3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
Size

1016KB
MD5

521fd896b6374beaa621bb0598032c30
SHA1

b071e5bac7615f8beaefde4b0b9badf753ea6b2b
SHA256

3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e
SHA512

876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d
SSDEEP

12288:51IXsgtvm1De5YlOx6lzBH46Uzf7lXUW:51U81yMBbE

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xblxcdp.exe

UAC bypass 3 TTPs 11 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

xblxcdp.exexblxcdp.exeiffdguquspp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xblxcdp.exe

Adds policy Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xblxcdp.exexblxcdp.exeiffdguquspp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbyxpdcznftzipbydqgx.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\knwhll = "xnjhyljfsjwbjpawamb.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\knwhll = "drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\knwhll = "zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\knwhll = "zrppixxvkdszjreciwnfd.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\knwhll = "wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xnjhyljfsjwbjpawamb.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jjp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\knwhll = "drlhwhdxixilrveya.exe"	xblxcdp.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xblxcdp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xblxcdp.exe

Executes dropped EXE 3 IoCs

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

pid process

896 iffdguquspp.exe
332 xblxcdp.exe
756 xblxcdp.exe

pid	process
896	iffdguquspp.exe
332	xblxcdp.exe
756	xblxcdp.exe

Loads dropped DLL 6 IoCs

Processes:

3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exeiffdguquspp.exe

pid	process
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
896	iffdguquspp.exe
896	iffdguquspp.exe
896	iffdguquspp.exe
896	iffdguquspp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mrcpvxkv = "xnjhyljfsjwbjpawamb.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xnjhyljfsjwbjpawamb.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "drlhwhdxixilrveya.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mrcpvxkv = "drlhwhdxixilrveya.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mrcpvxkv = "mbwtjvsnzpbfmrbwzk.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mrcpvxkv = "drlhwhdxixilrveya.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "xnjhyljfsjwbjpawamb.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "kbyxpdcznftzipbydqgx.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xnjhyljfsjwbjpawamb.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "zrppixxvkdszjreciwnfd.exe"	iffdguquspp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\djvjqthtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbyxpdcznftzipbydqgx.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjcxlvqjthrtybjc.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\djvjqthtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe ."	iffdguquspp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qryh = "mbwtjvsnzpbfmrbwzk.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\djvjqthtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\djvjqthtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbyxpdcznftzipbydqgx.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\djvjqthtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjcxlvqjthrtybjc.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "mbwtjvsnzpbfmrbwzk.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe"	iffdguquspp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mrcpvxkv = "kbyxpdcznftzipbydqgx.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "wjcxlvqjthrtybjc.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "drlhwhdxixilrveya.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drlhwhdxixilrveya.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbyxpdcznftzipbydqgx.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "xnjhyljfsjwbjpawamb.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "drlhwhdxixilrveya.exe ."	xblxcdp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbyxpdcznftzipbydqgx.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbwtjvsnzpbfmrbwzk.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "mbwtjvsnzpbfmrbwzk.exe ."	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "drlhwhdxixilrveya.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\djvjqthtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drlhwhdxixilrveya.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xblxcdp = "zrppixxvkdszjreciwnfd.exe"	xblxcdp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbjtw = "kbyxpdcznftzipbydqgx.exe ."	xblxcdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\qryh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xnjhyljfsjwbjpawamb.exe"	xblxcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wdqfnrgtxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrppixxvkdszjreciwnfd.exe"	iffdguquspp.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xblxcdp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xblxcdp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xblxcdp.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 whatismyipaddress.com
4 whatismyip.everdot.org
11 www.showmyipaddress.com

flow	ioc
2	whatismyipaddress.com
4	whatismyip.everdot.org
11	www.showmyipaddress.com

