Adobe Flash Player 12.exe is usually located in the 'c:\downloads\' folder.
None of the anti-virus scanners at VirusTotal reports anything malicious about Adobe Flash Player 12.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Adobe Flash Player 12.exe does not have any version or vendor information.
Adobe Flash Player 12.exe is not signed.
None of the 55 anti-virus programs at VirusTotal detected the Adobe Flash Player 12.exe file.
The following information was gathered by executing the file inside Cuckoo Sandbox.
Successfully executed process in sandbox.
{ "downloads_file": [ "http:\/\/www.bing.com\/favicon.ico" ], "file_created": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF911E256C5268740C.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFE31CB9632DC5E3D3.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{AC7EBBCA-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF289872C7463083BD.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF0114216759C89F09.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF0971740A2F76B13D.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC7EBBCB-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF3642F304449DCDCA.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF29DA12936A2C623D.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF9DF5133F5D3E1699.TMP" ], "file_recreated": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "\\??\\C:", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "\\??\\MountPointManager", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "\\Device\\NetBT_Tcpip_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\Device\\Afd\\Endpoint", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "\\DEVICE\\NETBT_TCPIP_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\??\\Nsi" ], "dll_loaded": [ "C:\\Windows\\system32\\pnrpnsp.dll", "DNSAPI.dll", "SHELL32.dll", "UXTHEME.DLL", "C:\\Windows\\system32\\ole32.dll", "dwmapi.dll", "ImgUtil.dll", "C:\\Windows\\system32\\MSCTF.dll", "PROPSYS.dll", "SspiCli.dll", "ole32.dll", "USER32.dll", "msfeeds.dll", "C:\\Windows\\System32\\mswsock.dll", "Shell32.dll", "C:\\Windows\\System32\\wship6.dll", "dhcpcsvc6.DLL", "rpcrt4.dll", "C:\\Windows\\System32\\wshtcpip.dll", "urlmon.dll", "mshtml.dll", "apphelp.dll", "kernel32.dll", "CRYPTBASE.dll", "oleaut32.dll", "C:\\Windows\\system32\\napinsp.dll", "schannel", "WININET.dll", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "MLANG.dll", "IMM32.dll", "C:\\Program Files\\Internet Explorer\\sqmapi.dll", "comdlg32.dll", "C:\\Windows\\System32\\fwpuclnt.dll", "rtutils.dll", "IPHLPAPI.DLL", "RASAPI32.dll", "profapi.dll", "dhcpcsvc.DLL", "USERENV.dll", "VERSION.dll", "RpcRtRemote.dll", "user32.dll", "MSIMG32.dll", "CRYPT32.dll", "C:\\Windows\\system32\\rsaenh.dll", "C:\\Program Files\\Internet Explorer\\ieproxy.dll", "NTDLL.DLL", "shlwapi.dll", "iphlpapi", "UxTheme.dll", "comctl32.dll", "CRYPTSP.dll", "C:\\Windows\\system32\\msimg32.dll", "API-MS-WIN-Service-winsvc-L1-1-0.dll", "msctf.dll", "C:\\Windows\\system32\\xmllite.dll", "sensapi.dll", "IEShims.dll", "C:\\Windows\\system32\\NLAapi.dll", "C:\\Windows\\system32\\IEUI.dll", "SXS.DLL", "ADVAPI32.dll", "advapi32", "SETUPAPI.dll", "WS2_32.dll", "IEFRAME.dll", "wintrust.dll", "USER32.DLL", "ntmarta.dll", "API-MS-WIN-Service-Management-L1-1-0.dll", "rasadhlp.dll", "dnsapi", "OLEAUT32.DLL", "RASMAN.DLL", "IEUI.dll", "API-MS-Win-Security-SDDL-L1-1-0.dll", "wininet.dll", "SHELL32.DLL", "OLEAUT32.dll", "DHCPCSVC.DLL", "RPCRT4.dll", "C:\\Windows\\System32\\winrnr.dll", "C:\\Windows\\system32\\oleaut32.dll", "ws2_32", "C:\\Windows\\system32\\mswsock.dll", "DWMAPI.DLL", "Normaliz.dll" ], "file_opened": [ "C:\\Users\\cuck\\Favorites\\Links", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "C:\\", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "C:\\Windows\\System32\\en-US\\MSCTF.dll.mui", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\Desktop\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", "C:\\Windows\\System32\\shell32.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Windows\\System32\\wininet.dll", "C:\\Windows\\System32\\oleaccrc.dll", "C:\\Users\\cuck\\Favorites\\desktop.ini", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", "C:\\Windows\\System32\\url.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\", "C:\\Windows\\System32\\ieframe.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\", "C:\\Users\\cuck\\AppData\\Roaming\\", "C:\\Windows\\System32\\en-US\\urlmon.dll.mui", "C:\\Users\\cuck\\Favorites\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", "C:\\Users\\cuck\\Favorites\\Links\\Suggested Sites.url", "C:\\Users\\cuck\\Favorites\\Links\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "C:\\Windows\\System32\\stdole2.tlb", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Windows\\System32\\rsaenh.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@bing[1].txt", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@www.bing[1].txt", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", "C:\\Users", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "C:\\Users\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", "C:\\Users\\cuck", "C:\\Users\\cuck\\Favorites\\Links\\Web Slice Gallery.url", "C:\\Users\\cuck\\AppData\\Local\\Temp\\4f6b663009a5ed17d67d17cf2d09a514651be3b7441370e32791709ad848028f.bin.html", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", "C:\\Users\\cuck\\AppData\\", "C:\\Windows\\System32\\ras\\", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Desktop", "C:\\Users\\cuck\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", "C:\\Windows\\WindowsShell.manifest", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "C:\\Windows\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\", "C:\\Users\\cuck\\AppData\\Local\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Windows\\System32\\" ], "command_line": [ "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" SCODEF:2420 CREDAT:14337" ], "file_written": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC7EBBCB-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF29DA12936A2C623D.