9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
Size

1016KB
MD5

668276ce2a6a32018460ddf9de4dc5b0
SHA1

7c02536f057ac4d06c1c62ed6b8a7c9ee566b416
SHA256

9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51
SHA512

c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5
SSDEEP

6144:UIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUzx84a2lXUW:UIXsgtvm1De5YlOx6lzBH46Uzf7lXUW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ipbdft.exe

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ipbdft.exe

Adds policy Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbvfplwnabbefl = "kdbpddsnejnuzjehse.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbvfplwnabbefl = "btqdqpdxnruaenhjt.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btqdqpdxnruaenhjt.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbvfplwnabbefl = "kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbvfplwnabbefl = "vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbvfplwnabbefl = "iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbvfplwnabbefl = "kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtulcfxvpxeowjhnbqmne.exe"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtulcfxvpxeowjhnbqmne.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pbszgzhvfda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	ipbdft.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipbdft.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipbdft.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipbdft.exe

Executes dropped EXE 3 IoCs

pid	Process
1992	iffdguquspp.exe
544	ipbdft.exe
432	ipbdft.exe

Loads dropped DLL 6 IoCs

pid	Process
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
1992	iffdguquspp.exe
1992	iffdguquspp.exe
1992	iffdguquspp.exe
1992	iffdguquspp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfalwtfxlnosubt = "iddtjlczszfovhejwkff.exe"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ulhtfdqjybdiltmn = "ulhtfdqjybdiltmn.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfalwtfxlnosubt = "iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "ulhtfdqjybdiltmn.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulhtfdqjybdiltmn.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ulhtfdqjybdiltmn = "kdbpddsnejnuzjehse.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe ."	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ulhtfdqjybdiltmn = "iddtjlczszfovhejwkff.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "ulhtfdqjybdiltmn.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "btqdqpdxnruaenhjt.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpodstjfxdiqwhdhtga.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ulhtfdqjybdiltmn = "btqdqpdxnruaenhjt.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtulcfxvpxeowjhnbqmne.exe"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btqdqpdxnruaenhjt.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtulcfxvpxeowjhnbqmne.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "iddtjlczszfovhejwkff.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "xtulcfxvpxeowjhnbqmne.exe ."	ipbdft.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "ulhtfdqjybdiltmn.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtulcfxvpxeowjhnbqmne.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "vpodstjfxdiqwhdhtga.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfalwtfxlnosubt = "vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulhtfdqjybdiltmn.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "vpodstjfxdiqwhdhtga.exe"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "btqdqpdxnruaenhjt.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfalwtfxlnosubt = "kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfalwtfxlnosubt = "kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btqdqpdxnruaenhjt.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ulhtfdqjybdiltmn = "xtulcfxvpxeowjhnbqmne.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kdbpddsnejnuzjehse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe"	ipbdft.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ipbdft.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btqdqpdxnruaenhjt.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "ulhtfdqjybdiltmn.exe ."	iffdguquspp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pfalwtfxlnosubt = "iddtjlczszfovhejwkff.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ulhtfdqjybdiltmn.exe"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe"	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iddtjlczszfovhejwkff.exe"	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzrzhbkzkjhi = "kdbpddsnejnuzjehse.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ipbdft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lzsbkfpfrrqss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdbpddsnejnuzjehse.exe ."	ipbdft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\btqdqpdxnruaenhjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xtulcfxvpxeowjhnbqmne.exe ."	ipbdft.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ipbdft.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ipbdft.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	whatismyip.everdot.org
2	www.showmyipaddress.com