Drops file in System32 directory 25 IoCs

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mbwtjvsnzpbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\drlhwhdxixilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\xnjhyljfsjwbjpawamb.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\zrppixxvkdszjreciwnfd.exe	xblxcdp.exe
File created	C:\Windows\SysWOW64\rdvpclfxgtcdhjqiiqbnfzmvphqdmnrtassal.pjw	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\zrppixxvkdszjreciwnfd.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\drlhwhdxixilrveya.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\mbwtjvsnzpbfmrbwzk.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\kbyxpdcznftzipbydqgx.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\qjijdtutjdtbmvjipewpop.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\xnjhyljfsjwbjpawamb.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\qryhjhqxvxvlevrynkklsbdbkr.rpf	xblxcdp.exe
File created	C:\Windows\SysWOW64\qryhjhqxvxvlevrynkklsbdbkr.rpf	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\xnjhyljfsjwbjpawamb.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\kbyxpdcznftzipbydqgx.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\qjijdtutjdtbmvjipewpop.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\wjcxlvqjthrtybjc.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\wjcxlvqjthrtybjc.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\drlhwhdxixilrveya.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\mbwtjvsnzpbfmrbwzk.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\kbyxpdcznftzipbydqgx.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\wjcxlvqjthrtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\qjijdtutjdtbmvjipewpop.exe	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\rdvpclfxgtcdhjqiiqbnfzmvphqdmnrtassal.pjw	xblxcdp.exe
File opened for modification	C:\Windows\SysWOW64\zrppixxvkdszjreciwnfd.exe	xblxcdp.exe

Drops file in Program Files directory 4 IoCs

Processes:

xblxcdp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\qryhjhqxvxvlevrynkklsbdbkr.rpf	xblxcdp.exe
File created	C:\Program Files (x86)\qryhjhqxvxvlevrynkklsbdbkr.rpf	xblxcdp.exe
File opened for modification	C:\Program Files (x86)\rdvpclfxgtcdhjqiiqbnfzmvphqdmnrtassal.pjw	xblxcdp.exe
File created	C:\Program Files (x86)\rdvpclfxgtcdhjqiiqbnfzmvphqdmnrtassal.pjw	xblxcdp.exe

Drops file in Windows directory 25 IoCs

Processes:

xblxcdp.exexblxcdp.exeiffdguquspp.exe

description	ioc	process
File opened for modification	C:\Windows\mbwtjvsnzpbfmrbwzk.exe	xblxcdp.exe
File opened for modification	C:\Windows\qjijdtutjdtbmvjipewpop.exe	xblxcdp.exe
File opened for modification	C:\Windows\kbyxpdcznftzipbydqgx.exe	xblxcdp.exe
File opened for modification	C:\Windows\qjijdtutjdtbmvjipewpop.exe	iffdguquspp.exe
File opened for modification	C:\Windows\wjcxlvqjthrtybjc.exe	xblxcdp.exe
File opened for modification	C:\Windows\wjcxlvqjthrtybjc.exe	xblxcdp.exe
File opened for modification	C:\Windows\drlhwhdxixilrveya.exe	xblxcdp.exe
File created	C:\Windows\qryhjhqxvxvlevrynkklsbdbkr.rpf	xblxcdp.exe
File opened for modification	C:\Windows\rdvpclfxgtcdhjqiiqbnfzmvphqdmnrtassal.pjw	xblxcdp.exe
File opened for modification	C:\Windows\wjcxlvqjthrtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\zrppixxvkdszjreciwnfd.exe	iffdguquspp.exe
File opened for modification	C:\Windows\xnjhyljfsjwbjpawamb.exe	xblxcdp.exe
File opened for modification	C:\Windows\zrppixxvkdszjreciwnfd.exe	xblxcdp.exe
File opened for modification	C:\Windows\xnjhyljfsjwbjpawamb.exe	iffdguquspp.exe
File opened for modification	C:\Windows\drlhwhdxixilrveya.exe	xblxcdp.exe
File opened for modification	C:\Windows\kbyxpdcznftzipbydqgx.exe	iffdguquspp.exe
File opened for modification	C:\Windows\kbyxpdcznftzipbydqgx.exe	xblxcdp.exe
File opened for modification	C:\Windows\zrppixxvkdszjreciwnfd.exe	xblxcdp.exe
File opened for modification	C:\Windows\mbwtjvsnzpbfmrbwzk.exe	xblxcdp.exe
File opened for modification	C:\Windows\xnjhyljfsjwbjpawamb.exe	xblxcdp.exe
File opened for modification	C:\Windows\qjijdtutjdtbmvjipewpop.exe	xblxcdp.exe
File opened for modification	C:\Windows\drlhwhdxixilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\mbwtjvsnzpbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\qryhjhqxvxvlevrynkklsbdbkr.rpf	xblxcdp.exe
File created	C:\Windows\rdvpclfxgtcdhjqiiqbnfzmvphqdmnrtassal.pjw	xblxcdp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exexblxcdp.exe

pid	process
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
332	xblxcdp.exe
332	xblxcdp.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
332	xblxcdp.exe
332	xblxcdp.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

xblxcdp.exe

description pid process

Token: SeDebugPrivilege 332 xblxcdp.exe

description	pid	process
Token: SeDebugPrivilege	332	xblxcdp.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exeiffdguquspp.exe

