PUP.ImLoader

The detection of PUP.ImLoader on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand what this detection means and how to proceed with removing the threat to protect your system and personal data.

What Is PUP.ImLoader?

PUP.ImLoader is a detection name given to a type of potentially unwanted program that may exhibit malicious behavior, such as displaying unwanted advertisements, collecting user data without consent, or installing additional unwanted software. PUPs like PUP.ImLoader can be installed on a system through various means, including bundled software downloads, infected websites, or exploited vulnerabilities.

How PUP.ImLoader Operates

Once installed, PUP.ImLoader may operate in the background, consuming system resources and potentially causing issues with system stability. It may also communicate with remote servers to send or receive data, which could lead to further security risks. PUPs often use deceptive tactics to evade detection, making it challenging for users to identify and remove them.

Symptoms of Infection

Systems infected with PUP.ImLoader may exhibit various symptoms, including slow system performance, unwanted pop-ups or advertisements, suspicious program installations, or unexpected changes to browser settings. Users may also notice unusual network activity or unfamiliar programs running in the background. If you've noticed any of these symptoms, it's crucial to take immediate action to remove the threat and prevent further damage.

• Unwanted advertisements or pop-ups
• Suspicious program installations
• Changes to browser settings or homepage
• Slow system performance or crashes
• Unusual network activity

How to Remove PUP.ImLoader

To remove PUP.ImLoader from your system, follow these steps:

1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and interfering with the removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove any associated malware or PUPs.
3. Uninstall any suspicious programs or applications that may be related to the PUP.ImLoader detection.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or changes.
5. Reboot your system and perform another full scan to ensure that the threat has been completely removed.

Conclusion

Removing PUP.ImLoader from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove the threat and protect your system from further damage. Remember to always prioritize system security and take proactive measures to prevent future infections, such as keeping your operating system and software up to date, using strong antivirus protection, and being cautious when downloading software or clicking on links from unknown sources.

Analysis Report

General information

Family Name:	PUP.ImLoader
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 271216d7e2782c12a678f6ef02b676f8 SHA1: d1e8fc0673698dcd8f2c034a303eb59ead54778d File Size: 9.50 MB, 9495936 bytes

MD5: 4986978e6a19c79708589f35aebc44bd SHA1: c8225336bfb2d0f1035e59fdd77dd50031850269 File Size: 6.09 MB, 6091912 bytes

MD5: 00256098d4ddf70c56764b10cae9d25e SHA1: cc497b4832189dfcb982babbf73cf04f31a97827 File Size: 2.59 MB, 2586760 bytes

MD5: f0fe82b5b096608ffbabf413a97879fa SHA1: 633ca95d4d7877ade6f785d01402098288b969e0 SHA256: E50E847520A7DA8AE48A8D5FFC73CF059D42FB19521729E66E2F7E660F2958FB File Size: 480.04 KB, 480040 bytes

MD5: ea8dc9dd31f3892d95c1fa6ffce6102f SHA1: c0683b41a3990e86d811a0135e8b7a3a49c7bafd SHA256: 291B68B3A5A716D14912460F9A61502E74C4ABB9EB43B476983E2FFCBD6F8BDE File Size: 8.30 MB, 8302200 bytes

Show More

MD5: 6b03cd71c65cb84cf98639419e82decc SHA1: a07c98c6d5ba0236741dcb0b0a1e1a728d7a0a07 SHA256: E20C8C180860B4F6284F756869B83EAE62D59C3B0F159C154580658292458D4F File Size: 221.18 KB, 221184 bytes

MD5: 157278ed3f2737da741b024300996bc5 SHA1: e623aa24e51b94e223550a0b8c5dff71929940f8 SHA256: 79D60749EBE8BD993F5F9D121011183DBB0D51BA0DCC629AFCC4AA738F3C8EA1 File Size: 623.46 KB, 623464 bytes

MD5: 4f6ba7c43efc3e8d8625868f424404b1 SHA1: 2599fcdcc5eea5e1fb2fca133824d38a9e36794e SHA256: 35703A847E5C468AC4B3492126EC8F1C68F67EAAFA822A08A8FF1B39F38EE1E4 File Size: 371.81 KB, 371808 bytes

MD5: 29b0a57bd14994b77d92cf29f8cdab71 SHA1: 36261cdd2d665604fa6a91669f93f1c4435335ab SHA256: 0A58736CA36396BE0EAB8DE700AA9D889FB536B58665D89F9B74DA2E8DA7B7AD File Size: 474.43 KB, 474432 bytes

MD5: 297974018946726a8a283481e96b193e SHA1: 3e3ea4e4b64d3ff87d745830981cd1a29d5d778c SHA256: 4A7B0C08C29193D24D01F089A5AB16AD7487BA230E7D108F20D3DA1122964898 File Size: 5.49 MB, 5489800 bytes

MD5: 89f85f44a552df3590e062226d5af493 SHA1: c94dcfdd0fc9bc5071b63dabb2abd9c3f5ba96a7 SHA256: 08F2B81B878F1BE8D333E403BD1BB0B83C3AE32EE45C01468E43A808201E977A File Size: 427.38 KB, 427376 bytes

MD5: 8a6f0af8ea113f7649f410977ef579e1 SHA1: 06e6bd43e768209cea00890292141bf2dfc33bb4 SHA256: 32BA83025992F68557D68CA90BDD8306304E4A34E302066139F81E5CE034D2D1 File Size: 5.18 MB, 5180688 bytes

MD5: 34fe0e41d2679a1df03c95c80ec38343 SHA1: cf78288754b4f1bc75c2a8a25862f491523db607 SHA256: AFED856D07035EFC2FABF199A678AED14F7865BC5B5C72E20F0340F354F92E24 File Size: 8.20 MB, 8196712 bytes

MD5: d165a9df07770aa99cf4db7df052e5ac SHA1: cb05cf2b0c5c662edbd151eacfb068379f1264b3 SHA256: B008424DDDFE1494240C7B1DFEF0C7D1EE8F190892782D7556729EB217FB0604 File Size: 5.72 MB, 5719176 bytes

MD5: 0947f1389aef4ee2203b0531c21da93e SHA1: 7d512c5110fc26112d786eb0039ac7f1b5dba1c7 SHA256: 408CDDFCB9899CC5ED0790BC045FF4047676746ACE597BA7E8CA4378E5CAE955 File Size: 575.73 KB, 575728 bytes

MD5: 0eec944172b75e7d1e363e8b47d11e82 SHA1: c610373465d2f4fed733bccbee29f37a3cb77f94 SHA256: 1744E20F3ED429F70D84B55C07F5A5AA6DAE66BCB7E58B7B3A98927763F9C4AF File Size: 221.18 KB, 221184 bytes

MD5: 91467cf78182be6cf7c6b2404d4dbf3d SHA1: acf1d5e262cd90cf7ec5bbf456140cff25e4ebef SHA256: FA43F4BB4D11BF30E3EF6F7756E917A894CDA0D766335A1A3F8D543E023CE009 File Size: 324.99 KB, 324992 bytes

MD5: 11b9455002f076b58f27b493ebd3db10 SHA1: 1b4d7ee194ed02e909f538de1942239b01cf7c0f SHA256: F263F6A3EE53FFCC38C73ECB967ED49373E82B771539AFD4BC01BE05A75B1B01 File Size: 9.62 MB, 9615976 bytes

MD5: a19cd78fa3b184fbb7499da8bbf3f3ae SHA1: 069ac88f1ee45164e790e55abbc608416156652a SHA256: B2DBEB46D18B485E71253AB024D5CDA9F5F1C94BE0B5AD2387080327AC7AEE12 File Size: 356.39 KB, 356395 bytes

MD5: ccdcdc1bf67d7860a536f1a222fb9f8c SHA1: 7e3316d44c80d6bd629f8f6c240b9270cf1461e5 SHA256: BE53E35EE988542ADFE127D8B1175DEBA66422FA4450CEB4F51CD0C0EB021AA6 File Size: 8.15 MB, 8150136 bytes

MD5: dff9b301236d14e7a4613fc80683202a SHA1: f09e21c195e4d0ed940067a2adc0925d17d1d7b8 SHA256: A181F6634FCA54E3258A7A4193102AAA9BD113D0D724D56008F764FF39D490A7 File Size: 475.43 KB, 475432 bytes

MD5: a64d9fc59166c6572de297013c029ae7 SHA1: f2636ca4892bd42b07f008ee41cdd76387cbd5c5 SHA256: 5813BA988E7784CA919A9EDFE1FE1A6C44D8370EAD08DACDC15F7B24EF0476B4 File Size: 7.96 MB, 7957096 bytes

MD5: 9f86b4e87ed278570d95de25d37f264f SHA1: 0064f13e94f6e9a1e155fc92396def56b5ea75cb SHA256: AC7C205A04C0A9CEBA05EF59A25FD2BCBAF932C4F29C8A9C035533CD80E648D9 File Size: 474.94 KB, 474944 bytes

MD5: 20f587c2ce55782b6fecfb60aeacb7f2 SHA1: 2b7eb7a4509b22b9e40ef73586c16d54a55d71d2 SHA256: 084A2DA4AB0A75E613143055C1FDD4D5A6B65C7DCE046B3B61055B55BF093537 File Size: 9.84 MB, 9841768 bytes

MD5: 915f3e572fbb629c7c22fccc89fc7d1f SHA1: 28baf7f5526cab902fb6e8020e5c4afff7f4554e SHA256: E981F9F194B8E098C8EF056D42CDCB3E5B6407ED9A5F138D2EC784862321BCD2 File Size: 4.23 MB, 4230928 bytes

MD5: 5c8e47d540adea7c606a88e642e71113 SHA1: 6e559a1475333b6bf00b17bb2323948169ff3c54 SHA256: 8F17E488D8EA55CF5D9611492CA495E8BD184D1EE09C2D1F95D073272CD1CBA4 File Size: 478.23 KB, 478227 bytes

MD5: 479a7da13c02ba32cc31b1dbd32b1219 SHA1: 5009c22afee99c937505d80d337657b48f5b5301 SHA256: 0BA12BCA31C86E295A3E7419BA718936BF0B6C52700C0999283E6929182F778C File Size: 480.04 KB, 480040 bytes

MD5: 9101363b1d242928843e6e0cae51ade9 SHA1: 955a2933022b5d9c8d76674cce9fee244ce600dc SHA256: 981B77B494DE733B0CFBDDCEA7EEE353D30E9C767B158EE55FC9B223E239C8F0 File Size: 32.13 KB, 32128 bytes

MD5: f110dac2e7ef4da353cb25c495db669d SHA1: 19fe8b2d63ab42d0ff0bfbea8b9720ea7001e27c SHA256: F7D489AD4FA4C7B830CF4E8FA9E28527209B517ADDF4590A05078E4E2D27B1D4 File Size: 475.43 KB, 475432 bytes

MD5: 7730d734ec4c497c4cd6b3482246ce22 SHA1: 5877958b6bed284775eddad4dc9e16c93d814fc4 SHA256: AC8FAE574F47CA63A336BC5895CB04ED91149CE6387AA466A51DB340BEB81B7F File Size: 460.61 KB, 460608 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
1008	VarFileInfo
Company Name	IncrediMail IncrediMail, Ltd. IncrediMail LTD IncrediMail Ltd. Magneto Software Verticon
File Description	Flash Player Wrapper Global Network Inventory Scanner HiYo installer HiYo Installer IMHttpCo Dynamic Link Library IncrediMail IncrediMail ImSetup Application IncrediMail Installer IncrediMail installer IncrediMail setup Show More Setup Launcher
File Version	8, 0, 0, 1338 8, 0, 0, 1337 8, 0, 0, 1298 8, 0, 0, 1282 8, 0, 0, 1270 8, 0, 0, 1223 8,0,0,1036 7, 0, 0, 1785 7, 0, 0, 1712 7, 0, 0, 1693 Show More 7, 0, 0, 1579 6.2.9.5006 5.6.8.3226 5.3.1.2750 5.3.1.2740 4, 5, 0, 2089 4, 1, 0, 4 1.0 1, 0, 0, 10
Internal Build Number	62562
Internal Name	GNI Scanner HiYo_Install IMHttpCo ImSetup IncrediMail Installer Setup SfxLoader wflash3
Legal Copyright	Copyright (C) 2001 Copyright (C) 2007 Macrovision Corporation Copyright (C) 2008 Copyright (C) 2010 CopyrightВ© Magneto Software incredimail
Original Filename	gniscan.exe HiYo_Install.exe IMHttpCo.dll ImSetup.EXE IncrediMail_Install.exe Setup.exe SfxLoader.exe
Product Name	Global Network Inventory HiYo installer IMHttpCo Dynamic Link Library ImSetup Application IncrediMail IncrediMail Installer IncrediMail installer
Product Version	8, 0, 0, 1338 8, 0, 0, 1337 8, 0, 0, 1298 8, 0, 0, 1282 8, 0, 0, 1270 8, 0, 0, 1223 8,0,0,1036 7, 0, 0, 1785 7, 0, 0, 1712 7, 0, 0, 1693 Show More 7, 0, 0, 1579 6.2.9.5006 4, 5, 0, 2089 4, 1, 0, 4 1, 0, 0, 10
Ights Reserved.	@ OriginalFilename
L Copyright	Copyright (C) 2009 IncrediMail Ltd. All rights reserved.
Uct Name	Flash Player Wrapper

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
QIHU 360 SOFTWARE CO. LIMITED	Symantec Class 3 SHA256 Code Signing CA	Hash Mismatch
IncrediMail Ltd.	VeriSign Class 3 Code Signing 2001 CA	Root Not Trusted
IncrediMail Ltd.	VeriSign Class 3 Code Signing 2001-4 CA	Root Not Trusted
IncrediMail Ltd.	VeriSign Class 3 Code Signing 2004 CA	Root Not Trusted
IncrediMail Ltd.	VeriSign Class 3 Code Signing 2004 CA	Hash Mismatch

Show More

IncrediMail Ltd.	VeriSign Class 3 Code Signing 2004 CA	Self Signed
IncrediMail Ltd.	VeriSign Class 3 Code Signing 2009-2 CA	Hash Mismatch
IncrediMail Ltd.	VeriSign Class 3 Code Signing 2009-2 CA	Self Signed
QIHU 360 SOFTWARE CO. LIMITED	VeriSign Class 3 Code Signing 2010 CA	Hash Mismatch

File Traits

• HighEntropy
• Installer Version
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	139
Potentially Malicious Blocks:	4
Whitelisted Blocks:	56
Unknown Blocks:	79

Visual Map

? ? 0 ? ? ? ? 0 ? ? 0 ? ? ? 0 0 0 0 0 0 x 0 0 ? 0 ? ? ? ? 0 ? ? ? x ? ? 0 ? ? ? ? 0 0 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 ? ? 0 0 ? ? 0 0 ? 0 0 0 0 0 0 0 ? 0 ? x ? 0 0 0 0 1 1 0 0 0 0 ? ? ? ? ? ? ? ? ? ? 1 ? 0 x 0 0 ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Delf.XB
• Injector.FHBH
• Injector.KDG
• Injector.KFTA
• Injector.PMB

Show More

• Injector.XN
• Kryptik.YFH
• Kryptik.YFK
• NetBus.A
• Sqwire.AA
• Trojan.Injector.Gen.FBD

