650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4

Analysis

max time kernel
151s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
Size

255KB
MD5

7ca629734460580e992499971725c64b
SHA1

742a6823b9366ae5f38526161f034c4da2cf63ea
SHA256

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4
SHA512

9dc80fcb22aabc231f9bf835503cf548b150d676c3782dfc99104cdcd34de63e80d713353182230fd10fb6cb4ebdacda3dcf2f4de9ad998b15b920ff63b11ef0
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJx:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

gofrkpvatl.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	gofrkpvatl.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

gofrkpvatl.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	gofrkpvatl.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

gofrkpvatl.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	gofrkpvatl.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

gofrkpvatl.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	gofrkpvatl.exe

Executes dropped EXE 6 IoCs

Processes:

gofrkpvatl.exerfiljhtlpbkdkud.exenytpbculqkbbl.exegicjocqw.exenytpbculqkbbl.exegicjocqw.exe

pid process

1668 gofrkpvatl.exe
1260 rfiljhtlpbkdkud.exe
1096 nytpbculqkbbl.exe
1764 gicjocqw.exe
1300 nytpbculqkbbl.exe
1104 gicjocqw.exe

pid	process
1668	gofrkpvatl.exe
1260	rfiljhtlpbkdkud.exe
1096	nytpbculqkbbl.exe
1764	gicjocqw.exe
1300	nytpbculqkbbl.exe
1104	gicjocqw.exe

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\gofrkpvatl.exe	upx
C:\Windows\SysWOW64\gofrkpvatl.exe	upx
\Windows\SysWOW64\rfiljhtlpbkdkud.exe	upx
C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe	upx
\Windows\SysWOW64\gicjocqw.exe	upx
\Windows\SysWOW64\nytpbculqkbbl.exe	upx
C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe	upx
C:\Windows\SysWOW64\gicjocqw.exe	upx
C:\Windows\SysWOW64\nytpbculqkbbl.exe	upx
C:\Windows\SysWOW64\gofrkpvatl.exe	upx
C:\Windows\SysWOW64\nytpbculqkbbl.exe	upx
\Windows\SysWOW64\nytpbculqkbbl.exe	upx
C:\Windows\SysWOW64\nytpbculqkbbl.exe	upx
behavioral1/memory/1688-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\gicjocqw.exe	upx
\Windows\SysWOW64\gicjocqw.exe	upx
behavioral1/memory/1668-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\gicjocqw.exe	upx
behavioral1/memory/1096-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1764-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1300-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1688-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1104-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1668-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1260-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1096-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1300-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1104-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

Processes:

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.execmd.exegofrkpvatl.exe

pid	process
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1232	cmd.exe
1668	gofrkpvatl.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

gofrkpvatl.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	gofrkpvatl.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rfiljhtlpbkdkud.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	rfiljhtlpbkdkud.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tcdjkeyi = "gofrkpvatl.exe"	rfiljhtlpbkdkud.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qcesvnya = "rfiljhtlpbkdkud.exe"	rfiljhtlpbkdkud.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nytpbculqkbbl.exe"	rfiljhtlpbkdkud.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

