1ba03c3750f8cddea31a0bb897cf00eec2c5102a676dc70fc4e93464425dc547

Analysis

max time kernel
154s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21683aef181b87eb95f9bd10a7c129e9.exe
Size

512KB
MD5

21683aef181b87eb95f9bd10a7c129e9
SHA1

f62e26da896e841e6c96615add344170e3dc67ca
SHA256

1ba03c3750f8cddea31a0bb897cf00eec2c5102a676dc70fc4e93464425dc547
SHA512

1d7dcd0b77c962611a51a29483e0d72c7ad57df087b8f959ad04b9d992ebbdae080cfee3118aeb045e04976d1c2273f8ca92708595519a8290bb915efe85ddf5
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ipyfjguvvc.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ipyfjguvvc.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ipyfjguvvc.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ipyfjguvvc.exe

Executes dropped EXE 5 IoCs

pid	Process
2852	ipyfjguvvc.exe
2732	hnfjbcjymcjeewi.exe
2584	duhwrzkg.exe
2952	ynnbgbcidxfdy.exe
2572	duhwrzkg.exe

Loads dropped DLL 5 IoCs

pid	Process
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2852	ipyfjguvvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ipyfjguvvc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wirdkham = "ipyfjguvvc.exe"	hnfjbcjymcjeewi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eobzuqqy = "hnfjbcjymcjeewi.exe"	hnfjbcjymcjeewi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ynnbgbcidxfdy.exe"	hnfjbcjymcjeewi.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	duhwrzkg.exe
File opened (read-only)	\??\g:	ipyfjguvvc.exe
File opened (read-only)	\??\o:	duhwrzkg.exe
File opened (read-only)	\??\r:	duhwrzkg.exe
File opened (read-only)	\??\a:	duhwrzkg.exe
File opened (read-only)	\??\k:	duhwrzkg.exe
File opened (read-only)	\??\o:	duhwrzkg.exe
File opened (read-only)	\??\k:	duhwrzkg.exe
File opened (read-only)	\??\a:	duhwrzkg.exe
File opened (read-only)	\??\n:	duhwrzkg.exe
File opened (read-only)	\??\g:	duhwrzkg.exe
File opened (read-only)	\??\h:	ipyfjguvvc.exe
File opened (read-only)	\??\a:	ipyfjguvvc.exe
File opened (read-only)	\??\z:	duhwrzkg.exe
File opened (read-only)	\??\w:	duhwrzkg.exe
File opened (read-only)	\??\z:	duhwrzkg.exe
File opened (read-only)	\??\m:	ipyfjguvvc.exe
File opened (read-only)	\??\x:	ipyfjguvvc.exe
File opened (read-only)	\??\z:	ipyfjguvvc.exe
File opened (read-only)	\??\v:	duhwrzkg.exe
File opened (read-only)	\??\t:	duhwrzkg.exe
File opened (read-only)	\??\u:	duhwrzkg.exe
File opened (read-only)	\??\i:	ipyfjguvvc.exe
File opened (read-only)	\??\o:	ipyfjguvvc.exe
File opened (read-only)	\??\n:	duhwrzkg.exe
File opened (read-only)	\??\r:	duhwrzkg.exe
File opened (read-only)	\??\h:	duhwrzkg.exe
File opened (read-only)	\??\i:	duhwrzkg.exe
File opened (read-only)	\??\q:	duhwrzkg.exe
File opened (read-only)	\??\h:	duhwrzkg.exe
File opened (read-only)	\??\r:	ipyfjguvvc.exe
File opened (read-only)	\??\e:	duhwrzkg.exe
File opened (read-only)	\??\l:	ipyfjguvvc.exe
File opened (read-only)	\??\t:	ipyfjguvvc.exe
File opened (read-only)	\??\u:	ipyfjguvvc.exe
File opened (read-only)	\??\g:	duhwrzkg.exe
File opened (read-only)	\??\m:	duhwrzkg.exe
File opened (read-only)	\??\s:	duhwrzkg.exe
File opened (read-only)	\??\y:	duhwrzkg.exe
File opened (read-only)	\??\q:	duhwrzkg.exe
File opened (read-only)	\??\s:	duhwrzkg.exe
File opened (read-only)	\??\v:	duhwrzkg.exe
File opened (read-only)	\??\e:	duhwrzkg.exe
File opened (read-only)	\??\t:	duhwrzkg.exe
File opened (read-only)	\??\u:	duhwrzkg.exe
File opened (read-only)	\??\w:	duhwrzkg.exe
File opened (read-only)	\??\b:	duhwrzkg.exe
File opened (read-only)	\??\w:	ipyfjguvvc.exe
File opened (read-only)	\??\j:	duhwrzkg.exe
File opened (read-only)	\??\x:	duhwrzkg.exe
File opened (read-only)	\??\l:	duhwrzkg.exe
File opened (read-only)	\??\p:	ipyfjguvvc.exe
File opened (read-only)	\??\j:	ipyfjguvvc.exe
File opened (read-only)	\??\k:	ipyfjguvvc.exe
File opened (read-only)	\??\n:	ipyfjguvvc.exe
File opened (read-only)	\??\s:	ipyfjguvvc.exe
File opened (read-only)	\??\v:	ipyfjguvvc.exe
File opened (read-only)	\??\y:	ipyfjguvvc.exe
File opened (read-only)	\??\x:	duhwrzkg.exe
File opened (read-only)	\??\b:	ipyfjguvvc.exe
File opened (read-only)	\??\p:	duhwrzkg.exe
File opened (read-only)	\??\y:	duhwrzkg.exe
File opened (read-only)	\??\e:	ipyfjguvvc.exe
File opened (read-only)	\??\l:	duhwrzkg.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	ipyfjguvvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	ipyfjguvvc.exe

