IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive
initial sample
 malicious
C:\Program Files (x86)\PrintFolders\PrintFolders.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
modified
 malicious
C:\Program Files (x86)\PrintFolders\Russian.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\is-6QPAJ.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\is-JPR4D.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\CqxAaSZxg.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\Guide.chm (copy)
MS Windows HtmlHelp Data
dropped
C:\Program Files (x86)\PrintFolders\History.txt (copy)
ASCII text, with CRLF line terminators
dropped
C:\Program Files (x86)\PrintFolders\License.txt (copy)
RAGE Package Format (RPF),
dropped
C:\Program Files (x86)\PrintFolders\is-3PESN.tmp
data
dropped
C:\Program Files (x86)\PrintFolders\is-B2P4P.tmp
RAGE Package Format (RPF),
dropped
C:\Program Files (x86)\PrintFolders\is-D385T.tmp
ASCII text, with CRLF line terminators
dropped
C:\Program Files (x86)\PrintFolders\is-U4GGJ.tmp
MS Windows HtmlHelp Data
dropped
C:\Program Files (x86)\PrintFolders\unins000.dat
InnoSetup Log PrintFolders {73D78C7A-78F2-476F-86FF-9025EA410908}, version 0x2a, 3814 bytes, 992547\user, "C:\Program Files (x86)\PrintFolders"
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\fuckingdllENCR[1].dll
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\count[1].htm
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\library[1].htm
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\library[1].htm
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\ping[1].htm
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files (x86)\PrintFolders\PrintFolders.exe
"C:\Program Files (x86)\PrintFolders\PrintFolders.exe"
malicious
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\CqxAaSZxg.exe
malicious
C:\Users\user\Desktop\file.exe
C:\Users\user\Desktop\file.exe
C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp
"C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp" /SL4 $30340 "C:\Users\user\Desktop\file.exe" 1077961 51712
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "PrintFolders.exe" /f & erase "C:\Program Files (x86)\PrintFolders\PrintFolders.exe" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\taskkill.exe
taskkill /im "PrintFolders.exe" /f

URLs

Name
IP
Malicious
http://171.22.30.106/library.phpV
unknown
 malicious
http://171.22.30.106/library.php:
unknown
 malicious
http://171.22.30.106/library.php~
unknown
 malicious
http://171.22.30.106/library.phpB
unknown
 malicious
http://171.22.30.106/library.phpjN
unknown
 malicious
http://171.22.30.106/library.phpH
unknown
 malicious
http://171.22.30.106/library.php&
unknown
 malicious
http://171.22.30.106/library.phpj
unknown
 malicious
http://171.22.30.106/library.php0
unknown
 malicious
http://171.22.30.106/library.php
171.22.30.106
 malicious
http://pfolders.atopoint.com.
unknown
http://www.innosetup.com/
unknown
http://pfolders.atopoint.com2
unknown
http://www.atopoint.com
unknown
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
45.139.105.171
http://107.182.129.235/storage/extension.php
107.182.129.235
http://www.remobjects.com/?ps
unknown
http://pfolders.atopoint.com
unknown
http://www.innosetup.com
unknown
http://107.182.129.235/storage/ping.php
107.182.129.235
http://www.atopoint.com.
unknown
http://www.innosetup.comDVarFileInfo$
unknown
http://www.remobjects.com/?psU
unknown
There are 13 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
45.139.105.1
unknown
Italy
malicious
85.31.46.167
unknown
Germany
malicious
45.139.105.171
unknown
Italy
107.182.129.235
unknown
Reserved
171.22.30.106
unknown
Germany

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Atopoint Software\PrintFolders
Language
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: Setup Version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: App Path
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
InstallLocation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: Icon Group
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: User
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
DisplayIcon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
UninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
QuietUninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
DisplayVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
URLInfoAbout
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
HelpLink
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
URLUpdateInfo
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
NoModify
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
NoRepair
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1730000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
3310000
direct allocation
page read and write
 malicious
21F0000
direct allocation
page read and write
3861000
heap
page read and write
410000
unkown
page readonly
44D4000
trusted library allocation
page read and write
2F40000
direct allocation
page read and write
3370000
direct allocation
page read and write
1760000
heap
page read and write
15C4000
heap
page read and write
15C4000
heap
page read and write
3861000
heap
page read and write
E74000
unkown
page readonly
30000
heap
page read and write
2F8E000
stack
page read and write
3861000
heap
page read and write
1273000
unkown
page readonly
401000
unkown
page execute read
700000
heap
page read and write
3861000
heap
page read and write
4368000
trusted library allocation
page read and write
2740000
trusted library allocation
page read and write
10019000
direct allocation
page readonly
14FA000
heap
page read and write
23DF000
stack
page read and write
4368000
trusted library allocation
page read and write
4386000
trusted library allocation
page read and write
4333000
trusted library allocation
page read and write
3861000
heap
page read and write
10000000
unkown
page readonly
44D2000
trusted library allocation
page read and write
67E000
stack
page read and write
15C4000
heap
page read and write
5C0000
trusted library allocation
page read and write
97000
stack
page read and write
5F5000
heap
page read and write
6FA000
heap
page read and write
22DE000
stack
page read and write
3861000
heap
page read and write
3860000
heap
page read and write
E61000
unkown
page execute read
44D2000
trusted library allocation
page read and write
10001000
unkown
page execute read
30B0000
direct allocation
page read and write
1FA8000
direct allocation
page read and write
30000
trusted library allocation
page read and write
4386000
trusted library allocation
page read and write
402E000
stack
page read and write
44D2000
trusted library allocation
page read and write
412E000
stack
page read and write
10017000
direct allocation
page read and write
15C4000
heap
page read and write
33DD000
stack
page read and write
15C4000
heap
page read and write
3861000
heap
page read and write
791000
heap
page read and write
3E6F000
stack
page read and write
4386000
trusted library allocation
page read and write
400000
unkown
page readonly
B3C000
stack
page read and write
4386000
trusted library allocation
page read and write
E61000
unkown
page execute read
4368000
trusted library allocation
page read and write
106A000
heap
page read and write
9C000
stack
page read and write
3861000
heap
page read and write
3960000
trusted library allocation
page read and write
1410000
heap
page read and write
3861000
heap
page read and write
26C0000
trusted library allocation
page read and write
15C4000
heap
page read and write
4386000
trusted library allocation
page read and write
70A000
heap
page read and write
12B9000
unkown
page readonly
724000
heap
page read and write
433B000
trusted library allocation
page read and write
15C4000
heap
page read and write
14C6000
heap
page read and write
3861000
heap
page read and write
19B000
stack
page read and write
15C4000
heap
page read and write
33EE000
stack
page read and write
3861000
heap
page read and write
15C4000
heap
page read and write
471C000
stack
page read and write
461E000
stack
page read and write
19D000
stack
page read and write
1E80000
heap
page read and write
44D2000
trusted library allocation
page read and write
336F000
stack
page read and write
3861000
heap
page read and write
769000
heap
page read and write
44D2000
trusted library allocation
page read and write
18F000
stack
page read and write
1503000
heap
page read and write
910000
heap
page read and write
15C4000
heap
page read and write
769000
heap
page read and write
E60000
unkown
page readonly
21C0000
direct allocation
page read and write
1FA4000
direct allocation
page read and write
3861000
heap
page read and write
CB0000
heap
page read and write
3221000
trusted library allocation
page read and write
21C4000
direct allocation
page read and write
8EF000
stack
page read and write
4F0000
trusted library allocation
page read and write
3861000
heap
page read and write
9C000
stack
page read and write
540000
heap
page read and write
5E4000
heap
page read and write
15C4000
heap
page read and write
401000
unkown
page execute read
300F000
stack
page read and write
3AEE000
stack
page read and write
2090000
direct allocation
page read and write
3861000
heap
page read and write
15C4000
heap
page read and write
4386000
trusted library allocation
page read and write
410000
unkown
page readonly
44D2000
trusted library allocation
page read and write
3390000
direct allocation
page read and write
1765000
heap
page read and write
15C4000
heap
page read and write
6A0000
direct allocation
page execute and read and write
15B0000
direct allocation
page read and write
4368000
trusted library allocation
page read and write
4BC000
unkown
page readonly
442A000
trusted library allocation
page read and write
21EC000
direct allocation
page read and write
74C000
heap
page read and write
15C4000
heap
page read and write
312E000
stack
page read and write
3861000
heap
page read and write
3861000
heap
page read and write
6F0000
heap
page read and write
42B7000
trusted library allocation
page read and write
3FDA000
stack
page read and write
4AF000
unkown
page write copy
412C000
stack
page read and write
204C000
direct allocation
page read and write
16DE000
stack
page read and write
15C4000
heap
page read and write
452000
unkown
page execute and read and write
21D4000
direct allocation
page read and write
1060000
heap
page read and write
401000
unkown
page execute read
21D4000
direct allocation
page read and write
34DF000
stack
page read and write
3861000
heap
page read and write
4386000
trusted library allocation
page read and write
1FA1000
direct allocation
page read and write
6D0000
trusted library allocation
page read and write
15C4000
heap
page read and write
916000
heap
page read and write
400000
unkown
page readonly
15C4000
heap
page read and write
520000
trusted library allocation
page read and write
150D000
heap
page read and write
416E000
stack
page read and write
4368000
trusted library allocation
page read and write
3861000
heap
page read and write
3861000
heap
page read and write
3861000
heap
page read and write
3861000
heap
page read and write
3861000
heap
page read and write
48C000
unkown
page read and write
4368000
trusted library allocation
page read and write
4368000
trusted library allocation
page read and write
63E000
stack
page read and write
500000
heap
page read and write
21ED000
direct allocation
page read and write
5F0000
heap
page read and write
4368000
trusted library allocation
page read and write
44D2000
trusted library allocation
page read and write
1F90000
direct allocation
page read and write
16E0000
direct allocation
page read and write
E74000
unkown
page readonly
19C000
stack
page read and write
320F000
stack
page read and write
3870000
heap
page read and write
39AE000
stack
page read and write
3861000
heap
page read and write
744000
heap
page read and write
4368000
trusted library allocation
page read and write
2090000
direct allocation
page read and write
10001000
direct allocation
page execute read
3861000
heap
page read and write
44D2000
trusted library allocation
page read and write
401000
unkown
page execute read
33AE000
stack
page read and write
15C4000
heap
page read and write
3861000
heap
page read and write
426F000
stack
page read and write
1700000
direct allocation
page read and write
400000
unkown
page readonly
15C4000
heap
page read and write
15C4000
heap
page read and write
1E4E000
stack
page read and write
4AE000
unkown
page read and write
753000
heap
page read and write
3861000
heap
page read and write
12BA000
unkown
page execute and write copy
1001A000
direct allocation
page read and write
4386000
trusted library allocation
page read and write
E6C000
unkown
page readonly
400000
unkown
page readonly
15C4000
heap
page read and write
44D4000
trusted library allocation
page read and write
74C000
heap
page read and write
15C4000
heap
page read and write
15C4000
heap
page read and write
199000
stack
page read and write
E6C000
unkown
page readonly
791000
heap
page read and write
15C4000
heap
page read and write
400000
unkown
page readonly
3960000
trusted library allocation
page read and write
15C4000
heap
page read and write
3861000
heap
page read and write
E72000
unkown
page write copy
1FA1000
direct allocation
page read and write
3861000
heap
page read and write
48C000
unkown
page write copy
3E80000
heap
page read and write
2F40000
direct allocation
page read and write
3861000
heap
page read and write
E60000
unkown
page readonly
3EDE000
stack
page read and write
3861000
heap
page read and write
1400000
trusted library allocation
page read and write
3960000
trusted library allocation
page read and write
3861000
heap
page read and write
44D2000
trusted library allocation
page read and write
3861000
heap
page read and write
44D2000
trusted library allocation
page read and write
21BF000
stack
page read and write
3861000
heap
page read and write
40A000
unkown
page write copy
3861000
heap
page read and write
401000
unkown
page execute read
40C000
unkown
page write copy
15A0000
heap
page read and write
7D0000
heap
page read and write
3D2F000
stack
page read and write
4BC000
unkown
page readonly
479F000
stack
page read and write
16F0000
heap
page read and write
3AAF000
stack
page read and write
4368000
trusted library allocation
page read and write
3861000
heap
page read and write
15C4000
heap
page read and write
3861000
heap
page read and write
4386000
trusted library allocation
page read and write
15C4000
heap
page read and write
E72000
unkown
page read and write
4386000
trusted library allocation
page read and write
1F8F000
stack
page read and write
10002000
unkown
page readonly
5A0000
trusted library allocation
page read and write
308F000
stack
page read and write
10010000
direct allocation
page readonly
3861000
heap
page read and write
3D6E000
stack
page read and write
747000
heap
page read and write
489F000
stack
page read and write
46A0000
trusted library allocation
page read and write
4368000
trusted library allocation
page read and write
15C4000
heap
page read and write
3BEF000
stack
page read and write
3861000
heap
page read and write
3C2E000
stack
page read and write
91A000
heap
page read and write
20000
heap
page read and write
3861000
heap
page read and write
322F000
stack
page read and write
15C0000
heap
page read and write
3861000
heap
page read and write
40A000
unkown
page read and write
435A000
trusted library allocation
page read and write
8F0000
heap
page read and write
4386000
trusted library allocation
page read and write
46F000
unkown
page readonly
5E0000
heap
page read and write
C70000
trusted library allocation
page read and write
15C4000
heap
page read and write
30000
heap
page read and write
D30000
heap
page read and write
4386000
trusted library allocation
page read and write
154E000
stack
page read and write
326E000
stack
page read and write
3861000
heap
page read and write
A3C000
stack
page read and write
141A000
heap
page read and write
2910000
heap
page read and write
199000
stack
page read and write
15C4000
heap
page read and write
10000000
direct allocation
page read and write
There are 289 hidden memdumps, click here to show them.