Malware Analysis Report

2025-08-10 22:52

Sample ID 240107-x2jpcsccfr
Target ab6b87a8ef210e5c047f565cd76a0a1f.exe
SHA256 1474f25f1f927dcea56a12f600530547de3fa6a226474b3459425ec4145bb226
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1474f25f1f927dcea56a12f600530547de3fa6a226474b3459425ec4145bb226

Threat Level: Known bad

The file ab6b87a8ef210e5c047f565cd76a0a1f.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Modifies Installed Components in the registry

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Modifies WinLogon

Enumerates connected drives

Adds Run key to start application

AutoIT Executable

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 19:20

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 19:20

Reported

2024-01-07 19:23

Platform

win7-20231215-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jhhyblmp = "zzpxpuafcp.exe" C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dvbscfqa = "nzpuyraiesbvscj.exe" C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "apdlrggrqwckd.exe" C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\v: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\zzpxpuafcp.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\nzpuyraiesbvscj.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\apdlrggrqwckd.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\apdlrggrqwckd.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
File opened for modification C:\Windows\SysWOW64\zzpxpuafcp.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\nzpuyraiesbvscj.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\jvltsuyd.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\jvltsuyd.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\jvltsuyd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C70C15E0DBC3B8BE7CE2EC9F34C8" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBF9BEFE14F2E584793A43869A3998B08A038C4311023FE2CD429C08A0" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7806BC4FE6C22D1D272D0A28A74906A" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\zzpxpuafcp.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\apdlrggrqwckd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\SysWOW64\jvltsuyd.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\zzpxpuafcp.exe
PID 3016 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\zzpxpuafcp.exe
PID 3016 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\zzpxpuafcp.exe
PID 3016 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\zzpxpuafcp.exe
PID 3016 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\nzpuyraiesbvscj.exe
PID 3016 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\nzpuyraiesbvscj.exe
PID 3016 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\nzpuyraiesbvscj.exe
PID 3016 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\nzpuyraiesbvscj.exe
PID 3016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 3016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 3016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 3016 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 2708 wrote to memory of 2604 N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2604 N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2604 N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2604 N/A C:\Windows\SysWOW64\nzpuyraiesbvscj.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\apdlrggrqwckd.exe
PID 3016 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\apdlrggrqwckd.exe
PID 3016 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\apdlrggrqwckd.exe
PID 3016 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\apdlrggrqwckd.exe
PID 2828 wrote to memory of 2596 N/A C:\Windows\SysWOW64\zzpxpuafcp.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 2828 wrote to memory of 2596 N/A C:\Windows\SysWOW64\zzpxpuafcp.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 2828 wrote to memory of 2596 N/A C:\Windows\SysWOW64\zzpxpuafcp.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 2828 wrote to memory of 2596 N/A C:\Windows\SysWOW64\zzpxpuafcp.exe C:\Windows\SysWOW64\jvltsuyd.exe
PID 3016 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 3016 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 3016 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 3016 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2388 wrote to memory of 2928 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2388 wrote to memory of 2928 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2388 wrote to memory of 2928 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2388 wrote to memory of 2928 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe

"C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe"

C:\Windows\SysWOW64\apdlrggrqwckd.exe

apdlrggrqwckd.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\SysWOW64\jvltsuyd.exe

C:\Windows\system32\jvltsuyd.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c apdlrggrqwckd.exe

C:\Windows\SysWOW64\jvltsuyd.exe

jvltsuyd.exe

C:\Windows\SysWOW64\nzpuyraiesbvscj.exe

nzpuyraiesbvscj.exe

C:\Windows\SysWOW64\zzpxpuafcp.exe

zzpxpuafcp.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

Network

N/A

Files

memory/3016-0-0x0000000000400000-0x0000000000496000-memory.dmp

\Windows\SysWOW64\zzpxpuafcp.exe

MD5 0e6183c8138efaaf0d56f4a1aead56c0
SHA1 1d5899fab32e0b572b00280f0be352836b49a890
SHA256 3e512f8c572e2047d90455c10f1723208ab0012f7a107eda4813bc2d167e2eeb
SHA512 d8781af9f5366b9ac625ca59830c5bbcfb00e1c20835b06c28dbd3da5d9b700bce47c3e4bf9d39e8d0bf9d395a3c69055487fa84dc75cd1bee695dac0373d9ae