AutoIT Executable 18 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2108-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral1/files/0x002f000000016d2f-5.dat	autoit_exe
behavioral1/files/0x000b000000012266-17.dat	autoit_exe
behavioral1/files/0x000b000000012266-20.dat	autoit_exe
behavioral1/files/0x002f000000016d2f-22.dat	autoit_exe
behavioral1/files/0x002f000000016d2f-26.dat	autoit_exe
behavioral1/files/0x0007000000016d58-31.dat	autoit_exe
behavioral1/files/0x002f000000016d2f-32.dat	autoit_exe
behavioral1/files/0x0007000000016d58-34.dat	autoit_exe
behavioral1/files/0x0007000000016d58-28.dat	autoit_exe
behavioral1/files/0x000b000000012266-25.dat	autoit_exe
behavioral1/files/0x0007000000016d5d-39.dat	autoit_exe
behavioral1/files/0x0007000000016d5d-35.dat	autoit_exe
behavioral1/files/0x0007000000016d58-42.dat	autoit_exe
behavioral1/files/0x0007000000016d58-41.dat	autoit_exe
behavioral1/files/0x0007000000016d5d-45.dat	autoit_exe
behavioral1/files/0x000500000001962c-69.dat	autoit_exe
behavioral1/files/0x00050000000197e4-83.dat	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hnfjbcjymcjeewi.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File opened for modification	C:\Windows\SysWOW64\hnfjbcjymcjeewi.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File opened for modification	C:\Windows\SysWOW64\ynnbgbcidxfdy.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	ipyfjguvvc.exe
File created	C:\Windows\SysWOW64\ipyfjguvvc.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File created	C:\Windows\SysWOW64\duhwrzkg.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File opened for modification	C:\Windows\SysWOW64\duhwrzkg.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File created	C:\Windows\SysWOW64\ynnbgbcidxfdy.exe	21683aef181b87eb95f9bd10a7c129e9.exe
File opened for modification	C:\Windows\SysWOW64\ipyfjguvvc.exe	21683aef181b87eb95f9bd10a7c129e9.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	duhwrzkg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	duhwrzkg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	duhwrzkg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	duhwrzkg.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	duhwrzkg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	duhwrzkg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	duhwrzkg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	21683aef181b87eb95f9bd10a7c129e9.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	ipyfjguvvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33352D789D2083596A3676D777232DD87CF164DA"	21683aef181b87eb95f9bd10a7c129e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	ipyfjguvvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B02F47E6389E52CCB9A7329ED7BE"	21683aef181b87eb95f9bd10a7c129e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	ipyfjguvvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2656	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2732	hnfjbcjymcjeewi.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2732	hnfjbcjymcjeewi.exe
2952	ynnbgbcidxfdy.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2108	21683aef181b87eb95f9bd10a7c129e9.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2852	ipyfjguvvc.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2732	hnfjbcjymcjeewi.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2584	duhwrzkg.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2572	duhwrzkg.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe
2952	ynnbgbcidxfdy.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	WINWORD.EXE
2656	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2852	2108	21683aef181b87eb95f9bd10a7c129e9.exe	28
PID 2108 wrote to memory of 2852	2108	21683aef181b87eb95f9bd10a7c129e9.exe	28
PID 2108 wrote to memory of 2852	2108	21683aef181b87eb95f9bd10a7c129e9.exe	28
PID 2108 wrote to memory of 2852	2108	21683aef181b87eb95f9bd10a7c129e9.exe	28
PID 2108 wrote to memory of 2732	2108	21683aef181b87eb95f9bd10a7c129e9.exe	29
PID 2108 wrote to memory of 2732	2108	21683aef181b87eb95f9bd10a7c129e9.exe	29
PID 2108 wrote to memory of 2732	2108	21683aef181b87eb95f9bd10a7c129e9.exe	29
PID 2108 wrote to memory of 2732	2108	21683aef181b87eb95f9bd10a7c129e9.exe	29
PID 2108 wrote to memory of 2584	2108	21683aef181b87eb95f9bd10a7c129e9.exe	30
PID 2108 wrote to memory of 2584	2108	21683aef181b87eb95f9bd10a7c129e9.exe	30
PID 2108 wrote to memory of 2584	2108	21683aef181b87eb95f9bd10a7c129e9.exe	30
PID 2108 wrote to memory of 2584	2108	21683aef181b87eb95f9bd10a7c129e9.exe	30
PID 2108 wrote to memory of 2952	2108	21683aef181b87eb95f9bd10a7c129e9.exe	33
PID 2108 wrote to memory of 2952	2108	21683aef181b87eb95f9bd10a7c129e9.exe	33
PID 2108 wrote to memory of 2952	2108	21683aef181b87eb95f9bd10a7c129e9.exe	33
PID 2108 wrote to memory of 2952	2108	21683aef181b87eb95f9bd10a7c129e9.exe	33
PID 2732 wrote to memory of 2036	2732	hnfjbcjymcjeewi.exe	31
PID 2732 wrote to memory of 2036	2732	hnfjbcjymcjeewi.exe	31
PID 2732 wrote to memory of 2036	2732	hnfjbcjymcjeewi.exe	31
PID 2732 wrote to memory of 2036	2732	hnfjbcjymcjeewi.exe	31
PID 2852 wrote to memory of 2572	2852	ipyfjguvvc.exe	34
PID 2852 wrote to memory of 2572	2852	ipyfjguvvc.exe	34
PID 2852 wrote to memory of 2572	2852	ipyfjguvvc.exe	34
PID 2852 wrote to memory of 2572	2852	ipyfjguvvc.exe	34
PID 2108 wrote to memory of 2656	2108	21683aef181b87eb95f9bd10a7c129e9.exe	35
PID 2108 wrote to memory of 2656	2108	21683aef181b87eb95f9bd10a7c129e9.exe	35
PID 2108 wrote to memory of 2656	2108	21683aef181b87eb95f9bd10a7c129e9.exe	35
PID 2108 wrote to memory of 2656	2108	21683aef181b87eb95f9bd10a7c129e9.exe	35
PID 2656 wrote to memory of 1808	2656	WINWORD.EXE	38
PID 2656 wrote to memory of 1808	2656	WINWORD.EXE	38
PID 2656 wrote to memory of 1808	2656	WINWORD.EXE	38
PID 2656 wrote to memory of 1808	2656	WINWORD.EXE	38

