488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

Analysis

max time kernel
66s
max time network
75s
platform
windows7_x64
resource
win7-20220414-en
submitted
19-05-2022 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UQD_211116.exe
Size

11.7MB
MD5

4dadc2245fc209e51d9c22753f5a8eec
SHA1

2e32247294f43fac2edcdd1d044c70b398e03905
SHA256

488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA512

4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Score

10^/10

adware evasion persistence spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Drops file in Drivers directory 2 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	UQD_211116.exe
File created	C:\Windows\System32\drivers\etc\hosts	UQD_211116.exe

Executes dropped EXE 6 IoCs

Processes:

ifblscv.exefynqhto.exe~sojfgzi.exe~sojfgzi.exezxbrstc.exe~sojfgzi.exe

pid process

1776 ifblscv.exe
1308 fynqhto.exe
1324 ~sojfgzi.exe
1868 ~sojfgzi.exe
468 zxbrstc.exe
612 ~sojfgzi.exe

pid	process
1776	ifblscv.exe
1308	fynqhto.exe
1324	~sojfgzi.exe
1868	~sojfgzi.exe
468	zxbrstc.exe
612	~sojfgzi.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe	upx
\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe	upx
C:\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe	upx
C:\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe	upx
\Users\Admin\AppData\Local\Temp\fynqhto.exe	upx
\Users\Admin\AppData\Local\Temp\fynqhto.exe	upx
C:\Users\Admin\AppData\Local\Temp\fynqhto.exe	upx
C:\Users\Admin\AppData\Local\Temp\fynqhto.exe	upx
\Users\Admin\AppData\Local\Temp\zxbrstc.exe	upx
\Users\Admin\AppData\Local\Temp\zxbrstc.exe	upx
C:\Users\Admin\AppData\Local\Temp\zxbrstc.exe	upx
C:\Users\Admin\AppData\Local\Temp\zxbrstc.exe	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1588 cmd.exe

pid	process
1588	cmd.exe

Drops startup file 1 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	UQD_211116.exe

Loads dropped DLL 12 IoCs

Processes:

UQD_211116.exe

pid	process
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
1940
532	UQD_211116.exe
576
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
1596

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

UQD_211116.exeRundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RUNONCEEX	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUNONCE	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RUNONCE	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCEEX	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUNONCEEX	UQD_211116.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

UQD_211116.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" UQD_211116.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	UQD_211116.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	UQD_211116.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	UQD_211116.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	UQD_211116.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

UQD_211116.exe

description	ioc	process
File opened (read-only)	\??\g:	UQD_211116.exe
File opened (read-only)	\??\k:	UQD_211116.exe
File opened (read-only)	\??\o:	UQD_211116.exe
File opened (read-only)	\??\p:	UQD_211116.exe
File opened (read-only)	\??\b:	UQD_211116.exe
File opened (read-only)	\??\e:	UQD_211116.exe
File opened (read-only)	\??\h:	UQD_211116.exe
File opened (read-only)	\??\i:	UQD_211116.exe
File opened (read-only)	\??\l:	UQD_211116.exe
File opened (read-only)	\??\m:	UQD_211116.exe
File opened (read-only)	\??\n:	UQD_211116.exe
File opened (read-only)	\??\v:	UQD_211116.exe
File opened (read-only)	\??\a:	UQD_211116.exe
File opened (read-only)	\??\f:	UQD_211116.exe
File opened (read-only)	\??\y:	UQD_211116.exe
File opened (read-only)	\??\u:	UQD_211116.exe
File opened (read-only)	\??\w:	UQD_211116.exe
File opened (read-only)	\??\x:	UQD_211116.exe
File opened (read-only)	\??\z:	UQD_211116.exe
File opened (read-only)	\??\q:	UQD_211116.exe
File opened (read-only)	\??\r:	UQD_211116.exe
File opened (read-only)	\??\t:	UQD_211116.exe
File opened (read-only)	\??\j:	UQD_211116.exe
File opened (read-only)	\??\s:	UQD_211116.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in Program Files directory 3 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File created	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	UQD_211116.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	UQD_211116.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL	UQD_211116.exe

Drops file in Windows directory 1 IoCs

Processes:

Rundll32.exe

description ioc process

File opened for modification C:\Windows\INF\setupapi.app.log Rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	Rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

UQD_211116.exe~sojfgzi.exe~sojfgzi.exe~sojfgzi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.136738.com/?30519"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\First Home Page = "http://www.136738.com/?30519"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~sojfgzi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~sojfgzi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~sojfgzi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.136738.com/?30519"	UQD_211116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30519"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\First Home Page = "http://www.136738.com/?30519"	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\Main	UQD_211116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30519"	UQD_211116.exe

Modifies Internet Explorer start page 1 TTPs 3 IoCs

stealer

Modify Registry

T1112

Processes:

UQD_211116.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.136738.com/?30519"	UQD_211116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30519"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.136738.com/?30519"	UQD_211116.exe

Modifies registry class 35 IoCs

Processes:

UQD_211116.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command\ = "C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,Control_RunDLL C:\\Windows\\SysWOW64\\inetcpl.cpl"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon\ = "C:\\Windows\\SysWOW64\\ieframe.dll,-190"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\ = "在没有加载项的情况下启动"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\""	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\InprocServer32	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\ = "Internet Explorer"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\ = "属性(&R)"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\ = "打开主页(&H)"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\InprocServer32	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -extoff"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\InprocServer32	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\InprocServer32	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\InprocServer32	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	UQD_211116.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

340 PING.EXE
1596 PING.EXE
1632 PING.EXE

pid	process
340	PING.EXE
1596	PING.EXE
1632	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

UQD_211116.exeUQD_211116.exe

pid	process
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
960	UQD_211116.exe
960	UQD_211116.exe
960	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

UQD_211116.exe

pid process

532 UQD_211116.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

UQD_211116.exeifblscv.exe~sojfgzi.exe~sojfgzi.exeUQD_211116.exe~sojfgzi.exefynqhto.exezxbrstc.exeRundll32.exe

description	pid	process
Token: SeDebugPrivilege	532	UQD_211116.exe
Token: SeDebugPrivilege	1776	ifblscv.exe
Token: SeBackupPrivilege	1324	~sojfgzi.exe
Token: SeRestorePrivilege	1324	~sojfgzi.exe
Token: SeTakeOwnershipPrivilege	1324	~sojfgzi.exe
Token: SeBackupPrivilege	1868	~sojfgzi.exe
Token: SeRestorePrivilege	1868	~sojfgzi.exe
Token: SeTakeOwnershipPrivilege	1868	~sojfgzi.exe
Token: SeDebugPrivilege	960	UQD_211116.exe
Token: SeBackupPrivilege	612	~sojfgzi.exe
Token: SeRestorePrivilege	612	~sojfgzi.exe
Token: SeTakeOwnershipPrivilege	612	~sojfgzi.exe
Token: SeDebugPrivilege	1308	fynqhto.exe
Token: SeRestorePrivilege	1308	fynqhto.exe
Token: SeTakeOwnershipPrivilege	1308	fynqhto.exe
Token: SeDebugPrivilege	1308	fynqhto.exe
Token: SeSecurityPrivilege	1308	fynqhto.exe
Token: SeDebugPrivilege	468	zxbrstc.exe
Token: SeRestorePrivilege	468	zxbrstc.exe
Token: SeTakeOwnershipPrivilege	468	zxbrstc.exe
Token: SeDebugPrivilege	468	zxbrstc.exe
Token: SeSecurityPrivilege	468	zxbrstc.exe
Token: SeRestorePrivilege	752	Rundll32.exe
Token: SeRestorePrivilege	752	Rundll32.exe
Token: SeRestorePrivilege	752	Rundll32.exe
Token: SeRestorePrivilege	752	Rundll32.exe
Token: SeRestorePrivilege	752	Rundll32.exe
Token: SeRestorePrivilege	752	Rundll32.exe
Token: SeRestorePrivilege	752	Rundll32.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

UQD_211116.exe

pid	process
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe

Suspicious use of SendNotifyMessage 45 IoCs

Processes:

UQD_211116.exe

pid	process
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe
532	UQD_211116.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

UQD_211116.exeifblscv.execmd.exeRundll32.exerunonce.execmd.execmd.exe

description	pid	process	target process
PID 532 wrote to memory of 960	532	UQD_211116.exe	UQD_211116.exe
PID 532 wrote to memory of 960	532	UQD_211116.exe	UQD_211116.exe
PID 532 wrote to memory of 960	532	UQD_211116.exe	UQD_211116.exe
PID 532 wrote to memory of 960	532	UQD_211116.exe	UQD_211116.exe
PID 532 wrote to memory of 1776	532	UQD_211116.exe	ifblscv.exe
PID 532 wrote to memory of 1776	532	UQD_211116.exe	ifblscv.exe
PID 532 wrote to memory of 1776	532	UQD_211116.exe	ifblscv.exe
PID 532 wrote to memory of 1776	532	UQD_211116.exe	ifblscv.exe
PID 532 wrote to memory of 1308	532	UQD_211116.exe	fynqhto.exe
PID 532 wrote to memory of 1308	532	UQD_211116.exe	fynqhto.exe
PID 532 wrote to memory of 1308	532	UQD_211116.exe	fynqhto.exe
PID 532 wrote to memory of 1308	532	UQD_211116.exe	fynqhto.exe
PID 532 wrote to memory of 1324	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1324	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1324	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1324	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1868	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1868	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1868	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 1868	532	UQD_211116.exe	~sojfgzi.exe
PID 1776 wrote to memory of 1512	1776	ifblscv.exe	cmd.exe
PID 1776 wrote to memory of 1512	1776	ifblscv.exe	cmd.exe
PID 1776 wrote to memory of 1512	1776	ifblscv.exe	cmd.exe
PID 1776 wrote to memory of 1512	1776	ifblscv.exe	cmd.exe
PID 1512 wrote to memory of 340	1512	cmd.exe	PING.EXE
PID 1512 wrote to memory of 340	1512	cmd.exe	PING.EXE
PID 1512 wrote to memory of 340	1512	cmd.exe	PING.EXE
PID 532 wrote to memory of 468	532	UQD_211116.exe	zxbrstc.exe
PID 532 wrote to memory of 468	532	UQD_211116.exe	zxbrstc.exe
PID 532 wrote to memory of 468	532	UQD_211116.exe	zxbrstc.exe
PID 532 wrote to memory of 468	532	UQD_211116.exe	zxbrstc.exe
PID 532 wrote to memory of 612	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 612	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 612	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 612	532	UQD_211116.exe	~sojfgzi.exe
PID 532 wrote to memory of 752	532	UQD_211116.exe	Rundll32.exe
PID 532 wrote to memory of 752	532	UQD_211116.exe	Rundll32.exe
PID 532 wrote to memory of 752	532	UQD_211116.exe	Rundll32.exe
PID 532 wrote to memory of 752	532	UQD_211116.exe	Rundll32.exe
PID 752 wrote to memory of 1576	752	Rundll32.exe	runonce.exe
PID 752 wrote to memory of 1576	752	Rundll32.exe	runonce.exe
PID 752 wrote to memory of 1576	752	Rundll32.exe	runonce.exe
PID 1576 wrote to memory of 632	1576	runonce.exe	grpconv.exe
PID 1576 wrote to memory of 632	1576	runonce.exe	grpconv.exe
PID 1576 wrote to memory of 632	1576	runonce.exe	grpconv.exe
PID 532 wrote to memory of 1588	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1588	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1588	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1588	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1780	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1780	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1780	532	UQD_211116.exe	cmd.exe
PID 532 wrote to memory of 1780	532	UQD_211116.exe	cmd.exe
PID 1780 wrote to memory of 1632	1780	cmd.exe	PING.EXE
PID 1780 wrote to memory of 1632	1780	cmd.exe	PING.EXE
PID 1780 wrote to memory of 1632	1780	cmd.exe	PING.EXE
PID 1588 wrote to memory of 1596	1588	cmd.exe	PING.EXE
PID 1588 wrote to memory of 1596	1588	cmd.exe	PING.EXE
PID 1588 wrote to memory of 1596	1588	cmd.exe	PING.EXE

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

UQD_211116.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	UQD_211116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	UQD_211116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	UQD_211116.exe

C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe
"C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:532

C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe
C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe /nstart
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe
C:\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe /nys
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VgNoem9.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
4⤵
- Runs ping.exe
PID:340

C:\Users\Admin\AppData\Local\Temp\fynqhto.exe
C:\Users\Admin\AppData\Local\Temp\fynqhto.exe /HomeRegAccess10
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Users\Admin\AppData\Local\Temp\zxbrstc.exe
C:\Users\Admin\AppData\Local\Temp\zxbrstc.exe /HomeRegAccess10
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\system32\Rundll32.exe
Rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\~nrxrjoj.inf
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
4⤵
PID:632