gicjocqw.exegofrkpvatl.exe

description	ioc	process
File opened (read-only)	\??\i:	gicjocqw.exe
File opened (read-only)	\??\o:	gicjocqw.exe
File opened (read-only)	\??\s:	gicjocqw.exe
File opened (read-only)	\??\w:	gicjocqw.exe
File opened (read-only)	\??\a:	gofrkpvatl.exe
File opened (read-only)	\??\e:	gofrkpvatl.exe
File opened (read-only)	\??\e:	gicjocqw.exe
File opened (read-only)	\??\v:	gicjocqw.exe
File opened (read-only)	\??\j:	gofrkpvatl.exe
File opened (read-only)	\??\f:	gicjocqw.exe
File opened (read-only)	\??\n:	gicjocqw.exe
File opened (read-only)	\??\p:	gicjocqw.exe
File opened (read-only)	\??\y:	gicjocqw.exe
File opened (read-only)	\??\h:	gofrkpvatl.exe
File opened (read-only)	\??\u:	gofrkpvatl.exe
File opened (read-only)	\??\m:	gicjocqw.exe
File opened (read-only)	\??\r:	gofrkpvatl.exe
File opened (read-only)	\??\t:	gofrkpvatl.exe
File opened (read-only)	\??\j:	gicjocqw.exe
File opened (read-only)	\??\l:	gicjocqw.exe
File opened (read-only)	\??\k:	gofrkpvatl.exe
File opened (read-only)	\??\m:	gofrkpvatl.exe
File opened (read-only)	\??\o:	gofrkpvatl.exe
File opened (read-only)	\??\q:	gofrkpvatl.exe
File opened (read-only)	\??\x:	gofrkpvatl.exe
File opened (read-only)	\??\b:	gicjocqw.exe
File opened (read-only)	\??\h:	gicjocqw.exe
File opened (read-only)	\??\k:	gicjocqw.exe
File opened (read-only)	\??\g:	gofrkpvatl.exe
File opened (read-only)	\??\l:	gofrkpvatl.exe
File opened (read-only)	\??\p:	gofrkpvatl.exe
File opened (read-only)	\??\y:	gofrkpvatl.exe
File opened (read-only)	\??\z:	gofrkpvatl.exe
File opened (read-only)	\??\q:	gicjocqw.exe
File opened (read-only)	\??\r:	gicjocqw.exe
File opened (read-only)	\??\t:	gicjocqw.exe
File opened (read-only)	\??\b:	gofrkpvatl.exe
File opened (read-only)	\??\n:	gofrkpvatl.exe
File opened (read-only)	\??\v:	gofrkpvatl.exe
File opened (read-only)	\??\u:	gicjocqw.exe
File opened (read-only)	\??\z:	gicjocqw.exe
File opened (read-only)	\??\f:	gofrkpvatl.exe
File opened (read-only)	\??\w:	gofrkpvatl.exe
File opened (read-only)	\??\a:	gicjocqw.exe
File opened (read-only)	\??\x:	gicjocqw.exe
File opened (read-only)	\??\i:	gofrkpvatl.exe
File opened (read-only)	\??\s:	gofrkpvatl.exe
File opened (read-only)	\??\g:	gicjocqw.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

gofrkpvatl.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	gofrkpvatl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	gofrkpvatl.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1688-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1688-80-0x0000000002F50000-0x0000000002FF0000-memory.dmp	autoit_exe
behavioral1/memory/1668-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1096-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1300-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1688-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1104-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1668-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1260-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1096-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1300-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1104-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exegofrkpvatl.exe

description	ioc	process
File created	C:\Windows\SysWOW64\gofrkpvatl.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File created	C:\Windows\SysWOW64\gicjocqw.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File created	C:\Windows\SysWOW64\nytpbculqkbbl.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	gofrkpvatl.exe
File opened for modification	C:\Windows\SysWOW64\gofrkpvatl.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File created	C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File opened for modification	C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File opened for modification	C:\Windows\SysWOW64\gicjocqw.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
File opened for modification	C:\Windows\SysWOW64\nytpbculqkbbl.exe	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe

Drops file in Program Files directory 12 IoCs

Processes:

gicjocqw.exe

description	ioc	process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gicjocqw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gicjocqw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	gicjocqw.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gicjocqw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gicjocqw.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gicjocqw.exe
File created	\??\c:\Program Files\PushMount.doc.exe	gicjocqw.exe
File opened for modification	\??\c:\Program Files\PushMount.doc.exe	gicjocqw.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gicjocqw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	gicjocqw.exe
File opened for modification	C:\Program Files\PushMount.doc.exe	gicjocqw.exe
File opened for modification	C:\Program Files\PushMount.nal	gicjocqw.exe

Drops file in Windows directory 4 IoCs

Processes:

WINWORD.EXE650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEexplorer.exeexplorer.exeexplorer.exeexplorer.exegofrkpvatl.exeexplorer.exeexplorer.exe650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	gofrkpvatl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	gofrkpvatl.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	gofrkpvatl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F56BB6FE1B21A9D27BD0D28B099163"	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	gofrkpvatl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	gofrkpvatl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1672 WINWORD.EXE

pid	process
1672	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exerfiljhtlpbkdkud.exegofrkpvatl.exenytpbculqkbbl.exenytpbculqkbbl.exegicjocqw.exe

pid	process
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1260	rfiljhtlpbkdkud.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1104	gicjocqw.exe
1104	gicjocqw.exe
1104	gicjocqw.exe
1104	gicjocqw.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1260	rfiljhtlpbkdkud.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1260	rfiljhtlpbkdkud.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1260	rfiljhtlpbkdkud.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1260	rfiljhtlpbkdkud.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1260	rfiljhtlpbkdkud.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	pid	process
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1376	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1700	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1920	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	1576	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	584	explorer.exe
Token: SeShutdownPrivilege	1600	explorer.exe
Token: SeShutdownPrivilege	1600	explorer.exe
Token: SeShutdownPrivilege	1600	explorer.exe
Token: SeShutdownPrivilege	1600	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exerfiljhtlpbkdkud.exegofrkpvatl.exenytpbculqkbbl.exenytpbculqkbbl.exegicjocqw.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1104	gicjocqw.exe
1104	gicjocqw.exe
1104	gicjocqw.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exerfiljhtlpbkdkud.exegofrkpvatl.exenytpbculqkbbl.exenytpbculqkbbl.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1260	rfiljhtlpbkdkud.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1668	gofrkpvatl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1096	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1300	nytpbculqkbbl.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1376	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1920	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe
1576	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1672 WINWORD.EXE
1672 WINWORD.EXE

pid	process
1672	WINWORD.EXE
1672	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exerfiljhtlpbkdkud.execmd.exegofrkpvatl.exeWINWORD.EXE

description	pid	process	target process
PID 1688 wrote to memory of 1668	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gofrkpvatl.exe
PID 1688 wrote to memory of 1668	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gofrkpvatl.exe
PID 1688 wrote to memory of 1668	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gofrkpvatl.exe
PID 1688 wrote to memory of 1668	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gofrkpvatl.exe
PID 1688 wrote to memory of 1260	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	rfiljhtlpbkdkud.exe
PID 1688 wrote to memory of 1260	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	rfiljhtlpbkdkud.exe
PID 1688 wrote to memory of 1260	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	rfiljhtlpbkdkud.exe
PID 1688 wrote to memory of 1260	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	rfiljhtlpbkdkud.exe
PID 1688 wrote to memory of 1764	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gicjocqw.exe
PID 1688 wrote to memory of 1764	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gicjocqw.exe
PID 1688 wrote to memory of 1764	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gicjocqw.exe
PID 1688 wrote to memory of 1764	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	gicjocqw.exe
PID 1688 wrote to memory of 1096	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	nytpbculqkbbl.exe
PID 1688 wrote to memory of 1096	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	nytpbculqkbbl.exe
PID 1688 wrote to memory of 1096	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	nytpbculqkbbl.exe
PID 1688 wrote to memory of 1096	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	nytpbculqkbbl.exe
PID 1260 wrote to memory of 1232	1260	rfiljhtlpbkdkud.exe	cmd.exe
PID 1260 wrote to memory of 1232	1260	rfiljhtlpbkdkud.exe	cmd.exe
PID 1260 wrote to memory of 1232	1260	rfiljhtlpbkdkud.exe	cmd.exe
PID 1260 wrote to memory of 1232	1260	rfiljhtlpbkdkud.exe	cmd.exe
PID 1232 wrote to memory of 1300	1232	cmd.exe	nytpbculqkbbl.exe
PID 1232 wrote to memory of 1300	1232	cmd.exe	nytpbculqkbbl.exe
PID 1232 wrote to memory of 1300	1232	cmd.exe	nytpbculqkbbl.exe
PID 1232 wrote to memory of 1300	1232	cmd.exe	nytpbculqkbbl.exe
PID 1668 wrote to memory of 1104	1668	gofrkpvatl.exe	gicjocqw.exe
PID 1668 wrote to memory of 1104	1668	gofrkpvatl.exe	gicjocqw.exe
PID 1668 wrote to memory of 1104	1668	gofrkpvatl.exe	gicjocqw.exe
PID 1668 wrote to memory of 1104	1668	gofrkpvatl.exe	gicjocqw.exe
PID 1688 wrote to memory of 1672	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	WINWORD.EXE
PID 1688 wrote to memory of 1672	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	WINWORD.EXE
PID 1688 wrote to memory of 1672	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	WINWORD.EXE
PID 1688 wrote to memory of 1672	1688	650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe	WINWORD.EXE
PID 1672 wrote to memory of 1552	1672	WINWORD.EXE	splwow64.exe
PID 1672 wrote to memory of 1552	1672	WINWORD.EXE	splwow64.exe
PID 1672 wrote to memory of 1552	1672	WINWORD.EXE	splwow64.exe
PID 1672 wrote to memory of 1552	1672	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe
"C:\Users\Admin\AppData\Local\Temp\650383ffc7e7bf7e8de53661c1cf32b240d0411fa2d9b2e14bfeaed523f7bff4.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\gofrkpvatl.exe
gofrkpvatl.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\gicjocqw.exe
C:\Windows\system32\gicjocqw.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1104

