Malware Analysis Report

2025-08-10 22:52

Sample ID 240107-x2kxesccgj
Target ab0757415e5a33fde6893ba93d5683ff.exe
SHA256 677fc2b026079044c61098fc32986c2624095fc78d0f478e74e588a559bba8a0
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

677fc2b026079044c61098fc32986c2624095fc78d0f478e74e588a559bba8a0

Threat Level: Known bad

The file ab0757415e5a33fde6893ba93d5683ff.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Windows security bypass

Disables RegEdit via registry modification

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Windows security modification

Enumerates connected drives

Adds Run key to start application

Modifies WinLogon

AutoIT Executable

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 19:20

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 19:20

Reported

2024-01-07 19:23

Platform

win7-20231215-en

Max time kernel

151s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\nrnahlpexs.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\nrnahlpexs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lfmuxtfn = "nrnahlpexs.exe" C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\abkzyrpj = "xgeddcddpsqcpfs.exe" C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "klncvszjgclwb.exe" C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\l: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\nrnahlpexs.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\nrnahlpexs.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File created C:\Windows\SysWOW64\tddulpyx.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\tddulpyx.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\klncvszjgclwb.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File created C:\Windows\SysWOW64\nrnahlpexs.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\nrnahlpexs.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\nrnahlpexs.exe N/A
File created C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File created C:\Windows\SysWOW64\klncvszjgclwb.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\tddulpyx.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\tddulpyx.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\tddulpyx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tddulpyx.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFF8B482E85129045D65D7EE6BDE7E135594467346242D7ED" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\nrnahlpexs.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342D7A9C2783276A3476DC77262CDB7C8665DA" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Windows\SysWOW64\nrnahlpexs.exe N/A
N/A N/A C:\Windows\SysWOW64\nrnahlpexs.exe N/A
N/A N/A C:\Windows\SysWOW64\nrnahlpexs.exe N/A
N/A N/A C:\Windows\SysWOW64\nrnahlpexs.exe N/A
N/A N/A C:\Windows\SysWOW64\nrnahlpexs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\tddulpyx.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\klncvszjgclwb.exe N/A
N/A N/A C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1308 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\nrnahlpexs.exe
PID 1308 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\nrnahlpexs.exe
PID 1308 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\nrnahlpexs.exe
PID 1308 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\nrnahlpexs.exe
PID 1308 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe
PID 1308 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe
PID 1308 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe
PID 1308 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe
PID 1308 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 1308 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 1308 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 1308 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 1308 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\klncvszjgclwb.exe
PID 1308 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\klncvszjgclwb.exe
PID 1308 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\klncvszjgclwb.exe
PID 1308 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\klncvszjgclwb.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\nrnahlpexs.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\nrnahlpexs.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\nrnahlpexs.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\nrnahlpexs.exe C:\Windows\SysWOW64\tddulpyx.exe
PID 1308 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1308 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1308 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1308 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2540 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2540 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2540 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2540 wrote to memory of 1948 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe

"C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe"

C:\Windows\SysWOW64\nrnahlpexs.exe

nrnahlpexs.exe

C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe

xgeddcddpsqcpfs.exe

C:\Windows\SysWOW64\tddulpyx.exe

C:\Windows\system32\tddulpyx.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\SysWOW64\klncvszjgclwb.exe

klncvszjgclwb.exe

C:\Windows\SysWOW64\tddulpyx.exe

tddulpyx.exe

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/1308-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe

MD5 408dfd55c92f6bcff5726eb159a5d864
SHA1 faad33f4d3eee41523ee331dfdaab2a0b528238d
SHA256 b51d47b62f5da9d0d9b11b2ae8d1488274ce19f2027c9fe675fa31b001ee1856
SHA512 224ad987157e3804025fe32f6791d0dc0feaf5ac17142f969e6b03b7d98b972df0250333bd8d724cb6cbd39545d4abdd5c59457766efe5491d13ddcf13bb0bf6

\Windows\SysWOW64\nrnahlpexs.exe

MD5 e37e88958b9a6bd01c13e2d82773ca14
SHA1 b03ae165d97f002b565d207a8f57905548781bd3
SHA256 d829f701c034149f22fd4e43d80a4a7267ca63b9b5a57c7c34f87f7841d3761c
SHA512 a52e720bce8a636900edd1ced181f76ebc6a0b70f0a28f82b0c8c2e9220989281994b512e0bdadff1a4e9c2689602d2c563a9340cb6f048de2296e86e23aab37