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BiJPTCH.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
3⤵
- Runs ping.exe
PID:1632

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GFgVdB0.bat
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
3⤵
- Runs ping.exe
PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BiJPTCH.bat
Filesize
473B

MD5
629cd62953c35705b6a6454b7c1a3061

SHA1
f80b1afab88498e5730ec57786fb111e0acd9449

SHA256
689bb87238111e86743a3f70277cb635083f56c1a317d37fa3d4f1a3c86df8b7

SHA512
812726f6f5419015f408a9ed2a14b629a3037efc025e9b92e1b157e36b6c2af2af902382f5482c82eb5ee8d2ce803af0c87a0bf121219db2b46e570e172b57f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GFgVdB0.bat
Filesize
465B

MD5
3f632dce352653743f1d63e53cd64d28

SHA1
88d38654840d3d5e996d4276cfffa38cd79de017

SHA256
2834d3dd6c7c6f375158d602737edb98facdabe6fd20ca84cdd8f23622df3bc1

SHA512
bd77fbb29814ac9c1407bbc57953732b402527127ef6ba9c7a2ced5720496ce7d607caf78d20cbea5b89925eafe54005a2f7a47a6516cf194723c1de5ad09f09

Download Submit
C:\Users\Admin\AppData\Local\Temp\VgNoem9.bat
Filesize
493B

MD5
41ea9b417c3558c31d7845346d947068

SHA1
9155ce5564291a65b89479060eff96e71f16f2a3

SHA256
7be377f7d02bfda63c6364876ed3503300b9b4682fcf2b972de0be38f0e93868

SHA512
c819f20e18d761c7c9a4e97d044e5cf1e3e09683ac6444c8c43fda68fbb63f481bcf00f8506b5a92263b31e193d4cf56372f593dfd785fdb2dcb907e81cd05e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\fynqhto.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\fynqhto.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxbrstc.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxbrstc.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nrxrjoj.inf
Filesize
32B

MD5
8f5f4837dd4a1680d79bbdca9cc1e08f

SHA1
688b5d5ef993733b97b303ed4c8409a14b230de5

SHA256
2bce6b9395cc74d16b9c94fd90debd9d524ffb53c6f6ae3a49b6e139671417b2

SHA512
bd75b564fe3c93dffdc65fe58463378f54268308ca5eaba5fc7f80458016f331a6596bfdaf63845c1d5c6c60df2a0ec2aff94d2aae7797da4f5f975f0363bd66

Download Submit
C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
\Users\Admin\AppData\Local\Temp\flmfuzy\ifblscv.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
\Users\Admin\AppData\Local\Temp\fynqhto.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
\Users\Admin\AppData\Local\Temp\fynqhto.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
\Users\Admin\AppData\Local\Temp\zxbrstc.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
\Users\Admin\AppData\Local\Temp\zxbrstc.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
\Users\Admin\AppData\Local\Temp\~sojfgzi.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
memory/340-79-0x0000000000000000-mapping.dmp

Download
memory/468-82-0x0000000000000000-mapping.dmp

Download
memory/532-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/612-87-0x0000000000000000-mapping.dmp

Download
memory/632-94-0x0000000000000000-mapping.dmp

Download
memory/752-90-0x0000000000000000-mapping.dmp

Download
memory/960-55-0x0000000000000000-mapping.dmp

Download
memory/1308-65-0x0000000000000000-mapping.dmp

Download
memory/1324-70-0x0000000000000000-mapping.dmp

Download
memory/1512-77-0x0000000000000000-mapping.dmp

Download
memory/1576-93-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Filesize
8KB

Download
memory/1576-92-0x0000000000000000-mapping.dmp

Download
memory/1588-96-0x0000000000000000-mapping.dmp

Download
memory/1596-101-0x0000000000000000-mapping.dmp

Download
memory/1632-100-0x0000000000000000-mapping.dmp

Download
memory/1776-59-0x0000000000000000-mapping.dmp

Download
memory/1780-97-0x0000000000000000-mapping.dmp

Download
memory/1868-74-0x0000000000000000-mapping.dmp

Download