\Windows\SysWOW64\nzpuyraiesbvscj.exe

MD5 b034eb39fa2e13db766f27eb7d6dad8d
SHA1 9a95ed9bec3bfad89d8191d59a29efbf0403696a
SHA256 cddf8a49033718d91ae300e3ad8cffc145214b67cb3d13873806737e6df9030f
SHA512 b0654979485335772ad89a3e86ca9c0cf48387322de1a5447d8cb2545860b142f96e45bd8cb14b3d3f66d59d987250bc07212c7eb9a7dde4d4120d0ad87ef317

\Windows\SysWOW64\apdlrggrqwckd.exe

MD5 4f48933a4f80218441168a3b616d6a32
SHA1 545cd2768a3d4cd109b7fe7a5640d8290c261962
SHA256 fca12dbc8cceadbb3618da213bc11a01962fb703dfb24f997f9875ca95d6666b
SHA512 8f6fdc96e5c993f5b425cb5df06bb614109b5a9255620c794e794feb5d653554cb98dc1b52dff3b5bbbbdb6ed7fc06adcf91e89071789a8e24caf6104fd5b501

C:\Windows\SysWOW64\nzpuyraiesbvscj.exe

MD5 6e42e2765ed3840a79e984c6c1b92445
SHA1 9ce1ae3ef0ccfa798e440c51c8e52704ed7333b6
SHA256 3263f5b73396cbe768f0602a961dea4bbeb477d6fcedf31ae8da1d3475ae1ad3
SHA512 d79d92d28058fdde7c34109359f46fa78b6e31f0a016f72f67fcfea21622cacc48ea4dd98b2e30f793e86594b785091126b7de77862705ba1576d6ff0b04c93e

C:\Windows\SysWOW64\jvltsuyd.exe

MD5 9a43be07b744a39f6fd32b78ce8cb23e
SHA1 4dd2ced60c46f0394ae8751e68fdb5f0bd94b4b3
SHA256 f7b32d21fd3069d66dd51543224aca4ed176c7e24989ca4caa61d9effe3cc2b7
SHA512 e46acc7c6d23766501e0e79751981a2da2ace37d82851f2f6f941fbbc4ad2ac7490037c48cd0f3a96225dc63039511eb26f2c2a2b415f2d3947ca8ae29351265

C:\Windows\SysWOW64\apdlrggrqwckd.exe

MD5 b39657a2ccf130086f58eeb184f2f073
SHA1 67db059b9e5ed1c1b754b9332f114b8cd36d7f26
SHA256 c5ca81c8eba594e625affcf25709b16f78628e606931f3f1d11275cd3f36b627
SHA512 97d3fad06f8620bd90c07bf516afc51d0f40d8fe8cd47c41d7d57ecc33084969fd22592b4cbccb359ea8e66320aa2165a926be7079da6024653eb246a3c57a0c

C:\Windows\SysWOW64\jvltsuyd.exe

MD5 f3a0150b0b0e4c49ca0b0868a89a0410
SHA1 527f30d7bb83f62659c5ee6f4589003d3ddb2221
SHA256 415b93f11f2869a0092ff6610a0913bf875049ccc519f293198e30739cc5face
SHA512 81e72b0b3eaedb72d7945ac8205060ffd6a065369c409f92df807f7237bfe064dea489aea00cb0dfd6109fe4826f535ada7f8fa01988d797a04384cdde8878d0

memory/2388-45-0x000000002FDA1000-0x000000002FDA2000-memory.dmp

\Windows\SysWOW64\jvltsuyd.exe

MD5 27623bf17711551baa843bbab18a4b07
SHA1 2d6d50bab42c5defdd9bdf3f14fb826853558392
SHA256 6a2c1908feaaa4585f579f19881c7fec6c64bfe38500306f55eaeb5fa0a7b368
SHA512 53f01abdb0a6c91cedd6e7bb705ad27f9dfc89722bd6bb07ad9df87ff00ca5c9fc6764706ab6edc018fd90f519cf4d12af670416b3fff7cee5e6aca87e9f153b