\Windows\SysWOW64\xgeddcddpsqcpfs.exe

MD5 0e151ec3919b72f9a6c7fe60d10f4ea0
SHA1 91fb01badc6db9808233ff95abf39c37982a8c85
SHA256 f644299fe8f10c5f3e24c1943fc808270b5d4f853e2316abf091c8d18344193c
SHA512 41d25f82ce04a14c21d19a9ad2d12663714221b6ecb1c3ee579a4a134949de0bfb3e6212e9acf97d0659d50e7a034dcdc103ecbedd8a71fbfefdc30f5728c12b

C:\Windows\SysWOW64\xgeddcddpsqcpfs.exe

MD5 27623bf17711551baa843bbab18a4b07
SHA1 2d6d50bab42c5defdd9bdf3f14fb826853558392
SHA256 6a2c1908feaaa4585f579f19881c7fec6c64bfe38500306f55eaeb5fa0a7b368
SHA512 53f01abdb0a6c91cedd6e7bb705ad27f9dfc89722bd6bb07ad9df87ff00ca5c9fc6764706ab6edc018fd90f519cf4d12af670416b3fff7cee5e6aca87e9f153b

C:\Windows\SysWOW64\klncvszjgclwb.exe

MD5 bdc83ea97433795a5c26b1d826ac8323
SHA1 75aefbc23df2df09a1b60d58e85abb4c5326619f
SHA256 b15923256b7e7a49cff71b64858b0a02ba69f7f352f275eee801a36353913dbd
SHA512 ef7c67e85a9861b1dbb863e82e6f89b6012e26cb67b392bff6fc02c7b0ecfa80ae1840f94ba30c4cc3d32ad7d5ef5c3e62dcd014e43d3c957799e8f72d5a249f

\Windows\SysWOW64\klncvszjgclwb.exe

MD5 badd716c7c48a8241873d9251da496d1
SHA1 6bd2a072c8f64a1780fe75d983cb7b6584985c6d
SHA256 ad4373bfa026f66380b8ce44d6bc300d146770114fb10087019af7c616dc11d7
SHA512 7bf3f09216e2ba376053e668963797cd78f91119467917a84f467dd3110d6bd26592784cdf7cefd293413ff5b6dbe10a996d89627177235d9f109732c05f36c5

C:\Windows\SysWOW64\tddulpyx.exe

MD5 33ee1a8a64e645d4f6851dc714022c15
SHA1 ba4eb8765bbe95e8699077340904fcedc382ccea
SHA256 60d0cf8ef77e3c55dde0f067d6782fe549ee95bb5548f864093f5e142c84762b
SHA512 94c8ab332fad1c7d1b6df385159a6f657f66742a034d82b158a887a0a4872514b016d6e4baaf04e5889bfbcfd226f2559aabf02d34c751780dd6956710c2345f

\Windows\SysWOW64\tddulpyx.exe

MD5 de83bfac85a2c62d0cb12eb47652d5dc
SHA1 1990b0d527e8ea6e7503d0084dced33b9ffce8a6
SHA256 5d14fa9e8658105bdf0715b3de050ea871e8b3aceb585810c35435c966aed51c
SHA512 fee49bcb9c25cce746b005724afca9832b0b74b422569a441bb521bec8d31bca3f286c599b8822e7926cae1d0866a27215be6baf8b285356cd1a0bdf4f5da51e

memory/2540-45-0x000000002F9B1000-0x000000002F9B2000-memory.dmp

\Windows\SysWOW64\tddulpyx.exe

MD5 f2743abd2bcd7b8ddb886282eb27c5fe
SHA1 12fedd2bb51b8480bae521c788c0428c7f1a7163
SHA256 34d4acba07430a8f06759ba85825be072f942f3dcc684f7ddeccd271496ffcfa
SHA512 0e38d916edfc5d63492872ec5b0a33f855afd3904f724196d96bc80c5a18e56bb5ee50bf81da471ec17f97984d2baf09713702239d0f492f58ffefd6f5336ac3

C:\Windows\SysWOW64\nrnahlpexs.exe

MD5 c8f31e331d8c82a1f4150bbc9512e520
SHA1 9c59fd655a1ba8c9cbd48ad9c3f4c3f501f6d1a1
SHA256 d05c0b78773e864a2cf2f940a4aa7617303b72ae23da7e1562016a412461e56e
SHA512 328827fde9c316017132fbb2c58b835c5a689a77e75c11221fc939753f054da57703c1c274d25ee18b5106f42264d7702f0854296e5781cef643749d5dc619e9

memory/2540-47-0x0000000070E1D000-0x0000000070E28000-memory.dmp

memory/2540-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 e72a03b4cbc70dd02a2a891bbad55125
SHA1 300ca87e84272e2d1fd3448be4cf473cf79b3ec9
SHA256 c3ef95656206a2188502faf16e7a60b9edd56bdb1cbf55b55bfffe747e61ec82
SHA512 52ee9d5fe27c647ad6474c518403f8f4471410ab20b56ddca88f4644ca8561d597f30a7e30a41241c6b0d9620ffcd2371f25377abe41581299345bda1904ff37

C:\Users\Admin\AppData\Roaming\MergeLock.doc.exe

MD5 af0170a6c815eca0de7c8f53512add64
SHA1 d2e1f2c52efd65a612a352faa80ec5562b00db7b
SHA256 6e2f625bd893ee21a55f07c9148d5204918e0df6aec58dd80b2854d921ddc910
SHA512 0d26f17d05eef1f72fc7ef2d381bd3e1fc241e8eb4b9a7713befdd6c7cb895d4dd4291e23950ea47dcd11b12d78a3e77f6f914b480d38c899e1b53a3f29d25e9

C:\Users\Admin\Documents\FormatSet.doc.exe

MD5 b9bc6aea0a33849b8d92167fee3034de
SHA1 e8f2ff6eef336da9a942b4be1aca09720cc62c85
SHA256 5453c6ca4503e32bf86205fe82cf30436f5c5b92573a57b6188a8586eb10de96
SHA512 8f6b500525f627c86df565d6c24770cfa972dd7f5d9821dd70746715a6a6734fbc4fea50cef4569e6379460b8daf6d6a1f17016d7f32ffa3579b405cb552f51c

memory/2540-80-0x0000000070E1D000-0x0000000070E28000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 0dfb9a88c389cfd27d405594f07ad056
SHA1 f25ce7f3faf5cfc4bb738878f284856d12c2be02
SHA256 f30394fdda489b71b287a4e4c8578d6fc74af1d46ee6dd1204808047cc2fd886
SHA512 c4054d3de2ef9147b97550dccfb3e27b64a859052d7780b8a8ef94251b4318fc2ed4986a1ede52520542ed998860d0c5f6cce93e616d484ad043f5ef5198fc02

memory/2540-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 19:20

Reported

2024-01-07 19:23

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\tfhzyegewp.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\tfhzyegewp.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\elxeeltg = "tfhzyegewp.exe" C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\emvgskgm = "zwxsmvdczunjwvo.exe" C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "swxcfvamnuxom.exe" C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\vzmoklvn.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\tfhzyegewp.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File created C:\Windows\SysWOW64\tfhzyegewp.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\tfhzyegewp.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File created C:\Windows\SysWOW64\vzmoklvn.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\vzmoklvn.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\swxcfvamnuxom.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\tfhzyegewp.exe N/A
File created C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File created C:\Windows\SysWOW64\swxcfvamnuxom.exe C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\TestRestart.nal C:\Windows\SysWOW64\vzmoklvn.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Program Files\TestRestart.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\TestRestart.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File created \??\c:\Program Files\TestRestart.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Program Files\TestRestart.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\TestRestart.doc.exe C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\TestRestart.nal C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\vzmoklvn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\vzmoklvn.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFF9CAFE65F2E3837D3A47869F3992B3FC03F143660333E2C945E608A5" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B02047E339ED53C5BAA53393D7C8" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8BFCFB4F2885129145D6217D94BDE0E13C5842664F6331D799" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F46BB9FF6C21DDD20CD0A28B7D9114" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1845C67C14E4DAC7B9BE7C94EDE034BD" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C7E9C2182556D3576D570212CDB7CF265D9" C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\tfhzyegewp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\tfhzyegewp.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\swxcfvamnuxom.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\tfhzyegewp.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A
N/A N/A C:\Windows\SysWOW64\vzmoklvn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 472 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tfhzyegewp.exe
PID 472 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tfhzyegewp.exe
PID 472 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\tfhzyegewp.exe
PID 472 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe
PID 472 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe
PID 472 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe
PID 472 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\vzmoklvn.exe
PID 472 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\vzmoklvn.exe
PID 472 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\vzmoklvn.exe
PID 472 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\swxcfvamnuxom.exe
PID 472 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\swxcfvamnuxom.exe
PID 472 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Windows\SysWOW64\swxcfvamnuxom.exe
PID 472 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 472 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1820 wrote to memory of 2380 N/A C:\Windows\SysWOW64\tfhzyegewp.exe C:\Windows\SysWOW64\vzmoklvn.exe
PID 1820 wrote to memory of 2380 N/A C:\Windows\SysWOW64\tfhzyegewp.exe C:\Windows\SysWOW64\vzmoklvn.exe
PID 1820 wrote to memory of 2380 N/A C:\Windows\SysWOW64\tfhzyegewp.exe C:\Windows\SysWOW64\vzmoklvn.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe

"C:\Users\Admin\AppData\Local\Temp\ab0757415e5a33fde6893ba93d5683ff.exe"

C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe

zwxsmvdczunjwvo.exe

C:\Windows\SysWOW64\swxcfvamnuxom.exe

swxcfvamnuxom.exe

C:\Windows\SysWOW64\vzmoklvn.exe

vzmoklvn.exe

C:\Windows\SysWOW64\tfhzyegewp.exe

tfhzyegewp.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\vzmoklvn.exe

C:\Windows\system32\vzmoklvn.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 54.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 28.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 13.107.21.200:443 tse1.mm.bing.net tcp
US 13.107.21.200:443 tse1.mm.bing.net tcp
US 13.107.21.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

memory/472-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe

MD5 9e97238a4b66b97f7641432d70271214
SHA1 2e44909e0fbfcd7cf6efde896cdbb1f9849c0f40
SHA256 82ba1b4758777c22a0db08f573802e59a32ccb9664755f4ee3bb25563b16bcf3
SHA512 6f8b897a7065e049254d7f8b6562dc0953da2a99be6bc9b02d1b23daafcc4d861f830e5b34dcaefb2d1ca9b490378de3d8d024dbed7bc5d0797b615750a63a51

C:\Windows\SysWOW64\tfhzyegewp.exe

MD5 15a3d2b3724e4136732800ffc95cfff4
SHA1 208b934db770942aa6f144d13dd4f22b109f1183
SHA256 350ab509dc64fff82357289a63ea774736c37c59496c96b8c6dff3a0d4a8f79f
SHA512 4254a66404eb7226afe5e841064e40b58240836c85cd8f99173f257c593482859dd141c72e7d79124799daa696374188967df630937450046151e67f28e16ae2

C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe

MD5 188a2cb1a83217d3ef1dcaedd499ae04
SHA1 d766646ffdf7464a806c97e8f2a0bfcb683c637a
SHA256 236974f313405232bcae5759fc51b6dff856be0a75c881d79aef1e1360177e8b
SHA512 1831ee0991aca1845c1df686c91a34f3cad7d565c60439fb2f29ca0ab8a42e09d9d12648058fc2559b4065beadb838eab4f0e0c450b9e0f8711f7e520e8601f4

C:\Windows\SysWOW64\swxcfvamnuxom.exe

MD5 7dbdcbe747b80791f0f6aec3abe3c5d4
SHA1 4135a59cabf3d3b2c9b83df2b1a40a1c61cf6728
SHA256 0032043dd23eeb1b00f954ed084e14fb706fcf1f7b210086e4d2b38fadc779ad
SHA512 605698eb7d445c4adc8dd528e0d4e26788ad393a2a0ccc42ae7f24f6694faae11747cc50845416dd6c7b5388dfea25705231e7928f71a10a75a54ce9711a9651

C:\Windows\SysWOW64\swxcfvamnuxom.exe

MD5 db33817d93722f19d6d4333d3629e2c5
SHA1 41cf81c964ebac3d3a28066060e900f50454e2f5
SHA256 ad3e74d472acef9e84b0432d706084c1f5b58443d7b7443b27306c652e937e22
SHA512 7a93d3fe2ea2cd9697d0ca831a40c033f9c0c6dabfaf95aeefe1ddfd870b8390d8cffb37ad587921fdb4a15de9103a3a979b7a6978bbcf05aeaf1ffc88175eec

C:\Windows\SysWOW64\vzmoklvn.exe

MD5 02ed63381b80fe5bf2b9989f9ec52bfa
SHA1 dc674c87ecc8a5262d3d3cc13ff1d16287673217
SHA256 13f57c059208d36284bf51352e7ef19b11ba6d96c3c72401e342237e36949383
SHA512 23c73106c98f023f4e764be2095743a8ec2b276ea117c9618a23433414877cab5056cdad6e6ff56cf30aa2e3eaaad9fbf5d04b287dd475fa512d0c20c67ba8ab

C:\Windows\SysWOW64\vzmoklvn.exe

MD5 d3d0372cd3ebd4ef83f58d32ff8c237f
SHA1 d06eb030cbe907be0d216c84713ec55ff999c2ee
SHA256 ff25434b189c3a1bb93e4df47696321a8208a7d2f84cae89d064794a26bf40d4
SHA512 f19f75f4b8137fe49496e9c9be9382ad99d37f9231fda2a477b79c874b7cb25605a823b792135dc44c07aa4d254de7ba00d7a12b5f824cd87d4c02ebece392d1

