f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
Size

1016KB
MD5

6112b7be85e203de144e8cf777877430
SHA1

eeca0708de0f1ea1fc8187c6d8d7e77d840fe894
SHA256

f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121
SHA512

dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3
SSDEEP

6144:1IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:1IXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe

Adds policy Run key to start application 2 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idwtjcrnzpiwfflvzb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "vtppiewvkdzqcfobinjhd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "gdyxpkbznfaqbdlxdhcz.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "slcxlcpjthykrptb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idwtjcrnzpiwfflvzb.exe"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "tpjhysifsjdscdkvadx.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "tpjhysifsjdscdkvadx.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "idwtjcrnzpiwfflvzb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zlvjqagtw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "vtppiewvkdzqcfobinjhd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kzmdnajzfpck = "slcxlcpjthykrptb.exe"	vdjtw.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdjtw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdjtw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe

Executes dropped EXE 4 IoCs

pid	Process
3916	pwyrqtqlzgi.exe
4580	vdjtw.exe
1520	vdjtw.exe
4944	pwyrqtqlzgi.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfvpcsexgtjuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idwtjcrnzpiwfflvzb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfvpcsexgtjuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "idwtjcrnzpiwfflvzb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfvpcsexgtjuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtppiewvkdzqcfobinjhd.exe ."	vdjtw.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	vdjtw.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "idwtjcrnzpiwfflvzb.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "vtppiewvkdzqcfobinjhd.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "tpjhysifsjdscdkvadx.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "gdyxpkbznfaqbdlxdhcz.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "idwtjcrnzpiwfflvzb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "gdyxpkbznfaqbdlxdhcz.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "vtppiewvkdzqcfobinjhd.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "ztlhwocxixpckjoxa.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idwtjcrnzpiwfflvzb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "ztlhwocxixpckjoxa.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "gdyxpkbznfaqbdlxdhcz.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfvpcsexgtjuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtppiewvkdzqcfobinjhd.exe"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "slcxlcpjthykrptb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfvpcsexgtjuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "idwtjcrnzpiwfflvzb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "slcxlcpjthykrptb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "tpjhysifsjdscdkvadx.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "ztlhwocxixpckjoxa.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "slcxlcpjthykrptb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtppiewvkdzqcfobinjhd.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "vtppiewvkdzqcfobinjhd.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfvpcsexgtjuaxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tpjhysifsjdscdkvadx.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "gdyxpkbznfaqbdlxdhcz.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idwtjcrnzpiwfflvzb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "vtppiewvkdzqcfobinjhd.exe"	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\slcxlcpjthykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfqfnyftxf = "gdyxpkbznfaqbdlxdhcz.exe"	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kbqjvkvnvhwglh = "idwtjcrnzpiwfflvzb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlhwocxixpckjoxa.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slcxlcpjthykrptb.exe ."	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "idwtjcrnzpiwfflvzb.exe ."	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jznfqeofmxluy = "slcxlcpjthykrptb.exe"	vdjtw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbndmygvajv = "slcxlcpjthykrptb.exe ."	vdjtw.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdjtw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdjtw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	whatismyip.everdot.org
14	whatismyipaddress.com
16	www.showmyipaddress.com
49	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	vdjtw.exe
File created	C:\autorun.inf	vdjtw.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ztlhwocxixpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\vtppiewvkdzqcfobinjhd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\gdyxpkbznfaqbdlxdhcz.exe	vdjtw.exe
File created	C:\Windows\SysWOW64\nfvpcsexgtjuaxahihxpfzmcohqdtekhkrsrh.pjw	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\vtppiewvkdzqcfobinjhd.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\ztlhwocxixpckjoxa.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\ztlhwocxixpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\slcxlcpjthykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\gdyxpkbznfaqbdlxdhcz.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\gdyxpkbznfaqbdlxdhcz.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\mlijdattjdasfjthpvsrop.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\slcxlcpjthykrptb.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\idwtjcrnzpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ztlhwocxixpckjoxa.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\nfvpcsexgtjuaxahihxpfzmcohqdtekhkrsrh.pjw	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\vtppiewvkdzqcfobinjhd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\idwtjcrnzpiwfflvzb.