4	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ulhtfdqjybdiltmn.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\btqdqpdxnruaenhjt.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\olnfxbutoxfqznmtiyvxph.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\btqdqpdxnruaenhjt.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\cfnljtsxynbshbgtoknvtrba.gvj	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\iddtjlczszfovhejwkff.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\xtulcfxvpxeowjhnbqmne.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\ulhtfdqjybdiltmn.exe	ipbdft.exe
File created	C:\Windows\SysWOW64\cfnljtsxynbshbgtoknvtrba.gvj	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\kdbpddsnejnuzjehse.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\olnfxbutoxfqznmtiyvxph.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\btqdqpdxnruaenhjt.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\kdbpddsnejnuzjehse.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\iddtjlczszfovhejwkff.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\olnfxbutoxfqznmtiyvxph.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\xtulcfxvpxeowjhnbqmne.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\vpodstjfxdiqwhdhtga.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\iddtjlczszfovhejwkff.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\xtulcfxvpxeowjhnbqmne.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\ulhtfdqjybdiltmn.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\kdbpddsnejnuzjehse.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\vpodstjfxdiqwhdhtga.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\vpodstjfxdiqwhdhtga.exe	ipbdft.exe
File opened for modification	C:\Windows\SysWOW64\lzsbkfpfrrqssxnlrymfoxscseedffkayel.sbk	ipbdft.exe
File created	C:\Windows\SysWOW64\lzsbkfpfrrqssxnlrymfoxscseedffkayel.sbk	ipbdft.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\lzsbkfpfrrqssxnlrymfoxscseedffkayel.sbk	ipbdft.exe
File created	C:\Program Files (x86)\lzsbkfpfrrqssxnlrymfoxscseedffkayel.sbk	ipbdft.exe
File opened for modification	C:\Program Files (x86)\cfnljtsxynbshbgtoknvtrba.gvj	ipbdft.exe
File created	C:\Program Files (x86)\cfnljtsxynbshbgtoknvtrba.gvj	ipbdft.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ulhtfdqjybdiltmn.exe	ipbdft.exe
File opened for modification	C:\Windows\lzsbkfpfrrqssxnlrymfoxscseedffkayel.sbk	ipbdft.exe
File opened for modification	C:\Windows\btqdqpdxnruaenhjt.exe	ipbdft.exe
File opened for modification	C:\Windows\olnfxbutoxfqznmtiyvxph.exe	ipbdft.exe
File opened for modification	C:\Windows\olnfxbutoxfqznmtiyvxph.exe	ipbdft.exe
File created	C:\Windows\cfnljtsxynbshbgtoknvtrba.gvj	ipbdft.exe
File opened for modification	C:\Windows\btqdqpdxnruaenhjt.exe	iffdguquspp.exe
File opened for modification	C:\Windows\xtulcfxvpxeowjhnbqmne.exe	iffdguquspp.exe
File opened for modification	C:\Windows\cfnljtsxynbshbgtoknvtrba.gvj	ipbdft.exe
File opened for modification	C:\Windows\vpodstjfxdiqwhdhtga.exe	iffdguquspp.exe
File opened for modification	C:\Windows\xtulcfxvpxeowjhnbqmne.exe	ipbdft.exe
File opened for modification	C:\Windows\iddtjlczszfovhejwkff.exe	iffdguquspp.exe
File opened for modification	C:\Windows\olnfxbutoxfqznmtiyvxph.exe	iffdguquspp.exe
File opened for modification	C:\Windows\ulhtfdqjybdiltmn.exe	ipbdft.exe
File opened for modification	C:\Windows\kdbpddsnejnuzjehse.exe	ipbdft.exe
File opened for modification	C:\Windows\vpodstjfxdiqwhdhtga.exe	ipbdft.exe
File opened for modification	C:\Windows\iddtjlczszfovhejwkff.exe	ipbdft.exe
File opened for modification	C:\Windows\ulhtfdqjybdiltmn.exe	iffdguquspp.exe
File opened for modification	C:\Windows\kdbpddsnejnuzjehse.exe	iffdguquspp.exe
File opened for modification	C:\Windows\kdbpddsnejnuzjehse.exe	ipbdft.exe
File opened for modification	C:\Windows\vpodstjfxdiqwhdhtga.exe	ipbdft.exe
File opened for modification	C:\Windows\iddtjlczszfovhejwkff.exe	ipbdft.exe
File created	C:\Windows\lzsbkfpfrrqssxnlrymfoxscseedffkayel.sbk	ipbdft.exe
File opened for modification	C:\Windows\xtulcfxvpxeowjhnbqmne.exe	ipbdft.exe
File opened for modification	C:\Windows\btqdqpdxnruaenhjt.exe	ipbdft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
544	ipbdft.exe
544	ipbdft.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
544	ipbdft.exe
544	ipbdft.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	ipbdft.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1992	960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe	27
PID 960 wrote to memory of 1992	960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe	27
PID 960 wrote to memory of 1992	960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe	27
PID 960 wrote to memory of 1992	960	9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe	27
PID 1992 wrote to memory of 544	1992	iffdguquspp.exe	28
PID 1992 wrote to memory of 544	1992	iffdguquspp.exe	28
PID 1992 wrote to memory of 544	1992	iffdguquspp.exe	28
PID 1992 wrote to memory of 544	1992	iffdguquspp.exe	28
PID 1992 wrote to memory of 432	1992	iffdguquspp.exe	29
PID 1992 wrote to memory of 432	1992	iffdguquspp.exe	29
PID 1992 wrote to memory of 432	1992	iffdguquspp.exe	29
PID 1992 wrote to memory of 432	1992	iffdguquspp.exe	29

