IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive
initial sample
 malicious
C:\Program Files (x86)\PrintFolders\PrintFolders.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
modified
 malicious
C:\Program Files (x86)\PrintFolders\Russian.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\is-GLBR6.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\is-NSDTB.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-258FQ.tmp\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-258FQ.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-OJDTA.tmp\is-8PA5U.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\1mWX2l.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\PrintFolders\Guide.chm (copy)
MS Windows HtmlHelp Data
dropped
C:\Program Files (x86)\PrintFolders\History.txt (copy)
ASCII text, with CRLF line terminators
dropped
C:\Program Files (x86)\PrintFolders\License.txt (copy)
RAGE Package Format (RPF),
dropped
C:\Program Files (x86)\PrintFolders\is-36EDD.tmp
MS Windows HtmlHelp Data
dropped
C:\Program Files (x86)\PrintFolders\is-9NS73.tmp
data
dropped
C:\Program Files (x86)\PrintFolders\is-EPDSE.tmp
RAGE Package Format (RPF),
dropped
C:\Program Files (x86)\PrintFolders\is-GVS6M.tmp
ASCII text, with CRLF line terminators
dropped
C:\Program Files (x86)\PrintFolders\unins000.dat
InnoSetup Log PrintFolders {73D78C7A-78F2-476F-86FF-9025EA410908}, version 0x2a, 3813 bytes, 040965\user, "C:\Program Files (x86)\PrintFolders"
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\count[1].htm
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fuckingdllENCR[1].dll
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\library[1].htm
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ping[1].htm
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\library[1].htm
very short file (no magic)
dropped
C:\Users\user\AppData\Local\Temp\is-258FQ.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files (x86)\PrintFolders\PrintFolders.exe
"C:\Program Files (x86)\PrintFolders\PrintFolders.exe"
malicious
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\1mWX2l.exe
malicious
C:\Users\user\Desktop\file.exe
C:\Users\user\Desktop\file.exe
C:\Users\user\AppData\Local\Temp\is-OJDTA.tmp\is-8PA5U.tmp
"C:\Users\user\AppData\Local\Temp\is-OJDTA.tmp\is-8PA5U.tmp" /SL4 $4025C "C:\Users\user\Desktop\file.exe" 1079207 51712
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "PrintFolders.exe" /f & erase "C:\Program Files (x86)\PrintFolders\PrintFolders.exe" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\taskkill.exe
taskkill /im "PrintFolders.exe" /f

URLs

Name
IP
Malicious
http://107.182.129.235/storage/extension.php
107.182.129.235
 malicious
http://107.182.129.235/storage/ping.php
107.182.129.235
 malicious
http://171.22.30.106/library.php
171.22.30.106
 malicious
http://pfolders.atopoint.com.
unknown
http://www.innosetup.com/
unknown
http://www.atopoint.com
unknown
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
45.139.105.171
http://pfolders.atopoint.comZ
unknown
http://www.remobjects.com/?ps
unknown
http://pfolders.atopoint.com
unknown
http://www.innosetup.com
unknown
http://www.atopoint.com.
unknown
http://www.innosetup.comDVarFileInfo$
unknown
http://www.atopoint.comJ
unknown
http://www.remobjects.com/?psU
unknown
There are 5 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
45.139.105.1
unknown
Italy
malicious
85.31.46.167
unknown
Germany
malicious
107.182.129.235
unknown
Reserved
malicious
171.22.30.106
unknown
Germany
malicious
45.139.105.171
unknown
Italy

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Atopoint Software\PrintFolders
Language
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: Setup Version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: App Path
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
InstallLocation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: Icon Group
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Inno Setup: User
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
DisplayIcon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
UninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
QuietUninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
DisplayVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
URLInfoAbout
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
HelpLink
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
URLUpdateInfo
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
NoModify
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{73D78C7A-78F2-476F-86FF-9025EA410908}}_is1
NoRepair
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
30D0000
direct allocation
page read and write
 malicious
3070000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
97000
stack
page read and write
4107000
trusted library allocation
page read and write
3FEC000
stack
page read and write
19C000
stack
page read and write
396F000
stack
page read and write
3721000
heap
page read and write
4108000
trusted library allocation
page read and write
4BC000
unkown
page readonly
4252000
trusted library allocation
page read and write
851000
unkown
page execute read
3BEF000
stack
page read and write
4AF000
unkown
page write copy
4255000
trusted library allocation
page read and write
21B0000
direct allocation
page read and write
157B000
heap
page read and write
33EE000
stack
page read and write
4107000
trusted library allocation
page read and write
10000000
direct allocation
page read and write
401000
unkown
page execute read
2F20000
direct allocation
page read and write
D00000
heap
page read and write
40CE000
trusted library allocation
page read and write
3721000
heap
page read and write
148E000
stack
page read and write
3721000
heap
page read and write
738000
heap
page read and write
3721000
heap
page read and write
3721000
heap
page read and write
4252000
trusted library allocation
page read and write
1F4000
heap
page read and write
3721000
heap
page read and write
197000
stack
page read and write
1F4000
heap
page read and write
4108000
trusted library allocation
page read and write
339F000
stack
page read and write
1F4000
heap
page read and write
3721000
heap
page read and write
157D000
heap
page read and write
4108000
trusted library allocation
page read and write
734000
heap
page read and write
30DE000
stack
page read and write
40CE000
trusted library allocation
page read and write
4108000
trusted library allocation
page read and write
1542000
heap
page read and write
1581000
heap
page read and write
1810000
heap
page read and write
21D0000
direct allocation
page read and write
10017000
direct allocation
page read and write
3240000
direct allocation
page read and write
4108000
trusted library allocation
page read and write
40EC000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
1F4000
heap
page read and write
3730000
heap
page read and write
2690000
trusted library allocation
page read and write
3721000
heap
page read and write
144E000
stack
page read and write
4255000
trusted library allocation
page read and write
4252000
trusted library allocation
page read and write
2F60000
heap
page read and write
4108000
trusted library allocation
page read and write
3AAF000
stack
page read and write
1F4000
heap
page read and write
714000
heap
page read and write
1F4000
heap
page read and write
218C000
direct allocation
page read and write
1F4000
heap
page read and write
68E000
stack
page read and write
19D000
stack
page read and write
2180000
direct allocation
page read and write
4107000
trusted library allocation
page read and write
2F2F000
stack
page read and write
4108000
trusted library allocation
page read and write
3721000
heap
page read and write
44CE000
stack
page read and write
335E000
stack
page read and write
3721000
heap
page read and write
20D0000
direct allocation
page read and write
3E9A000
stack
page read and write
1F4000
heap
page read and write
386E000
stack
page read and write
1F4000
heap
page read and write
20E8000
direct allocation
page read and write
400000
unkown
page readonly
4D0000
trusted library allocation
page read and write
48C000
unkown
page read and write
1001A000
direct allocation
page read and write
410000
unkown
page readonly
3721000
heap
page read and write
400000
unkown
page readonly
489F000
stack
page read and write
45CD000
stack
page read and write
4252000
trusted library allocation
page read and write
864000
unkown
page readonly
1F4000
heap
page read and write
39AE000
stack
page read and write
3110000
heap
page read and write
C60000
trusted library allocation
page read and write
40C000
unkown
page write copy
862000
unkown
page read and write
40EC000
trusted library allocation
page read and write
40CE000
trusted library allocation
page read and write
40EC000
trusted library allocation
page read and write
41AA000
trusted library allocation
page read and write
3721000
heap
page read and write
3820000
trusted library allocation
page read and write
1F4000
heap
page read and write
40A000
unkown
page write copy
10000000
unkown
page readonly
3D2F000
stack
page read and write
3D9E000
stack
page read and write
4252000
trusted library allocation
page read and write
9C000
stack
page read and write
73C000
heap
page read and write
4255000
trusted library allocation
page read and write
504000
heap
page read and write
3721000
heap
page read and write
3721000
heap
page read and write
743000
heap
page read and write
448000
heap
page read and write
40A1000
trusted library allocation
page read and write
3FEE000
stack
page read and write
3721000
heap
page read and write
4255000
trusted library allocation
page read and write
1F4000
heap
page read and write
1F4000
heap
page read and write
40EC000
trusted library allocation
page read and write
40CE000
trusted library allocation
page read and write
4AE000
unkown
page read and write
20CF000
stack
page read and write
CD0000
heap
page read and write
850000
unkown
page readonly
620000
trusted library allocation
page read and write
40CE000
trusted library allocation
page read and write
3721000
heap
page read and write
401000
unkown
page execute read
3721000
heap
page read and write
4010000
trusted library allocation
page read and write
10010000
direct allocation
page readonly
4108000
trusted library allocation
page read and write
864000
unkown
page readonly
410000
unkown
page readonly
3721000
heap
page read and write
4255000
trusted library allocation
page read and write
21D0000
direct allocation
page read and write
401000
unkown
page execute read
851000
unkown
page execute read
452000
unkown
page execute and read and write
4107000
trusted library allocation
page read and write
3220000
direct allocation
page read and write
3721000
heap
page read and write
191000
stack
page read and write
40EC000
trusted library allocation
page read and write
52A000
heap
page read and write
4252000
trusted library allocation
page read and write
2F30000
direct allocation
page read and write
3721000
heap
page read and write
3250000
direct allocation
page read and write
535000
heap
page read and write
158B000
heap
page read and write
3721000
heap
page read and write
12BA000
unkown
page execute and write copy
40EC000
trusted library allocation
page read and write
1588000
heap
page read and write
40CE000
trusted library allocation
page read and write
3721000
heap
page read and write
1F4000
heap
page read and write
20E1000
direct allocation
page read and write
2194000
direct allocation
page read and write
31DF000
stack
page read and write
10002000
unkown
page readonly
306F000
stack
page read and write
1490000
heap
page read and write
1F4000
heap
page read and write
401000
unkown
page execute read
1F4000
heap
page read and write
4255000
trusted library allocation
page read and write