C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe
rfiljhtlpbkdkud.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c nytpbculqkbbl.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\nytpbculqkbbl.exe
nytpbculqkbbl.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1300

C:\Windows\SysWOW64\gicjocqw.exe
gicjocqw.exe
2⤵
- Executes dropped EXE
PID:1764

C:\Windows\SysWOW64\nytpbculqkbbl.exe
nytpbculqkbbl.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1096

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1552

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x588
1⤵
PID:1160

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1700

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1576

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\gicjocqw.exe

Filesize
255KB

MD5
cc8d1db7e2f40d0e5c48d1af8a8a011b

SHA1
9297f98a3bcb9c0cbdbb1d723cc52f5727869b59

SHA256
ff4bcb356849d87c70993088e90a10abcf7792cfac07c65f98e1fb9181269454

SHA512
7895ae4f06d02c7ea4df2cfe0b9c25ecbe1db534fff6ea5d8d965eb753a931c10bfa1a83459e3fd1cecf6b0c770278f75cad134241be10d054d1cf8fcaf9b6ae

Download Submit
C:\Windows\SysWOW64\gicjocqw.exe

Filesize
255KB

MD5
cc8d1db7e2f40d0e5c48d1af8a8a011b

SHA1
9297f98a3bcb9c0cbdbb1d723cc52f5727869b59

SHA256
ff4bcb356849d87c70993088e90a10abcf7792cfac07c65f98e1fb9181269454

SHA512
7895ae4f06d02c7ea4df2cfe0b9c25ecbe1db534fff6ea5d8d965eb753a931c10bfa1a83459e3fd1cecf6b0c770278f75cad134241be10d054d1cf8fcaf9b6ae

Download Submit
C:\Windows\SysWOW64\gicjocqw.exe

Filesize
255KB

MD5
cc8d1db7e2f40d0e5c48d1af8a8a011b

SHA1
9297f98a3bcb9c0cbdbb1d723cc52f5727869b59

SHA256
ff4bcb356849d87c70993088e90a10abcf7792cfac07c65f98e1fb9181269454

SHA512
7895ae4f06d02c7ea4df2cfe0b9c25ecbe1db534fff6ea5d8d965eb753a931c10bfa1a83459e3fd1cecf6b0c770278f75cad134241be10d054d1cf8fcaf9b6ae

Download Submit
C:\Windows\SysWOW64\gofrkpvatl.exe

Filesize
255KB

MD5
38d7e080d1bcbfa5722ab221d3a8edf7

SHA1
78e98b69aea1f8c655afd115982858da977e0337

SHA256
f38fd12de8fa8f3590548db8b933dc696dfa02bcd2054f37bb0ce4a31954bdec

SHA512
6506af9368ae01eba18b9ed9788da932c8fec3e078531bc6fc9643d2f1b5b37445383e9d0325083cddb1bc2dad11b43791257655e5e728f39e3957148ceebede

Download Submit
C:\Windows\SysWOW64\gofrkpvatl.exe

Filesize
255KB

MD5
38d7e080d1bcbfa5722ab221d3a8edf7

SHA1
78e98b69aea1f8c655afd115982858da977e0337

SHA256
f38fd12de8fa8f3590548db8b933dc696dfa02bcd2054f37bb0ce4a31954bdec

SHA512
6506af9368ae01eba18b9ed9788da932c8fec3e078531bc6fc9643d2f1b5b37445383e9d0325083cddb1bc2dad11b43791257655e5e728f39e3957148ceebede

Download Submit
C:\Windows\SysWOW64\nytpbculqkbbl.exe

Filesize
255KB

MD5
be7c0192c8066a28e933efdfb1e42486

SHA1
786c19ea503b80b8f3a6d7471f9d8be51d0d5f06

SHA256
61c99498c966d6cd8dfb9d9832f20cbb2ed0b8f5443f74d7e2a7139994d1d7be

SHA512
630844a2c63784bbf6fc393d0a387602824969a664b6a62e676bb1defd03ef8797589d90c185557b18fe68c3c3135989b94605d72725dec393922cddce9d1db7

Download Submit
C:\Windows\SysWOW64\nytpbculqkbbl.exe

Filesize
255KB

MD5
be7c0192c8066a28e933efdfb1e42486

SHA1
786c19ea503b80b8f3a6d7471f9d8be51d0d5f06

SHA256
61c99498c966d6cd8dfb9d9832f20cbb2ed0b8f5443f74d7e2a7139994d1d7be

SHA512
630844a2c63784bbf6fc393d0a387602824969a664b6a62e676bb1defd03ef8797589d90c185557b18fe68c3c3135989b94605d72725dec393922cddce9d1db7

Download Submit
C:\Windows\SysWOW64\nytpbculqkbbl.exe

Filesize
255KB

MD5
be7c0192c8066a28e933efdfb1e42486

SHA1
786c19ea503b80b8f3a6d7471f9d8be51d0d5f06

SHA256
61c99498c966d6cd8dfb9d9832f20cbb2ed0b8f5443f74d7e2a7139994d1d7be

SHA512
630844a2c63784bbf6fc393d0a387602824969a664b6a62e676bb1defd03ef8797589d90c185557b18fe68c3c3135989b94605d72725dec393922cddce9d1db7

Download Submit
C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe

Filesize
255KB

MD5
839a4c5b83cb6612c69ea4f1470d7d8b

SHA1
e72fbe80852aedb736853aa193a55a31591840eb

SHA256
668eea2fa3134973c43e5f7860740043dd6055c4614d585f5b696a23f40fcef4

SHA512
80ea153873c9ba08a337f53fd0ee07cfb752f9d1a1cf19bb8cda2cd7a2cde4092bd91dd9aa925accabc9e684c2bdd8228aa11d6c21717e3293345dc94178d6b9

Download Submit
C:\Windows\SysWOW64\rfiljhtlpbkdkud.exe

Filesize
255KB

MD5
839a4c5b83cb6612c69ea4f1470d7d8b

SHA1
e72fbe80852aedb736853aa193a55a31591840eb

SHA256
668eea2fa3134973c43e5f7860740043dd6055c4614d585f5b696a23f40fcef4

SHA512
80ea153873c9ba08a337f53fd0ee07cfb752f9d1a1cf19bb8cda2cd7a2cde4092bd91dd9aa925accabc9e684c2bdd8228aa11d6c21717e3293345dc94178d6b9

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\SysWOW64\gicjocqw.exe

Filesize
255KB

MD5
cc8d1db7e2f40d0e5c48d1af8a8a011b

SHA1
9297f98a3bcb9c0cbdbb1d723cc52f5727869b59

SHA256
ff4bcb356849d87c70993088e90a10abcf7792cfac07c65f98e1fb9181269454

SHA512
7895ae4f06d02c7ea4df2cfe0b9c25ecbe1db534fff6ea5d8d965eb753a931c10bfa1a83459e3fd1cecf6b0c770278f75cad134241be10d054d1cf8fcaf9b6ae

Download Submit
\Windows\SysWOW64\gicjocqw.exe

Filesize
255KB

MD5
cc8d1db7e2f40d0e5c48d1af8a8a011b

SHA1
9297f98a3bcb9c0cbdbb1d723cc52f5727869b59

SHA256
ff4bcb356849d87c70993088e90a10abcf7792cfac07c65f98e1fb9181269454

SHA512
7895ae4f06d02c7ea4df2cfe0b9c25ecbe1db534fff6ea5d8d965eb753a931c10bfa1a83459e3fd1cecf6b0c770278f75cad134241be10d054d1cf8fcaf9b6ae

Download Submit
\Windows\SysWOW64\gofrkpvatl.exe

Filesize
255KB

MD5
38d7e080d1bcbfa5722ab221d3a8edf7

SHA1
78e98b69aea1f8c655afd115982858da977e0337

SHA256
f38fd12de8fa8f3590548db8b933dc696dfa02bcd2054f37bb0ce4a31954bdec

SHA512
6506af9368ae01eba18b9ed9788da932c8fec3e078531bc6fc9643d2f1b5b37445383e9d0325083cddb1bc2dad11b43791257655e5e728f39e3957148ceebede

Download Submit
\Windows\SysWOW64\nytpbculqkbbl.exe

Filesize
255KB

MD5
be7c0192c8066a28e933efdfb1e42486

SHA1
786c19ea503b80b8f3a6d7471f9d8be51d0d5f06

SHA256
61c99498c966d6cd8dfb9d9832f20cbb2ed0b8f5443f74d7e2a7139994d1d7be

SHA512
630844a2c63784bbf6fc393d0a387602824969a664b6a62e676bb1defd03ef8797589d90c185557b18fe68c3c3135989b94605d72725dec393922cddce9d1db7

Download Submit
\Windows\SysWOW64\nytpbculqkbbl.exe

Filesize
255KB

MD5
be7c0192c8066a28e933efdfb1e42486

SHA1
786c19ea503b80b8f3a6d7471f9d8be51d0d5f06

SHA256
61c99498c966d6cd8dfb9d9832f20cbb2ed0b8f5443f74d7e2a7139994d1d7be

SHA512
630844a2c63784bbf6fc393d0a387602824969a664b6a62e676bb1defd03ef8797589d90c185557b18fe68c3c3135989b94605d72725dec393922cddce9d1db7

Download Submit
\Windows\SysWOW64\rfiljhtlpbkdkud.exe

Filesize
255KB

MD5
839a4c5b83cb6612c69ea4f1470d7d8b

SHA1
e72fbe80852aedb736853aa193a55a31591840eb

SHA256
668eea2fa3134973c43e5f7860740043dd6055c4614d585f5b696a23f40fcef4

SHA512
80ea153873c9ba08a337f53fd0ee07cfb752f9d1a1cf19bb8cda2cd7a2cde4092bd91dd9aa925accabc9e684c2bdd8228aa11d6c21717e3293345dc94178d6b9

Download Submit
memory/1096-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1096-67-0x0000000000000000-mapping.dmp

Download
memory/1096-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1104-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1104-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1104-84-0x0000000000000000-mapping.dmp

Download
memory/1232-74-0x0000000000000000-mapping.dmp

Download
memory/1260-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1260-60-0x0000000000000000-mapping.dmp

Download
memory/1300-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1300-76-0x0000000000000000-mapping.dmp

Download
memory/1300-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1376-102-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1552-111-0x0000000000000000-mapping.dmp

Download
memory/1668-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1668-108-0x0000000003C70000-0x0000000003D10000-memory.dmp

Filesize
640KB

Download
memory/1668-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1668-56-0x0000000000000000-mapping.dmp

Download
memory/1668-99-0x0000000003C70000-0x0000000003D10000-memory.dmp

Filesize
640KB

Download
memory/1672-98-0x0000000070BFD000-0x0000000070C08000-memory.dmp

Filesize
44KB

Download
memory/1672-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1672-92-0x0000000000000000-mapping.dmp

Download
memory/1672-107-0x0000000070BFD000-0x0000000070C08000-memory.dmp

Filesize
44KB

Download
memory/1672-95-0x000000006FC11000-0x000000006FC13000-memory.dmp

Filesize
8KB

Download
memory/1672-94-0x0000000072191000-0x0000000072194000-memory.dmp

Filesize
12KB

Download
memory/1688-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1688-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1688-85-0x0000000002F50000-0x0000000002FF0000-memory.dmp

Filesize
640KB

Download
memory/1688-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1688-80-0x0000000002F50000-0x0000000002FF0000-memory.dmp

Filesize
640KB

Download
memory/1764-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1764-64-0x0000000000000000-mapping.dmp

Download