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF911E256C5268740C.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{AC7EBBCA-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]" ], "file_failed": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "\\Device\\NetBT_Tcpip6_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "\\DEVICE\\NETBT_TCPIP_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "\\Device\\NetBT_Tcpip_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\Users", "\\Sessions\\1\\BaseNamedObjects\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming", "\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "\\Device\\NetBT_Tcpip6_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "\\Sessions\\1\\BaseNamedObjects\\Isolation Signal Registry (AC7EBBC9-2F12-11EA-8829-08002749D99B, 0)", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "\\Device\\NetBT_Tcpip6_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds", "\\Device\\RasAcd", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low" ], "guid": [ "{6f237df9-9ddb-47ad-b218-400d54c286ad}", "{6a01fda0-30df-11d0-b724-00aa006c1a01}", "{c43dc798-95d1-4bea-9030-bb99e2983a1a}", "{f5078f32-c551-11d3-89b9-0000f81fe221}", "{06eee834-461c-42c2-8dcf-1502b527b1f9}", "{00020420-0000-0000-c000-000000000046}", "{9ba05972-f6a8-11cf-a442-00a0c90a8f39}", "{6e26e776-04f0-495d-80e4-3330352e3169}", "{25336920-03f9-11cf-8fd0-00aa00686f13}", "{a3ccedf7-2de2-11d0-86f4-00a0c913f750}", "{dcb00c01-570f-4a9b-8d69-199fdba5723b}", "{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}", "{4ef17940-30e0-11d0-b724-00aa006c1a01}", "{6e89f8e2-9a2a-4797-9b91-41146bdf0e7b}", "{465a756d-45ad-4305-85fd-d3321650f3b7}", "{00000146-0000-0000-c000-000000000046}", "{6c736dc1-ab0d-11d0-a2ad-00a0c90f27e8}", "{4516cee1-97da-4030-a444-2d8e296b96b6}", "{d0074ffd-570f-4a9b-8d69-199fdba5723b}", "{a3ccedf3-2de2-11d0-86f4-00a0c913f750}", "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}", "{871c5380-42a0-1069-a2ea-08002b30309d}", "{000214e6-0000-0000-c000-000000000046}", "{00000001-0000-0000-c000-000000000046}", "{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}", "{d9e89500-30fa-11d0-b724-00aa006c1a01}", "{00000323-0000-0000-c000-000000000046}", "{0000010b-0000-0000-c000-000000000046}", "{56fdf344-fd6d-11d0-958a-006097c9a090}", "{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}", "{2933bf81-7b36-11d2-b20e-00c04f983e60}", "{e7e4bc40-e76a-11ce-a9bb-00aa004ae837}", "{85cb6900-4d95-11cf-960c-0080c7f4ee85}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{8856f961-340a-11d0-a96b-00c04fd705a2}", "{79eac9ef-baf9-11ce-8c82-00aa004ba90b}", "{dcb00000-570f-4a9b-8d69-199fdba5723b}", "{50d5107a-d278-4871-8989-f4ceaaf59cfc}", "{bb1a2ae1-a4f9-11cf-8f20-00805f2cd064}", "{7b8a2d95-0ac9-11d1-896c-00c04fb6bfc4}", "{00021500-0000-0000-c000-000000000046}", "{a47979d2-c419-11d9-a5b4-001185ad2b89}", "{fbf23b40-e3f0-101b-8488-00aa003e56f8}", "{30c3b080-30fb-11d0-b724-00aa006c1a01}", "{00000109-0000-0000-c000-000000000046}", "{6c736db1-bd94-11d0-8a23-00aa00b58e10}", "{3050f406-98b5-11cf-bb82-00aa00bdce0b}", "{08c0e040-62d1-11d1-9326-0060b067b86e}", "{e569bde7-a8dc-47f3-893f-fd2b31b3eefd}" ] }
[ { "yara": [], "sha1": "47f78f68d72e3d9041acc9107a6b0d665f408385", "name": "70f316a5492848bb_down[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "type": "PNG image data, 15 x 15, 8-bit\/color RGBA, non-interlaced", "sha256": "70f316a5492848bb8242d49539468830b353ddaa850964db4e60a6d2d7db4880", "urls": [], "crc32": "9EA3279D", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/70f316a5492848bb_down[1]", "ssdeep": null, "size": 3414, "sha512": "021f2f0da228a23826cfddf2898e2b63787b3be2d94a49e58fc6973628b3995dc690ff7a80a09974b7769b45c7e5df953edb5632562c907273d7071af5ad253c", "pids": [ 2244 ], "md5": "555e83ce7f5d280d7454af334571fb25" }, { "yara": [], "sha1": "5fe75a2de43359d047ec7d7f74b06d0e29871e8f", "name": "85fb4611465a49e5_recoverystore.{ac7ebbca-2f12-11ea-8829-08002749d99b}.dat", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{AC7EBBCA-2F12-11EA-8829-08002749D99B}.dat", "type": "Composite Document File V2 Document, Cannot read section info", "sha256": "85fb4611465a49e57fb3d72e644ec3022c11d364bb2d1f868a9d57d41886521d", "urls": [], "crc32": "DE292D9A", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/85fb4611465a49e5_recoverystore.{ac7ebbca-2f12-11ea-8829-08002749d99b}.dat", "ssdeep": null, "size": 3584, "sha512": "2afd52e93eca90ca95b6ad5a999dca4c0a961c9a4d609f037b3711957068e55ba3fa1844db2bc04467907a824e746e2fb494dc4bb189d2326d00af817814598e", "pids": [ 2420 ], "md5": "e7489e58dc758fbf47850c2bd1e84bb2" }, { "yara": [], "sha1": "a6d24e8a1ffd7e6fc0d1ecd00e67eb72425019a7", "name": "eb5678de9d8f29ca_errorpagestrings[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "type": "UTF-8 Unicode (with BOM) text, with CRLF line terminators", "sha256": "eb5678de9d8f29ca6893d4e6ca79bd5ab4f312813820fe4997b009a2b1a1654c", "urls": [], "crc32": "1B8FC3FF", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/eb5678de9d8f29ca_errorpagestrings[1]", "ssdeep": null, "size": 1817, "sha512": "4f68d0f0c897ce4c751d5b7b51e7fb9ea31e0c0641376919a2c77ee094ece6b7ef203a29f03a6af1665036a471585f853c906caa2afdb2b822cc4be320f0cae7", "pids": [ 