C:\Windows\SysWOW64\apdlrggrqwckd.exe

MD5 a07b8a6a02acfaa14cb1c447196d78ea
SHA1 33856afd7a1de92a0d49b2a697ee84b56c58d7bb
SHA256 22bdad5af5d56021fbcb6704d154077a027ac86a5954b7b37aad905799d17949
SHA512 207c50691db178673bc12e4e44e62c4ad498279276c04f3bb5c0ddeb34a22407588ce9d6a20d4ea6e9d8ecbd1c830d7f0bbda56d6b8c47fcd814c8439c8b9271

memory/2388-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2388-47-0x0000000070A9D000-0x0000000070AA8000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Windows\SysWOW64\jvltsuyd.exe

MD5 876ba27d8b3800a4f69324dea397c877
SHA1 8c47ad648fb3264bba8430d5cdffe1705259f7a8
SHA256 fd24f824a6fe8c40269e2cad859ccc958e604712c822cfd54e9f7337ecf85172
SHA512 72d274a4dd4ba2f8828a191b8b46b6e1bfcd0bab54e18543e69f17403dc771c4e6f9e98d3c250fff8d93c4d433a0657060d0e791d6e0c89a2149c9159c9cfd20

C:\Windows\SysWOW64\nzpuyraiesbvscj.exe

MD5 59b27545f6774df170f6e029fbea9c1d
SHA1 69f177a30d45be612d3d2ae7d09a6e9c4d44db1f
SHA256 2079811ff3b903d8e4231cbe6100f81601813738ea49b22ce781101007400770
SHA512 272fa9ff843bbb87f9742c756951a9c4f09746a78a915bb6a648b5c1e21c79a0432301d1f156cc1e26bee8de2bf27f6e2fd2d10668e6cf57bbdcf954f2453b89

C:\Windows\SysWOW64\zzpxpuafcp.exe

MD5 e67ace7436ff24488c9f04ae953eac74
SHA1 f68fd80e760e45b3ebb593db09e87a0096f4b340
SHA256 a6a76b0a7689a47e8be675e05ca2307eccac3c451beba8f7a2ec75138b2627cf
SHA512 0e3f661d3cd95abff1cec613c0b8b5bf70613a0fa678039b9a0ef6f0f83fc6b20b49feca771fb350a958fe7558cfc540e0cdd56d1efe9d72448fa5c3bc55faf9

\Windows\SysWOW64\jvltsuyd.exe

MD5 17ae4b1db52054219a7e49f0ce1f32d7
SHA1 5c60a6650a6c358bd4f04ffa0dd590a49aec01cb
SHA256 6c7cfcce878333ad1fc97ca5ebfa24dbbdbcb6a16f7a113116b1b7e9c8a598a0
SHA512 ac5923aa3480292543bcaa85b9ce01461402f833e3c8290febc492bb225862ca3b76903a540ae8737f66456276bdaf80b9a1175913c8139c9b64db2840e0b46a

C:\Windows\SysWOW64\zzpxpuafcp.exe

MD5 798e4b5770f7973cfa95c8f2cacc869c
SHA1 2dcb002bf23a5be39ffd6a3cf9013c7958b9add7
SHA256 f98ef4d5c3fa996fa199ef20542a81a6ae3a76e58d2d6d27ebb1e40b273da38c
SHA512 cadf010d2aa79eb4b66c8f1344bce9b3953297ef48e92e09e66009d03fc293dbdd1c7810e384ce6e0b749c22c44ac1a338af61c56fa089d9062fe2b86d70e311

C:\Windows\SysWOW64\nzpuyraiesbvscj.exe

MD5 a68136f45c4323f9dc17f6607de98e51
SHA1 612eeb3d0f808d28c060a65b81032c9a7a75cd9a
SHA256 5ccdeee55769ca75dc0c8eb81b38db4279f40f1ba2c5377938520b2dce24dce7
SHA512 016ec9bac4b4ae869e1d40c4b1e06ed04222c93578fbf57567a2b2ec5a178a19a1557dd683ec0ff7feb4193917eefa7166fab2f966012fff0d1a67aa8f369dd5