C:\Windows\SysWOW64\zwxsmvdczunjwvo.exe

MD5 7bc574f523387fc2297dbb9b74441f30
SHA1 09fc48885420776c7e201dc65d3d37b41e1735ae
SHA256 71816cec8e7caea90b17cc2ba923c9c074b8847f919a978ed235131fea186425
SHA512 ac4e18057b1c6eda27c793023b0623fb91343fd9997c28018c165a1578d97442c7df07228bbc914e45ad365f5b999878e19d8b23ff8048337b8478e714539727

C:\Windows\SysWOW64\tfhzyegewp.exe

MD5 6269d949df79ef193df2dadd5f2e72cf
SHA1 7764496fa553027add89141d33ac0a553fcbb36e
SHA256 d42f6a835ba7a91662ededb28cdd918fb4d80a0b428bf47a357abcda23307417
SHA512 1bb841bc71ed349aa8dc82e98c7f51cacefafcff000fab964644192db0d2db748f6ef9182e37e8c03b4f496fc71bb939ff6608139a278137c5c9266ae28df23c

C:\Windows\SysWOW64\vzmoklvn.exe

MD5 d8766c0ed9e611d21eb2e7654b07ff9d
SHA1 1a47cf93f09a8da5f75ed9b2a00feb120087ede1
SHA256 9afd8cb37b32badcb61a97f5e2a7b18b146a8090b7cf69a5b40b3ac9be99e479
SHA512 c10620d5f1d34ce180de52f0222bc869baf8dad5f5c7a46ef75d56b5693fc0106ff4d6b5840d74a9f4f49cbf194478e58b7aa5e382163710a816b4dc0b18a9bd

memory/1532-38-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-43-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-44-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-45-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-46-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-42-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-47-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-41-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-49-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-48-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-40-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-50-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-39-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-37-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-51-0x00007FF9850B0000-0x00007FF9850C0000-memory.dmp

memory/1532-52-0x00007FF9850B0000-0x00007FF9850C0000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\TestRestart.doc.exe

MD5 6662b185f19fbf697c56a25c92de7961
SHA1 0df0c0df0de3724258df2549c583e3c934aca726
SHA256 c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86
SHA512 c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

memory/1532-87-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 cbe8e58ef10a2f15c0c5c3e0ae84073a
SHA1 6ec662aca33da72547decff0ede38b904a0b78d8
SHA256 327e02bd880c89fe1b6d06950c373e13ce03e93ec6701488fd6093d27cf667c5
SHA512 bd5830fd8557bf883439c8987024b839b7513b3b7912351234281c1d94d2d58ceeb2d108b30cd424462a5afbfa46d06964cc9349ac46e09222d76ec7dc478fe1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 e893ec3d72480ae864ab86b06e9b481e
SHA1 8e684285b2d061911681fad25678e2ee612c096b
SHA256 f6a174e4b409bab117bca668fe4fd7c3a795dfe05705bc6642a394d947b655bc
SHA512 18c9b7a662d9f83cc2f324283914efe2280558d1681c4390e5d9b42ed04f236c28b506ccfa14c8b28c17d22b417d80b675f8531f7d64ddb1c5ef6b57761efe7e

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 8fc27978ff544392eb5f47efb9bceac3
SHA1 ef87caedbeb42db84ffb9fc70df969d060f86ce4
SHA256 bbe15f65397492bba09930622ee9f6bf01bc7ed7c3ca9089bd59bd0a96a93596
SHA512 0fbc6e29cb34d1c54dc7b5ec61d4187949d6fa5b836ef35a013dc87a7f4e77ccaa92fa356d5041a1d851938a0b2fe4f2460f3ec9d9c7dd0075bf34ec106ea6a2

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 d48a60d58828217bc6257427cb4a4f80
SHA1 3bb0ac15c22bee189190e33e9c2247443805b158
SHA256 7455997a91d7e5e97915c31abe46455095929fce14cad9c21916bafae85cb66c
SHA512 2be96375e619b0c430b73aadd7492e65cf8429f3a7e3c04e716c1bc328a5756b969e919719c0d94fe03d32b0a7c54192ee69d3221dacf659282fe333443946fb

memory/1532-133-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-134-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-136-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-135-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-137-0x00007FF987730000-0x00007FF987740000-memory.dmp

memory/1532-140-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-139-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-141-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp

memory/1532-138-0x00007FF9C76B0000-0x00007FF9C78A5000-memory.dmp