2244 ], "md5": "1a0563f7fb85a678771450b131ed66fd" }, { "yara": [], "sha1": "098b04b7237860874db38b22830387937aeb5073", "name": "6976c426e3ac66d6_noconnect[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "type": "PNG image data, 48 x 48, 8-bit\/color RGBA, non-interlaced", "sha256": "6976c426e3ac66d66303c114b22b2b41109a7de648ba55ffc3e5a53bd0db09e7", "urls": [], "crc32": "F9D26F41", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/6976c426e3ac66d6_noconnect[1]", "ssdeep": null, "size": 8230, "sha512": "e307d058de7d1168f0f0f5e51657091f956af310dc55e967fffac06ebd73bfed4c33d488b4af3297dd0dfeedd26c9d53728fd75722b333c9c2cde016d52ff58b", "pids": [ 2244 ], "md5": "3cb8faccd5de434d415ab75c17e8fd86" }, { "yara": [], "sha1": "b326a89ee587636bad7ad52aa944dc314fc6a6e2", "name": "62a7038cc42c1482_tools[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "type": "PNG image data, 16 x 16, 8-bit\/color RGBA, non-interlaced", "sha256": "62a7038cc42c1482d70465192318f21fc1ce0f0c737cb8804137f38a1f9d680b", "urls": [], "crc32": "6793DDC5", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/62a7038cc42c1482_tools[1]", "ssdeep": null, "size": 3560, "sha512": "7fd273080b9ab234576d61233ec62b0e02506e99deddb76c3dfb02e125de60a26d67553b5d23e2d2d0e82d551fab5ed51092f9f437eaef682950953ac24d0d9c", "pids": [ 2244 ], "md5": "6f20ba58551e13cfd87ec059327effd0" }, { "yara": [], "sha1": "250c965d7f4eb882d2289706a6c66e2b8976c1a8", "name": "1ff3334c3eb27033_dnserror[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "type": "HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators", "sha256": "1ff3334c3eb27033f8f37029fd72f648edd4551fce85fc1f5159feaea1439630", "urls": [], "crc32": "D67C7CDA", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/1ff3334c3eb27033_dnserror[1]", "ssdeep": null, "size": 5947, "sha512": "60ea2052fa47781c1c9c09512f2bebeee4704efe44ea38e92fcb7684347740e0402c95ffd3c59a64e747f185939e0ad479ff942cdb99897d87531048bb4b9ff5", "pids": [ 2244 ], "md5": "68e03ed57ec741a4afbbcd11fab1bdbe" }, { "yara": [], "sha1": "62c180ec01ff2c30396fb1601004123f56b10d2f", "name": "07d07a467e4988d3_favcenter[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "type": "PNG image data, 16 x 16, 8-bit\/color RGBA, non-interlaced", "sha256": "07d07a467e4988d3c377acd6dc9e53abca6b64e8fbf70f6be19d795a1619289b", "urls": [], "crc32": "7FE3FBCC", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/07d07a467e4988d3_favcenter[1]", "ssdeep": null, "size": 3366, "sha512": "28a82e06f8c59d637630d0426950b0b0a9c3e553d8712e918a304f7fffd961dd06642d17cf3957f2d11574801b61f89c07e049834e7c8d88c90537dcc10c70b0", "pids": [ 2244 ], "md5": "25d76ee5fb5b890f2cc022d94a42fe19" }, { "yara": [], "sha1": "fe815ae0f865ec4c26e421bf0bd21bb09bc6f410", "name": "58268ca71a28973b_httperrorpagesscripts[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "type": "UTF-8 Unicode (with BOM) text, with CRLF, CR line terminators", "sha256": "58268ca71a28973b756a48bbd7c9dc2f6b87b62ae343e582ce067c725275b63c", "urls": [ "http:\/\/www.DocURL.com\/bar.htm", "http:\/\/www.microsoft.com\/bar.htm" ], "crc32": "A7C34EF3", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/58268ca71a28973b_httperrorpagesscripts[1]", "ssdeep": null, "size": 8601, "sha512": "40d33112debdd440f169d3a62b06607afa94c45903c3e650093036b3af2d616310ad6e0a4774f92927295cd3967963d127f63df33c4e763f0d40f306aa52449e", "pids": [ 2244 ], "md5": "e7ca76a3c9ee0564471671d500e3f0f3" }, { "yara": [], "sha1": "8dfe3edf7ddb48d1bb4ff1372d3b132ee4fd2e77", "name": "3698cd099f3268c4_{ac7ebbcb-2f12-11ea-8829-08002749d99b}.dat", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC7EBBCB-2F12-11EA-8829-08002749D99B}.dat", "type": "Composite Document File V2 Document, Cannot read section info", "sha256": "3698cd099f3268c42a0efebb01f2b5be4e6af81d949660cd775c20a58e635c3a", "urls": [], "crc32": "D5873409", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/3698cd099f3268c4_{ac7ebbcb-2f12-11ea-8829-08002749d99b}.dat", "ssdeep": null, "size": 4608, "sha512": "29a0f03ccedd9757a4f9f37bb0693a5ffd22aab1d4f82b555044e8ced930cfc1a872ef2d40521ac6d75907f239abfe58d23a99da8ff3deca0088c6aa93843704", "pids": [ 2420 ], "md5": "7095c11178e1592eb54ae955acf453fe" }, { "yara": [], "sha1": "56bac3d2c88a83628134b36322e37deb6b00b1a1", "name": "1cb3b6ea56c5b5de_bullet[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "type": "PNG image data, 15 x 15, 8-bit\/color RGBA, non-interlaced", "sha256": "1cb3b6ea56c5b5decf5e1d487ad51dbb2f62e6a6c78f23c1c81fda1b64f8db16", "urls": [], "crc32": "51CC83D9", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/1cb3b6ea56c5b5de_bullet[1]", "ssdeep": null, "size": 3169, "sha512": "8d975b96217e503d9fe01cf81d56500ef66a2dedd9ab70ebf0ad475f09522aef0107a6aae38e3c292bcdb206439611f1c2ce05aa692546ee8d56ba640d78bc4e", "pids": [ 2244 ], "md5": "0c4c086dd852704e8eeb8ff83e3b73d1" }, { "yara": [], "sha1": "c2e7ab3ce114465ea7060f2ef738afcb3341a384", "name": "caa140523ba00994_info_48[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "type": "PNG image data, 47 x 48, 8-bit\/color RGBA, non-interlaced", "sha256": "caa140523ba00994536b33618654e379216261babaae726164a0f74157bb11ff", "urls": [], "crc32": "4C99540A", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/caa140523ba00994_info_48[1]", "ssdeep": null, "size": 6993, "sha512": "fede6e06011d2203f0359ba7b178771e4dd6500af1c72dd13456f0fad0cde3b75b8709af68447d25b2b916126d85808579940aa24e25b2357d407afd1143da08", "pids": [ 2244 ], "md5": "49e0ef03e74704089a60c437085db89e" }, { "yara": [], "sha1": "42464c70fc16f3f361c2419751acd57d51613cdf", "name": "bee0439fcf31de76_navcancl[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "type": "HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators", "sha256": "bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228", "urls": [], "crc32": "912EA90C", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/bee0439fcf31de76_navcancl[1]", "ssdeep": null, "size": 2713, "sha512": "bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e", "pids": [ 2244 ], "md5": "4bcfe9f8db04948cddb5e31fe6a7f984" }, { "yara": [], "sha1": "f4eda06901edb98633a686b11d02f4925f827bf0", "name": "8d018639281b33da_errorpagetemplate[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "type": "UTF-8 Unicode (with BOM) text, with CRLF line terminators", "sha256": "8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f", "urls": [], "crc32": "E6FF242A", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/8d018639281b33da_errorpagetemplate[1]", "ssdeep": null, "size": 2168, "sha512": "62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436", "pids": [ 2244 ], "md5": "f4fe1cb77e758e1ba56b8a8ec20417c5" }, { "yara": [], "sha1": "51f5fc61d8bf19100df0f8aadaa57fcd9c086255", "name": "1471693be91e53c2_background_gradient[1]", "filepath": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]", "type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3", "sha256": "1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b", "urls": [], "crc32": "C2D0CE77", "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/4773\/files\/1471693be91e53c2_background_gradient[1]", "ssdeep": null, "size": 453, "sha512": "5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a", "pids": [ 2244 ], "md5": "20f0110ed5e4e0d5384a496e4880139b" } ]
[ { "process_path": "C:\\Program Files\\Internet Explorer\\iexplore.exe", "process_name": "iexplore.exe", "pid": 2420, "summary": { "downloads_file": [ "http:\/\/www.bing.com\/favicon.ico" ], "file_created": [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF3642F304449DCDCA.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF289872C7463083BD.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF0114216759C89F09.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF0971740A2F76B13D.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF911E256C5268740C.TMP", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF29DA12936A2C623D.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC7EBBCB-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DFE31CB9632DC5E3D3.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{AC7EBBCA-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF9DF5133F5D3E1699.TMP" ], "file_recreated": [ "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\MountPointManager", "\\??\\C:", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\Device\\NetBT_Tcpip_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\DEVICE\\NETBT_TCPIP_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\??\\Nsi", "\\Device\\Afd\\Endpoint" ], "dll_loaded": [ "IEFRAME.dll", "C:\\Windows\\System32\\fwpuclnt.dll", "sensapi.dll", "urlmon.dll", "C:\\Windows\\System32\\mswsock.dll", "msfeeds.dll", "dhcpcsvc.DLL", "rasadhlp.dll", "Shell32.dll", "kernel32.dll", "comdlg32.dll", "C:\\Windows\\System32\\wshtcpip.dll", "C:\\Windows\\system32\\ole32.dll", "dwmapi.dll", "NTDLL.DLL", "shlwapi.dll", "C:\\Windows\\system32\\napinsp.dll", "iphlpapi", "UxTheme.dll", "ntmarta.dll", "API-MS-WIN-Service-Management-L1-1-0.dll", "C:\\Program Files\\Internet Explorer\\ieproxy.dll", "PROPSYS.dll", "WININET.dll", "C:\\Windows\\System32\\wship6.dll", "dnsapi", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "DHCPCSVC.DLL", "OLEAUT32.DLL", "SspiCli.dll", "ole32.dll", "USER32.dll", "IMM32.dll", "C:\\Program Files\\Internet Explorer\\sqmapi.dll", "API-MS-Win-Security-SDDL-L1-1-0.dll", "C:\\Windows\\system32\\pnrpnsp.dll", "RASMAN.DLL", "msctf.dll", "rtutils.dll", "IPHLPAPI.DLL", "API-MS-WIN-Service-winsvc-L1-1-0.dll", "wininet.dll", "apphelp.dll", "SHELL32.DLL", "C:\\Windows\\system32\\xmllite.dll", "RASAPI32.dll", "OLEAUT32.dll", "profapi.dll", "SHELL32.dll", "RPCRT4.dll", "DNSAPI.dll", "C:\\Windows\\System32\\winrnr.dll", "IEUI.dll", "comctl32.dll", "C:\\Windows\\system32\\oleaut32.dll", "C:\\Windows\\system32\\NLAapi.dll", "C:\\Windows\\system32\\IEUI.dll", "VERSION.dll", "ws2_32", "MLANG.dll", "UXTHEME.DLL", "dhcpcsvc6.DLL", "C:\\Windows\\system32\\mswsock.dll", "SXS.DLL", "ADVAPI32.dll", "rpcrt4.dll", "advapi32", "SETUPAPI.dll", "WS2_32.dll", "C:\\Windows\\system32\\MSCTF.dll", "user32.dll", "MSIMG32.dll" ], "file_opened": [ "C:\\Users\\cuck\\Favorites\\Links", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "C:\\", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", "C:\\Windows\\System32\\en-US\\MSCTF.dll.mui", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\Desktop\\desktop.ini", "C:\\Windows\\System32\\shell32.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Windows\\System32\\wininet.dll", "C:\\Windows\\System32\\oleaccrc.dll", "C:\\Users\\cuck\\Favorites\\desktop.ini", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", "C:\\Windows\\System32\\url.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "C:\\Windows\\System32\\ieframe.