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 b5addadae5c1a41dc5359783d76dccb4
SHA1 867fe3224b46cbb2f50c96d393ca17d50b043e00
SHA256 70330982608413acd92a9a87b764907e7df03dc6b245fc44b64eaa912ded4c64
SHA512 a1171fc317331330a31186e0919fc1c71ab260bf813b98b5f85433785ebfa9df8afe09dc54fb5715aac921ff9a0c3eec101677fae77875223d649aefce7fc34f

memory/1376-76-0x0000000004360000-0x0000000004361000-memory.dmp

memory/1000-77-0x0000000004220000-0x0000000004221000-memory.dmp

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2388-79-0x0000000070A9D000-0x0000000070AA8000-memory.dmp

memory/996-80-0x0000000004280000-0x0000000004281000-memory.dmp

memory/996-82-0x0000000004280000-0x0000000004281000-memory.dmp

memory/996-87-0x0000000003C20000-0x0000000003C30000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 19:20

Reported

2024-01-07 19:23

Platform

win10v2004-20231215-en

Max time kernel

139s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gcjabdoo = "dtwdosdnwumspcd.exe" C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "pdqdblefhnggz.exe" C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gmiqgaqu = "bqqqdbgszb.exe" C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\q: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\bqqqdbgszb.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\dtwdosdnwumspcd.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\pdqdblefhnggz.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\luyvtbfq.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\pdqdblefhnggz.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Windows\SysWOW64\dtwdosdnwumspcd.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created C:\Windows\SysWOW64\bqqqdbgszb.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\luyvtbfq.exe C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\luyvtbfq.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8EFF834F58856E9141D72B7D90BD92E143593267406342D69E" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412D799D5782276A4176D270212DDD7C8464DB" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB8FE6D22D9D20ED0D68B789016" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9B0FE6AF1E2837F3A42869F39E6B38803F14365023AE2CE429C08D5" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC60B1591DAC5B8BD7CE0ED9134C6" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B02F44E7389D52CABAD03293D4BC" C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\bqqqdbgszb.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\pdqdblefhnggz.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\bqqqdbgszb.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\dtwdosdnwumspcd.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A
N/A N/A C:\Windows\SysWOW64\luyvtbfq.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3828 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\bqqqdbgszb.exe
PID 3828 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\bqqqdbgszb.exe
PID 3828 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\bqqqdbgszb.exe
PID 3828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\dtwdosdnwumspcd.exe
PID 3828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\dtwdosdnwumspcd.exe
PID 3828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\dtwdosdnwumspcd.exe
PID 3828 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\luyvtbfq.exe
PID 3828 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\luyvtbfq.exe
PID 3828 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\luyvtbfq.exe
PID 3828 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\pdqdblefhnggz.exe
PID 3828 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\pdqdblefhnggz.exe
PID 3828 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Windows\SysWOW64\pdqdblefhnggz.exe
PID 3828 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 3828 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4336 wrote to memory of 3248 N/A C:\Windows\SysWOW64\bqqqdbgszb.exe C:\Windows\SysWOW64\luyvtbfq.exe
PID 4336 wrote to memory of 3248 N/A C:\Windows\SysWOW64\bqqqdbgszb.exe C:\Windows\SysWOW64\luyvtbfq.exe
PID 4336 wrote to memory of 3248 N/A C:\Windows\SysWOW64\bqqqdbgszb.exe C:\Windows\SysWOW64\luyvtbfq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe

"C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe"

C:\Windows\SysWOW64\bqqqdbgszb.exe

bqqqdbgszb.exe

C:\Windows\SysWOW64\dtwdosdnwumspcd.exe

dtwdosdnwumspcd.exe

C:\Windows\SysWOW64\pdqdblefhnggz.exe

pdqdblefhnggz.exe

C:\Windows\SysWOW64\luyvtbfq.exe

luyvtbfq.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\luyvtbfq.exe

C:\Windows\system32\luyvtbfq.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 85.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 66.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 48.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp

Files

memory/3828-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\luyvtbfq.exe

MD5 36cabac8345833fed9bb7944e6ff00fa
SHA1 095f58f00addb206ab2b4677a6049f36e97f41d4
SHA256 be1e525d3dc765f89d0a9ef33457ac54e28fb415d0bcde4fdd8167e995774a01
SHA512 fca8d2f5aee1064e97c5ae34e6384bee92cca2dfde5d6c5bc3e526eb5aef4b50f136446ca90a6a74c2fba5fc0baac4b520827c7b6789871bfd57f1b283c4a371

C:\Windows\SysWOW64\bqqqdbgszb.exe

MD5 5421cb1cbba708b4ea0c07a64e19ffed
SHA1 9667419b526c83905b2456a5cc3b17cb320ba48c
SHA256 d3ff18b4c4808393aaed293e30733cb03eab694e34439d82e77b5cc9e9c16cad
SHA512 f89a18405de14bb7d0da267798935e952f29d6161e007c7f298976e9099ab72217eeca283032818d8cf764efe4bc1c9e86c722b1c192e5050fff5e1f8e1d075d

C:\Windows\SysWOW64\pdqdblefhnggz.exe

MD5 06da1727b90a5c016f16a3548a016c63
SHA1 a497c1fbcf0f71785a9be2cfc89e647e570d5cdf
SHA256 9f63f7848636a989c149712e0e4b15ae1190508edb89c50425391d774e16953c
SHA512 32c35e2c44c6b12e713b7de72465a4f18506d8c7b13a487cfab3a0990eae355df17c0e8990ca842cd156f7a31b850aaf1c401b2a2c97ad8db0ee677ab6b709bc

C:\Windows\SysWOW64\dtwdosdnwumspcd.exe

MD5 6d368801e62ecca9f0ff6d5a5e9fdaca
SHA1 515ce20e43d63b12cb444e362364b2476f7d7ee9
SHA256 b6a5f6bc7cf97c58014477074e19c840834510e99ee90e6bfba0036c4bafcd6d
SHA512 6cfbde5142b16130d79a021ab028dd9f023e772c68b876fb3771932c6bc8baf6e0bbdd8a9b4fa6c72fa777126a70dfdca3cae2864d6e107a4f45c0a38934722b

C:\Windows\SysWOW64\bqqqdbgszb.exe

MD5 90adb29ed44b7a78fb717cbebe59c447
SHA1 4da5d9617555a7956b328e29a6ad52619ee66db5
SHA256 5dadf9f84aa031a75afc962530ac3f15ad6144f2cfeed16a9f12ea242dce7510
SHA512 67c8f31bcb531b8766f39cf6e540095b0b8a2aa00c7c99735b6cf1742864a61216a06b565c6e216d4ffdaa95d71a58234bfca18eb50b0473af3e20d1e1bcdf15

memory/4528-38-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-39-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

C:\Windows\SysWOW64\luyvtbfq.exe

MD5 7fc6cf931da79ecd4267f22c6a1aefa8
SHA1 913682b9a75a4089cc18ec25b28e082916a6b314
SHA256 2672445b36639d26c7bcf277704d7f634ea7a6f4eac634027b98fb3f94062487
SHA512 272947751145ba29cbfecc6fe73cf5e20cf017c8c436a8af45198499e8b34c5f70215c3d5f21676a2a5de87616e85aa12b5cf0e263d57042e4221f7e12d81eaf

memory/4528-45-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-49-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-52-0x00007FFAAA0E0000-0x00007FFAAA0F0000-memory.dmp

memory/4528-54-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-56-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-58-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-59-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-57-0x00007FFAAA0E0000-0x00007FFAAA0F0000-memory.dmp

memory/4528-55-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-53-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-51-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-50-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-48-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-47-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-46-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-44-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-43-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-42-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-41-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-40-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-35-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-118-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-119-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-120-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-147-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-146-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

memory/4528-145-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-144-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-143-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

memory/4528-142-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp