Analysis
-
max time kernel
252s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:03
Behavioral task
behavioral1
Sample
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe
Resource
win10v2004-20221111-en
General
-
Target
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe
-
Size
255KB
-
MD5
8f1e3fe00745836a1d9446e7c5bccd1d
-
SHA1
fdf9d4553100bc347287d3a187c8277a5c04b2d3
-
SHA256
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb
-
SHA512
7ba041ad463153089d1d3690be6a015e8210c29bdfc8ac913f4ed7457f4bb89b544c0f93b12b73da1e2231150f0f3a8fbaff2e030ed1a2f4664bde28117d35d0
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJS:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
uuevznfxjt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" uuevznfxjt.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
uuevznfxjt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" uuevznfxjt.exe -
Processes:
uuevznfxjt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" uuevznfxjt.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
uuevznfxjt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uuevznfxjt.exe -
Executes dropped EXE 5 IoCs
Processes:
uuevznfxjt.exeuvclgknizomttoj.exeyzsubnse.exekjsgoshifdhgq.exeyzsubnse.exepid process 584 uuevznfxjt.exe 1632 uvclgknizomttoj.exe 1696 yzsubnse.exe 1356 kjsgoshifdhgq.exe 1200 yzsubnse.exe -
Processes:
resource yara_rule behavioral1/memory/896-55-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\uuevznfxjt.exe upx behavioral1/memory/896-57-0x00000000032E0000-0x0000000003380000-memory.dmp upx behavioral1/memory/896-58-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\uuevznfxjt.exe upx \Windows\SysWOW64\yzsubnse.exe upx C:\Windows\SysWOW64\yzsubnse.exe upx \Windows\SysWOW64\kjsgoshifdhgq.exe upx C:\Windows\SysWOW64\kjsgoshifdhgq.exe upx C:\Windows\SysWOW64\yzsubnse.exe upx C:\Windows\SysWOW64\uuevznfxjt.exe upx behavioral1/memory/584-73-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\uvclgknizomttoj.exe upx behavioral1/memory/1632-79-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\uvclgknizomttoj.exe upx \Windows\SysWOW64\uvclgknizomttoj.exe upx behavioral1/memory/1696-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\yzsubnse.exe upx C:\Windows\SysWOW64\yzsubnse.exe upx behavioral1/memory/896-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1356-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1200-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/584-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1632-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1696-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1200-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeuuevznfxjt.exepid process 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 584 uuevznfxjt.exe -
Processes:
uuevznfxjt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" uuevznfxjt.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
uvclgknizomttoj.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run uvclgknizomttoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hoamhjnh = "uuevznfxjt.exe" uvclgknizomttoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\monsdfad = "uvclgknizomttoj.exe" uvclgknizomttoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kjsgoshifdhgq.exe" uvclgknizomttoj.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