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\low\sfxbeginner_log_formutex_1260.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\low\sfxbeginner_log_formutex_2436.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\low\sfxbeginner_log_formutex_5592.log	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\low\sfxbeginnerlog.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\1702116\actionengine.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\ars.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\arscookies.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\autoupdateengine.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\basicparameters.xml	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\1702116\basicproductparams.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\basicproductutils.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\basicscript.7z	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\basicscript.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\api.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\api.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\jquery-1.3.2.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\jquery.localisation.min.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-ar.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-da.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-de.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-el.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-en.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-es.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-fi.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-fr.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-he.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-hu.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-it.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-nb.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-nl.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-pl.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-pt.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-ru.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-sv.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings-tr.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\language\splash-strings.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\loading_center.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\loading_icon.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\loading_left.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\loading_right.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\splash.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\splash.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\splash.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\gui\translation.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\instlangs.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\settings-ar.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\settings-en.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\settings-he.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-ar.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-da.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-de.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-el.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-en.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-es.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-fi.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-fr.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-he.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-hu.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-it.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-nb.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-nl.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-pl.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-pt.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-ru.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-sv.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\language\strings-tr.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\productscorrelations.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\statistics.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\terms.7z	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\uninstallsearchguard.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\1702116\utilities.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_msi5166._is	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glb1091.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glb2d22.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glb4a86.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glb7776.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glba728.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glba7c4.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glba802.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glbba0e.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glbd038.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glbd365.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glbe314.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glc11e9.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glc2f16.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glc4c0d.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glc78ed.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glca8cd.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glca96a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glca9a8.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glcbbc3.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glcd1fd.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glcd4cc.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glce40e.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\glf1df4.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glf1df4.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glf3b02.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glf3b02.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glf5857.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glf5857.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glf8536.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glf8536.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glfb4b9.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glfb4b9.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glfb575.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glfb575.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glfb5f2.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glfb5f2.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glfc7ce.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glfc7ce.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glfde27.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glfde27.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glfe0c9.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glfe0c9.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glff049.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\glff049.tmp	Synchronize,Write Data
c:\users\user\appdata\local\temp\glg1db4.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glg3ae2.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glg57c9.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glg8516.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glgb499.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glgb545.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glgb5d2.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glgc79f.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glgddf7.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glge099.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glgf029.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glj1209.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glj2f46.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glj4c3d.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glj792c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glja8fd.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glja9a9.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glja9d8.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gljbbf3.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gljd23c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\gljd4ec.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glje42f.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glk140e.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glk314a.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glk4e41.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glk7b21.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glkab02.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glkab9e.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glkabdd.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glkbde8.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glkd431.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glkd6e1.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glke633.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glmd8f6.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\glme848.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\iminstaller\hiyo\arguments.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\iminstaller\hiyo\globaltable.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\iminstaller\hiyo\status.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\iminstaller\incredimail\injectparams.xml	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\incredimail\incredimail_terms.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\incredimail\incredimail_terms.txt	Synchronize,Write Data
c:\users\user\appdata\local\temp\incredimail\incredimail_termsansi.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\incredimail\incredimail_termsansi.txt	Synchronize,Write Data
c:\users\user\appdata\local\temp\incredimail\~glh0001.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi34d3.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi34d3.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi3532.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi3532.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi3562.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi3562.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi35d0.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi35d0.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi35f1.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi35f1.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi558b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi558b.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi55ea.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi55ea.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi5658.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi5658.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi5688.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi5688.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgi56a8.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgi56a8.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgibe47.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgibe47.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgibec5.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgibec5.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgibef5.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgibef5.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgibf15.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgibf15.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgibf45.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgibf45.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgieeb1.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgieeb1.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgief00.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgief00.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgief20.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgief20.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgief40.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rgief40.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rgief61.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

13 additional files are not displayed above.

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	B[  �r� \  � �* ��� �8 \x� �B +� �� �6 �}�� �� 7� xy �� �� ۀ  > �����B���� �x�% ���8 �5���� Bx�����\�! I �RN�sb! > !wz#@�#�� #�O $kF $��$¨%:�%f�%� '�'i '�	RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	51faf072-2bbf-4063-9f46-36c1dc5cf5ea	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	봐㜄彂ǜ	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\advanced inf setup\ie complist::ie.hkcuzoneinfo		RegNtPreCreateKey
HKCU\software\hiyo::sessionguid	95a41785-9490-460f-9e51-38292a4f1482	RegNtPreCreateKey
HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\firewallcontrolpanel.dll,-12122	Windows Defender Firewall	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKCU\software\hiyo::installationfallbackmode		RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	a6c4b285-7787-46a4-ab9c-9a518dc016a9	RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	2be4aa51-90d6-4ab8-a541-4f1e049db9f1	RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	3af55b4d-17fb-4812-9c8b-211a21bc961c	RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	e270bcf5-427b-48e9-b4cc-a24d40a87aca	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	����� 	RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	ddf0f299-0acc-4b44-95b2-e67006558874	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	匆䰨⇣ǝ	RegNtPreCreateKey
HKCU\software\iminstaller\incredimail::sessionguid	21e2c70f-f9c2-4d3e-a49d-4a307fb857fd	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	趯⣾⍛ǝ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Process Shell Execute	CreateProcess ShellExecuteEx WriteConsole
Anti Debug	IsDebuggerPresent NtQuerySystemInformation OutputDebugString
User Data Access	GetUserObjectInformation
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Terminate	TerminateProcess
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Ydvjreop\AppData\Local\Temp\GLB1091.tmp C:\Users\Ydvjreop\AppData\Local\Temp\GLB1091.tmp 4736 c:\users\user\DOWNLO~1\D1E8FC~1.EXE

C:\Users\Isoprpbz\AppData\Local\Temp\GLBE314.tmp C:\Users\Isoprpbz\AppData\Local\Temp\GLBE314.tmp 4736 c:\users\user\DOWNLO~1\C82253~1.EXE

C:\Users\Qsregxpn\AppData\Local\Temp\GLBD365.tmp C:\Users\Qsregxpn\AppData\Local\Temp\GLBD365.tmp 4736 c:\users\user\DOWNLO~1\CC497B~1.EXE

C:\Users\Bowizmzx\AppData\Local\Temp\GLB4A86.tmp C:\Users\Bowizmzx\AppData\Local\Temp\GLB4A86.tmp 4736 c:\users\user\DOWNLO~1\C0683B~1

(NULL) icacls C:\Users\Obsqucne\AppData\Local\Temp\Low /setintegritylevel (OI)(CI)low

Show More

WriteConsole: processed file:

WriteConsole: Successfully pro

C:\Users\Dormhndg\AppData\Local\Temp\GLB2D22.tmp C:\Users\Dormhndg\AppData\Local\Temp\GLB2D22.tmp 4736 c:\users\user\DOWNLO~1\3E3EA4~1

C:\Users\Ynfsibca\AppData\Local\Temp\GLBD038.tmp C:\Users\Ynfsibca\AppData\Local\Temp\GLBD038.tmp 4736 c:\users\user\DOWNLO~1\CF7828~1

C:\Users\Eqjmdvzz\AppData\Local\Temp\GLBBA0E.tmp C:\Users\Eqjmdvzz\AppData\Local\Temp\GLBBA0E.tmp 4736 c:\users\user\DOWNLO~1\CB05CF~1

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\acf1d5e262cd90cf7ec5bbf456140cff25e4ebef_0000324992.,LiQMAxHB

C:\Users\Zmjqzuji\AppData\Local\Temp\GLBA728.tmp C:\Users\Zmjqzuji\AppData\Local\Temp\GLBA728.tmp 4736 c:\users\user\DOWNLO~1\1B4D7E~1

C:\Users\Ejwvbkmr\AppData\Local\Temp\GLBA802.tmp C:\Users\Ejwvbkmr\AppData\Local\Temp\GLBA802.tmp 4736 c:\users\user\DOWNLO~1\7E3316~1

C:\Users\Uqjbxlwk\AppData\Local\Temp\GLBA7C4.tmp C:\Users\Uqjbxlwk\AppData\Local\Temp\GLBA7C4.tmp 4736 c:\users\user\DOWNLO~1\F2636C~1

C:\Users\Udpwegfl\AppData\Local\Temp\GLB7776.tmp C:\Users\Udpwegfl\AppData\Local\Temp\GLB7776.tmp 4736 c:\users\user\DOWNLO~1\2B7EB7~1

(NULL) icacls C:\Users\Fftcfili\AppData\Local\Temp\Low /setintegritylevel (OI)(CI)low

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\955a2933022b5d9c8d76674cce9fee244ce600dc_0000032128.,LiQMAxHB

(NULL) icacls C:\Users\Ecbcmvsg\AppData\Local\Temp\Low /setintegritylevel (OI)(CI)low

(NULL) icacls C:\Users\Bpismgqh\AppData\Local\Temp\Low /setintegritylevel (OI)(CI)low