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\tpjhysifsjdscdkvadx.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\mlijdattjdasfjthpvsrop.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\slcxlcpjthykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\mlijdattjdasfjthpvsrop.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\gdyxpkbznfaqbdlxdhcz.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\tpjhysifsjdscdkvadx.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\mlijdattjdasfjthpvsrop.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\tpjhysifsjdscdkvadx.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\idwtjcrnzpiwfflvzb.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\vtppiewvkdzqcfobinjhd.exe	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\mtyhjopxvxccxjbxnbgnsbdijr.rww	vdjtw.exe
File opened for modification	C:\Windows\SysWOW64\tpjhysifsjdscdkvadx.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\idwtjcrnzpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\slcxlcpjthykrptb.exe	vdjtw.exe
File created	C:\Windows\SysWOW64\mtyhjopxvxccxjbxnbgnsbdijr.rww	vdjtw.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\nfvpcsexgtjuaxahihxpfzmcohqdtekhkrsrh.pjw	vdjtw.exe
File opened for modification	C:\Program Files (x86)\mtyhjopxvxccxjbxnbgnsbdijr.rww	vdjtw.exe
File created	C:\Program Files (x86)\mtyhjopxvxccxjbxnbgnsbdijr.rww	vdjtw.exe
File opened for modification	C:\Program Files (x86)\nfvpcsexgtjuaxahihxpfzmcohqdtekhkrsrh.pjw	vdjtw.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mlijdattjdasfjthpvsrop.exe	vdjtw.exe
File opened for modification	C:\Windows\slcxlcpjthykrptb.exe	vdjtw.exe
File opened for modification	C:\Windows\idwtjcrnzpiwfflvzb.exe	vdjtw.exe
File opened for modification	C:\Windows\tpjhysifsjdscdkvadx.exe	vdjtw.exe
File opened for modification	C:\Windows\vtppiewvkdzqcfobinjhd.exe	vdjtw.exe
File opened for modification	C:\Windows\idwtjcrnzpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\slcxlcpjthykrptb.exe	vdjtw.exe
File opened for modification	C:\Windows\tpjhysifsjdscdkvadx.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vtppiewvkdzqcfobinjhd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\idwtjcrnzpiwfflvzb.exe	vdjtw.exe
File opened for modification	C:\Windows\gdyxpkbznfaqbdlxdhcz.exe	vdjtw.exe
File created	C:\Windows\mtyhjopxvxccxjbxnbgnsbdijr.rww	vdjtw.exe
File opened for modification	C:\Windows\gdyxpkbznfaqbdlxdhcz.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\mlijdattjdasfjthpvsrop.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\tpjhysifsjdscdkvadx.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\mlijdattjdasfjthpvsrop.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\gdyxpkbznfaqbdlxdhcz.exe	vdjtw.exe
File opened for modification	C:\Windows\slcxlcpjthykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vtppiewvkdzqcfobinjhd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\idwtjcrnzpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vtppiewvkdzqcfobinjhd.exe	vdjtw.exe
File opened for modification	C:\Windows\mtyhjopxvxccxjbxnbgnsbdijr.rww	vdjtw.exe
File opened for modification	C:\Windows\slcxlcpjthykrptb.exe	pwyrqtqlzgi.exe
File created	C:\Windows\nfvpcsexgtjuaxahihxpfzmcohqdtekhkrsrh.pjw	vdjtw.exe
File opened for modification	C:\Windows\ztlhwocxixpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\ztlhwocxixpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\ztlhwocxixpckjoxa.exe	vdjtw.exe
File opened for modification	C:\Windows\gdyxpkbznfaqbdlxdhcz.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\ztlhwocxixpckjoxa.exe	vdjtw.exe
File opened for modification	C:\Windows\mlijdattjdasfjthpvsrop.exe	vdjtw.exe
File opened for modification	C:\Windows\nfvpcsexgtjuaxahihxpfzmcohqdtekhkrsrh.pjw	vdjtw.exe
File opened for modification	C:\Windows\tpjhysifsjdscdkvadx.exe	vdjtw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
4580	vdjtw.exe
4580	vdjtw.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
4580	vdjtw.exe
4580	vdjtw.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	vdjtw.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3916	2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe	82
PID 2060 wrote to memory of 3916	2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe	82
PID 2060 wrote to memory of 3916	2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe	82
PID 3916 wrote to memory of 4580	3916	pwyrqtqlzgi.exe	83
PID 3916 wrote to memory of 4580	3916	pwyrqtqlzgi.exe	83
PID 3916 wrote to memory of 4580	3916	pwyrqtqlzgi.exe	83
PID 3916 wrote to memory of 1520	3916	pwyrqtqlzgi.exe	84
PID 3916 wrote to memory of 1520	3916	pwyrqtqlzgi.exe	84
PID 3916 wrote to memory of 1520	3916	pwyrqtqlzgi.exe	84
PID 2060 wrote to memory of 4944	2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe	93
PID 2060 wrote to memory of 4944	2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe	93
PID 2060 wrote to memory of 4944	2060	f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe	93

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vdjtw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vdjtw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vdjtw.exe

C:\Users\Admin\AppData\Local\Temp\f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe
"C:\Users\Admin\AppData\Local\Temp\f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3916
- - C:\Users\Admin\AppData\Local\Temp\vdjtw.exe
    "C:\Users\Admin\AppData\Local\Temp\vdjtw.exe" "-C:\Users\Admin\AppData\Local\Temp\slcxlcpjthykrptb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\vdjtw.exe
    "C:\Users\Admin\AppData\Local\Temp\vdjtw.exe" "-C:\Users\Admin\AppData\Local\Temp\slcxlcpjthykrptb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1520
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gdyxpkbznfaqbdlxdhcz.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\idwtjcrnzpiwfflvzb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mlijdattjdasfjthpvsrop.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
47f9c1ced82539389170fb9232197684