yzsubnse.exeuuevznfxjt.exeyzsubnse.exedescription ioc process File opened (read-only) \??\e: yzsubnse.exe File opened (read-only) \??\q: yzsubnse.exe File opened (read-only) \??\j: uuevznfxjt.exe File opened (read-only) \??\j: yzsubnse.exe File opened (read-only) \??\p: yzsubnse.exe File opened (read-only) \??\s: yzsubnse.exe File opened (read-only) \??\u: yzsubnse.exe File opened (read-only) \??\m: uuevznfxjt.exe File opened (read-only) \??\m: yzsubnse.exe File opened (read-only) \??\r: yzsubnse.exe File opened (read-only) \??\r: yzsubnse.exe File opened (read-only) \??\i: uuevznfxjt.exe File opened (read-only) \??\p: uuevznfxjt.exe File opened (read-only) \??\l: yzsubnse.exe File opened (read-only) \??\a: uuevznfxjt.exe File opened (read-only) \??\n: uuevznfxjt.exe File opened (read-only) \??\r: uuevznfxjt.exe File opened (read-only) \??\o: yzsubnse.exe File opened (read-only) \??\p: yzsubnse.exe File opened (read-only) \??\i: yzsubnse.exe File opened (read-only) \??\w: uuevznfxjt.exe File opened (read-only) \??\x: uuevznfxjt.exe File opened (read-only) \??\b: yzsubnse.exe File opened (read-only) \??\w: yzsubnse.exe File opened (read-only) \??\y: yzsubnse.exe File opened (read-only) \??\w: yzsubnse.exe File opened (read-only) \??\b: uuevznfxjt.exe File opened (read-only) \??\f: uuevznfxjt.exe File opened (read-only) \??\o: uuevznfxjt.exe File opened (read-only) \??\h: yzsubnse.exe File opened (read-only) \??\n: yzsubnse.exe File opened (read-only) \??\v: yzsubnse.exe File opened (read-only) \??\g: yzsubnse.exe File opened (read-only) \??\y: uuevznfxjt.exe File opened (read-only) \??\g: yzsubnse.exe File opened (read-only) \??\h: yzsubnse.exe File opened (read-only) \??\q: uuevznfxjt.exe File opened (read-only) \??\q: yzsubnse.exe File opened (read-only) \??\z: yzsubnse.exe File opened (read-only) \??\o: yzsubnse.exe File opened (read-only) \??\u: uuevznfxjt.exe File opened (read-only) \??\s: yzsubnse.exe File opened (read-only) \??\z: yzsubnse.exe File opened (read-only) \??\k: uuevznfxjt.exe File opened (read-only) \??\s: uuevznfxjt.exe File opened (read-only) \??\g: uuevznfxjt.exe File opened (read-only) \??\n: yzsubnse.exe File opened (read-only) \??\t: yzsubnse.exe File opened (read-only) \??\y: yzsubnse.exe File opened (read-only) \??\f: yzsubnse.exe File opened (read-only) \??\i: yzsubnse.exe File opened (read-only) \??\l: yzsubnse.exe File opened (read-only) \??\m: yzsubnse.exe File opened (read-only) \??\k: yzsubnse.exe File opened (read-only) \??\h: uuevznfxjt.exe File opened (read-only) \??\b: yzsubnse.exe File opened (read-only) \??\x: yzsubnse.exe File opened (read-only) \??\l: uuevznfxjt.exe File opened (read-only) \??\a: yzsubnse.exe File opened (read-only) \??\a: yzsubnse.exe File opened (read-only) \??\e: uuevznfxjt.exe File opened (read-only) \??\v: uuevznfxjt.exe File opened (read-only) \??\z: uuevznfxjt.exe File opened (read-only) \??\j: yzsubnse.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
uuevznfxjt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" uuevznfxjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" uuevznfxjt.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/896-55-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/896-58-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/584-73-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1632-79-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1696-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/896-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1200-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/584-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1632-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1696-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1200-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeuuevznfxjt.exedescription ioc process File created C:\Windows\SysWOW64\uuevznfxjt.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File created C:\Windows\SysWOW64\uvclgknizomttoj.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File created C:\Windows\SysWOW64\kjsgoshifdhgq.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File opened for modification C:\Windows\SysWOW64\kjsgoshifdhgq.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll uuevznfxjt.exe File opened for modification C:\Windows\SysWOW64\uuevznfxjt.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File opened for modification C:\Windows\SysWOW64\uvclgknizomttoj.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File created C:\Windows\SysWOW64\yzsubnse.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File opened for modification C:\Windows\SysWOW64\yzsubnse.exe 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe -
Drops file in Windows directory 5 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEuuevznfxjt.exe87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" uuevznfxjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462D7D9C2C82596D3676A570202DD67D8465DD" 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFF9C9F911F195830C3B4A86EE3998B3FC02FB4365023DE2CA42EF08A0" 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" uuevznfxjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" uuevznfxjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" uuevznfxjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" uuevznfxjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf uuevznfxjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 240 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeuuevznfxjt.exeyzsubnse.exeuvclgknizomttoj.exeyzsubnse.exepid process 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1200 yzsubnse.exe 1200 yzsubnse.exe 1200 yzsubnse.exe 1200 yzsubnse.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeuuevznfxjt.exeyzsubnse.exeuvclgknizomttoj.exeyzsubnse.exepid process 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1200 yzsubnse.exe 1200 yzsubnse.exe 1200 yzsubnse.exe -
Suspicious use of SendNotifyMessage 15 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeuuevznfxjt.exeyzsubnse.exeuvclgknizomttoj.exeyzsubnse.exepid process 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 584 uuevznfxjt.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1696 yzsubnse.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1632 uvclgknizomttoj.exe 1200 yzsubnse.exe 1200 yzsubnse.exe 1200 yzsubnse.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 240 WINWORD.EXE 240 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exeuuevznfxjt.exeWINWORD.EXEdescription pid process target process PID 896 wrote to memory of 584 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uuevznfxjt.exe PID 896 wrote to memory of 584 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uuevznfxjt.exe PID 896 wrote to memory of 584 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uuevznfxjt.exe PID 896 wrote to memory of 584 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uuevznfxjt.exe PID 896 wrote to memory of 1632 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uvclgknizomttoj.exe PID 896 wrote to memory of 1632 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uvclgknizomttoj.exe PID 896 wrote to memory of 1632 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uvclgknizomttoj.exe PID 896 wrote to memory of 1632 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe uvclgknizomttoj.exe PID 896 wrote to memory of 1696 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe yzsubnse.exe PID 896 wrote to memory of 1696 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe yzsubnse.exe PID 896 wrote to memory of 1696 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe yzsubnse.exe PID 896 wrote to memory of 1696 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe yzsubnse.exe PID 896 wrote to memory of 1356 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe kjsgoshifdhgq.exe PID 896 wrote to memory of 1356 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe kjsgoshifdhgq.exe PID 896 wrote to memory of 1356 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe kjsgoshifdhgq.exe PID 896 wrote to memory of 1356 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe kjsgoshifdhgq.exe PID 584 wrote to memory of 1200 584 uuevznfxjt.exe yzsubnse.exe PID 584 wrote to memory of 1200 584 uuevznfxjt.exe yzsubnse.exe PID 584 wrote to memory of 1200 584 uuevznfxjt.exe yzsubnse.exe PID 584 wrote to memory of 1200 584 uuevznfxjt.exe yzsubnse.exe PID 896 wrote to memory of 240 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe WINWORD.EXE PID 896 wrote to memory of 240 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe WINWORD.EXE PID 896 wrote to memory of 240 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe WINWORD.EXE PID 896 wrote to memory of 240 896 87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe WINWORD.EXE PID 240 wrote to memory of 1232 240 WINWORD.EXE splwow64.exe PID 240 wrote to memory of 1232 240 WINWORD.EXE splwow64.exe PID 240 wrote to memory of 1232 240 WINWORD.EXE splwow64.exe PID 240 wrote to memory of 1232 240 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe"C:\Users\Admin\AppData\Local\Temp\87baaf5877a36d0833ad455ec1f129826a71f747176fe3b3480eafa647c289cb.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\uuevznfxjt.exeuuevznfxjt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\yzsubnse.exeC:\Windows\system32\yzsubnse.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200 -
C:\Windows\SysWOW64\uvclgknizomttoj.exeuvclgknizomttoj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1632 -
C:\Windows\SysWOW64\yzsubnse.exeyzsubnse.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1696 -
C:\Windows\SysWOW64\kjsgoshifdhgq.exekjsgoshifdhgq.exe2⤵
- Executes dropped EXE
PID:1356 -
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1232
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\kjsgoshifdhgq.exeFilesize
255KB
MD520b9a81e7f16e40002933274f7a0e15e
SHA100f0de014f9f8ad320a97abdcc0ad63e3cd762c3
SHA256ebafaeaeccb7e12f1b1a321c6f1ebad5e082cc2f3f31147da190ecc5eb9f381f
SHA512f884ebbf385cd46a1a4d30c407a1bb6effcd11695789ab14a8f95d5c15f29ab09c4456ad0d1da8388ee0038b4fbb6d2532e07ceea301481cb63af4caa7aede99
-
C:\Windows\SysWOW64\uuevznfxjt.exeFilesize
255KB
MD5d4d1a59fb8ca431c0fc5eddc31268fc6
SHA1f660ba161736850e1f61d870bf501b4c8cf96dd9
SHA25666a3fe0ff72fa8b7a38a532e950667eb1afced272b715298e3e65697b3c99117
SHA5122f0086f0063772ca8dbefc35110609a74b1fcd981869a0a042e7e7b53ab87d6c71b120335ca4c71c29c2d5a12ad76ac13c0afda1bb0e072edca95af6c1da0d72
-
C:\Windows\SysWOW64\uuevznfxjt.exeFilesize
255KB
MD5d4d1a59fb8ca431c0fc5eddc31268fc6
SHA1f660ba161736850e1f61d870bf501b4c8cf96dd9
SHA25666a3fe0ff72fa8b7a38a532e950667eb1afced272b715298e3e65697b3c99117
SHA5122f0086f0063772ca8dbefc35110609a74b1fcd981869a0a042e7e7b53ab87d6c71b120335ca4c71c29c2d5a12ad76ac13c0afda1bb0e072edca95af6c1da0d72
-
C:\Windows\SysWOW64\uvclgknizomttoj.exeFilesize
255KB
MD51e5ef8c71f86d5da8cdf6666d2dc31bf
SHA11ce5f9de477517e60e7bc2e1e8c6dd326cf2b89a
SHA256a585b0f3fc713a31505f8a7e92bb41195f722e77cf6a559aeed1655da4f5daf5
SHA512b56026a54c296a888375d57c833d4f6fac2f7d9c41f873614db621698c6cef3aa3e466b22e106968e530abb27d9875bfd3b3d560b38825c87ca914b216a4bdb4
-
C:\Windows\SysWOW64\uvclgknizomttoj.exeFilesize
255KB
MD51e5ef8c71f86d5da8cdf6666d2dc31bf
SHA11ce5f9de477517e60e7bc2e1e8c6dd326cf2b89a
SHA256a585b0f3fc713a31505f8a7e92bb41195f722e77cf6a559aeed1655da4f5daf5
SHA512b56026a54c296a888375d57c833d4f6fac2f7d9c41f873614db621698c6cef3aa3e466b22e106968e530abb27d9875bfd3b3d560b38825c87ca914b216a4bdb4
-
C:\Windows\SysWOW64\yzsubnse.exeFilesize
255KB
MD5992939b24c170116203395798b24dcca
SHA137bda410e454d89bdd1f696719cecc2e96bdb678
SHA2565842a05162cd1f77af22914b4b9da8115c117ec32e30105692d26783c5dcdc9e
SHA51248e87a43ba7609990f3d1d2eb2adc2900ac2a432c284aca413255272130a732b2e5f7c25c80f067fd0b49ef859fd52c1c780f7b2461c00742dbb42d3c5977810
-
C:\Windows\SysWOW64\yzsubnse.exeFilesize
255KB
MD5992939b24c170116203395798b24dcca
SHA137bda410e454d89bdd1f696719cecc2e96bdb678
SHA2565842a05162cd1f77af22914b4b9da8115c117ec32e30105692d26783c5dcdc9e
SHA51248e87a43ba7609990f3d1d2eb2adc2900ac2a432c284aca413255272130a732b2e5f7c25c80f067fd0b49ef859fd52c1c780f7b2461c00742dbb42d3c5977810