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\", "C:\\Users\\cuck\\AppData\\Roaming\\", "C:\\Windows\\System32\\en-US\\urlmon.dll.mui", "C:\\Users\\cuck\\Favorites\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "C:\\Users\\cuck\\Favorites\\Links\\Suggested Sites.url", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\Favorites\\Links\\Web Slice Gallery.url", "C:\\Windows\\System32\\stdole2.tlb", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", "C:\\Users\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@www.bing[1].txt", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", "C:\\Users", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "C:\\Users\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", "C:\\Users\\cuck", "C:\\Users\\cuck\\Favorites\\Links\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@bing[1].txt", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", "C:\\Users\\cuck\\AppData\\", "C:\\Windows\\System32\\ras\\", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Desktop", "C:\\Users\\cuck\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\", "C:\\Users\\cuck\\AppData\\Local\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\" ], "command_line": [ "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" SCODEF:2420 CREDAT:14337" ], "file_written": [ "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF911E256C5268740C.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{AC7EBBCA-2F12-11EA-8829-08002749D99B}.dat", "C:\\Users\\cuck\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", "C:\\Users\\cuck\\AppData\\Local\\Temp\\~DF29DA12936A2C623D.TMP", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC7EBBCB-2F12-11EA-8829-08002749D99B}.dat" ], "file_failed": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", "\\Device\\NetBT_Tcpip6_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\Users\\cuck\\AppData", "C:\\Users\\cuck\\Favorites", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", "\\DEVICE\\NETBT_TCPIP_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "\\Device\\NetBT_Tcpip_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", "\\Sessions\\1\\BaseNamedObjects\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows", "\\Device\\NetBT_Tcpip6_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", "\\Sessions\\1\\BaseNamedObjects\\Isolation Signal Registry (AC7EBBC9-2F12-11EA-8829-08002749D99B, 0)", "\\Device\\NetBT_Tcpip6_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", "\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}", "C:\\Users", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck\\AppData\\Local\\Microsoft", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", "C:\\Users\\cuck\\AppData\\Local\\Temp\\Low", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds", "\\Device\\RasAcd", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files" ], "guid": [ "{6f237df9-9ddb-47ad-b218-400d54c286ad}", "{c43dc798-95d1-4bea-9030-bb99e2983a1a}", "{f5078f32-c551-11d3-89b9-0000f81fe221}", "{06eee834-461c-42c2-8dcf-1502b527b1f9}", "{00020420-0000-0000-c000-000000000046}", "{6e26e776-04f0-495d-80e4-3330352e3169}", "{dcb00c01-570f-4a9b-8d69-199fdba5723b}", "{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}", "{465a756d-45ad-4305-85fd-d3321650f3b7}", "{00000146-0000-0000-c000-000000000046}", "{4516cee1-97da-4030-a444-2d8e296b96b6}", "{d0074ffd-570f-4a9b-8d69-199fdba5723b}", "{d5f569d0-593b-101a-b569-08002b2dbf7a}", "{fbf23b40-e3f0-101b-8488-00aa003e56f8}", "{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}", "{00000323-0000-0000-c000-000000000046}", "{0000010b-0000-0000-c000-000000000046}", "{56fdf344-fd6d-11d0-958a-006097c9a090}", "{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}", "{2933bf81-7b36-11d2-b20e-00c04f983e60}", "{00021500-0000-0000-c000-000000000046}", "{dcb00000-570f-4a9b-8d69-199fdba5723b}", "{a47979d2-c419-11d9-a5b4-001185ad2b89}", "{00000109-0000-0000-c000-000000000046}" ] }, "first_seen": 1578160384.578125, "ppid": 1268 }, { "process_path": "C:\\Windows\\System32\\lsass.exe", "process_name": "lsass.exe", "pid": 476, "summary": {}, "first_seen": 1578160384.328125, "ppid": 376 }, { "process_path": "C:\\Program Files\\Internet Explorer\\iexplore.exe", "process_name": "iexplore.exe", "pid": 2244, "summary": { "file_created": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]" ], "file_recreated": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "\\??\\C:", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "\\??\\MountPointManager", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]", "\\??\\STORAGE#Volume#{3f5cc1b2-70f9-11e8-b07b-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "\\Device\\NetBT_Tcpip_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\Device\\Afd\\Endpoint", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "\\DEVICE\\NETBT_TCPIP_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "\\??\\Nsi" ], "dll_loaded": [ "IEFRAME.dll", "dhcpcsvc.DLL", "C:\\Windows\\System32\\fwpuclnt.dll", "sensapi.dll", "urlmon.dll", "mshtml.dll", "C:\\Windows\\System32\\mswsock.dll", "apphelp.dll", "CRYPT32.dll", "rasadhlp.dll", "Shell32.dll", "kernel32.dll", "API-MS-Win-Security-SDDL-L1-1-0.dll", "CRYPTBASE.dll", "C:\\Windows\\system32\\rsaenh.dll", "C:\\Windows\\system32\\ole32.dll", "IEShims.dll", "dwmapi.dll", "C:\\Windows\\system32\\msimg32.dll", "shlwapi.dll", "C:\\Windows\\system32\\napinsp.dll", "USER32.DLL", "iphlpapi", "ImgUtil.dll", "ntmarta.dll", "schannel", "API-MS-WIN-Service-Management-L1-1-0.dll", "C:\\Program Files\\Internet Explorer\\ieproxy.dll", "PROPSYS.dll", "WININET.dll", "C:\\Windows\\System32\\wship6.dll", "dnsapi", "API-MS-Win-Core-LocalRegistry-L1-1-0.dll", "DHCPCSVC.DLL", "OLEAUT32.DLL", "SspiCli.dll", "ole32.dll", "USERENV.dll", "CRYPTSP.dll", "USER32.dll", "IMM32.dll", "C:\\Program Files\\Internet