83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

Analysis

max time kernel
58s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
Size

600KB
MD5

5a50497a16f62ecabbbf0baddf2c6730
SHA1

51bff4da617ba0eed283ee3103500faa4cca0813
SHA256

83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282
SHA512

f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95
SSDEEP

12288:lpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsxoFS:lpUNr6YkVRFkgbeqeo68Fhq8oFS

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	winobgk.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winobgk.exe

Adds policy Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "liykiynlwqrbvfetnm.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "wulyxoedpkmxsddtooa.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "wulyxoedpkmxsddtooa.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynyvkyvfyyhajhvo.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "liykiynlwqrbvfetnm.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynyvkyvfyyhajhvo.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "wulyxoedpkmxsddtooa.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "cynyvkyvfyyhajhvo.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaoogxxkgjvrdevrsfe.exe"	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\neoumwfxcqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulyxoedpkmxsddtooa.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qkxgboavduszqxt = "yyrghastheivsfhzwymmf.exe"	winobgk.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winobgk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winobgk.exe

Executes dropped EXE 3 IoCs

pid	Process
4164	yborjrewily.exe
1260	winobgk.exe
1288	winobgk.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "jiaoogxxkgjvrdevrsfe.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "cynyvkyvfyyhajhvo.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe ."	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "vqeokylhqihphpmz.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wulyxoedpkmxsddtooa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liykiynlwqrbvfetnm.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wulyxoedpkmxsddtooa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaoogxxkgjvrdevrsfe.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "cynyvkyvfyyhajhvo.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynyvkyvfyyhajhvo.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqeokylhqihphpmz.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "wulyxoedpkmxsddtooa.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "yyrghastheivsfhzwymmf.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liykiynlwqrbvfetnm.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulyxoedpkmxsddtooa.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "jiaoogxxkgjvrdevrsfe.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "liykiynlwqrbvfetnm.exe ."	winobgk.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "wulyxoedpkmxsddtooa.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "vqeokylhqihphpmz.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wulyxoedpkmxsddtooa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulyxoedpkmxsddtooa.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wulyxoedpkmxsddtooa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynyvkyvfyyhajhvo.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "wulyxoedpkmxsddtooa.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "yyrghastheivsfhzwymmf.exe ."	winobgk.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "cynyvkyvfyyhajhvo.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaoogxxkgjvrdevrsfe.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrghastheivsfhzwymmf.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulyxoedpkmxsddtooa.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "wulyxoedpkmxsddtooa.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "jiaoogxxkgjvrdevrsfe.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "vqeokylhqihphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "vqeokylhqihphpmz.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "wulyxoedpkmxsddtooa.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynyvkyvfyyhajhvo.exe"	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "yyrghastheivsfhzwymmf.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wulyxoedpkmxsddtooa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaoogxxkgjvrdevrsfe.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqeokylhqihphpmz.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulyxoedpkmxsddtooa.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaoogxxkgjvrdevrsfe.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "liykiynlwqrbvfetnm.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liykiynlwqrbvfetnm.exe ."	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wulyxoedpkmxsddtooa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liykiynlwqrbvfetnm.exe"	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "vqeokylhqihphpmz.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "yyrghastheivsfhzwymmf.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cynyvkyvfyyhajhvo = "cynyvkyvfyyhajhvo.exe ."	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "wulyxoedpkmxsddtooa.exe"	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mepwpakdjyuzo = "liykiynlwqrbvfetnm.exe"	winobgk.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	winobgk.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	winobgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\liykiynlwqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynyvkyvfyyhajhvo.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ngsaugrlsiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulyxoedpkmxsddtooa.exe ."	winobgk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqeokylhqihphpmz = "liykiynlwqrbvfetnm.exe"	winobgk.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winobgk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winobgk.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	whatismyipaddress.com
26	whatismyip.everdot.org
29	www.showmyipaddress.com
36	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wulyxoedpkmxsddtooa.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yyrghastheivsfhzwymmf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yyrghastheivsfhzwymmf.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\pqkacwprgejxvjmfdgvwqg.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\agfahgelfislohpnqysyxsz.wdx	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\vqeokylhqihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\vqeokylhqihphpmz.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\neoumwfxcqlpdhajxqvmwcuenfkytxlpir.ydu	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\cynyvkyvfyyhajhvo.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\vqeokylhqihphpmz.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\liykiynlwqrbvfetnm.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\liykiynlwqrbvfetnm.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\wulyxoedpkmxsddtooa.exe	winobgk.exe
File created	C:\Windows\SysWOW64\agfahgelfislohpnqysyxsz.wdx	winobgk.exe
File created	C:\Windows\SysWOW64\neoumwfxcqlpdhajxqvmwcuenfkytxlpir.ydu	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\cynyvkyvfyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\jiaoogxxkgjvrdevrsfe.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\pqkacwprgejxvjmfdgvwqg.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wulyxoedpkmxsddtooa.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\jiaoogxxkgjvrdevrsfe.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\pqkacwprgejxvjmfdgvwqg.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\cynyvkyvfyyhajhvo.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\jiaoogxxkgjvrdevrsfe.exe	winobgk.exe
File opened for modification	C:\Windows\SysWOW64\liykiynlwqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yyrghastheivsfhzwymmf.exe	winobgk.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\agfahgelfislohpnqysyxsz.wdx	winobgk.exe
File created	C:\Program Files (x86)\agfahgelfislohpnqysyxsz.wdx	winobgk.exe
File opened for modification	C:\Program Files (x86)\neoumwfxcqlpdhajxqvmwcuenfkytxlpir.ydu	winobgk.exe
File created	C:\Program Files (x86)\neoumwfxcqlpdhajxqvmwcuenfkytxlpir.ydu	winobgk.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wulyxoedpkmxsddtooa.exe	winobgk.exe
File opened for modification	C:\Windows\cynyvkyvfyyhajhvo.exe	winobgk.exe
File opened for modification	C:\Windows\wulyxoedpkmxsddtooa.exe	winobgk.exe
File opened for modification	C:\Windows\yyrghastheivsfhzwymmf.exe	winobgk.exe
File opened for modification	C:\Windows\cynyvkyvfyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\liykiynlwqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\wulyxoedpkmxsddtooa.exe	yborjrewily.exe
File opened for modification	C:\Windows\jiaoogxxkgjvrdevrsfe.exe	yborjrewily.exe
File opened for modification	C:\Windows\yyrghastheivsfhzwymmf.exe	winobgk.exe
File opened for modification	C:\Windows\pqkacwprgejxvjmfdgvwqg.exe	winobgk.exe
File opened for modification	C:\Windows\liykiynlwqrbvfetnm.exe	winobgk.exe
File opened for modification	C:\Windows\agfahgelfislohpnqysyxsz.wdx	winobgk.exe
File opened for modification	C:\Windows\vqeokylhqihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\yyrghastheivsfhzwymmf.exe	yborjrewily.exe
File opened for modification	C:\Windows\pqkacwprgejxvjmfdgvwqg.exe	yborjrewily.exe
File opened for modification	C:\Windows\jiaoogxxkgjvrdevrsfe.exe	winobgk.exe
File created	C:\Windows\agfahgelfislohpnqysyxsz.wdx	winobgk.exe
File opened for modification	C:\Windows\liykiynlwqrbvfetnm.exe	winobgk.exe
File opened for modification	C:\Windows\vqeokylhqihphpmz.exe	winobgk.exe
File opened for modification	C:\Windows\pqkacwprgejxvjmfdgvwqg.exe	winobgk.exe
File created	C:\Windows\neoumwfxcqlpdhajxqvmwcuenfkytxlpir.ydu	winobgk.exe
File opened for modification	C:\Windows\vqeokylhqihphpmz.exe	winobgk.exe
File opened for modification	C:\Windows\cynyvkyvfyyhajhvo.exe	winobgk.exe
File opened for modification	C:\Windows\jiaoogxxkgjvrdevrsfe.exe	winobgk.exe
File opened for modification	C:\Windows\neoumwfxcqlpdhajxqvmwcuenfkytxlpir.ydu	winobgk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1260	winobgk.exe
1260	winobgk.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	winobgk.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4164	1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe	81
PID 1968 wrote to memory of 4164	1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe	81
PID 1968 wrote to memory of 4164	1968	83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe	81
PID 4164 wrote to memory of 1260	4164	yborjrewily.exe	82
PID 4164 wrote to memory of 1260	4164	yborjrewily.exe	82
PID 4164 wrote to memory of 1260	4164	yborjrewily.exe	82
PID 4164 wrote to memory of 1288	4164	yborjrewily.exe	83
PID 4164 wrote to memory of 1288	4164	yborjrewily.exe	83
PID 4164 wrote to memory of 1288	4164	yborjrewily.exe	83

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winobgk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	winobgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winobgk.exe

C:\Users\Admin\AppData\Local\Temp\83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe
"C:\Users\Admin\AppData\Local\Temp\83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4164
- - C:\Users\Admin\AppData\Local\Temp\winobgk.exe
    "C:\Users\Admin\AppData\Local\Temp\winobgk.exe" "-C:\Users\Admin\AppData\Local\Temp\vqeokylhqihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\winobgk.exe
    "C:\Users\Admin\AppData\Local\Temp\winobgk.exe" "-C:\Users\Admin\AppData\Local\Temp\vqeokylhqihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cynyvkyvfyyhajhvo.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\jiaoogxxkgjvrdevrsfe.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\liykiynlwqrbvfetnm.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\pqkacwprgejxvjmfdgvwqg.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\vqeokylhqihphpmz.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\winobgk.exe