3721000
heap
page read and write
E30000
heap
page read and write
3721000
heap
page read and write
1F4000
heap
page read and write
4255000
trusted library allocation
page read and write
4BC000
unkown
page readonly
199000
stack
page read and write
3721000
heap
page read and write
3721000
heap
page read and write
3721000
heap
page read and write
30000
heap
page read and write
440000
heap
page read and write
4CA0000
trusted library allocation
page read and write
3131000
trusted library allocation
page read and write
1F4000
heap
page read and write
33AE000
stack
page read and write
4108000
trusted library allocation
page read and write
1F4000
heap
page read and write
1F4000
heap
page read and write
3721000
heap
page read and write
207F000
stack
page read and write
3D40000
heap
page read and write
630000
heap
page read and write
8FD000
stack
page read and write
4252000
trusted library allocation
page read and write
3721000
heap
page read and write
4097000
trusted library allocation
page read and write
4F0000
trusted library allocation
page read and write
2F20000
heap
page read and write
4107000
trusted library allocation
page read and write
31F0000
heap
page read and write
1815000
heap
page read and write
3721000
heap
page read and write
526000
heap
page read and write
2184000
direct allocation
page read and write
1F4000
heap
page read and write
46F000
unkown
page readonly
4252000
trusted library allocation
page read and write
40EC000
trusted library allocation
page read and write
1010000
heap
page read and write
6E0000
heap
page read and write
85C000
unkown
page readonly
3721000
heap
page read and write
40C2000
trusted library allocation
page read and write
4108000
trusted library allocation
page read and write
199000
stack
page read and write
3721000
heap
page read and write
2194000
direct allocation
page read and write
400000
unkown
page readonly
21AD000
direct allocation
page read and write
3EEE000
stack
page read and write
40A000
unkown
page read and write
19B000
stack
page read and write
1F4000
heap
page read and write
10001000
direct allocation
page execute read
3721000
heap
page read and write
1F4000
heap
page read and write
6B0000
direct allocation
page execute and read and write
40EC000
trusted library allocation
page read and write
3721000
heap
page read and write
3721000
heap
page read and write
85C000
unkown
page readonly
3721000
heap
page read and write
12B9000
unkown
page readonly
308F000
stack
page read and write
217F000
stack
page read and write
1273000
unkown
page readonly
3100000
direct allocation
page read and write
530000
heap
page read and write
1F0000
heap
page read and write
40EC000
trusted library allocation
page read and write
40CE000
trusted library allocation
page read and write
3721000
heap
page read and write
20E4000
direct allocation
page read and write
3721000
heap
page read and write
156D000
heap
page read and write
30000
trusted library allocation
page read and write
73C000
heap
page read and write
862000
unkown
page write copy
10001000
unkown
page execute read
329D000
stack
page read and write
40C0000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
40CE000
trusted library allocation
page read and write
500000
heap
page read and write
6EA000
heap
page read and write
40CE000
trusted library allocation
page read and write
400000
unkown
page readonly
2F20000
direct allocation
page read and write
9C000
stack
page read and write
40EC000
trusted library allocation
page read and write
3820000
trusted library allocation
page read and write
3721000
heap
page read and write
4252000
trusted library allocation
page read and write
40EC000
trusted library allocation
page read and write
1F4000
heap
page read and write
1F4000
heap
page read and write
3721000
heap
page read and write
17F0000
trusted library allocation
page read and write
9FC000
stack
page read and write
E3A000
heap
page read and write
20000
heap
page read and write
1F4000
heap
page read and write
401000
unkown
page execute read
4255000
trusted library allocation
page read and write
4252000
trusted library allocation
page read and write
3721000
heap
page read and write
193000
stack
page read and write
1F4000
heap
page read and write
21AC000
direct allocation
page read and write
2340000
trusted library allocation
page read and write
3360000
direct allocation
page read and write
4108000
trusted library allocation
page read and write
4252000
trusted library allocation
page read and write
400000
unkown
page readonly
720000
heap
page read and write
3721000
heap
page read and write
1F4000
heap
page read and write
3721000
heap
page read and write
1F4000
heap
page read and write
2F8E000
stack
page read and write
4107000
trusted library allocation
page read and write
479F000
stack
page read and write
4255000
trusted library allocation
page read and write
3720000
heap
page read and write
4107000
trusted library allocation
page read and write
2710000
trusted library allocation
page read and write
3820000
trusted library allocation
page read and write
520000
heap
page read and write
4C9F000
stack
page read and write
30000
heap
page read and write
850000
unkown
page readonly
20E1000
direct allocation
page read and write
64E000
stack
page read and write
3AEE000
stack
page read and write
3C2E000
stack
page read and write
149A000
heap
page read and write
40CE000
trusted library allocation
page read and write
18E000
stack
page read and write
10019000
direct allocation
page readonly
40EC000
trusted library allocation
page read and write
4107000
trusted library allocation
page read and write
420000
trusted library allocation
page read and write
48C000
unkown
page write copy
6CE000
stack
page read and write
540000
heap
page read and write
890000
heap
page read and write
1F4000
heap
page read and write
3721000
heap
page read and write
There are 319 hidden memdumps, click here to show them.