System policy modification 1 TTPs 29 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ipbdft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ipbdft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ipbdft.exe

C:\Users\Admin\AppData\Local\Temp\9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe
"C:\Users\Admin\AppData\Local\Temp\9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe
  "C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\ipbdft.exe
    "C:\Users\Admin\AppData\Local\Temp\ipbdft.exe" "-C:\Users\Admin\AppData\Local\Temp\ulhtfdqjybdiltmn.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\ipbdft.exe
    "C:\Users\Admin\AppData\Local\Temp\ipbdft.exe" "-C:\Users\Admin\AppData\Local\Temp\ulhtfdqjybdiltmn.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\btqdqpdxnruaenhjt.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iddtjlczszfovhejwkff.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4ba73efd5b4f4769256369d552ce5e0e

SHA1
910b8ff7f651f4d25d7ee50bb39637af9f42f084

SHA256
bb91a304d7c710d5d92efbe9eafdea0e1608ed7ffd5f0f563069f61a8002110d

SHA512
7bd65287b6f39f30f38d828637ed0d8ecbeba032b306f3b830f533a1718207ca493d1ff47d66ad0396fe97bfa4e1a6ac4aa66fe585b634cbdf60adbed194b358

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4ba73efd5b4f4769256369d552ce5e0e

SHA1
910b8ff7f651f4d25d7ee50bb39637af9f42f084

SHA256
bb91a304d7c710d5d92efbe9eafdea0e1608ed7ffd5f0f563069f61a8002110d

SHA512
7bd65287b6f39f30f38d828637ed0d8ecbeba032b306f3b830f533a1718207ca493d1ff47d66ad0396fe97bfa4e1a6ac4aa66fe585b634cbdf60adbed194b358

Download Submit
C:\Users\Admin\AppData\Local\Temp\ipbdft.exe

Filesize
692KB

MD5
298f54bcc1830cfa1945a7dc96aea568

SHA1
9442a8f56ce41c60e4a3c31073ee74576473b3ac

SHA256
feda6961ca527b29c4d4b100226fb8bf3b4e2433bdbc7c5232ad29fd55f8045f

SHA512
6f4b3b7bd02b611e19e12bd450286ac19415df7076bc551b6a0da1b2af2f5ddde28deb7ddb8973a12de8abd7cd8320d9a234e2493164e8b7e0870de9cd9deb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\ipbdft.exe

Filesize
692KB

MD5
298f54bcc1830cfa1945a7dc96aea568

SHA1
9442a8f56ce41c60e4a3c31073ee74576473b3ac

SHA256
feda6961ca527b29c4d4b100226fb8bf3b4e2433bdbc7c5232ad29fd55f8045f

SHA512
6f4b3b7bd02b611e19e12bd450286ac19415df7076bc551b6a0da1b2af2f5ddde28deb7ddb8973a12de8abd7cd8320d9a234e2493164e8b7e0870de9cd9deb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\kdbpddsnejnuzjehse.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\olnfxbutoxfqznmtiyvxph.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ulhtfdqjybdiltmn.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vpodstjfxdiqwhdhtga.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtulcfxvpxeowjhnbqmne.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\btqdqpdxnruaenhjt.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\iddtjlczszfovhejwkff.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\kdbpddsnejnuzjehse.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\olnfxbutoxfqznmtiyvxph.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\ulhtfdqjybdiltmn.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\vpodstjfxdiqwhdhtga.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\SysWOW64\xtulcfxvpxeowjhnbqmne.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\btqdqpdxnruaenhjt.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\btqdqpdxnruaenhjt.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\iddtjlczszfovhejwkff.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\iddtjlczszfovhejwkff.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\kdbpddsnejnuzjehse.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\kdbpddsnejnuzjehse.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\olnfxbutoxfqznmtiyvxph.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\olnfxbutoxfqznmtiyvxph.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\ulhtfdqjybdiltmn.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\ulhtfdqjybdiltmn.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\vpodstjfxdiqwhdhtga.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\vpodstjfxdiqwhdhtga.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\xtulcfxvpxeowjhnbqmne.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
C:\Windows\xtulcfxvpxeowjhnbqmne.exe