C:\Users\Admin\AppData\Local\Temp\21683aef181b87eb95f9bd10a7c129e9.exe
"C:\Users\Admin\AppData\Local\Temp\21683aef181b87eb95f9bd10a7c129e9.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\ipyfjguvvc.exe
  ipyfjguvvc.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\duhwrzkg.exe
    C:\Windows\system32\duhwrzkg.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2572
- C:\Windows\SysWOW64\hnfjbcjymcjeewi.exe
  hnfjbcjymcjeewi.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ynnbgbcidxfdy.exe
    3⤵
    PID:2036
- C:\Windows\SysWOW64\duhwrzkg.exe
  duhwrzkg.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2584
- C:\Windows\SysWOW64\ynnbgbcidxfdy.exe
  ynnbgbcidxfdy.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2952
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
512KB

MD5
a7e32def91a6b91139ac8a58fe920bac

SHA1
f42210d17c17ef13c03df7a2aad2735a0813ab8a

SHA256
629a935ab044098f107b317c5dd540bd1115d3cac64d18ad35b50ef1614b83d3

SHA512
069f536b0ec7e082e0505f84d79934fcd5aab63e5f70e4f02a94ec69145c8936eac7e12c87a7777864dd1ee3e0bfa01578cb0c3858dead0eae85d758bb135c80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
bba2b2ba99c84816c21e7e0da0d4ae81

SHA1
36e0d29b81ca468d06835288a6999965dee66c46

SHA256
711adab2e4c2e3a51bf739a068293785e932068718d490d5320f53c299caf2d1

SHA512
eb8c7d51ffff88e842cc66c6b659b0f790fbc8b6ab86dfa46f28d0160c716faa76047eaef49c076f5ea00b96468ae4b16a5c4d418bb3d75d42d7c27ca435a9ba

Download Submit
C:\Users\Admin\Downloads\LimitAssert.doc.exe

Filesize
512KB

MD5
35cb53840bdd94ad1958c3c1e9d00177

SHA1
e1a6e227e4e247d2a604508a32cd3397cb3501a4

SHA256
c21f0180dce055366723cb277789455f9ef4efd7d08827cd3bc4ec6a095f4414

SHA512
bba4cfe3b19ff5d55400216b02ecb69a4e3f5ab872d09e1f7f9ce257fae14522a205fe0f5c3a77db0acc441ee821d51cfab0d0763e29b5dba0daa9c069cc5af1

Download Submit
C:\Windows\SysWOW64\duhwrzkg.exe

Filesize
302KB

MD5
8a0b4f997b90b6f1ee675c6825074958

SHA1
099d906aab1e6e01b242f0ddcc4af2ea3254277e

SHA256
c9a74d7f78d5e7016da526407021c5c9dfc8853269bf42d388c52432be12c01d

SHA512
b5de29dc9401df2913e167d935b2632e689fd050d020ff873b607986a5f2c991435f10ddd8c2eca4c5c2684a6f2e819f0ae82e2a358636c62c87ce98c6f4b76d

Download Submit
C:\Windows\SysWOW64\duhwrzkg.exe

Filesize
387KB

MD5
3e5aa6b390c912452008d5077c95523e

SHA1
e0485a6014f22652aefcb738a313693d2a6a7d34

SHA256
deb989858935fee23b0642d8efc74a4c33e17d2298353a6f5ac71b8fbbdd2bd1

SHA512
a374ae0d79553605aedf609eb10e87674628dd3edefe0bb52a1cc10c104c1e4812410ecb5989a34aca4eda8a249f008b02cbc710a9d45993c6b62c6685e3a684

Download Submit
C:\Windows\SysWOW64\duhwrzkg.exe

Filesize
173KB

MD5
0bb4c4a32bdd05c9a881de15eec1c9be

SHA1
c1422161a96da8bfa3480b462c89a1b9e338a69e

SHA256
28e7c49395f61051de2513b7451eb44f94db74b325de848aa77dbed1a4883d0d

SHA512
4cf336bdbc1458afa0a0446d4b8e0fad46187fd838cb1403acaf5f2770e28c4c7a55426675664445b2673862168fb19cd1236d33cdbe6599d0a7f22462192ccc

Download Submit
C:\Windows\SysWOW64\hnfjbcjymcjeewi.exe

Filesize
403KB

MD5
b4b3f2f201d13f83f34b7fbb27b1e899

SHA1
181da33dc262cb8732122e5c3f2e589ee814e048

SHA256
20d46314c9b23200b2fc098d56bf4b567cf4a15f4c832f4a8ab7b09ec523c134

SHA512
2e525cce92a6ba89a29057f60446bae9c44b68a2ae38f4e94362c645af9203fef261f89a97aea087da048a438ae165f88e717cd3d44cfe49a6960ae9793956fa

Download Submit
C:\Windows\SysWOW64\hnfjbcjymcjeewi.exe

Filesize
292KB

MD5
5cc477822518cc70883533c739e78cc2

SHA1
ea0979c2e0c8fbea3d8a97ed9cf7b3a14bd55d11

SHA256
ec15b4e34ed252b66ef24914b1da4568e0d7c1ba3299d4d96abc48525e7cc7c8

SHA512
29ea90d842c62a4b6237a501c56b4662a87caaf976bdc9d6f52267af4d15c79faf3fe76640b0ef925021237d2aa9b82a529324a4c998f21e9bd91a417e526ad9

Download Submit
C:\Windows\SysWOW64\hnfjbcjymcjeewi.exe

Filesize
288KB

MD5
8343c5f665a60efdf222d45258ba136f

SHA1
d6c94fe91a8987b510b11fdf85153ed0d2611db4

SHA256
6b2aff2ed21ae54311ef3d4758da4c25d2530276e9a293d571fb81d08ea508f3

SHA512
9e1757be5c3545ec9455b087066e41a2f896952eaaeb79f4fc36633a9c9e1234cc90375c9894490c57be453e8f1167b972ed4d3f1b5e0a8b7a34582543e88376

Download Submit
C:\Windows\SysWOW64\ipyfjguvvc.exe

Filesize
302KB

MD5
cb4c4ca1bc2881f6f865a965bfa3059e

SHA1
170d4a43e70516ed176c66e11333ba9556685a15

SHA256
de856dd7530ac967d68ce3587a5430908d503212e0361f7964ee98412aaf117d

SHA512
feb3fa9cb76b13cc79531c2c16bd7917bae927eed19a303394810673262e54b85b6a5231b62bbbf963779b4b5f9d2f0df08d950b8d1b632aece3d872889cf63d

Download Submit
C:\Windows\SysWOW64\ipyfjguvvc.exe

Filesize
287KB

MD5
3cfbf4fb56d2cd36749433fe2c83b69c

SHA1
9ca3eebd589b5327167eccdb6387ae09b409e532

SHA256
12d0206ac6e36a177adffdbb8ef0eb3e2ccc4bbc48c079229f36acd5c6a1ff41

SHA512
1242dd2a9ba2ad965b4f4abfa7d3dfe270d6888788d7dc6fc380a84b5b20421a50f26d6b679a8215c787528264fc7a430712e3084c39fa56b58d8e5b4ef74866

Download Submit
C:\Windows\SysWOW64\ynnbgbcidxfdy.exe

Filesize
227KB

MD5
f9f4de7f46b63d0b639b21fd6a987d93

SHA1
300a7ee30a65f5af9e59ce518587287b19088594

SHA256
1167bd6a246bc34781adf7e9cdaef85df4ccb7f743874cf39a46c5057e412560

SHA512
11e4ae55897bb94fc0006203587ffd79bb2cc1a1d207eef85d6938a72b5c233eff400cb845ec4ecc8305efbfb68e5d6fde7ffcaa29fe998bb43d0446f14215ee

Download Submit
C:\Windows\SysWOW64\ynnbgbcidxfdy.exe

Filesize
82KB

MD5
55b6798327346bca45a341e1da9f71d9

SHA1
9b568dccefa44d6068d4760de36fbfbc111d4429

SHA256
7b846f6dc460f6543637026005c37d4ad5f728e94447ef472d6304bb7b1ced90

SHA512
dfb97f89bdf09f557a1b1011ce4ddf9f49ac82152f3290e0f69ce4f6a15ef864d00c82eb0690cf60232dc1d2097372cb3e6aced7b31eb4e95fba7afdd0c362aa

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\duhwrzkg.exe

Filesize
297KB

MD5
cfa7060ce00af2f61d07e6af3d9cae0f

SHA1
feb18f7a9fa8c5e76e3a18b9c5c00f1cb5a74120

SHA256
ff8c017de19c4d9d40fe46bc600e9ebe6366d46ab80e3a95bcdde0dbf3a07802

SHA512
32613bf51ed2215eafe528bc697f97b55cc21dbf9a8bf6c048133349f6b243da1900e37a87fa24afdba1c582d555a351557423ed42c0347c07b056e0c4223b10

Download Submit
\Windows\SysWOW64\duhwrzkg.exe

Filesize
114KB

MD5
ae74ba6cb0a3f4fa2edcd2590efd6107

SHA1
ae27beddc82e6f7906790efedf2267d420de01af

SHA256
cb37c7aad746470de3f362f27770615b4df63f7f4114509fb08e18811bd6d3af

SHA512
6c8f7c6db4fc52a4b9f352681ea094444961c62f074335cfe387bae518a09c74863b0b3c71386cab05f79ecb897ebb1f74775f463e0645a81ef87ba1a7a4751f

Download Submit
\Windows\SysWOW64\hnfjbcjymcjeewi.exe

Filesize
343KB

MD5
633781d15d03c566602be598cf79da32

SHA1
b6db66af8f222791a27a7f607904d60b30452c68

SHA256
875eddde307abff699e54f5108f568843c30bac9b3713f0fdc1418d4c0e83e29

SHA512
7908e6666b277a7d2cb6786f40626eb9afc2c923e66bf1a831b5ea71861b9e92ab2b366a1ca6a048e6c5c94ded8d0e6b8ae9cf38973f822c978cbdfbd09631d2

Download Submit
\Windows\SysWOW64\ipyfjguvvc.exe

Filesize
324KB

MD5
3f46cdb44ce4e7b7f9c7d5cb6005d34d

SHA1
653280896631245cfe9537ce9a8ca9b0db10a880

SHA256
bde461b4c97c2dd9f2fd62f611a5ae29196118801bffd0489b1d413525ed095d

SHA512
9248964d8841a0a8ba9ebd19db42ab85448ad68f7307f54559692a83770f4f1db90cb9d045f05e74e04fbff6280429446ddedb09d6c55e28b9d1db60e8e49803

Download Submit
\Windows\SysWOW64\ynnbgbcidxfdy.exe

Filesize
262KB

MD5
a0f3337f55e7976e451213a18b44c597

SHA1
44357c8434b8793bf1cda0c657c155ad15870734

SHA256
a7145c31feb0ce16a0f6612a2cb788da1d7b3764c588f753c87d931b74962027

SHA512
5640aa0707c9fddc36729cdb9a12c1b67c81d9ac2ad52d07eabdd590ef51cd6025d9cf16c8806e3d09dae6da618acf9296c6da31f5ecacdfacd9fba18a32e38d

Download Submit
memory/2108-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2656-47-0x000000007130D000-0x0000000071318000-memory.dmp

Filesize
44KB

Download
memory/2656-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2656-44-0x000000002F931000-0x000000002F932000-memory.dmp

Filesize
4KB

Download
memory/2656-90-0x000000007130D000-0x0000000071318000-memory.dmp

Filesize
44KB

Download
memory/2656-111-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download