Technical Information
Malicious functions
Injects code into
the following user processes:
- pqcplaybf
Modifies file system
Creates the following files
- <Current directory>\pqcplaybf
- <SYSTEM32>\microsoft\protect\s-1-5-18\user\diagnostic
- %TEMP%\aa88a3f00f\log\installmanager\20251203 153849.303207.txt
Moves the following files
- from <Current directory>\pqcplaybf to \:exit
Network activity
Connects to
- '<DNS_SERVER>':53
TCP
Other
- '15#.#01.193.91':443
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c msiexec /x "{B7C0DCDE-DB8E-49DE-9FB1-3CCB517BF7D0}" /quiet
- '%WINDIR%\syswow64\msiexec.exe' /x "{B7C0DCDE-DB8E-49DE-9FB1-3CCB517BF7D0}" /quiet
- '%WINDIR%\syswow64\cmd.exe' /c msiexec /x "{B7C0DCDE-DB8E-49DE-9FB1-3CCB517BF7D0}" /quiet' (with hidden window)