-
C:\Windows\SysWOW64\yzsubnse.exeFilesize
255KB
MD5992939b24c170116203395798b24dcca
SHA137bda410e454d89bdd1f696719cecc2e96bdb678
SHA2565842a05162cd1f77af22914b4b9da8115c117ec32e30105692d26783c5dcdc9e
SHA51248e87a43ba7609990f3d1d2eb2adc2900ac2a432c284aca413255272130a732b2e5f7c25c80f067fd0b49ef859fd52c1c780f7b2461c00742dbb42d3c5977810
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\kjsgoshifdhgq.exeFilesize
255KB
MD520b9a81e7f16e40002933274f7a0e15e
SHA100f0de014f9f8ad320a97abdcc0ad63e3cd762c3
SHA256ebafaeaeccb7e12f1b1a321c6f1ebad5e082cc2f3f31147da190ecc5eb9f381f
SHA512f884ebbf385cd46a1a4d30c407a1bb6effcd11695789ab14a8f95d5c15f29ab09c4456ad0d1da8388ee0038b4fbb6d2532e07ceea301481cb63af4caa7aede99
-
\Windows\SysWOW64\uuevznfxjt.exeFilesize
255KB
MD5d4d1a59fb8ca431c0fc5eddc31268fc6
SHA1f660ba161736850e1f61d870bf501b4c8cf96dd9
SHA25666a3fe0ff72fa8b7a38a532e950667eb1afced272b715298e3e65697b3c99117
SHA5122f0086f0063772ca8dbefc35110609a74b1fcd981869a0a042e7e7b53ab87d6c71b120335ca4c71c29c2d5a12ad76ac13c0afda1bb0e072edca95af6c1da0d72
-
\Windows\SysWOW64\uvclgknizomttoj.exeFilesize
255KB
MD51e5ef8c71f86d5da8cdf6666d2dc31bf
SHA11ce5f9de477517e60e7bc2e1e8c6dd326cf2b89a
SHA256a585b0f3fc713a31505f8a7e92bb41195f722e77cf6a559aeed1655da4f5daf5
SHA512b56026a54c296a888375d57c833d4f6fac2f7d9c41f873614db621698c6cef3aa3e466b22e106968e530abb27d9875bfd3b3d560b38825c87ca914b216a4bdb4
-
\Windows\SysWOW64\yzsubnse.exeFilesize
255KB
MD5992939b24c170116203395798b24dcca
SHA137bda410e454d89bdd1f696719cecc2e96bdb678
SHA2565842a05162cd1f77af22914b4b9da8115c117ec32e30105692d26783c5dcdc9e
SHA51248e87a43ba7609990f3d1d2eb2adc2900ac2a432c284aca413255272130a732b2e5f7c25c80f067fd0b49ef859fd52c1c780f7b2461c00742dbb42d3c5977810
-
\Windows\SysWOW64\yzsubnse.exeFilesize
255KB
MD5992939b24c170116203395798b24dcca
SHA137bda410e454d89bdd1f696719cecc2e96bdb678
SHA2565842a05162cd1f77af22914b4b9da8115c117ec32e30105692d26783c5dcdc9e
SHA51248e87a43ba7609990f3d1d2eb2adc2900ac2a432c284aca413255272130a732b2e5f7c25c80f067fd0b49ef859fd52c1c780f7b2461c00742dbb42d3c5977810
-
memory/240-89-0x000000006FF11000-0x000000006FF13000-memory.dmpFilesize
8KB
-
memory/240-86-0x0000000000000000-mapping.dmp
-
memory/240-100-0x0000000070EFD000-0x0000000070F08000-memory.dmpFilesize
44KB
-
memory/240-95-0x0000000070EFD000-0x0000000070F08000-memory.dmpFilesize
44KB
-
memory/240-92-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/240-88-0x0000000072491000-0x0000000072494000-memory.dmpFilesize
12KB
-
memory/584-96-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/584-59-0x0000000000000000-mapping.dmp
-
memory/584-73-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/896-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/896-80-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/896-55-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/896-77-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/896-58-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/896-57-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/896-87-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1200-83-0x0000000000000000-mapping.dmp
-
memory/1200-91-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1200-99-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1232-101-0x0000000000000000-mapping.dmp
-
memory/1232-102-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmpFilesize
8KB
-
memory/1356-90-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1356-71-0x0000000000000000-mapping.dmp
-
memory/1632-97-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1632-79-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1632-63-0x0000000000000000-mapping.dmp
-
memory/1696-98-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1696-66-0x0000000000000000-mapping.dmp
-
memory/1696-81-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB