 C2 B2 61 C1 D4 89 D8 06 08 21 3B 32 28 43 44 03 C8 B6 E9 6C 95 0F 21 DB C6 16 35 1B 3D 91 DC 26 0F 17 F7 09 5A 19 0B C7 EA 31 AB A3 68 D9 AA 8E D0 BE E4 49 50 CB E4 54 A8 61 08 ED 6A 19 E6 53 61 C1 B4 60 AD 25 A9 93 81 C0 8B C0 35 0D F5 47 C9 3E 9F D0 1E 30 F2 4F 5F 28 A0 42 47 C1 B0 21 BC 54 F4 88 0A 18 2B C3 D8 27 68 68 2E D2 B7 45 56 5B 91 71 21 D4 A1 71 3A E4 6E 57 1E BA B9 DD 89 89 69 7B A2 C2 05 9E 8E 62 50 68 4D 0B 95 4E 2B 9F 32 7D CF 55 F1 82 CA D2 42 34 B0 84 2D 18 A8 2C 12 5A E8 60 CA 11 6B 38 A5 38 60 C7 F2 2A FB 4F DA 1C 0B 4C 52 EE 58 A0 B2 F4 C4 3D 57 C1 67 2A 74 97 02 C1 C8 89 C9 50 A7 F8 BE 00 8C 95 05 73 F6 7C 24 FD B9 A8 B5 E8 4B 33 2C 69 79 CE 14 8E 20 29 4D 61 67 4F 2E CC 97 B1 85 B9 D6 73 4D 30 11 86 89 0E A1 6F 82 62 6C 1A C4 31 89 70 4C 26 20 8C 80 2B 82 22 BB 08 CA BD 48 45 71 14 B1 61 05 63 D1 74 A5 08 48 CD C6 6C 63 D1 76 93 40 37 50 FA 7D 01 D0 0B 3D DF 0C 16 D3 98 2F 56 E8 AD DF F3 71 9C 59 84 63 C0 38 8D 01 53 73 D0 98 11 E3 28 AB 8D 2F 39 17 08 62 4B 4D E7 63 C1 2B 42 04 33 46 7A EE DD DB 0A E3 ED 8B 8B EE 52 21 39 C7 E6 71 66 6B E0 99 56 56 CF C1 16 44 13 34 AA B0 1A C5 B7 15 F2 F0 29 50 EF 74 67 D1 84 CC 7C E1 EC 12 4F 2D 80 E4 5D 12 A9 53 E5 77 A1 FC 2E 92 DF C5 F0 15 CC 9E 4A 21 AB A7 96 40 55 82 A9 D3 A0 8E C1 54 1A 18 39 9C 48 65 90 E5 ED D4 52 62 FD 65 F0 C9 4F 9D 6E 39 8D 1D 65 A3 3D 45 7D 52 D4 E7 0C AC 4F 77 51 1F 18 42 05 A3 A1 F4 54 E1 2E 4F 2D 87 EC 43 E1 CA 76 93 52 67 02 6A 12 85 35 0D D8 4B D3 67 EA F0 70 5B 41 4E C1 10 34 6E 2E AC 99 02 31 C2 65 93 8A F3 42 42 D4 61 3A 32 23 28 BE E0 19 D1 67 85 40 42 1A 87 40 34 61 9C A0 30 36 56 03 B5 43 C9 04 08 18 54 75 2B B0 B5 E9 73 81 D8 2B 48 22 E4 03 EB D4 9D 29 34 5D 50 8C CF B0 51 F9 AA 1F E4 5B F3 2D 1C 64 89 31 C7 53 22 8D 9D DE 1F 94 5A 13 1B 16 C1 91 88 B0 D8 DA 86 1C D5 8F 63 AF EB 8A BC 15 C6 EA 88 FE 79 14 C7 A9 2C 9B 5C 1C 08 56 96 09 59 0F 95 16 23 4C D1 61 B0 E4 3C 2F DE 2A EE E3 B7 90 87 44 04 DB 9F DC 3D 40 18 AE 97 8B 66 44 82 A9 2B 61 A6 61 7A 0F 2B 18 94 74 88 D8 55 D6 80 84 4D 91 42 7D 2C 80 EF 6C 14 01 01 3B 39 A4 C6 0A FA 53 F5 22 52 A3 E8 FE 01 BF 4D EE 3C 70 07 D0 5D 65 BD 90 AC 15 B1 56 41 02 72 E5 B1 0B D2 A4 8F 15 8D 68 14 0C 1A 68 EC 22 EC F9 64 3B 18 B7 15 F7 F1 E1 FC 4C 31 D4 2F D9 11 F0 22 E5 5F B2 12 C2 4B 98 47 02 34 CF 23 E2 61 A9 76 6A 25 D8 52 82 0A B6 4A 01 43 53 48 01 F1 A7 18 F5 A6 98 FD 7D 96 68 DF 91 58 7D 99 18 EC 2F 91 FF A1 08 4B 35 80 06 6B 37 00 9B 6D 75 20 1C 56 55 88 72 61 AA A9 2D D4 AF 4B 24 D9 08 68 AA 17 C5 05 EA 40 30 DA 36 8C 76 83 0D 00 20 70 74 2F D5 FE 2C 11 F1 ED 90 EC 7B 61 AB 73 77 54 27 9C AF FA 1E 9A 9E 2A B0 92 39 3E 2C 90 04 A8 21 9A 1D 65 3D 27 E7 6C D3 1B 39 38 1F 30 07 3F E9 3B 05 2C 75 02 C0 22 00 8B 38 61 51 86 DD CB B0 02 86 3D C2 B0 42 86 FD 81 61 45 0C 7B 9E 61 AD 00 16 75 96 D1 9A 61 AF 30 2C 06 B0 02 67 BC 36 0C D3 F1 8A 01 06 91 D3 6F 30 AC 84 61 EF 33 AC 2D C3 BE 64 58 1C 60 C5 CE B4 09 86 E9 B4 A5 0C D3 69 CB 18 7F BA 2E E5 00 2B 77 D6 B9 02 60 15 4E 58 3B 86 E9 B4 ED 19 F6 3D C3 3A 70 7E 3A 5E 25 C0 2A 9D F9 75 64 98 8E 77 00 C3 74 7E 9D 18 F6 2F 86 75 E6 32 74 BC 03 01 76 A0 B3 8C 2E 0C D3 65 74 65 98 4E DB 8D 61 BA 8C 24 E3 4A C7 3B 08 60 07 39 CB A8 E2 78 3A 6D 77 80 75 77 C6 EB 01 AC 0D FD 52 F1 7D 71 9F 3C AB C2 C2 B9 D9 18 99 51 C1 CC FE 08 88 7B 3B F5 8B F8 92 41 A4 64 69 C8 AA 16 71 05 A1 63 FE F4 2F 90 E9 2A 11 58 0B E9 55 DA EF B2 D3 DA C9 1E 96 A5 64 5B 85 90 83 10 BF 14 FA 31 E6 01 F3 3B C1 08 0D 41 4A 22 68 2C 8A C8 3E 69 00 C6 62 56 78 A8 48 5A 6D C3 44 4E 30 F5 08 65 85 75 19 66 E1 68 20 E6 B7 87 43 2F 4D 54 F9 97 15 A2 18 AA 03 6F BC 8A 92 44 D1 82 0B 0A 95 35 A8 35 DA 7B 50 52 28 9C 7A 18 72 8A 57 25 A8 6D 0A 1F BD 6C 7F A0 A4 04 A6 45 82 55 17 DB 49 D1 DC A0 ED 6F E8 0D 62 25 D0 D0 07 3E 79 0D 7D E1 53 14 68 A8 66 39 11 B5 B6 88 6F 39 CA 4E 4A 12 4F 15 44 85 F4 C9 08 A4 53 6A 7F 82 20 BB 00 02 19 95 46 50 2B FA 83 04 17 79 08 C4 A5 0E 8E C2 64 C6 11 36 99 B9 80 6A AB 06 D6 D2 EC 50 3C 79 80 C0 29 16 5E D3 5E 42 1E 80 CC A0 1A 35 51 90 51 79 61 21 A3 56 8B 66 AC 08 26 26 45 84 9E 28 14 B9 55 5F AD F4 D1 36 7B 99 68 A3 4D 8B 17 4B C1 59 65 A3 59 69 27 03 22 62 E6 60 29 E8 3B D8 F5 50 65 21 1B EB FB C8 6F 5F F9 AD A6 F9 F8 90 05 D3 DC 82 8E B1 D2 8D 45 88 F2 38 A5 D9 01 BE 60 82 12 92 27 73 0F B2 44 3C 4E B9 A4 7E 27 BC A1 78 82 F2 22 5F E6 B2 28 D2 1C 79 AC A7 F5 27 B9 48 95 1E 12 56 32 B7 1F F0 32 FC A4 27 87 15 2F C3 62 59 23 FC A4 67 30 EC 60 80 1D EC E4 F9 01 0C D3 FD 6F 20 C3 74 BF AA 61 98 EE 43 B5 0C 9B CF 65 D4 31 6C 11 C3 06 71 FD 74 B9 83 B9 7E A7 71 BC 21 00 1B E2 8C 37 14 60 43 9D B0 61 0C D3 75 1E CE 30 5D E7 43 18 A6 EB 7C 28 C3 74 9D 0F 63 98 AE F3 E1 5C 17 5D C6 11 00 3B C2 59 97 23 19 A6 E3 1D C5 30 5D 97 A3 19 A6 EB 72 4C B6 BC 89 58 43 D4 98 CF D5 57 40 81 8F 30 FB 0A 42 8E 45 48 A9 01 19 29 FB 1D F1 8B 8D 6B 4C 98 DF B2 98 66 EF 18 B2 F7 B2 F3 84 B5 41 3C BE 14 9C 99 A1 C0 E3 E9 33 05 12 EC E4 E1 C2 26 A1 89 E6 2B 81 D1 D6 40 C7 A1 BA D6 8F 90 FC 7E AC FC 8E 24 BE F7 C3 EA B3 25 94 50 AC 4C F3 FD 08 93 EF 8F 65 4F 29 A5 92 9D 60 6B 94 E4 16 E4 5F C7 72 E5 38 6C 89 B3 0D 6D 74 1B DA 78 B7 E1 F0 16 B4 01 C6 A0 82 01 AD F6 20 93 EA A1 1C 14 06 1B 4B A1 D6 F1 68 0D 2C AB 04 43 14 12 22 DC 8A 01 48 70 07 84 87 12 93 A2 A1 E0 A6 F9 FD DE 09 4A DA 61 34 D1 FE 56 D6 95 60 3B 65 CB B9 31 40 17 31 14 0A 90 CC 29 1D 76 3A 88 36 72 0F 87 7A 28 92 82 98 13 36 2F 88 B9 BA 36 D0 A4 60 AA 06 E0 7D FD 22 83 E3 A1 14 05 39 06 20 A3 11 62 26 D6 31 99 29 FA 38 A3 7B F0 45 B1 C6 69 B1 37 4E 8F 6E 01 4E 45 45 84 6A 38 16 35 D0 7D 84 00 7F 1D 0A DE

Signature Hits	Behavior Group	Mitre Attack
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Memdumps

Base Address

Regiontype

Protect

Malicious

542000

unkown

page readonly

2811000

trusted library allocation

page read and write

E60000

trusted library section

page read and write

1B76F000

heap

page read and write

987000

heap

page read and write

1702000

heap

page read and write

7FFD342A0000

trusted library allocation

page read and write

1B28F000

stack

page read and write

7FFD33FF2000

trusted library allocation

page read and write

1B143000

heap

page read and write

7FFD33FE2000

trusted library allocation

page read and write

15EF000

stack

page read and write

299B000

trusted library allocation

page read and write

1B7A8000

heap

page read and write

E2C000

heap

page read and write

7FFD34310000

trusted library allocation

page execute and read and write

1AD9D000

stack

page read and write

30BF000

stack

page read and write

7FFD341A7000

trusted library allocation

page read and write

7FFD342C0000

trusted library allocation

page read and write

1402000

heap

page read and write

3110000

heap

page execute and read and write

E13000

heap

page read and write

7FFD33FED000

trusted library allocation

page execute and read and write

1BD0F000

stack

page read and write

1C20B000

stack

page read and write

1A840000

trusted library allocation

page read and write

7FFD33FFD000

trusted library allocation

page execute and read and write

3100000

heap

page read and write

1B900000

heap

page read and write

9C8000

heap

page read and write

99A000

heap

page read and write

950000

heap

page read and write

7FFD341B0000

trusted library allocation

page read and write

E87000

heap

page read and write

7FFD340F0000

trusted library allocation

page execute and read and write

1602000

heap

page read and write

1D0FF000

stack

page read and write

7FFD33FFB000

trusted library allocation

page execute and read and write

E00000

heap

page read and write

1AB90000

heap

page read and write

29E0000

trusted library allocation

page read and write

E56000

heap

page read and write

7FFD342B0000

trusted library allocation

page read and write

2957000

trusted library allocation

page read and write

7FFD34170000

trusted library allocation

page read and write

2EA1000

trusted library allocation

page read and write

7FFD34191000

trusted library allocation

page read and write

7FFD342F0000

trusted library allocation

page read and write

2EAC000

trusted library allocation

page read and write

12CE000

stack

page read and write

2EB1000

trusted library allocation

page read and write

1C3F9000

heap

page read and write

1251000

heap

page read and write

2A1B000

trusted library allocation

page read and write

1B74B000

heap

page read and write

7FFD340B6000

trusted library allocation

page execute and read and write

1229000

heap

page read and write

7FFD3402C000

trusted library allocation

page execute and read and write

BE0000

heap

page read and write

27C0000

heap

page execute and read and write

29DA000

trusted library allocation

page read and write

7FFD33FF0000

trusted library allocation

page read and write

7FFD34219000

trusted library allocation

page read and write

2DDD000

trusted library allocation

page read and write

1B2CE000

stack

page read and write

1B700000

heap

page read and write

7FFD34410000

trusted library allocation

page read and write

28E4000

trusted library allocation

page read and write

12C7000

heap

page read and write

2943000

trusted library allocation

page read and write

ED5000

heap

page read and write

1295000

heap

page read and write

12EA3000

trusted library allocation

page read and write

5F0000

heap

page read and write

540000

unkown

page readonly

1B742000

heap

page read and write

7FFD33FDD000

trusted library allocation

page execute and read and write

7FFD34280000

trusted library allocation

page read and write

2DD9000

trusted library allocation

page read and write

8F4000

stack

page read and write

124A000

heap

page read and write

B80000

trusted library allocation

page read and write

7FFD33FF4000

trusted library allocation

page read and write

1C400000

trusted library section

page read and write

13228000

trusted library allocation

page read and write

12B0000

heap

page read and write

1B711000

heap

page read and write

7FFD33FE4000

trusted library allocation

page read and write

7FFD340A0000

trusted library allocation

page execute and read and write

29E3000

trusted library allocation

page read and write

12953000

trusted library allocation

page read and write

7FFD341D0000

trusted library allocation