Explorer\\sqmapi.dll", "comdlg32.dll", "C:\\Windows\\system32\\pnrpnsp.dll", "MLANG.dll", "wintrust.dll", "rtutils.dll", "IPHLPAPI.DLL", "API-MS-WIN-Service-winsvc-L1-1-0.dll", "wininet.dll", "DWMAPI.DLL", "RASAPI32.dll", "OLEAUT32.dll", "profapi.dll", "SHELL32.dll", "RPCRT4.dll", "DNSAPI.dll", "C:\\Windows\\System32\\winrnr.dll", "C:\\Windows\\System32\\wshtcpip.dll", "comctl32.dll", "C:\\Windows\\system32\\oleaut32.dll", "C:\\Windows\\system32\\NLAapi.dll", "RASMAN.DLL", "VERSION.dll", "RpcRtRemote.dll", "ws2_32", "dhcpcsvc6.DLL", "UxTheme.dll", "Normaliz.dll", "C:\\Windows\\system32\\mswsock.dll", "ADVAPI32.dll", "rpcrt4.dll", "advapi32", "SETUPAPI.dll", "WS2_32.dll", "C:\\Windows\\system32\\MSCTF.dll", "user32.dll", "oleaut32.dll" ], "file_opened": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "C:\\", "C:\\Users\\cuck\\AppData", "C:\\Windows\\System32\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "C:\\Users\\cuck\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", "C:\\Windows\\WindowsShell.manifest", "C:\\Windows\\System32\\ras\\", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Windows\\System32\\en-US\\MSCTF.dll.mui", "C:\\Windows\\", "C:\\Windows\\System32\\en-US\\urlmon.dll.mui", "C:\\Users\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", "C:\\Users", "C:\\Users\\cuck\\AppData\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", "C:\\Users\\cuck\\Desktop\\desktop.ini", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", "C:\\Windows\\System32\\shell32.dll", "C:\\Users\\desktop.ini", "C:\\Users\\cuck", "C:\\Users\\cuck\\AppData\\Local\\", "C:\\Users\\cuck\\AppData\\Local\\Temp\\4f6b663009a5ed17d67d17cf2d09a514651be3b7441370e32791709ad848028f.bin.html", "C:\\Windows\\System32\\stdole2.tlb", "C:\\Users\\cuck\\AppData\\Local\\Temp", "C:\\Users\\cuck\\AppData\\Local", "C:\\Windows\\System32\\wininet.dll", "C:\\Windows\\System32\\oleaccrc.dll", "C:\\Users\\cuck\\Favorites\\desktop.ini", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", "C:\\Windows\\Fonts\\staticcache.dat", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", "C:\\Windows\\System32\\rsaenh.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", "C:\\Windows\\System32\\ieframe.dll", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" ], "file_written": [ "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\dnserror[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\bullet[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\info_48[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\navcancl[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\background_gradient[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\noConnect[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\httpErrorPagesScripts[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\errorPageStrings[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EIDFNJNY\\favcenter[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I6GMLZZB\\down[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\tools[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQUHP74Z\\ErrorPageTemplate[1]", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SHYNOLTK\\background_gradient[1]" ], "file_failed": [ "\\Device\\NetBT_Tcpip6_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "\\Device\\RasAcd", "\\Device\\NetBT_Tcpip6_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\", "\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History", "C:\\Users\\cuck", "\\DEVICE\\NETBT_TCPIP_{46C6AD23-CFC8-4177-B38F-6C28F239EB0D}", "C:\\Users\\cuck\\AppData\\Roaming", "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", "\\Device\\NetBT_Tcpip_{AEFD33F3-CC73-4821-AD44-6915063E7FB1}", "\\Device\\NetBT_Tcpip6_{EF381EA0-4D07-418D-A490-68AF67CE948B}", "C:\\Users\\cuck\\AppData\\Local", "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies" ], "guid": [ "{6a01fda0-30df-11d0-b724-00aa006c1a01}", "{9ba05972-f6a8-11cf-a442-00a0c90a8f39}", "{25336920-03f9-11cf-8fd0-00aa00686f13}", "{a3ccedf7-2de2-11d0-86f4-00a0c913f750}", "{dcb00c01-570f-4a9b-8d69-199fdba5723b}", "{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}", "{4ef17940-30e0-11d0-b724-00aa006c1a01}", "{6e89f8e2-9a2a-4797-9b91-41146bdf0e7b}", "{00000146-0000-0000-c000-000000000046}", "{6c736dc1-ab0d-11d0-a2ad-00a0c90f27e8}", "{d0074ffd-570f-4a9b-8d69-199fdba5723b}", "{a3ccedf3-2de2-11d0-86f4-00a0c913f750}", "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}", "{871c5380-42a0-1069-a2ea-08002b30309d}", "{000214e6-0000-0000-c000-000000000046}", "{00000001-0000-0000-c000-000000000046}", "{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}", "{d9e89500-30fa-11d0-b724-00aa006c1a01}", "{00000323-0000-0000-c000-000000000046}", "{e7e4bc40-e76a-11ce-a9bb-00aa004ae837}", "{85cb6900-4d95-11cf-960c-0080c7f4ee85}", "{8856f961-340a-11d0-a96b-00c04fd705a2}", "{79eac9ef-baf9-11ce-8c82-00aa004ba90b}", "{dcb00000-570f-4a9b-8d69-199fdba5723b}", "{50d5107a-d278-4871-8989-f4ceaaf59cfc}", "{bb1a2ae1-a4f9-11cf-8f20-00805f2cd064}", "{7b8a2d95-0ac9-11d1-896c-00c04fb6bfc4}", "{a47979d2-c419-11d9-a5b4-001185ad2b89}", "{30c3b080-30fb-11d0-b724-00aa006c1a01}", "{6c736db1-bd94-11d0-8a23-00aa00b58e10}", "{3050f406-98b5-11cf-bb82-00aa00bdce0b}", "{08c0e040-62d1-11d1-9326-0060b067b86e}", "{e569bde7-a8dc-47f3-893f-fd2b31b3eefd}" ] }, "first_seen": 1578160386.702374, "ppid": 2420 } ]