Filesize
716KB

MD5
3d7d85e1989254d224b1123b29362f81

SHA1
127326f3a188e027848d42eadd900bce4dd8fbf7

SHA256
d45b1c181e2d2e6790e63574b5a6f8612ffe765d74bdd5618ae2196307b8a083

SHA512
68aa3f4bdb63523d5d20717184d21b702cd6c5f6bcf6495daa41c2a49fa91184bc1305129e0dc583445a9d7518c232204b3f11293457a4bc925ea980bc848966

Download Submit
C:\Users\Admin\AppData\Local\Temp\winobgk.exe

Filesize
716KB

MD5
3d7d85e1989254d224b1123b29362f81

SHA1
127326f3a188e027848d42eadd900bce4dd8fbf7

SHA256
d45b1c181e2d2e6790e63574b5a6f8612ffe765d74bdd5618ae2196307b8a083

SHA512
68aa3f4bdb63523d5d20717184d21b702cd6c5f6bcf6495daa41c2a49fa91184bc1305129e0dc583445a9d7518c232204b3f11293457a4bc925ea980bc848966

Download Submit
C:\Users\Admin\AppData\Local\Temp\winobgk.exe

Filesize
716KB

MD5
3d7d85e1989254d224b1123b29362f81

SHA1
127326f3a188e027848d42eadd900bce4dd8fbf7

SHA256
d45b1c181e2d2e6790e63574b5a6f8612ffe765d74bdd5618ae2196307b8a083

SHA512
68aa3f4bdb63523d5d20717184d21b702cd6c5f6bcf6495daa41c2a49fa91184bc1305129e0dc583445a9d7518c232204b3f11293457a4bc925ea980bc848966

Download Submit
C:\Users\Admin\AppData\Local\Temp\wulyxoedpkmxsddtooa.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
09c02550232a4aaac2735b3e6ab4b94e

SHA1
8ba1f2a27edfaaf896d99f9a29592ef34edcc9e6

SHA256
8b5b580bcc9162bc806f2b0b55716db66cb0ef2a0f3505779d122569a3c443b8

SHA512
fdca59260b12086e5e9a7d809817317c66aa91da115cba8523566bc57a5bb0ac93c00d01434b61d1936833ecdc44d7bd212960cb0e6cc53f907fcd889aed32f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
09c02550232a4aaac2735b3e6ab4b94e

SHA1
8ba1f2a27edfaaf896d99f9a29592ef34edcc9e6

SHA256
8b5b580bcc9162bc806f2b0b55716db66cb0ef2a0f3505779d122569a3c443b8

SHA512
fdca59260b12086e5e9a7d809817317c66aa91da115cba8523566bc57a5bb0ac93c00d01434b61d1936833ecdc44d7bd212960cb0e6cc53f907fcd889aed32f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyrghastheivsfhzwymmf.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\cynyvkyvfyyhajhvo.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\jiaoogxxkgjvrdevrsfe.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\liykiynlwqrbvfetnm.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\pqkacwprgejxvjmfdgvwqg.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\vqeokylhqihphpmz.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\wulyxoedpkmxsddtooa.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\SysWOW64\yyrghastheivsfhzwymmf.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\cynyvkyvfyyhajhvo.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\cynyvkyvfyyhajhvo.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\jiaoogxxkgjvrdevrsfe.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\jiaoogxxkgjvrdevrsfe.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\liykiynlwqrbvfetnm.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\liykiynlwqrbvfetnm.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\pqkacwprgejxvjmfdgvwqg.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\pqkacwprgejxvjmfdgvwqg.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\vqeokylhqihphpmz.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\vqeokylhqihphpmz.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\wulyxoedpkmxsddtooa.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\wulyxoedpkmxsddtooa.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\yyrghastheivsfhzwymmf.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
C:\Windows\yyrghastheivsfhzwymmf.exe

Filesize
600KB

MD5
5a50497a16f62ecabbbf0baddf2c6730

SHA1
51bff4da617ba0eed283ee3103500faa4cca0813

SHA256
83fb78d5f00b4ba5ad247984b005c74724c0832499a301cf24899c3893962282

SHA512
f15a1bf957ece2616edaf12a1e1996cc20a85e942e49133f856a14a31f65b9d94950ca4c2272ab81a81a2c7caf0a20424deb81fb54f23c1a37c13762f9889e95

Download Submit
memory/1260-135-0x0000000000000000-mapping.dmp

Download
memory/1288-138-0x0000000000000000-mapping.dmp

Download
memory/4164-132-0x0000000000000000-mapping.dmp

Download