page read and write

1B726000

heap

page read and write

7FFD341B9000

trusted library allocation

page read and write

1BF0F000

stack

page read and write

E58000

heap

page read and write

E3B000

heap

page read and write

7FFD342D0000

trusted library allocation

page read and write

7FFD34090000

trusted library allocation

page execute and read and write

1B31D000

stack

page read and write

E21000

heap

page read and write

321F000

stack

page read and write

7FFD34420000

trusted library allocation

page read and write

1D310000

heap

page read and write

1C3F0000

heap

page read and write

7FFD33FED000

trusted library allocation

page execute and read and write

1BCFF000

stack

page read and write

1BE0C000

stack

page read and write

7FFD34392000

trusted library allocation

page read and write

1B745000

heap

page read and write

7FFD341C0000

trusted library allocation

page read and write

7FFD34080000

trusted library allocation

page read and write

1310000

trusted library allocation

page read and write

1330000

trusted library allocation

page read and write

13223000

trusted library allocation

page read and write

7FFD3402C000

trusted library allocation

page execute and read and write

99C000

heap

page read and write

7FFD3408C000

trusted library allocation

page execute and read and write

E5C000

heap

page read and write

E24000

heap

page read and write

1380000

heap

page execute and read and write

1247000

heap

page read and write

122E000

heap

page read and write

7FFD34250000

trusted library allocation

page read and write

7FFD33FFD000

trusted library allocation

page execute and read and write

322C000

trusted library allocation

page read and write

983000

heap

page read and write

14E0000

heap

page read and write

12EA8000

trusted library allocation

page read and write

1BF0D000

stack

page read and write

1B140000

heap

page read and write

B93000

trusted library allocation

page read and write

296F000

trusted library allocation

page read and write

277E000

stack

page read and write

7FF489D50000

trusted library allocation

page execute and read and write

7FFD34400000

trusted library allocation

page read and write

1C00C000

stack

page read and write

920000

heap

page read and write

1BD0A000

stack

page read and write

7FFD33FD3000

trusted library allocation

page execute and read and write

E62000

heap

page read and write

7FFD34230000

trusted library allocation

page read and write

1BAFF000

stack

page read and write

1BBFF000

stack

page read and write

123F000

heap

page read and write

1C10C000

stack

page read and write

7FFD34080000

trusted library allocation

page read and write

1B79E000

heap

page read and write

900000

heap

page read and write

7FFD34100000

trusted library allocation

page execute and read and write

BF0000

heap

page read and write

CCE000

stack

page read and write

7FFD33FE0000

trusted library allocation

page read and write

7FFD33FDD000

trusted library allocation

page execute and read and write

7FFD34086000

trusted library allocation

page read and write

29D6000

trusted library allocation

page read and write

7FFD34214000

trusted library allocation

page read and write

2945000

trusted library allocation

page read and write

2A19000

trusted library allocation

page read and write

DCC000

stack

page read and write

ED0000

heap

page read and write

12811000

trusted library allocation

page read and write

7FFD34240000

trusted library allocation

page read and write

7FFD34090000

trusted library allocation

page read and write

7FFD33FE4000

trusted library allocation

page read and write

2E09000

trusted library allocation

page read and write

BC5000

heap

page read and write

1B75E000

stack

page read and write

7FFD340B6000

trusted library allocation

page execute and read and write

1BC0D000

stack

page read and write

7FFD343F0000

trusted library allocation

page read and write

1C3FE000

heap

page read and write

27E0000

heap

page read and write

11CE000

stack

page read and write

1213000

heap

page read and write

7FFD33FF0000

trusted library allocation

page read and write

7FFD34390000

trusted library allocation

page read and write

1B69C000

stack

page read and write

7FFD34290000

trusted library allocation

page read and write

7FFD33FF0000

trusted library allocation

page read and write

1C2D0000

heap

page read and write

1B762000

heap

page read and write

2E3F000

trusted library allocation

page read and write

15F0000

heap

page read and write

7FFD33FD4000

trusted library allocation

page read and write

7FFD33FD3000

trusted library allocation

page execute and read and write

1B2F0000

heap

page execute and read and write

1C2D5000

heap

page read and write

7FFD343D0000

trusted library allocation

page read and write

13221000

trusted library allocation

page read and write

B90000

trusted library allocation

page read and write

7FFD341B2000

trusted library allocation

page read and write

9CD000

heap

page read and write

7FFD33FE2000

trusted library allocation

page read and write

1B782000

heap

page read and write

1226000

heap

page read and write

E70000

trusted library section

page read and write

30D0000

trusted library allocation

page read and write

1245000

heap

page read and write

EDE000

heap

page read and write

E37000

heap

page read and write

EC2000

heap

page read and write

1B5FD000

stack

page read and write

1B802000

heap

page read and write

1BE0E000

stack

page read and write

7FFD34170000

trusted library allocation

page read and write

7FFD34300000

trusted library allocation

page read and write

BC0000

heap

page read and write

B60000

trusted library allocation

page read and write

1B4FF000

stack

page read and write

12948000

trusted library allocation

page read and write

7FFD34270000

trusted library allocation

page read and write

7FFD34180000

trusted library allocation

page read and write

1BA02000

heap

page read and write

EB1000

heap

page read and write

7FFD341A0000

trusted library allocation

page read and write

7FFD34260000

trusted library allocation

page read and write

2E1E000

trusted library allocation

page read and write

1278000

heap

page read and write

7FFD34220000

trusted library allocation

page read and write

95C000

heap

page read and write

30F0000

trusted library allocation

page read and write

123D000

heap

page read and write

1302000

heap

page read and write

1B6FB000

stack

page read and write

1B24A000

stack

page read and write

7FFD343A0000

trusted library allocation

page read and write

BC0000

heap

page read and write

7FFD33FD4000

trusted library allocation

page read and write

7FFD3417C000

trusted library allocation

page read and write

1360000

heap

page read and write

1B3F4000

stack

page read and write

1400000

heap

page read and write

7FFD34000000

trusted library allocation

page read and write

EAE000

heap

page read and write

9C5000

heap

page read and write

1340000

heap

page read and write

7FFD340F0000

trusted library allocation

page execute and read and write

956000

heap

page read and write

2EAF000

trusted library allocation

page read and write

7FFD342E0000

trusted library allocation

page read and write

E50000

heap

page read and write

E40000

unkown

page readonly

F02000

heap

page read and write

12C3000

heap

page read and write

7FFD340C6000

trusted library allocation

page execute and read and write

1350000

heap

page execute and read and write

1D300000

heap

page read and write

7FFD33FF4000

trusted library allocation

page read and write

7FFD33FD0000

trusted library allocation

page read and write

1200000

heap

page read and write

A12000

heap

page read and write

B20000

heap

page read and write

7FFD343E0000

trusted library allocation

page read and write

FE0000

heap

page read and write

7FFD34090000

trusted library allocation

page execute and read and write

FA4000

stack

page read and write

1B9E0000

heap

page read and write

7FFD34180000

trusted library allocation

page execute and read and write

EB0000

trusted library section

page read and write

7FFD343C0000

trusted library allocation

page read and write

7FFD33FE3000

trusted library allocation

page execute and read and write

7FFD33FD2000

trusted library allocation

page read and write

12EA1000

trusted library allocation

page read and write

7FFD3403C000

trusted library allocation

page execute and read and write

1281E000

trusted library allocation

page read and write

7FFD343B0000

trusted library allocation

page read and write

B84000

stack

page read and write

7FFD33FED000

trusted library allocation

page execute and read and write

2E9E000

stack

page read and write

1C2E2000

heap

page read and write

1BC00000

heap

page execute and read and write

2800000

heap

page read and write

7FFD33FE0000

trusted library allocation

page read and write

12D0000

heap

page read and write

1BB0A000

stack

page read and write

1238000

heap

page read and write

3221000

trusted library allocation

page read and write

1502000

heap

page read and write

1B788000

heap

page read and write

There are 271 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
chrome.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportchrome.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
chrome.exe