SHA1
9b2e04ca0fb17471b0d8e7ed919a47ab15f3cc0c

SHA256
030809af11e1965ec00e30596016be398eed266613dd9ed81270178e364045d6

SHA512
b3b874e9d3a4fec1a623337231114a7f69c9aa68b32b2182e43629667939c119cee1aa6aa608df616f28cab67296e1a27e7705868e851b1349a817281a6e7e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
47f9c1ced82539389170fb9232197684

SHA1
9b2e04ca0fb17471b0d8e7ed919a47ab15f3cc0c

SHA256
030809af11e1965ec00e30596016be398eed266613dd9ed81270178e364045d6

SHA512
b3b874e9d3a4fec1a623337231114a7f69c9aa68b32b2182e43629667939c119cee1aa6aa608df616f28cab67296e1a27e7705868e851b1349a817281a6e7e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
47f9c1ced82539389170fb9232197684

SHA1
9b2e04ca0fb17471b0d8e7ed919a47ab15f3cc0c

SHA256
030809af11e1965ec00e30596016be398eed266613dd9ed81270178e364045d6

SHA512
b3b874e9d3a4fec1a623337231114a7f69c9aa68b32b2182e43629667939c119cee1aa6aa608df616f28cab67296e1a27e7705868e851b1349a817281a6e7e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\slcxlcpjthykrptb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpjhysifsjdscdkvadx.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdjtw.exe

Filesize
692KB

MD5
75542e108a97043446898f6a20cee639

SHA1
9dbb63e9d646bb0781d59451bf312c47369edc94

SHA256
8fefabe55186507940d4f867443dac3729dc073e06f1cb07592b891845b2b41d

SHA512
1c644380cf6981f230b7e17a6c09a9c0cfe3a3530fa3b05160f332873d0ba19ecc3cbd0c928598fe98cf00b2e672b92542adc635bb4b121ac55f2d2fc6d5c17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdjtw.exe

Filesize
692KB

MD5
75542e108a97043446898f6a20cee639

SHA1
9dbb63e9d646bb0781d59451bf312c47369edc94

SHA256
8fefabe55186507940d4f867443dac3729dc073e06f1cb07592b891845b2b41d

SHA512
1c644380cf6981f230b7e17a6c09a9c0cfe3a3530fa3b05160f332873d0ba19ecc3cbd0c928598fe98cf00b2e672b92542adc635bb4b121ac55f2d2fc6d5c17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdjtw.exe

Filesize
692KB

MD5
75542e108a97043446898f6a20cee639

SHA1
9dbb63e9d646bb0781d59451bf312c47369edc94

SHA256
8fefabe55186507940d4f867443dac3729dc073e06f1cb07592b891845b2b41d

SHA512
1c644380cf6981f230b7e17a6c09a9c0cfe3a3530fa3b05160f332873d0ba19ecc3cbd0c928598fe98cf00b2e672b92542adc635bb4b121ac55f2d2fc6d5c17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vtppiewvkdzqcfobinjhd.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ztlhwocxixpckjoxa.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\gdyxpkbznfaqbdlxdhcz.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\idwtjcrnzpiwfflvzb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\mlijdattjdasfjthpvsrop.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\slcxlcpjthykrptb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\tpjhysifsjdscdkvadx.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\vtppiewvkdzqcfobinjhd.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\SysWOW64\ztlhwocxixpckjoxa.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\gdyxpkbznfaqbdlxdhcz.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\gdyxpkbznfaqbdlxdhcz.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\gdyxpkbznfaqbdlxdhcz.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\idwtjcrnzpiwfflvzb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\idwtjcrnzpiwfflvzb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\idwtjcrnzpiwfflvzb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\mlijdattjdasfjthpvsrop.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\mlijdattjdasfjthpvsrop.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\mlijdattjdasfjthpvsrop.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\slcxlcpjthykrptb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\slcxlcpjthykrptb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\slcxlcpjthykrptb.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\tpjhysifsjdscdkvadx.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\tpjhysifsjdscdkvadx.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\tpjhysifsjdscdkvadx.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\vtppiewvkdzqcfobinjhd.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\vtppiewvkdzqcfobinjhd.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\vtppiewvkdzqcfobinjhd.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\ztlhwocxixpckjoxa.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\ztlhwocxixpckjoxa.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit
C:\Windows\ztlhwocxixpckjoxa.exe

Filesize
1016KB

MD5
6112b7be85e203de144e8cf777877430

SHA1
eeca0708de0f1ea1fc8187c6d8d7e77d840fe894

SHA256
f94a2ec66b0687d8653e12ab2587ca408e823f609a70ddd400afcb6e343c4121

SHA512
dc117254e5d76aee4e304a8789e95ab7d0f860356e242c2c5e9b56194eb33f433e19ca19e93c573cdae5430ee744dd01ec645c98180cc5652fd65a65d7231fd3

Download Submit