Filesize
1016KB

MD5
668276ce2a6a32018460ddf9de4dc5b0

SHA1
7c02536f057ac4d06c1c62ed6b8a7c9ee566b416

SHA256
9734e9f40aca93d5651a3f879a0e37c5ffc5e4865ff9e30f9113c369508e0e51

SHA512
c94fbe5e5ce9d7151a7e0cac84c06f6a65da56514729998a670c7461d682ae4826c1405d05b8d2169b480d4b4df49fe44aedda04c64613bf6da1977861febea5

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4ba73efd5b4f4769256369d552ce5e0e

SHA1
910b8ff7f651f4d25d7ee50bb39637af9f42f084

SHA256
bb91a304d7c710d5d92efbe9eafdea0e1608ed7ffd5f0f563069f61a8002110d

SHA512
7bd65287b6f39f30f38d828637ed0d8ecbeba032b306f3b830f533a1718207ca493d1ff47d66ad0396fe97bfa4e1a6ac4aa66fe585b634cbdf60adbed194b358

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4ba73efd5b4f4769256369d552ce5e0e

SHA1
910b8ff7f651f4d25d7ee50bb39637af9f42f084

SHA256
bb91a304d7c710d5d92efbe9eafdea0e1608ed7ffd5f0f563069f61a8002110d

SHA512
7bd65287b6f39f30f38d828637ed0d8ecbeba032b306f3b830f533a1718207ca493d1ff47d66ad0396fe97bfa4e1a6ac4aa66fe585b634cbdf60adbed194b358

Download Submit
\Users\Admin\AppData\Local\Temp\ipbdft.exe

Filesize
692KB

MD5
298f54bcc1830cfa1945a7dc96aea568

SHA1
9442a8f56ce41c60e4a3c31073ee74576473b3ac

SHA256
feda6961ca527b29c4d4b100226fb8bf3b4e2433bdbc7c5232ad29fd55f8045f

SHA512
6f4b3b7bd02b611e19e12bd450286ac19415df7076bc551b6a0da1b2af2f5ddde28deb7ddb8973a12de8abd7cd8320d9a234e2493164e8b7e0870de9cd9deb13

Download Submit
\Users\Admin\AppData\Local\Temp\ipbdft.exe

Filesize
692KB

MD5
298f54bcc1830cfa1945a7dc96aea568

SHA1
9442a8f56ce41c60e4a3c31073ee74576473b3ac

SHA256
feda6961ca527b29c4d4b100226fb8bf3b4e2433bdbc7c5232ad29fd55f8045f

SHA512
6f4b3b7bd02b611e19e12bd450286ac19415df7076bc551b6a0da1b2af2f5ddde28deb7ddb8973a12de8abd7cd8320d9a234e2493164e8b7e0870de9cd9deb13

Download Submit
\Users\Admin\AppData\Local\Temp\ipbdft.exe

Filesize
692KB

MD5
298f54bcc1830cfa1945a7dc96aea568

SHA1
9442a8f56ce41c60e4a3c31073ee74576473b3ac

SHA256
feda6961ca527b29c4d4b100226fb8bf3b4e2433bdbc7c5232ad29fd55f8045f

SHA512
6f4b3b7bd02b611e19e12bd450286ac19415df7076bc551b6a0da1b2af2f5ddde28deb7ddb8973a12de8abd7cd8320d9a234e2493164e8b7e0870de9cd9deb13

Download Submit
\Users\Admin\AppData\Local\Temp\ipbdft.exe

Filesize
692KB

MD5
298f54bcc1830cfa1945a7dc96aea568

SHA1
9442a8f56ce41c60e4a3c31073ee74576473b3ac

SHA256
feda6961ca527b29c4d4b100226fb8bf3b4e2433bdbc7c5232ad29fd55f8045f

SHA512
6f4b3b7bd02b611e19e12bd450286ac19415df7076bc551b6a0da1b2af2f5ddde28deb7ddb8973a12de8abd7cd8320d9a234e2493164e8b7e0870de9cd9deb13

Download Submit
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download