description	pid	process	target process
PID 1812 wrote to memory of 896	1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe	iffdguquspp.exe
PID 1812 wrote to memory of 896	1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe	iffdguquspp.exe
PID 1812 wrote to memory of 896	1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe	iffdguquspp.exe
PID 1812 wrote to memory of 896	1812	3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe	iffdguquspp.exe
PID 896 wrote to memory of 332	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 332	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 332	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 332	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 756	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 756	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 756	896	iffdguquspp.exe	xblxcdp.exe
PID 896 wrote to memory of 756	896	iffdguquspp.exe	xblxcdp.exe

System policy modification 1 TTPs 31 IoCs

evasion

Modify Registry

T1112

Processes:

iffdguquspp.exexblxcdp.exexblxcdp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xblxcdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xblxcdp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xblxcdp.exe

C:\Users\Admin\AppData\Local\Temp\3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe
"C:\Users\Admin\AppData\Local\Temp\3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe
  "C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\xblxcdp.exe
    "C:\Users\Admin\AppData\Local\Temp\xblxcdp.exe" "-C:\Users\Admin\AppData\Local\Temp\wjcxlvqjthrtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\xblxcdp.exe
    "C:\Users\Admin\AppData\Local\Temp\xblxcdp.exe" "-C:\Users\Admin\AppData\Local\Temp\wjcxlvqjthrtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\drlhwhdxixilrveya.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
19749befa5af4364611c5aac278730a1

SHA1
4cba375e59963a3940c97d4ee4b9808d7783ff1f

SHA256
4c395a5a7e9b751f13a880342e8ebf0b2b7c07c2dc29f8a4b7ac9950dca00e37

SHA512
eedde5a4135d626644029bdd2f67903eac5315b1cff45f61bd8b221b925e1bbffd8d469cf9bb41229fdb5d1e27aae4142c03bd0d447b3436ff6759e6f59cdc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
19749befa5af4364611c5aac278730a1

SHA1
4cba375e59963a3940c97d4ee4b9808d7783ff1f

SHA256
4c395a5a7e9b751f13a880342e8ebf0b2b7c07c2dc29f8a4b7ac9950dca00e37

SHA512
eedde5a4135d626644029bdd2f67903eac5315b1cff45f61bd8b221b925e1bbffd8d469cf9bb41229fdb5d1e27aae4142c03bd0d447b3436ff6759e6f59cdc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kbyxpdcznftzipbydqgx.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mbwtjvsnzpbfmrbwzk.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjijdtutjdtbmvjipewpop.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wjcxlvqjthrtybjc.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xblxcdp.exe

Filesize
700KB

MD5
3b4acd2c7b852016f44e63d826bead18

SHA1
d945a9152c1cab36309d2113283776c42d929b50

SHA256
d4d2a0770ea4a1ad3dc257f1da06711223e23b8ffbf30f9d06ec5cef79647c6c

SHA512
7febe5c84ab3a91d951dfb868d5c3741660372899528cfa5f807ea1ea888cb293861d666c7f884ddc1de3ce1b18568687312aa307b3994284559559df7102555

Download Submit
C:\Users\Admin\AppData\Local\Temp\xblxcdp.exe

Filesize
700KB

MD5
3b4acd2c7b852016f44e63d826bead18

SHA1
d945a9152c1cab36309d2113283776c42d929b50

SHA256
d4d2a0770ea4a1ad3dc257f1da06711223e23b8ffbf30f9d06ec5cef79647c6c

SHA512
7febe5c84ab3a91d951dfb868d5c3741660372899528cfa5f807ea1ea888cb293861d666c7f884ddc1de3ce1b18568687312aa307b3994284559559df7102555

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnjhyljfsjwbjpawamb.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zrppixxvkdszjreciwnfd.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\drlhwhdxixilrveya.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\kbyxpdcznftzipbydqgx.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\mbwtjvsnzpbfmrbwzk.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\qjijdtutjdtbmvjipewpop.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\wjcxlvqjthrtybjc.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\xnjhyljfsjwbjpawamb.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\SysWOW64\zrppixxvkdszjreciwnfd.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\drlhwhdxixilrveya.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\drlhwhdxixilrveya.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\kbyxpdcznftzipbydqgx.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\kbyxpdcznftzipbydqgx.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\mbwtjvsnzpbfmrbwzk.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\mbwtjvsnzpbfmrbwzk.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\qjijdtutjdtbmvjipewpop.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\qjijdtutjdtbmvjipewpop.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\wjcxlvqjthrtybjc.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\wjcxlvqjthrtybjc.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\xnjhyljfsjwbjpawamb.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\xnjhyljfsjwbjpawamb.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\zrppixxvkdszjreciwnfd.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
C:\Windows\zrppixxvkdszjreciwnfd.exe