[ { "markcount": 1, "families": [], "description": "Executes javascript", "severity": 2, "marks": [ { "call": { "category": "iexplore", "status": 1, "stacktrace": [], "api": "COleScript_Compile", "return_value": 0, "arguments": { "type": "JScript - window script block", "script": "\/\/Split out for localization.\r\nvar L_GOBACK_TEXT = \"Go back to the previous page.\";\r\nvar L_REFRESH_TEXT = \"Refresh the page.\";\r\nvar L_MOREINFO_TEXT = \"More information\";\r\nvar L_OFFLINE_USERS_TEXT = \"For offline users\";\r\nvar L_RELOAD_TEXT = \"Retype the address.\";\r\nvar L_HIDE_HOTKEYS_TEXT = \"Hide tab shortcuts\";\r\nvar L_SHOW_HOTKEYS_TEXT = \"Show more tab shortcuts\";\r\nvar L_CONNECTION_OFF_TEXT = \"You are not connected to the Internet. Check your Internet connection.\";\r\nvar L_CONNECTION_ON_TEXT = \"It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.\";\r\n\r\n\/\/used by invalidcert.js\r\nvar L_CertUnknownCA_TEXT = \"The security certificate presented by this website was not issued by a trusted certificate authority.\";\r\nvar L_CertExpired_TEXT = \"The security certificate presented by this website has expired or is not yet valid.\";\r\nvar L_CertCNMismatch_TEXT = \"The security certificate presented by this website was issued for a different website's address.\";\r\nvar L_CertRevoked_TEXT = \"This organization's certificate has been revoked.\";\r\n\r\nvar L_PhishingThreat_TEXT = \"Phishing threat: This is a phishing website that impersonates a trusted website to trick you into revealing personal or financial information.\";\r\nvar L_MalwareThreat_TEXT = \"Malicious software threat: This site contains links to viruses or other software programs that can reveal personal information stored or typed on your computer to malicious persons.\";\r\n\r\nvar L_ACR_Title_TEXT = \"We were unable to return you to %s.\";\r\nvar L_ACR_TitleFallback_TEXT = \"We were unable to return you to the page you were viewing.\";\r\nvar L_ACR_ReturnTo_TEXT = \"Try to return to %s\";\r\nvar L_ACR_ReturnToFallback_TEXT = \"Try to return to the page you were viewing\";\r\nvar L_ACR_GoHome_TEXT = \"Go to your home page\";\r\n" }, "time": 1578160394.749374, "tid": 2248, "flags": {} }, "pid": 2244, "type": "call", "cid": 498 } ], "references": [], "name": "js_eval" }, { "markcount": 45, "families": [], "description": "Allocates read-write-execute memory (usually to unpack itself)", "severity": 2, "marks": [ { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000000005fff0000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2420, "type": "call", "cid": 62 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 63 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 64 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 65 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 66 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 67 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 68 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778cd000" }, "time": 1578160384.812125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 69 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 70 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778d4000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 71 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 72 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000007fefc360000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2420, "type": "call", "cid": 73 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 74 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 75 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff8c4000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 76 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefe0c1000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 77 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778c0000" }, "time": 1578160384.828125, "tid": 2460, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2420, "type": "call", "cid": 78 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2420, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 4096, "base_address": "0x0000000002bc0000" }, "time": 1578160385.406125, "tid": 2584, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 2420, "type": "call", "cid": 609 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000000005fff0000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2244, "type": "call", "cid": 17 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 18 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 19 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 20 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 21 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 22 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x0000000077921000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 23 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778cd000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 24 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 25 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778d4000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 26 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778f2000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 27 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 1, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 12288, "base_address": "0x000007fefc360000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT|MEM_RESERVE" } }, "pid": 2244, "type": "call", "cid": 28 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 29 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefc3b5000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 30 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff8c4000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 31 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007fefe0c1000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 32 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778c0000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 33 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feffa17000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 34 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778bf000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 35 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778bd000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 36 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x00000000778bb000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 37 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feffb47000" }, "time": 1578160386.764374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 38 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff864000" }, "time": 1578160386.780374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 39 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff861000" }, "time": 1578160386.780374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 40 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff866000" }, "time": 1578160386.780374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 41 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtProtectVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "length": 4096, "protection": 64, "process_handle": "0xffffffffffffffff", "base_address": "0x000007feff861000" }, "time": 1578160386.780374, "tid": 2468, "flags": { "protection": "PAGE_EXECUTE_READWRITE" } }, "pid": 2244, "type": "call", "cid": 42 }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtAllocateVirtualMemory", "return_value": 0, "arguments": { "process_identifier": 2244, "region_size": 65536, "stack_dep_bypass": 0, "stack_pivoted": 0, "heap_dep_bypass": 0, "protection": 64, "process_handle": "0xffffffffffffffff", "allocation_type": 4096, "base_address": "0x0000000002320000" }, "time": 1578160386.999374, "tid": 2248, "flags": { "protection": "PAGE_EXECUTE_READWRITE", "allocation_type": "MEM_COMMIT" } }, "pid": 2244, "type": "call", "cid": 158 } ], "references": [], "name": "allocates_rwx" }, { "markcount": 1, "families": [], "description": "Uses Windows utilities for basic Windows functionality", "severity": 2, "marks": [ { "category": "cmdline", "ioc": "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" SCODEF:2420 CREDAT:14337", "type": "ioc", "description": null } ], "references": [ "http:\/\/blog.jpcert.or.jp\/2016\/01\/windows-commands-abused-by-attackers.html" ], "name": "uses_windows_utilities" }, { "markcount": 2, "families": [], "description": "Resumed a suspended thread in a remote process potentially indicative of process injection", "severity": 3, "marks": [ { "category": "Process injection", "ioc": "Process 2420 resumed a thread in remote process 2244", "type": "ioc", "description": null }, { "call": { "category": "process", "status": 1, "stacktrace": [], "api": "NtResumeThread", "return_value": 0, "arguments": { "thread_handle": "0x0000000000000508", "suspend_count": 1, "process_identifier": 2244 }, "time": 1578160386.500125, "tid": 2460, "flags": {} }, "pid": 2420, "type": "call", "cid": 802 } ], "references": [ "www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process" ], "name": "injection_resumethread" } ]
The Yara rules did not detect anything in the file.
{ "tls": [], "udp": [ { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 546, "time": 3.079077959060669, "dport": 137, "sport": 137 }, { "src": "192.168.56.101", "dst": "192.168.56.255", "offset": 8466, "time": 9.079308032989502, "dport": 138, "sport": 138 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 10310, "time": 4.675450086593628, "dport": 5355, "sport": 49840 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 10630, "time": 2.953295946121216, "dport": 5355, "sport": 51001 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 10950, "time": 1.0474841594696045, "dport": 5355, "sport": 53595 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 11278, "time": 3.0466699600219727, "dport": 5355, "sport": 53848 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 11606, "time": 1.5489921569824219, "dport": 5355, "sport": 54255 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 11934, "time": -0.089508056640625, "dport": 5355, "sport": 55314 }, { "src": "192.168.56.101", "dst": "224.0.0.252", "offset": 12262, "time": 3.053981065750122, "dport": 5355, "sport": 55880 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 12590, "time": 1.5806901454925537, "dport": 1900, "sport": 1900 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 32000, "time": 1.0778491497039795, "dport": 3702, "sport": 49152 }, { "src": "192.168.56.101", "dst": "239.255.255.250", "offset": 40384, "time": 3.1088690757751465, "dport": 1900, "sport": 53598 } ], "dns_servers": [], "http": [], "icmp": [], "smtp": [], "tcp": [], "smtp_ex": [], "mitm": [], "hosts": [], "pcap_sha256": "34be8868045cdbf75f1983bc4bd4065711316a9805cb4cc20a7a5995d29cf361", "dns": [], "http_ex": [], "domains": [], "dead_hosts": [], "sorted_pcap_sha256": "b339d0ed10ec2f0076657841a2d700b155edeb728346877596db2f468523483f", "irc": [], "https_ex": [] }
Adobe Flash Player 12.exe may also use other filenames. The most common variants are listed below:
Property | Value |
---|---|
MD5 | f461bfdbc18af8a4371fcff48f8f2b74 |
SHA256 | 4f6b663009a5ed17d67d17cf2d09a514651be3b7441370e32791709ad848028f |
These are some of the error messages that can appear related to adobe flash player 12.exe:
adobe flash player 12.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
adobe flash player 12.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
adobe flash player 12.exe has stopped working.
End Program - adobe flash player 12.exe. This program is not responding.
adobe flash player 12.exe is not a valid Win32 application.
adobe flash player 12.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
To help other users, please let us know what you will do with the file:
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.