Filesize
1016KB

MD5
521fd896b6374beaa621bb0598032c30

SHA1
b071e5bac7615f8beaefde4b0b9badf753ea6b2b

SHA256
3cfc109d784fb5b81ccdd3b1e66deb15a7050a98771005ebe34d755b212dc23e

SHA512
876b40c0b0ea5600944d44d4c3354034197457c455f1acc655a00f171389e0b03cef71b1b0bc17db4c4238c8eebe808732097b08f09feb1b5192ecf666f4f89d

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
19749befa5af4364611c5aac278730a1

SHA1
4cba375e59963a3940c97d4ee4b9808d7783ff1f

SHA256
4c395a5a7e9b751f13a880342e8ebf0b2b7c07c2dc29f8a4b7ac9950dca00e37

SHA512
eedde5a4135d626644029bdd2f67903eac5315b1cff45f61bd8b221b925e1bbffd8d469cf9bb41229fdb5d1e27aae4142c03bd0d447b3436ff6759e6f59cdc4f

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
19749befa5af4364611c5aac278730a1

SHA1
4cba375e59963a3940c97d4ee4b9808d7783ff1f

SHA256
4c395a5a7e9b751f13a880342e8ebf0b2b7c07c2dc29f8a4b7ac9950dca00e37

SHA512
eedde5a4135d626644029bdd2f67903eac5315b1cff45f61bd8b221b925e1bbffd8d469cf9bb41229fdb5d1e27aae4142c03bd0d447b3436ff6759e6f59cdc4f

Download Submit
\Users\Admin\AppData\Local\Temp\xblxcdp.exe

Filesize
700KB

MD5
3b4acd2c7b852016f44e63d826bead18

SHA1
d945a9152c1cab36309d2113283776c42d929b50

SHA256
d4d2a0770ea4a1ad3dc257f1da06711223e23b8ffbf30f9d06ec5cef79647c6c

SHA512
7febe5c84ab3a91d951dfb868d5c3741660372899528cfa5f807ea1ea888cb293861d666c7f884ddc1de3ce1b18568687312aa307b3994284559559df7102555

Download Submit
\Users\Admin\AppData\Local\Temp\xblxcdp.exe

Filesize
700KB

MD5
3b4acd2c7b852016f44e63d826bead18

SHA1
d945a9152c1cab36309d2113283776c42d929b50

SHA256
d4d2a0770ea4a1ad3dc257f1da06711223e23b8ffbf30f9d06ec5cef79647c6c

SHA512
7febe5c84ab3a91d951dfb868d5c3741660372899528cfa5f807ea1ea888cb293861d666c7f884ddc1de3ce1b18568687312aa307b3994284559559df7102555

Download Submit
\Users\Admin\AppData\Local\Temp\xblxcdp.exe

Filesize
700KB

MD5
3b4acd2c7b852016f44e63d826bead18

SHA1
d945a9152c1cab36309d2113283776c42d929b50

SHA256
d4d2a0770ea4a1ad3dc257f1da06711223e23b8ffbf30f9d06ec5cef79647c6c

SHA512
7febe5c84ab3a91d951dfb868d5c3741660372899528cfa5f807ea1ea888cb293861d666c7f884ddc1de3ce1b18568687312aa307b3994284559559df7102555

Download Submit
\Users\Admin\AppData\Local\Temp\xblxcdp.exe

Filesize
700KB

MD5
3b4acd2c7b852016f44e63d826bead18

SHA1
d945a9152c1cab36309d2113283776c42d929b50

SHA256
d4d2a0770ea4a1ad3dc257f1da06711223e23b8ffbf30f9d06ec5cef79647c6c

SHA512
7febe5c84ab3a91d951dfb868d5c3741660372899528cfa5f807ea1ea888cb293861d666c7f884ddc1de3ce1b18568687312aa307b3994284559559df7102555

Download Submit
memory/332-63-0x0000000000000000-mapping.dmp

Download
memory/756-68-0x0000000000000000-mapping.dmp

Download
memory/896-57-0x0000000000000000-mapping.dmp

Download
memory/1812-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download